Hardware Podcasts

Finding Hardware Flaws with Laura Abbott

The Amp Hour · 23 May 2022 · 57m · Episode 590

What this episode covers

Laura Abbott, an engineer at Oxide Computer, discusses her accidental discovery of a buffer overflow vulnerability in the ROM update mechanism of the NXP LPC55S69 microcontroller while working on Oxide's server root of trust. She explains how Oxide is rebuilding the server from the ground up with a focus on hardware security, utilizing their open-source operating system Hubris and the Rust programming language to mitigate risks like memory safety issues. The conversation covers the architecture of the server's secure components, including the service processor and TrustZone-M, as well as the challenges of remote hardware debugging and contributing to the Linux kernel community.

Most relevant to

early-stage companies

Topics

Mentioned

Companies
Oxide Computer, NXP, ARM
Products
Hubris, Linux, Zephyr
Chips
LPC55S69, STM32H7
Also
TrustZone-M, Rust

Related episodes from other shows

Other shows on the same ground, closest first.

  • Oxide and Friends · 1h 21m

    Another LPC55 ROM Vulnerability

    Laura Abbott, a security engineer at Oxide Computer Company, details the discovery of a second vulnerability in the NXP LPC55S69 microcontroller's ROM, which serves as Oxide's hardware root of trust. She explains how reverse engineering the undocumented ROM using Ghidra revealed a buffer overflow in the signed update parser that allowed extraction of device secrets before the system locked down. The episode covers the initial disclosure process, NXP's eventual receptiveness, and the broader industry challenges regarding transparency, CVEs, and the difficulty of securing general-purpose microcontrollers.

    Debugging & failure analysisSecurity & privacy
    13 chapters

  • Unnamed Reverse Engineering Podcast · 1h 01m

    055 - Stacks Of Bricked Chips

    Laura Abbott, a software developer at Oxide Computer, explains how her team reverse engineered the NXP LPC55S69 microcontroller to build a root of trust for their servers. She details discovering an undocumented ROM patching hardware block that allowed privilege escalation, leading to a CVE and a DEF CON presentation. Abbott also discusses her background in Linux kernel development, the transition to Rust for microcontrollers, and the challenges of working with contradictory chip documentation.

    Chips, FPGAs & semiconductorsSecurity & privacy
    7 chapters

  • Embedded.fm · 58m

    414: Puff, the Magically Secure Dragon

    Laura Abbott, a firmware engineer at Oxide Computing, discusses two silicon bugs found in the NXP LPC55S69 microcontroller, including a buffer overflow in the ROM that allows cloning the device's PUF identity. She explains how she used Ghidra to reverse-engineer the undocumented ROM code and details the security implications for TrustZone and Secure Boot. The conversation also covers Oxide's approach to hiring, their use of Rust for firmware, and the challenges of working with proprietary silicon.

    Debugging & failure analysisMicrocontrollers & dev platforms
    7 chapters

  • Embedded.fm · 57m

    342: That Girl's Brain

    Jessie Frazelle, Co-Founder and Chief Product Officer at Oxide Computer, explains how the company builds open-source, rack-scale servers for enterprises by adopting hyperscaler-style hardware design. She details the decision to open-source firmware and hardware to eliminate vendor finger-pointing and security vulnerabilities inherent in proprietary BMCs. The discussion covers their use of Rust for firmware and control plane software, power efficiency metrics like PUE, and the challenges of deploying high-density compute in traditional colocation environments.

    Embedded firmwareSecurity & privacy
    7 chapters

  • Oxide and Friends · 1h 50m

    Holistic Engineering with Robert Mustacchi

    Robert Mustacchi, a co-founder and key engineer at Oxide Computer Company, discusses the company's holistic approach to building rack-scale servers, from board design to firmware. He details the engineering challenges of eliminating BIOS/UEFI by reverse-engineering AMD's AGESA code, debugging the Spectre and Meltdown vulnerabilities in early Joyent systems, and resolving a PCIe link training failure on the T6 NIC during manufacturing. Mustacchi emphasizes the importance of hardware-software co-design, deep system observability, and anticipating operational issues like firmware upgradability before they occur.

    Debugging & failure analysisEmbedded firmware
    5 chapters

The summary, chapters and topics are generated from the episode’s audio by this directory, not written by The Amp Hour. The episode itself belongs to its publisher.