Hardware Podcasts

229: Slinky with a Lot of Math

Embedded.fm · 12 Jan 2018 · 1h 21m · Episode 229

What this episode covers

Nick Kartsioukas, an information security engineer known as ExplodingLemur, discusses the practical application of threat modeling, the mechanics of Spectre and Meltdown vulnerabilities, and essential user-level security hygiene. He explains how speculative execution and cache timing attacks allow user-space processes to leak kernel memory, highlighting the difficulty of patching legacy industrial and medical systems. For general users, he recommends using password managers, two-factor authentication, and ad blockers, while emphasizing the importance of data backups and mental health resources.

Most relevant to

early-stage companies

Topics

Mentioned

Companies
No Starch Press
Products
YubiKey
Tools
U-Block Origin
Also
Stuxnet, CIS 20

Related episodes from other shows

Other shows on the same ground, closest first.

  • The Amp Hour · 1h 07m

    Hardware Security with Matt Brown

    Matt Brown of Brown Find Security discusses hardware security best practices and reverse engineering techniques, using his analysis of a smart charcoal smoker as a primary case study. He explains how unencrypted flash storage and lack of key rotation on an ESP32-based device allowed him to extract private keys and intercept TLS traffic. The conversation covers the importance of threat modeling, the role of secure elements like the ATECC608, and the tools used for firmware dumping and RF analysis.

    Security & privacyDebugging & failure analysis
    7 chapters

  • Unnamed Reverse Engineering Podcast · 45m

    011 - Making Too Many Assumptions

    Bluetooth security researcher Mike Ryan, founder of Ice 9 Consulting, discusses his journey from hacking Game Boy ROMs to exposing critical vulnerabilities in Bluetooth products, including Boosted Skateboards and Fuse credit cards. He explains how developers often fail by implementing custom cryptography or ignoring threat models, such as the risk of a credit card being handed to a waiter, leading to data exposure. Ryan advocates for using built-in BLE security and provides a detailed workflow for reverse engineering using tools like Ubertooth, Wireshark, and CrackLE to analyze protocol flaws and pairing weaknesses.

    Security & privacyWireless & RF
    10 chapters

  • Manufacturing Happy Hour · 34m

    Common Cybersecurity Threats and What to Do about Them with Dana Mantilia

    Dana Mantilia, founder of Identity Protection Planning, explains that 85% of cybersecurity failures stem from non-technical employees clicking malicious links or sharing credentials, rather than technical firewall breaches. She outlines immediate steps for manufacturers, including creating digital asset inventories and enforcing basic cyber hygiene, to prepare for the Department of Defense's CMMC certification requirements. Mantilia also details her content strategy of using humor and props in short videos to simplify complex security topics for small businesses.

    Security & privacyDirect-to-consumer & e-commerce
    7 chapters

  • Oxide and Friends · 1h 43m

    Adventures in Data Corruption

    Bryan Cantrill, Adam Leventhal, John Gallagher, and Rain Paharia of Oxide Computer Company discuss a bizarre data corruption bug discovered two years prior during their sled recovery process. The team traced the issue to CPU speculative execution across kernel page table isolation boundaries, specifically involving a 'stowaway' mapping in the kernel-only CR3 that leaked into the TLB. They detail the debugging odyssey, from initial hash mismatches in the Installinator tool to identifying the 'haunted virtual address' region and finally confirming the microarchitectural speculation bug with AMD.

    Debugging & failure analysisMicrocontrollers & dev platforms
    8 chapters

  • The Amp Hour · 57m

    Finding Hardware Flaws with Laura Abbott

    Laura Abbott, an engineer at Oxide Computer, discusses her accidental discovery of a buffer overflow vulnerability in the ROM update mechanism of the NXP LPC55S69 microcontroller while working on Oxide's server root of trust. She explains how Oxide is rebuilding the server from the ground up with a focus on hardware security, utilizing their open-source operating system Hubris and the Rust programming language to mitigate risks like memory safety issues. The conversation covers the architecture of the server's secure components, including the service processor and TrustZone-M, as well as the challenges of remote hardware debugging and contributing to the Linux kernel community.

    Security & privacyMicrocontrollers & dev platforms
    6 chapters

The summary, chapters and topics are generated from the episode’s audio by this directory, not written by Embedded.fm. The episode itself belongs to its publisher.