Below the Surface (Audio): Recent Episodes
Security Weekly Productions
A lively discussion of the threats affecting supply chain, specifically focused on firmware and low-level code that is a blind spot for many organizations. This podcast will feature guests from the cybersecurity industry discussing the problems surrounding supply chain-related issues and potential solutions.
Check out our free and no-registration-required site for understanding and tracking infrastructure vulnerabilities and advisories: https://infra-trust.org
In this episode, the hosts discuss the challenges of collecting and aggregating vulnerability data, the introduction of Infratrust and Infratrust Pulse, and the importance of actionable data for cybersecurity teams. They explore the differences between vendor advisories and CVEs, the role of Eclipsium in data aggregation, and the ongoing challenges in vulnerability management and patching. The conversation highlights the need for a centralized source of truth for infrastructure vulnerabilities and the evolving landscape of cybersecurity threats. In this conversation, the speakers delve into the complexities of vulnerability management, particularly in the context of AI's rapid evolution in vulnerability discovery. They discuss the biases affecting vulnerability prioritization, the implications of AI on both offensive and defensive capabilities, and the critical risks associated with exposing Baseboard Management Controllers (BMCs) to the internet. The conversation emphasizes the need for better security practices and awareness in the face of evolving threats.
Chapters
00:00 Technical Challenges in Data Collection 02:58 Introduction to Infratrust and Infratrust Pulse 05:57 The Evolution of Infrastructure Pulse 09:02 Understanding Vendor Advisories vs CVEs 11:49 The Importance of Actionable Data 14:46 Navigating Vendor Advisory Inconsistencies 17:51 The Role of Eclipsium in Data Aggregation 20:46 Patching Challenges and Vulnerability Management 24:09 Interpreting Risk Scores and Vulnerability Impact 30:34 Understanding Vulnerability Management Challenges 32:43 The Impact of AI on Vulnerability Discovery 35:24 The Arms Race: Offensive vs Defensive Capabilities 38:41 The Dangers of Exposing BMCs to the Internet 41:31 BMC Vulnerabilities: A Deep Dive 49:29 Mitigating Risks: Best Practices for BMC Security
In this episode, the hosts discuss various vulnerabilities affecting network devices, the importance of timely patching in enterprises, and the implications of AI on security. They explore the challenges of compliance programs, the significance of dependency management in software, and the need for better privilege separation in network devices. The conversation also touches on the risks of supply chain attacks and the detection of orphaned packages in software ecosystems.
Chapters
00:00 Introduction to Vulnerabilities and Security Trends 02:49 Router Choices and Security Implications 10:41 The Need for Faster Patching in Enterprises 12:22 The Impact of AI on Security and Exploits 18:31 Challenges with Compliance and Vulnerability Management 24:17 The Importance of Dependency Management in Software 30:54 Supply Chain Attacks and Their Consequences 35:34 Privilege Separation and Device Security 40:40 The Role of AI in Exploit Development 53:43 Detecting Orphaned Packages and Security Risks
In this episode, we delve into the recent FortiBleed campaign, exploring how attackers harvest credentials from Fortinet devices, the vulnerabilities in password management, and best practices for defenders to mitigate such threats.
Key topics
- FortiBleed campaign details and impact
- Password hash vulnerabilities in FortiOS
- AI's role in analyzing large security breaches
- Credential harvesting techniques and defenses
- Importance of layered security and best practices
Chapters
00:00 Introduction and Initial Thoughts on AI Models 10:04 Credential Harvesting and Security Weaknesses 19:58 Hash Management and Security Appliances 30:15 Incident Response and Vulnerability Management 39:46 The Future of Security in the Age of AI
summary
In this episode of Below the Surface, Paul Asadoorian, Chase Snyder, and Vlad Babkin discuss the implications of AI in cybersecurity, the challenges posed by AI guardrails, and the operational risks associated with applying patches. They also explore vulnerabilities in security tools like Binwalk, the complexities of firmware update tools, and the importance of transparency in software signing, particularly in the context of open source software. In this conversation, the speakers delve into the complexities of cybersecurity, focusing on the limitations of security through obscurity, the challenges posed by UEFI shells and secure boot, and the operational risks associated with DBX updates. They discuss the difficulties in vulnerability management and the role of AI in cybersecurity, highlighting how it may benefit attackers more than defenders. The conversation also touches on emerging threats like Brickstorm malware and the need to rethink edge device security in light of these challenges. Finally, they emphasize the necessity for all companies to adopt robust cybersecurity measures.
