An Interview with Josh Datko

The Amp Hour · 3 Dec 2018 · 1h 31m · Episode 418

What this episode covers

Dave Jones, founder of Cryptotronics, discusses his transition from a U.S. Naval Academy graduate and nuclear submarine officer to an embedded security consultant. He details his experiences with military cryptography, the rigorous engineering constraints of defense contracting, and his research into hardware vulnerabilities in Bitcoin wallets like Trezor. Jones also shares anecdotes from his service in Afghanistan and explains the mechanics of hardware implants and side-channel attacks.

Mentioned

Companies
Cryptotronics, SparkFun, Super Micro, NSA, DigiKey
Products
Trezor, BeagleBone, Crypto Cape, Bitcoin, Tor
Chips
STM32
Also
Colin O'Flynn, Joe Fitzpatrick, Dimitri Nicos, Thomas Roth, DEF CON, CCC, cryptotronics.com

Other shows on the same ground, closest first.

  • Moore's Lobby · 1h 01m

    Ep. 28 | How DARPA Stops IC Hardware Hackers in Their Tracks: Insights from Serge Leef

    Serge Leef, DARPA’s Program Manager for the Microsystems Technology Office, discusses his transition from a 30-year career in design automation at companies like Mentor Graphics and Silicon Graphics to leading hardware security initiatives at DARPA. He outlines DARPA’s four attack surfaces for secure silicon—supply chain, side-channel, reverse engineering, and hardware Trojans—and explains the agency's strategy of embedding security into design tools, likening it to fluoridating water. Leef highlights the economic realities of hardware security, noting that while merchant semiconductor companies invest heavily in bespoke protection, IoT manufacturers often ignore it until forced by crisis, and emphasizes the critical vulnerability of untrusted third-party IP.

  • Embedded.fm · 1h 10m

    58: Use These Powers For Good

    Joe Grand, founder of Grand Idea Studio and former member of the hacker group LOIC, discusses his career in hardware hacking, his role as a judge for the Hackaday Prize, and his work teaching cybersecurity to high school students. He details his experience testifying before the U.S. Senate, his TV show Prototype This, and his advice for embedded engineers to adopt a 'hacker mindset' to improve security. Grand also critiques the privacy implications of wearables and the Internet of Things, emphasizing the need for responsible use of technical skills.

  • Unnamed Reverse Engineering Podcast · 1h 15m

    038 - My Favorite Random Number is 5

    Colin O'Flynn, founder of NewAE Technology, explains how differential power analysis (DPA) and fault injection allow attackers to recover cryptographic keys from embedded devices by measuring minute power variations or disrupting clock/voltage signals. He details the mechanics of side-channel attacks, the importance of random number generation, and the limitations of 'military grade' encryption claims. O'Flynn also discusses his open-source tool ChipWhisperer, electromagnetic fault injection hardware like BADFET, and the broader industry challenges in securing IoT devices against such physical attacks.

  • 019 - It's Still Not Magic

    Holly Graceful, a penetration tester at Graceful Security, discusses her hardware reverse engineering blog series and her career transition from the military to private sector security. She explains that debug interfaces like JTAG are often left accessible in consumer products due to manufacturing cost and testing requirements rather than security negligence. Graceful details her approach to demystifying hardware hacking by breaking complex topics into bite-sized tutorials, covering tools like the JTAGulator, USRP, and logic analyzers. She emphasizes that hardware access is often a vector for broader network attacks, not just compromising the device itself.

  • 042 - Diwali in the Morning

    Asmita Jha, an IoT security consultant at Payatu, discusses her transition from embedded firmware development to hardware security and reverse engineering. She details her workflow for analyzing IoT devices like routers and cameras, covering techniques for extracting firmware, decrypting images, and using tools like Ghidra, Binwalk, and QEMU. Jha also shares advice on secure firmware development, emphasizing the importance of avoiding hardcoded credentials and implementing proper secure boot mechanisms.

The summary, chapters and topics are generated from the episode’s audio by this directory, not written by The Amp Hour. The episode itself belongs to its publisher.