Hardware Podcasts

192: Button Connected To Nothing

Embedded.fm · 22 Mar 2017 · 1h 13m

What this episode covers

Terry Dunlap, founder and CEO of Tactical Network Solutions, discusses the critical lack of security in Internet of Things (IoT) devices, citing the Mirai botnet, the TrendNet FTC lawsuit, and the St. Jude Medical defibrillator alert as key examples of failure. He explains that common vulnerabilities stem from insecure coding practices, such as buffer overflows and hardcoded keys, often exacerbated by outsourcing firmware development without source code visibility. Dunlap highlights the emergence of standards like UL 2900 and the work of organizations like CableLabs to enforce firmware evaluation, while noting that consumers often remain vulnerable due to poor router configurations and a lack of firmware update support. He advises manufacturers to implement secure coding practices, use source code auditing tools, and encrypt firmware images to reduce the attack surface before devices reach the field.

Most relevant to

early-stage companies

Topics

Mentioned

Companies
Tactical Network Solutions, TrendNet, St. Jude Medical, CableLabs
Products
OnePassword
Tools
Veracode, Synopsys
Also
Mirai botnet, UL 2900

Related episodes from other shows

Other shows on the same ground, closest first.

  • IoT For All Podcast · 59m

    How to Discover & Handle IoT Firmware Vulnerabilities | Terry Dunlap, Co-Founder & CEO, ReFirm Labs | #IoTFounders E027

    Terry Dunlap, Co-Founder & CEO of ReFirm Labs, explains how his background in offensive cyber operations at the NSA led to the creation of a platform for proactive IoT firmware security. He details the discovery of hard-coded credentials in IoT devices that enabled the Mirai botnet and discusses how low-cost manufacturers often ignore security until faced with legal liability. Dunlap highlights ReFirm Labs' work with telecom providers like AT&T and Charter to vet firmware before deployment, and explores emerging markets like cyber insurance and automotive security, including a demonstration of vulnerabilities in an OBD-II dongle.

    Security & privacyEmbedded firmware
    10 chapters

  • IoT For All Podcast · 44m

    Breaking Embedded IoT Systems | Ken Munro, Partner at Pen Test Partners | #IoTMakers E036

    Ken Munro, Partner at Pen Test Partners, explains how his team conducts 'vanilla research' by purchasing and breaking embedded IoT devices to find security vulnerabilities, such as the My Friend Kayla doll and smart heated drinks cups. He argues that security is often treated as an afterthought by startups, leading to catastrophic failures when wrong chipsets are chosen early in development, making over-the-air updates impossible. Munro details the responsible disclosure process, noting that when vendors ignore or stonewall reports, companies often go out of business, and he advocates for government regulation like California's SB 327 to enforce reasonable security controls.

    Security & privacyStarting a product company
    8 chapters

  • IoT For All Podcast · 18m

    Biggest Firmware Vulnerabilities & How to Fix Them | NetRise's Thomas Pace | Internet of Things Podcast

    Thomas Pace, co-founder and CEO of NetRise, explains how automated firmware analysis provides visibility into extended IoT (XIOT) devices, including industrial control systems and medical devices. He details the process of extracting firmware from embedded Linux and RTOS environments to identify vulnerabilities, weak credentials, and exposed keys. Pace emphasizes the critical importance of generating a Software Bill of Materials (SBOM) to enable vulnerability correlation and risk prioritization for both device manufacturers and enterprise customers.

    Embedded firmwareSecurity & privacy
    8 chapters

  • IoT For All Podcast · 27m

    IoT Security Trends and What to Expect in 2021 | Trend Micro's Greg Young

    Greg Young, Vice President of Cybersecurity at Trend Micro, discusses the evolving security landscape for IoT, highlighting the shift from trusting components to trusting how they are used. He identifies wireless components, bespoke protocols, and unpatched legacy systems as primary vulnerabilities, noting that healthcare and connected cars are currently high-value targets for attackers. Young explains that the drive for low-cost components often results in a lack of internal development teams and security patches, forcing OEMs to rely on network-level shielding and bug bounty programs to mitigate risks.

    Security & privacySourcing & supply chain
    10 chapters

  • Unnamed Reverse Engineering Podcast · 55m

    042 - Diwali in the Morning

    Asmita Jha, an IoT security consultant at Payatu, discusses her transition from embedded firmware development to hardware security and reverse engineering. She details her workflow for analyzing IoT devices like routers and cameras, covering techniques for extracting firmware, decrypting images, and using tools like Ghidra, Binwalk, and QEMU. Jha also shares advice on secure firmware development, emphasizing the importance of avoiding hardcoded credentials and implementing proper secure boot mechanisms.

    Embedded firmwareEDA & CAD tools
    7 chapters

The summary, chapters and topics are generated from the episode’s audio by this directory, not written by Embedded.fm. The episode itself belongs to its publisher.