## 3 JTAG Exploitations
### Exploitation of Tiny OS and Mantis OS Using Open Source Software Available on Internet  
[PERSON] et al. [9] conducted experiments to show how physical attacks including JTAG attacks can be used to compromise sensor nodes. In this paper, researchers exploited TinyOS (an event-based operating system) and Mantis OS (a multi-threaded operating system). Tiny OS is an open source, BSD-licensed operating system developed specifically for low-power wireless devices and according to the official website it has averaged 35,000 downloads in a year. Mantis OS is popular due to its feature such as multi-threading capability with a small memory footprint (500 bytes). The author experimented on sensor wireless node \"Mica2 mote\" manufactured by XBow. the Mica2 internally uses an 8-bit processor (Atmega128) that runs on 4 MHz, contains 128 KB of instruction flash, 4 KB EEPROM, and 4 KB SRAM. The authors used AVR ICE JTAG programmer to dump and retrieve HEX code.The open source programs such as linux based standard GDB debugging tool, UISP, avr-objcopy and avr-tool are used to conduct this experiment. The authors got object file through serial interface connected to the PC. The Hex converter tool is used for reverse conversion of the assembly code. Generally, SRAM is considered as the safest among all memories to store keys and sensitive information due to its volatile nature. This experiment showed that the researchers not only collected sensitive data from the flash memory and EEPROM but they also copied all data from the SRAM. The authors showed  
Figure 1: JTAGulator device [8].  
that, by using simple hardware and free available software tools, one can get a memory footprint less than a minute from lightweight operating systems.  
Moreover, there has been rapid growth in development of operating systems specifically designed for small-sized IoT embedded platforms such as Windows 10 IOT OS, ArmMBED OS, Yocto project, etc. Devices such as routers, cameras, wireless sensor nodes, etc. now contains minimal sized OS (as small as in Kbytes) for managing hardware/software resources. Since these tiny OSs are used in many devices; such computing-feasible devices can be used as the bot to execute malicious code, or to scan to find other vulnerable devices. In comparison to this, recently, a self propagating botnet malware known as \"Mirai\" became very popular in industry and researchers community. The Mirai malware attacked website of \"Krebbs; a software security consultant company\", with 620 Gbps of traffic in September 2016, which was one of the huge DDoS attacks (Distributed denial-of-service). This Mirai botnet code infects devices such as routers and IP cameras that are still using their factory default username and password. Usually, manufacturing companies of these products expects that the user will change default credentials but in practice it has been observed that users are quite ignorant about its severity. [PERSON] et al. (2016) discussed the severity of this DDoS attack. In short, there are three main modules in this malware: Bot module, ScanListen module, and Load module. The Bot module scans other online devices in the network, ScanListen module sends collected information to load module and Load module performs actual attack. Due to this attack, Hangzhou Xingmai Technology recalled 4.3 million Internet-connected camera products from the U.S market (2016).