Hardware Podcasts

311: Attack Other People's Refrigerators

Embedded.fm · 22 Nov 2019 · 1h 08m · Episode 311

What this episode covers

Rick Altherr, a security researcher at Eclypsium and former engineer at Apple and Google, discusses firmware security, threat modeling, and the challenges of securing IoT devices like refrigerators. He explains how adding connectivity expands attack surfaces and details the STRIDE framework and OWASP guidelines for evaluating risks. Altherr also shares insights on his career path, the importance of mentorship, and his technical hobbies including reverse engineering FPGA bitstreams and car ECUs.

Most relevant to

large enterprises

Topics

Mentioned

Companies
Eclypsium, Apple, Google, GE Appliances, Nordic, MITRE
Chips
iCE40
Also
OWASP, Clifford Wolf

Related episodes from other shows

Other shows on the same ground, closest first.

  • IoT For All Podcast · 59m

    How to Discover & Handle IoT Firmware Vulnerabilities | Terry Dunlap, Co-Founder & CEO, ReFirm Labs | #IoTFounders E027

    Terry Dunlap, Co-Founder & CEO of ReFirm Labs, explains how his background in offensive cyber operations at the NSA led to the creation of a platform for proactive IoT firmware security. He details the discovery of hard-coded credentials in IoT devices that enabled the Mirai botnet and discusses how low-cost manufacturers often ignore security until faced with legal liability. Dunlap highlights ReFirm Labs' work with telecom providers like AT&T and Charter to vet firmware before deployment, and explores emerging markets like cyber insurance and automotive security, including a demonstration of vulnerabilities in an OBD-II dongle.

    Security & privacyEmbedded firmware
    10 chapters

  • Unnamed Reverse Engineering Podcast · 55m

    042 - Diwali in the Morning

    Asmita Jha, an IoT security consultant at Payatu, discusses her transition from embedded firmware development to hardware security and reverse engineering. She details her workflow for analyzing IoT devices like routers and cameras, covering techniques for extracting firmware, decrypting images, and using tools like Ghidra, Binwalk, and QEMU. Jha also shares advice on secure firmware development, emphasizing the importance of avoiding hardcoded credentials and implementing proper secure boot mechanisms.

    Embedded firmwareEDA & CAD tools
    7 chapters

  • IoT For All Podcast · 22m

    Internet of Things Security: What To Know | SmartSense by Digi's Gil Dror | Internet of Things Podcast

    Gil Dror, CTO of SmartSense by Digi, discusses IoT security vulnerabilities, emphasizing that physical access to devices and insecure communication protocols are primary risks. He outlines prioritization strategies like secure protocols, firmware updates, and zero-trust models, while noting industry-specific concerns in healthcare and retail. The conversation extends to the integration of LLMs for contextual data interaction, edge computing for AI execution, and neuromorphic computing as a future paradigm for low-power intelligence.

    Security & privacyAI & machine learning
    7 chapters

  • IoT For All Podcast · 18m

    Biggest Firmware Vulnerabilities & How to Fix Them | NetRise's Thomas Pace | Internet of Things Podcast

    Thomas Pace, co-founder and CEO of NetRise, explains how automated firmware analysis provides visibility into extended IoT (XIOT) devices, including industrial control systems and medical devices. He details the process of extracting firmware from embedded Linux and RTOS environments to identify vulnerabilities, weak credentials, and exposed keys. Pace emphasizes the critical importance of generating a Software Bill of Materials (SBOM) to enable vulnerability correlation and risk prioritization for both device manufacturers and enterprise customers.

    Embedded firmwareSecurity & privacy
    8 chapters

  • IoT For All Podcast · 50m

    What Are the Security Implications of IoT? | Andrew Howard, CTO at Kudelski Security | #AskIoT E020

    Andrew Howard, CTO of Kudelski Security, explains that IoT security requires protecting device integrity, data confidentiality, and access management, emphasizing that physical attacks on devices like OBD2 dongles can compromise vehicle safety. He highlights that manufacturers often neglect physical security, assuming network-only threats, while enterprises face risks from legacy systems that were never designed for connectivity. Howard advises non-technical companies to hire consultants and use vetted open-source solutions rather than building custom security infrastructure from scratch. The discussion covers the spectrum of risks from individual privacy breaches to physical harm in industrial and medical settings, noting that industrial control systems like SCADA are particularly vulnerable.

    Security & privacyMechanical engineering
    8 chapters

The summary, chapters and topics are generated from the episode’s audio by this directory, not written by Embedded.fm. The episode itself belongs to its publisher.