Hardware Podcasts

Another LPC55 ROM Vulnerability

Oxide and Friends · 5 Apr 2022 · 1h 21m · Episode 11

What this episode covers

Laura Abbott, a security engineer at Oxide Computer Company, details the discovery of a second vulnerability in the NXP LPC55S69 microcontroller's ROM, which serves as Oxide's hardware root of trust. She explains how reverse engineering the undocumented ROM using Ghidra revealed a buffer overflow in the signed update parser that allowed extraction of device secrets before the system locked down. The episode covers the initial disclosure process, NXP's eventual receptiveness, and the broader industry challenges regarding transparency, CVEs, and the difficulty of securing general-purpose microcontrollers.

Most relevant to

early-stage companies

Topics

Mentioned

Companies
Oxide Computer Company, NXP, Trusted Computing Group, Signatel, Freescale
Chips
LPC55S69
Tools
Ghidra
Also
DICE, Common Criteria, Hacker News

Related episodes from other shows

Other shows on the same ground, closest first.

  • Unnamed Reverse Engineering Podcast · 1h 01m

    055 - Stacks Of Bricked Chips

    Laura Abbott, a software developer at Oxide Computer, explains how her team reverse engineered the NXP LPC55S69 microcontroller to build a root of trust for their servers. She details discovering an undocumented ROM patching hardware block that allowed privilege escalation, leading to a CVE and a DEF CON presentation. Abbott also discusses her background in Linux kernel development, the transition to Rust for microcontrollers, and the challenges of working with contradictory chip documentation.

    Chips, FPGAs & semiconductorsSecurity & privacy
    7 chapters

  • Embedded.fm · 58m

    414: Puff, the Magically Secure Dragon

    Laura Abbott, a firmware engineer at Oxide Computing, discusses two silicon bugs found in the NXP LPC55S69 microcontroller, including a buffer overflow in the ROM that allows cloning the device's PUF identity. She explains how she used Ghidra to reverse-engineer the undocumented ROM code and details the security implications for TrustZone and Secure Boot. The conversation also covers Oxide's approach to hiring, their use of Rust for firmware, and the challenges of working with proprietary silicon.

    Debugging & failure analysisMicrocontrollers & dev platforms
    7 chapters

  • The Amp Hour · 57m

    Finding Hardware Flaws with Laura Abbott

    Laura Abbott, an engineer at Oxide Computer, discusses her accidental discovery of a buffer overflow vulnerability in the ROM update mechanism of the NXP LPC55S69 microcontroller while working on Oxide's server root of trust. She explains how Oxide is rebuilding the server from the ground up with a focus on hardware security, utilizing their open-source operating system Hubris and the Rust programming language to mitigate risks like memory safety issues. The conversation covers the architecture of the server's secure components, including the service processor and TrustZone-M, as well as the challenges of remote hardware debugging and contributing to the Linux kernel community.

    Security & privacyMicrocontrollers & dev platforms
    6 chapters

  • Unnamed Reverse Engineering Podcast · 50m

    047 - The Sun, The Moon, The Stars

    Jen Castillo and Alvaro Prieto discuss recent reverse engineering projects, including Colin O'Flynn's teardown of the Apple AirTag, which revealed an nRF52 microcontroller and a vulnerability allowing firmware dumping via the Pocket Glitcher. They also cover a method to transmit arbitrary data through Apple's Find My network, a 70% reduction in GTA Online loading times by patching a slow JSON parser, and reverse engineering of Reolink IP cameras and eInk price tags. The hosts highlight past guests' work on the LPC55S69 microcontroller and the Asahi Linux project for the Apple M1 processor, noting a trend toward better security practices in hardware design.

    Debugging & failure analysisMicrocontrollers & dev platforms
    7 chapters

  • Unnamed Reverse Engineering Podcast · 1h 15m

    043 - Filling In Zeros

    Dmitry Grinberg, a hardware hacker and repeat guest, details his reverse engineering of the Nintendo Pokéwalker, which uses a Renesas H8 microcontroller. He explains how he bypassed the chip's self-erase protection by exploiting a buffer overflow in its decompression algorithm to dump the ROM and execute arbitrary code. The discussion also covers his analysis of various processor architectures, specifically contrasting the compiler-friendly H8 and ARM designs with the notoriously difficult 8051 and PIC architectures.

    Debugging & failure analysisMicrocontrollers & dev platforms
    8 chapters

The summary, chapters and topics are generated from the episode’s audio by this directory, not written by Oxide and Friends. The episode itself belongs to its publisher.