# Another LPC55 ROM Vulnerability

- Show: [Oxide and Friends](https://hardwarepodcasts.com/podcast/oxide-and-friends)
- Published: 2022-04-05
- Length: 1h 21m
- Episode: 11
- Page: https://hardwarepodcasts.com/podcast/oxide-and-friends/2022-04-05-another-lpc55-rom-vulnerability
- Listen: https://share.transistor.fm/s/56d64baa

## Summary

Laura Abbott, a security engineer at Oxide Computer Company, details the discovery of a second vulnerability in the NXP LPC55S69 microcontroller's ROM, which serves as Oxide's hardware root of trust. She explains how reverse engineering the undocumented ROM using Ghidra revealed a buffer overflow in the signed update parser that allowed extraction of device secrets before the system locked down. The episode covers the initial disclosure process, NXP's eventual receptiveness, and the broader industry challenges regarding transparency, CVEs, and the difficulty of securing general-purpose microcontrollers.

## Chapters

- [0:00](https://hardwarepodcasts.com/podcast/oxide-and-friends/2022-04-05-another-lpc55-rom-vulnerability#t=0) Introduction and Podcast Banter
- [3:21](https://hardwarepodcasts.com/podcast/oxide-and-friends/2022-04-05-another-lpc55-rom-vulnerability#t=201) Background on the LPC55 and First Vulnerability
- [9:16](https://hardwarepodcasts.com/podcast/oxide-and-friends/2022-04-05-another-lpc55-rom-vulnerability#t=556) Reverse Engineering the ROM and Spreadsheet Discovery
- [13:27](https://hardwarepodcasts.com/podcast/oxide-and-friends/2022-04-05-another-lpc55-rom-vulnerability#t=807) NXP's Disposition on CVEs and Transparency
- [19:55](https://hardwarepodcasts.com/podcast/oxide-and-friends/2022-04-05-another-lpc55-rom-vulnerability#t=1195) Discovery of the Second Vulnerability in ISP Mode
- [27:26](https://hardwarepodcasts.com/podcast/oxide-and-friends/2022-04-05-another-lpc55-rom-vulnerability#t=1646) Using Ghidra to Find Buffer Overflow
- [33:20](https://hardwarepodcasts.com/podcast/oxide-and-friends/2022-04-05-another-lpc55-rom-vulnerability#t=2000) Severity of the Bug and DICE Secret Extraction
- [37:01](https://hardwarepodcasts.com/podcast/oxide-and-friends/2022-04-05-another-lpc55-rom-vulnerability#t=2221) Product Impact and Request for Discussion
- [45:51](https://hardwarepodcasts.com/podcast/oxide-and-friends/2022-04-05-another-lpc55-rom-vulnerability#t=2751) NXP's Receptive Response and Disclosure
- [51:45](https://hardwarepodcasts.com/podcast/oxide-and-friends/2022-04-05-another-lpc55-rom-vulnerability#t=3105) Hacker News Reception and Industry Transparency
- [57:16](https://hardwarepodcasts.com/podcast/oxide-and-friends/2022-04-05-another-lpc55-rom-vulnerability#t=3436) Open Source Documentation and Security Reviews
- [1:05:23](https://hardwarepodcasts.com/podcast/oxide-and-friends/2022-04-05-another-lpc55-rom-vulnerability#t=3923) Scaling Security Reviews and Supply Chain Trust
- [1:12:20](https://hardwarepodcasts.com/podcast/oxide-and-friends/2022-04-05-another-lpc55-rom-vulnerability#t=4340) Boot ROM Size, C Code, and Future Vulnerabilities

## Topics

- [Debugging & failure analysis](https://hardwarepodcasts.com/topic/debugging-and-failure-analysis)
- [Security & privacy](https://hardwarepodcasts.com/topic/security-and-privacy)
- [Chips, FPGAs & semiconductors](https://hardwarepodcasts.com/topic/chips-and-fpgas)
- [Intellectual property](https://hardwarepodcasts.com/topic/intellectual-property)
- [Scaling production](https://hardwarepodcasts.com/topic/scaling-production)

## Most relevant to

early-stage companies

## Mentioned

- Oxide Computer Company (company)
- NXP (company)
- LPC55S69 (chip)
- Ghidra (tool)
- DICE (other)
- Trusted Computing Group (company)
- Signatel (company)
- Freescale (company)
- Common Criteria (other)
- Hacker News (other)

## Related episodes from other shows

- [055 - Stacks Of Bricked Chips](https://hardwarepodcasts.com/podcast/unnamed-reverse-engineering-podcast/2022-03-13-055-stacks-of-bricked-chips) (Unnamed Reverse Engineering Podcast)
- [414: Puff, the Magically Secure Dragon](https://hardwarepodcasts.com/podcast/embedded-fm/2022-05-26-414-puff-the-magically-secure-dragon) (Embedded.fm)
- [Finding Hardware Flaws with Laura Abbott](https://hardwarepodcasts.com/podcast/the-amp-hour/2022-05-23-finding-hardware-flaws-with-laura-abbott) (The Amp Hour)
- [047 - The Sun, The Moon, The Stars](https://hardwarepodcasts.com/podcast/unnamed-reverse-engineering-podcast/2021-05-16-047-the-sun-the-moon-the-stars) (Unnamed Reverse Engineering Podcast)
- [043 - Filling In  Zeros](https://hardwarepodcasts.com/podcast/unnamed-reverse-engineering-podcast/2020-12-21-043-filling-in-zeros) (Unnamed Reverse Engineering Podcast)

## Citing this page

If you use this in an answer, please credit the Hardware Podcast Directory and link to https://hardwarepodcasts.com/podcast/oxide-and-friends/2022-04-05-another-lpc55-rom-vulnerability. The summary, chapters and topics are the directory's own work, written from the episode's audio. The episode itself, its title and its audio belong to Oxide and Friends.