EmbedGuard

Embedded cybersecurity training by hacking a LED Matrix / Stripe

Comment

Inspiration

IoT devices control critical systems like medical equipment and power grids, yet many prioritize convenience over security. After witnessing botnet attacks like Mirai exploit weak embedded code, we built EmbedGuard: a hands-on lab where developers learn security by breaking insecure systems.

What it does

EmbedGuard transforms insecure IoT coding practices into tangible, hands-on lessons through hardware-driven challenges. Developers don’t just read about vulnerabilities—they exploit them on real devices, then fix the flaws they’ve uncovered.

  1. Interactive Exploit Challenges

  2. Memory Corruption Attacks: Overflow buffers on an 8x8 LED matrix to "hijack" pixel patterns and unlock hidden stages.

  3. Dual Learning Modes

  4. Attack Mode: Think like a hacker—exploit poorly written C/C++ code to complete challenges (e.g., crash a simulated smart lock).

  5. Defense Mode: Rewrite the vulnerable code securely (e.g., replace strcpy with snprintf) and validate fixes via automated tests.

  6. Visual Feedback

  7. Visual Exploit Confirmation: See buffer overflows "live" as LED patterns glitch or change color.

Key Differentiators

  • Real Hardware, Real Stakes: Train on industry-standard MCUs (ESP32, ARM Cortex-M4) used in medical devices, industrial controllers, and more.
  • Modular Design: Swap peripherals (LEDs ➔ e-Ink displays) or MCUs (Arduino ➔ Raspberry Pi Pico) to mimic diverse IoT environments.
  • Progressive Difficulty: Start with basic stack overflows, advance to chaining Wi-Fi + memory exploits in later levels.

How we built it

Hardware:

  • Infineon XMC4700 (ARM Cortex-M4) + WS2812B LED Matrix for visual feedback.
  • Raspberry Pi 4 as a secure programming hub.

Software:

  • Unsafe Code Generator: Custom C++ library with intentional vulnerbilities
  • Web Interface: React app for challenge selection + live code submission.
  • CI/CD Pipeline: PlatformIO compiles code, flashes MCUs via USB, and validates exploits.

Challenges we ran into

  • Writing "Bad" Code: Creating exploitable flaws on purpose
  • 3D Printer shortage
  • Electrical engineering and debugging with limited hardware
  • Pipeline Orchestration

Accomplishments that we're proud of

  • Built a working MVP with 2 challanges across 2 MCU platforms
  • Proved hands-on hardware hacks improve retention vs. textbook learning
  • Designed a modular system for community-driven challenge expansions.

What we learned

  • Security requires intentionality - safe code doesn´n happen by accident
  • Hardware limitaions (e.g., memory) force creative exploit design design.
  • WebDev is harder than writing kernel drivers. ;) (for us embedded devs)

What's next for esp-lsd-led

  • Expand Challenges: Add BLE/Wi-Fi attack vectors and RTOS exploits.
  • Classroom Mode: Group leaderboards and collaborative CTF modules.
  • Productize: Pre-packages kits for universities/workshops.

Built With

Share this project:

Updates