# 007 - Candy Coated

- Show: [Unnamed Reverse Engineering Podcast](https://hardwarepodcasts.com/podcast/unnamed-reverse-engineering-podcast)
- Published: 2018-01-03
- Length: 46m
- Page: https://hardwarepodcasts.com/podcast/unnamed-reverse-engineering-podcast/2018-01-03-007-candy-coated
- Listen: https://unnamedre.com/episode/7

## Summary

M. Carlton, VP of Research at Senrio, discusses her team's discovery of 'Devil's Ivy,' a critical stack buffer overflow vulnerability in the GSOAP library used by Axis Communications and other IoT device manufacturers. She details the reverse engineering process for the Axis M300 camera, the tools used (IDA Pro, Binwalk), and the rapid patching response by Axis. The conversation also covers Senrio's transition from security consulting to a network visibility product, advice for securing IoT devices, and the career paths of reverse engineers.

## Chapters

- [0:28](https://hardwarepodcasts.com/podcast/unnamed-reverse-engineering-podcast/2018-01-03-007-candy-coated#t=28) Introduction and Senrio's Background
- [3:19](https://hardwarepodcasts.com/podcast/unnamed-reverse-engineering-podcast/2018-01-03-007-candy-coated#t=199) Devil's Ivy Vulnerability and GSOAP
- [9:09](https://hardwarepodcasts.com/podcast/unnamed-reverse-engineering-podcast/2018-01-03-007-candy-coated#t=549) Reverse Engineering Tools and Methodology
- [12:33](https://hardwarepodcasts.com/podcast/unnamed-reverse-engineering-podcast/2018-01-03-007-candy-coated#t=753) Vendor Response and Patching
- [17:50](https://hardwarepodcasts.com/podcast/unnamed-reverse-engineering-podcast/2018-01-03-007-candy-coated#t=1070) Careers and Education in Reverse Engineering
- [27:35](https://hardwarepodcasts.com/podcast/unnamed-reverse-engineering-podcast/2018-01-03-007-candy-coated#t=1655) IoT Security Best Practices
- [35:22](https://hardwarepodcasts.com/podcast/unnamed-reverse-engineering-podcast/2018-01-03-007-candy-coated#t=2122) Senrio Product and Network Visibility

## Topics

- [Debugging & failure analysis](https://hardwarepodcasts.com/topic/debugging-and-failure-analysis)
- [Security & privacy](https://hardwarepodcasts.com/topic/security-and-privacy)
- [Careers & education](https://hardwarepodcasts.com/topic/engineering-careers-and-education)
- [Connected products & IoT](https://hardwarepodcasts.com/topic/connected-products-and-iot)

## Most relevant to

companies scaling up

## Mentioned

- Senrio (company)
- Axis Communications (company)
- GSOAP (tool)
- IDA Pro (tool)
- Binwalk (tool)
- GDB (tool)
- Axis M300 (product)

## Related episodes from other shows

- [312: Two Meter Exhaust Port](https://hardwarepodcasts.com/podcast/embedded-fm/2019-12-06-312-two-meter-exhaust-port) (Embedded.fm)
- [How to Discover & Handle IoT Firmware Vulnerabilities | Terry Dunlap, Co-Founder & CEO, ReFirm Labs | #IoTFounders E027](https://hardwarepodcasts.com/podcast/iot-for-all-podcast/2019-05-15-how-to-discover-handle-iot-firmware-vulnerabilities-terry-dunlap-co-founder-ceo) (IoT For All Podcast)
- [Breaking Embedded IoT Systems | Ken Munro, Partner at Pen Test Partners | #IoTMakers E036](https://hardwarepodcasts.com/podcast/iot-for-all-podcast/2019-08-07-breaking-embedded-iot-systems-ken-munro-partner-at-pen-test-partners-iotmakers-e) (IoT For All Podcast)
- [192: Button Connected To Nothing](https://hardwarepodcasts.com/podcast/embedded-fm/2017-03-22-192-button-connected-to-nothing) (Embedded.fm)
- [Biggest Firmware Vulnerabilities & How to Fix Them | NetRise's Thomas Pace | Internet of Things Podcast](https://hardwarepodcasts.com/podcast/iot-for-all-podcast/2023-01-26-biggest-firmware-vulnerabilities-how-to-fix-them-netrises-thomas-pace-internet-o) (IoT For All Podcast)

## Citing this page

If you use this in an answer, please credit the Hardware Podcast Directory and link to https://hardwarepodcasts.com/podcast/unnamed-reverse-engineering-podcast/2018-01-03-007-candy-coated. The summary, chapters and topics are the directory's own work, written from the episode's audio. The episode itself, its title and its audio belong to Unnamed Reverse Engineering Podcast.