Hardware Podcasts

Ep 265: Behind the Epic SSH Hack, 1980s Cyber Butler, The Story of Season 7

Hackaday Podcast · 5 Apr 2024 · 42m · Episode 265

What this episode covers

Editors Elliot Williams and Kristina Panos discuss the xz backdoor incident, detailing the social engineering of maintainer Lasse Collin and the injection of malicious code into the build scripts. They also explore a 1980s 'Master Butler in a Box' voice-activated home automation system, a hack allowing LoRa transmission via an ESP32 without a dedicated radio, and the story of a German hacker who built a descrambler to watch Star Trek Season 7.

Most relevant to

makers and hobbyists

Topics

Mentioned

Companies
Gigaset, Augusta University, Sky TV
Products
Flipper Zero, Master Butler in a Box, Star Trek
Chips
ESP32, RP2040
Also
xz, Lasse Collin, LoRa, Charles Lohr, Jeremy Cook, Riley's Lab, Marcus Coon

Related episodes from other shows

Other shows on the same ground, closest first.

  • Oxide and Friends · 1h 37m

    Discovering the XZ Backdoor with Andres Freund

    Andres Freund, a PostgreSQL committer and performance expert, explains how he discovered the xz backdoor while benchmarking a performance patch. He detected anomalous CPU usage in sshd caused by injected code in liblzma, which was obfuscated to hide its malicious intent. The investigation revealed a sophisticated, likely state-sponsored attack that manipulated the build system and exploited dynamic linker features to intercept SSH authentication. Freund’s decision to rapidly disclose the vulnerability prevented widespread exploitation of Linux systems worldwide.

    Debugging & failure analysisSecurity & privacy
    9 chapters

  • The Amp Hour · 1h 01m

    Look at nature and meet nerds

    Dave Jones of EEVblog and Chris Gammell of Contextual Electronics discuss their upcoming in-person meeting in Australia and New Zealand, highlighting plans for maker meetups and tech tours. Jones details his firmware hack of the Keysight 1000X-Series oscilloscope to unlock higher bandwidth and sample rates, while also noting a footprint error in his Mixy Tube clock project. The conversation shifts to industry news, including the CIA's Vault 7 leaks, the use of silicon carbide electronics for Venus landers, and the security risks of IoT devices like the Cloud Pet teddy bear.

    PCB design & layoutEmbedded firmware
    7 chapters

  • Unnamed Reverse Engineering Podcast · 1h 40m

    053 - It's Hammer Time!

    Hash, a reverse engineer known for smart meter hacking, discusses his journey from self-taught electronics hobbyist to analyzing critical infrastructure. He details his reverse engineering of the Neato XV-11 robot vacuum's LIDAR to win a bounty, and his current work using Software Defined Radios (SDRs) like the HackRF and Yardstick One to analyze Landis+Gyr smart meters. Hash explains how he bypassed frequency hopping by transmitting on all channels simultaneously and highlights the security risks of these devices, including data leakage from decommissioned hardware found on eBay.

    Wireless & RFDebugging & failure analysis
    8 chapters

  • Unnamed Reverse Engineering Podcast · 1h 14m

    028 - Everyone Has a Bag of Tricks

    Johnny Xmas (@J0hnnyXm4s), a security architect and reverse engineer, discusses his career path from pharmacy to infosec and details the community effort to reverse engineer TSA master keys. He explains how the keys were leaked via a vendor catalog and Instagram, and how the community used 3D printing and lock disassembly to create working copies, highlighting the security implications for luggage and encryption. Xmas also describes his work at Kasada, a company that defends web infrastructure against automated abuse by detecting client-side automation rather than relying on traditional Web Application Firewalls (WAFs).

    Debugging & failure analysisSecurity & privacy
    9 chapters

  • Unnamed Reverse Engineering Podcast · 1h 03m

    065 - Multitalented Grinch

    Hosts Alvaro Brieto and Jen discuss their recent attendance at Open Sauce and the Crowd Supply teardown conference, highlighting the community aspect of hardware reverse engineering. They review several books on security and hacking history, including 'ARM Assembly and Reverse Engineering' and 'Murdoch's Pirates', while also sharing news about past guests like David from Cyber City Circuits teaching the First Lady to solder. The episode concludes with technical discussions on CAN bus vulnerabilities in Toyota vehicles, hotel IoT security, and Alvaro's new DJI Mic recording setup for upcoming coverage at CCCamp.

    Security & privacyMaker community & events
    8 chapters

The summary, chapters and topics are generated from the episode’s audio by this directory, not written by Hackaday Podcast. The episode itself belongs to its publisher.