# 192: Button Connected To Nothing

- Show: [Embedded.fm](https://hardwarepodcasts.com/podcast/embedded-fm)
- Published: 2017-03-22
- Length: 1h 13m
- Page: https://hardwarepodcasts.com/podcast/embedded-fm/2017-03-22-192-button-connected-to-nothing
- Listen: https://makingembeddedsystems.libsyn.com/192-button-connected-to-nothing

## Summary

Terry Dunlap, founder and CEO of Tactical Network Solutions, discusses the critical lack of security in Internet of Things (IoT) devices, citing the Mirai botnet, the TrendNet FTC lawsuit, and the St. Jude Medical defibrillator alert as key examples of failure. He explains that common vulnerabilities stem from insecure coding practices, such as buffer overflows and hardcoded keys, often exacerbated by outsourcing firmware development without source code visibility. Dunlap highlights the emergence of standards like UL 2900 and the work of organizations like CableLabs to enforce firmware evaluation, while noting that consumers often remain vulnerable due to poor router configurations and a lack of firmware update support. He advises manufacturers to implement secure coding practices, use source code auditing tools, and encrypt firmware images to reduce the attack surface before devices reach the field.

## Chapters

- [0:06](https://hardwarepodcasts.com/podcast/embedded-fm/2017-03-22-192-button-connected-to-nothing#t=6) Introduction: Terry Dunlap and Tactical Network Solutions
- [3:00](https://hardwarepodcasts.com/podcast/embedded-fm/2017-03-22-192-button-connected-to-nothing#t=180) IoT Security Status: Mirai Botnet and Default Credentials
- [5:39](https://hardwarepodcasts.com/podcast/embedded-fm/2017-03-22-192-button-connected-to-nothing#t=339) Malicious Backdoors and Outsourced Firmware Development
- [7:36](https://hardwarepodcasts.com/podcast/embedded-fm/2017-03-22-192-button-connected-to-nothing#t=456) Secure Coding Practices and CERT Top 10
- [12:33](https://hardwarepodcasts.com/podcast/embedded-fm/2017-03-22-192-button-connected-to-nothing#t=753) Regulatory Push: UL 2900, CableLabs, and Liability
- [19:18](https://hardwarepodcasts.com/podcast/embedded-fm/2017-03-22-192-button-connected-to-nothing#t=1158) Consumer Behavior and Router Security (UPnP, WPS)
- [27:31](https://hardwarepodcasts.com/podcast/embedded-fm/2017-03-22-192-button-connected-to-nothing#t=1651) Manufacturer Actions: Auditing Tools and Secure Lifecycle
- [35:04](https://hardwarepodcasts.com/podcast/embedded-fm/2017-03-22-192-button-connected-to-nothing#t=2104) Case Studies: TrendNet Lawsuit and St. Jude Medical Alert
- [41:44](https://hardwarepodcasts.com/podcast/embedded-fm/2017-03-22-192-button-connected-to-nothing#t=2504) Firmware Encryption and Third-Party Library Risks
- [46:42](https://hardwarepodcasts.com/podcast/embedded-fm/2017-03-22-192-button-connected-to-nothing#t=2802) Physical Access, Hardcoded Keys, and Automotive Hacking
- [56:28](https://hardwarepodcasts.com/podcast/embedded-fm/2017-03-22-192-button-connected-to-nothing#t=3388) Password Management and NSA Background

## Topics

- [Security & privacy](https://hardwarepodcasts.com/topic/security-and-privacy)
- [Embedded firmware](https://hardwarepodcasts.com/topic/embedded-firmware)
- [Certification & compliance](https://hardwarepodcasts.com/topic/certification-and-compliance)
- [Debugging & failure analysis](https://hardwarepodcasts.com/topic/debugging-and-failure-analysis)
- [Microcontrollers & dev platforms](https://hardwarepodcasts.com/topic/microcontrollers-and-platforms)

## Most relevant to

early-stage companies

## Mentioned

- Tactical Network Solutions (company)
- Mirai botnet (other)
- TrendNet (company)
- St. Jude Medical (company)
- UL 2900 (other)
- CableLabs (company)
- Veracode (tool)
- Synopsys (tool)
- OnePassword (product)

## Related episodes from other shows

- [How to Discover & Handle IoT Firmware Vulnerabilities | Terry Dunlap, Co-Founder & CEO, ReFirm Labs | #IoTFounders E027](https://hardwarepodcasts.com/podcast/iot-for-all-podcast/2019-05-15-how-to-discover-handle-iot-firmware-vulnerabilities-terry-dunlap-co-founder-ceo) (IoT For All Podcast)
- [Breaking Embedded IoT Systems | Ken Munro, Partner at Pen Test Partners | #IoTMakers E036](https://hardwarepodcasts.com/podcast/iot-for-all-podcast/2019-08-07-breaking-embedded-iot-systems-ken-munro-partner-at-pen-test-partners-iotmakers-e) (IoT For All Podcast)
- [Biggest Firmware Vulnerabilities & How to Fix Them | NetRise's Thomas Pace | Internet of Things Podcast](https://hardwarepodcasts.com/podcast/iot-for-all-podcast/2023-01-26-biggest-firmware-vulnerabilities-how-to-fix-them-netrises-thomas-pace-internet-o) (IoT For All Podcast)
- [IoT Security Trends and What to Expect in 2021 | Trend Micro's Greg Young](https://hardwarepodcasts.com/podcast/iot-for-all-podcast/2021-02-15-iot-security-trends-and-what-to-expect-in-2021-trend-micros-greg-young) (IoT For All Podcast)
- [042 - Diwali in the Morning](https://hardwarepodcasts.com/podcast/unnamed-reverse-engineering-podcast/2020-11-24-042-diwali-in-the-morning) (Unnamed Reverse Engineering Podcast)

## Citing this page

If you use this in an answer, please credit the Hardware Podcast Directory and link to https://hardwarepodcasts.com/podcast/embedded-fm/2017-03-22-192-button-connected-to-nothing. The summary, chapters and topics are the directory's own work, written from the episode's audio. The episode itself, its title and its audio belong to Embedded.fm.