Hardware Podcasts

Biggest Firmware Vulnerabilities & How to Fix Them | NetRise's Thomas Pace | Internet of Things Podcast

IoT For All Podcast · 26 Jan 2023 · 18m

What this episode covers

Thomas Pace, co-founder and CEO of NetRise, explains how automated firmware analysis provides visibility into extended IoT (XIOT) devices, including industrial control systems and medical devices. He details the process of extracting firmware from embedded Linux and RTOS environments to identify vulnerabilities, weak credentials, and exposed keys. Pace emphasizes the critical importance of generating a Software Bill of Materials (SBOM) to enable vulnerability correlation and risk prioritization for both device manufacturers and enterprise customers.

Most relevant to

early-stage companies

Topics

Mentioned

Companies
NetRise, Armis, Dragos
Also
VxWorks, Green Hills, uC/OS, eCos, UEFI

Related episodes from other shows

Other shows on the same ground, closest first.

  • Embedded.fm · 1h 10m

    515: Script Boomers

    Nick Kartsioukas, a Senior Security Engineer, discusses the evolving landscape of embedded system security, emphasizing the critical importance of Software Bill of Materials (SBOMs) and monitoring the Common Vulnerabilities and Exposures (CVE) database. He explains how to secure IoT devices through mutual TLS authentication and hardware roots of trust, while warning against the risks of using complex platforms like the Raspberry Pi in constrained environments. The conversation also covers threat modeling strategies, the crossover between safety and security, and practical advice for engineers to improve their security posture through Capture The Flag (CTF) challenges.

    Security & privacyConnected products & IoT
    8 chapters

  • Embedded.fm · 1h 13m

    192: Button Connected To Nothing

    Terry Dunlap, founder and CEO of Tactical Network Solutions, discusses the critical lack of security in Internet of Things (IoT) devices, citing the Mirai botnet, the TrendNet FTC lawsuit, and the St. Jude Medical defibrillator alert as key examples of failure. He explains that common vulnerabilities stem from insecure coding practices, such as buffer overflows and hardcoded keys, often exacerbated by outsourcing firmware development without source code visibility. Dunlap highlights the emergence of standards like UL 2900 and the work of organizations like CableLabs to enforce firmware evaluation, while noting that consumers often remain vulnerable due to poor router configurations and a lack of firmware update support. He advises manufacturers to implement secure coding practices, use source code auditing tools, and encrypt firmware images to reduce the attack surface before devices reach the field.

    Security & privacyEmbedded firmware
    11 chapters

  • Unnamed Reverse Engineering Podcast · 55m

    042 - Diwali in the Morning

    Asmita Jha, an IoT security consultant at Payatu, discusses her transition from embedded firmware development to hardware security and reverse engineering. She details her workflow for analyzing IoT devices like routers and cameras, covering techniques for extracting firmware, decrypting images, and using tools like Ghidra, Binwalk, and QEMU. Jha also shares advice on secure firmware development, emphasizing the importance of avoiding hardcoded credentials and implementing proper secure boot mechanisms.

    Embedded firmwareEDA & CAD tools
    7 chapters

  • Embedded.fm · 1h 08m

    311: Attack Other People's Refrigerators

    Rick Altherr, a security researcher at Eclypsium and former engineer at Apple and Google, discusses firmware security, threat modeling, and the challenges of securing IoT devices like refrigerators. He explains how adding connectivity expands attack surfaces and details the STRIDE framework and OWASP guidelines for evaluating risks. Altherr also shares insights on his career path, the importance of mentorship, and his technical hobbies including reverse engineering FPGA bitstreams and car ECUs.

    Security & privacyEmbedded firmware
    8 chapters

  • The Pragmatic Embedded Podcast · 48m

    Offensive Cybersecurity with Ryan Torvik

    Ryan Torvik, founder and CEO of Tulip Tree Technology, explains the offensive cybersecurity mindset and how it applies to securing embedded systems. He details techniques for extracting and analyzing firmware using tools like IDA Pro and Ghidra, and discusses the importance of designing security from the start, including using standard libraries and secure languages like Rust. Torvik also describes Tulip Tree's emulation technology, which models hardware behavior to allow developers to test firmware and detect vulnerabilities without physical hardware.

    Security & privacyEmbedded firmware
    10 chapters

The summary, chapters and topics are generated from the episode’s audio by this directory, not written by IoT For All Podcast. The episode itself belongs to its publisher.