Hardware Podcasts

CrowdStrike BSOD Fiasco with Katie Moussouris

Oxide and Friends · 25 Jul 2024 · 1h 41m · Episode 19

What this episode covers

Security expert Katie Moussouris joins Bryan Cantrill and Adam Leventhal to analyze the CrowdStrike outage, discussing the technical failure of a kernel-mode driver update that caused global Blue Screen of Death crashes. The conversation explores the role of the Cyber Safety Review Board (CSRB) in investigating such incidents, the challenges of software liability, and the complexities of securing ubiquitous third-party security tools. Moussouris also shares insights on her career, including pioneering Microsoft's bug bounty program and the limitations of open-source security models.

Most relevant to

large enterprises

Topics

Mentioned

Companies
CrowdStrike, Microsoft, SolarWinds, Clubhouse
Also
Cyber Safety Review Board, Log4j, OpenSSH, Rust

Related episodes from other shows

Other shows on the same ground, closest first.

  • The Amp Hour · 57m

    Finding Hardware Flaws with Laura Abbott

    Laura Abbott, an engineer at Oxide Computer, discusses her accidental discovery of a buffer overflow vulnerability in the ROM update mechanism of the NXP LPC55S69 microcontroller while working on Oxide's server root of trust. She explains how Oxide is rebuilding the server from the ground up with a focus on hardware security, utilizing their open-source operating system Hubris and the Rust programming language to mitigate risks like memory safety issues. The conversation covers the architecture of the server's secure components, including the service processor and TrustZone-M, as well as the challenges of remote hardware debugging and contributing to the Linux kernel community.

    Security & privacyMicrocontrollers & dev platforms
    6 chapters

  • The Next Byte Podcast · 1h 02m

    192. Karsten Roscher & The Need For Safe AI (Interview)

    Karsten Roscher, Head of the Certifiable AI department at the Fraunhofer Institute for Cognitive Systems (IKS), discusses the critical need for safety in AI development, particularly in autonomous driving. He explains the challenges of out-of-distribution detection, where models fail on unseen data like e-scooters or horse carriages, and introduces Robuscope, a free tool for evaluating model robustness without sharing proprietary data. Roscher also critiques the industry's over-reliance on benchmarks and highlights a new SAE International course designed to bridge the gap between machine learning engineers and safety experts.

    AI & machine learningDebugging & failure analysis
    6 chapters

  • Embedded.fm · 1h 18m

    166: Sardine Tornado

    Bob Apthorpe, a nuclear engineer with a background in web development, discusses the intersection of safety engineering, software reliability, and improv comedy. He explains how lessons from severe accident analysis, such as hydrogen control and molten fuel debris simulation, apply to software design, particularly regarding warning systems and common-cause failures. Apthorpe argues that the 'noise' of excessive compiler warnings or system alerts mirrors the 'annunciator panel' problem at Three Mile Island, advocating for rigorous signal-to-noise management. He also shares how stage improv helped him navigate workplace dynamics and accept failure as a necessary part of learning in hardware and software projects.

    Embedded firmwareDebugging & failure analysis
    8 chapters

  • Let's Combinate · 30m

    140 - Medical Device & Diagnostics Cybersecurity, 3rd Party Software, SBOM's, Evaluating Skill and Mindset with Christian Espinosa

    Christian Espinosa, CEO of Blue Goat Cyber, explains the unique cybersecurity challenges of medical devices, emphasizing that patient safety is the primary driver over data privacy. He details the importance of Software Bill of Materials (SBOM) and identifying third-party open-source components, such as the Shellshock vulnerability, to mitigate supply chain risks. Espinosa also discusses his hiring philosophy for Blue Goat Cyber, prioritizing practical aptitude and clarity of purpose over formal certifications or degrees.

    Security & privacyPCB design & layout
    6 chapters

  • Embedded.fm · 58m

    141: Malevolent and Trying to Trick You

    Julia Evans, a software engineer at Stripe, discusses using Linux system-level tools like `strace`, `perf`, and `top` to debug applications as black boxes. She explains how `strace` reveals system calls to understand program behavior without reading source code, and how `perf top` identifies CPU-intensive functions like garbage collection. Evans also shares her philosophy on debugging, emphasizing the importance of maintaining confidence and understanding that computers are logical machines, even when bugs seem impossible.

    Debugging & failure analysisTest & measurement
    7 chapters

The summary, chapters and topics are generated from the episode’s audio by this directory, not written by Oxide and Friends. The episode itself belongs to its publisher.