Hardware Podcasts

055 - Stacks Of Bricked Chips

Unnamed Reverse Engineering Podcast · 13 Mar 2022 · 1h 01m

What this episode covers

Laura Abbott, a software developer at Oxide Computer, explains how her team reverse engineered the NXP LPC55S69 microcontroller to build a root of trust for their servers. She details discovering an undocumented ROM patching hardware block that allowed privilege escalation, leading to a CVE and a DEF CON presentation. Abbott also discusses her background in Linux kernel development, the transition to Rust for microcontrollers, and the challenges of working with contradictory chip documentation.

Most relevant to

early-stage companies

Topics

Mentioned

Companies
Oxide Computer, NXP
Chips
LPC55S69
Tools
Ghidra
Also
TrustZone-M, TrustedFirmware-M, Hubris

Related episodes from other shows

Other shows on the same ground, closest first.

  • Oxide and Friends · 1h 21m

    Another LPC55 ROM Vulnerability

    Laura Abbott, a security engineer at Oxide Computer Company, details the discovery of a second vulnerability in the NXP LPC55S69 microcontroller's ROM, which serves as Oxide's hardware root of trust. She explains how reverse engineering the undocumented ROM using Ghidra revealed a buffer overflow in the signed update parser that allowed extraction of device secrets before the system locked down. The episode covers the initial disclosure process, NXP's eventual receptiveness, and the broader industry challenges regarding transparency, CVEs, and the difficulty of securing general-purpose microcontrollers.

    Debugging & failure analysisSecurity & privacy
    13 chapters

  • The Amp Hour · 57m

    Finding Hardware Flaws with Laura Abbott

    Laura Abbott, an engineer at Oxide Computer, discusses her accidental discovery of a buffer overflow vulnerability in the ROM update mechanism of the NXP LPC55S69 microcontroller while working on Oxide's server root of trust. She explains how Oxide is rebuilding the server from the ground up with a focus on hardware security, utilizing their open-source operating system Hubris and the Rust programming language to mitigate risks like memory safety issues. The conversation covers the architecture of the server's secure components, including the service processor and TrustZone-M, as well as the challenges of remote hardware debugging and contributing to the Linux kernel community.

    Security & privacyMicrocontrollers & dev platforms
    6 chapters

  • Embedded.fm · 58m

    414: Puff, the Magically Secure Dragon

    Laura Abbott, a firmware engineer at Oxide Computing, discusses two silicon bugs found in the NXP LPC55S69 microcontroller, including a buffer overflow in the ROM that allows cloning the device's PUF identity. She explains how she used Ghidra to reverse-engineer the undocumented ROM code and details the security implications for TrustZone and Secure Boot. The conversation also covers Oxide's approach to hiring, their use of Rust for firmware, and the challenges of working with proprietary silicon.

    Debugging & failure analysisMicrocontrollers & dev platforms
    7 chapters

  • Hackaday Podcast · 1h 10m

    Ep 387: Superhuman Clocks, CAN in USB-C, and the Joys of Bare Metal

    Hackaday editors Elliot Williams and Tom Nardi discuss recent community hacks, including Mikey Sklar's work to bring MicroPython's Viper and empy cross speedups to CircuitPython, and Bas Bottberg's reverse engineering of a Bluetooth printer using bleak. They also cover Ben's complete firmware rewrite of an E-grooter in Rust, which involved discovering CAN bus over USB-C, and Egg Karate Singh's complex mechanical clocks like Ovodio. The episode concludes with Hackaday Europe talks: Sylvain's bare metal 'Minimacy' virtual machine for security-critical applications, and Janelle Wellen's presentation on space mission hacks and troubleshooting.

    Embedded firmwareDebugging & failure analysis
    10 chapters

  • Embedded.fm · 50m

    111: Potty Train Your Tamagotchi (Repeat)

    Natalie Silvanovich, a security engineer at Google Project Zero, discusses her reverse engineering of Tamagotchi devices, detailing how she dumped code from General Plus 6502-based hardware and created a development kit. She explains the technical challenges of working with mask ROM, undocumented processors, and the specific vulnerabilities in Tamagotchi 'figures' that allowed for code execution. Silvanovich also touches on her broader career in hardware and software security, including her work on Flash exploits and the 'Hardware Excuse Generator' tool.

    Debugging & failure analysisMicrocontrollers & dev platforms
    8 chapters

The summary, chapters and topics are generated from the episode’s audio by this directory, not written by Unnamed Reverse Engineering Podcast. The episode itself belongs to its publisher.