Chapters
00:00 Introduction to Below the Surface Podcast 01:16 The Rise of AI and Its Implications 06:42 Challenges with AI Guardrails and Restrictions 10:53 Operational Risks in Cybersecurity 17:01 Vulnerabilities in Security Tools 20:11 Exploring Firmware Update Tools 29:07 The Importance of Open Source in Security 34:07 The Need for Transparency in Software Signing 35:12 The Fallacy of Security Through Obscurity 36:36 The Challenges of UEFI Shells and Secure Boot 39:58 The Complexity of DBX Updates and Operational Risks 43:20 The Difficulty of Vulnerability Management 48:11 AI's Role in Cybersecurity: A Double-Edged Sword 52:59 Emerging Threats: The Rise of Brickstorm Malware 55:54 Rethinking Edge Device Security 01:00:08 The Future of Cybersecurity Infrastructure
In this episode of Below the Surface, the team discusses recent cybersecurity trends, including the Verizon DBIR 2026 report, secure boot certificate expirations, and the evolving threat landscape with AI and hardware vulnerabilities. They explore how organizations can adapt their defense strategies to stay ahead of attackers and share insights on supply chain security and malware analysis.
- https://eclypsium.com/blog/microsoft-secure-boot-certificates-expire-2026/
- https://eclypsium.com/blog/verizon-dbir-2026/
- https://github.com/iss4cf0ng/OpenPetya
- https://gbhackers.com/exploit-f5-big-ip-ssh-access/
- https://www.microsoft.com/en-us/security/blog/2026/05/22/from-edge-appliance-to-enterprise-compromise-multi-stage-linux-intrusion-via-f5-and-confluence/
- https://cybersecuritynews.com/china-linked-hackers-target-southeast-asian-edge-routers/
- https://qiita.com/Y4er/items/0b6071745e4b7b240b3e
- https://www.greynoise.io/blog/sonicwall-scanning-spike-echoes-pattern-preceded-cve-2026-0400
- YellowKey update: https://www.reddit.com/r/sysadmin/comments/1tkq3x9/yellowkey_bitlocker_exploit_repo_taken_down/
Chapters
00:00 Introduction and Technical Issues 02:56 Verizon DBIR Insights 05:50 Trends in Vulnerability Management 09:04 The Role of AI in Cybersecurity 12:11 Challenges in Vulnerability Management 14:46 Secure Boot Certificates and Their Implications 29:52 Managing Updates and Security Risks 32:57 The Open Petya Project: A Historical Perspective 36:11 Understanding the Yellow Key Attack 39:34 The Dilemma of Independent Researchers 41:34 The Future of Bug Bounty Programs 43:59 The Evolving Landscape of Vulnerabilities 49:51 Visibility Challenges in Network Security 56:16 The Need for Better Information Sharing
In this episode, we explore recent vulnerabilities, the YellowKey BitLocker bypass, supply chain security, CVE data analysis, and the implications of hardware breaches like the one at Foxconn. We also delve into AI's role in vulnerability research and the evolving landscape of cybersecurity threats.
Topics * https://www.nist.gov/news-events/news/2026/04/nist-updates-nvd-operations-address-record-cve-growth * https://github.com/Nightmare-Eclipse/YellowKey * https://socket.dev/blog/tanstack-npm-packages-compromised-mini-shai-hulud-supply-chain-attack * https://x.com/AlvieriD/status/2053835732658143416
Chapters
00:00 Introduction to Vulnerability Research and AI 03:42 NIST and CVE Growth Challenges 06:46 Building Tools for CVE Analysis 10:58 The Complexity of CVSS Scoring 15:08 CISA's Role in Vulnerability Enrichment 18:06 Challenges in CWE and CPE Data 19:55 The Future of Vulnerability Research 27:18 BitLocker Bypass: A Case Study 33:05 Exploring the Complexity of Windows Features 34:49 Speculation on Microsoft and Conspiracy Theories 35:57 The Impact of BIOS Passwords on Security 39:12 The Foxconn Breach: A Major Data Compromise 47:34 Supply Chain Attacks on Package Managers 51:13 Deceptive Techniques in Cybersecurity
In this episode of Below the Surface, hosts Paul Asadoorian, Chase Snyder, and guest Brian Richardson explore the evolution of firmware security, the risks of supply chain vulnerabilities, and the latest threats targeting network edge devices like Cisco ASA and FTD. They discuss historical malware like the Chernobyl virus, modern malware campaigns such as Firestarter, and the challenges of securing complex network infrastructure in a rapidly evolving threat landscape.
Links: https://www.linkedin.com/news/story/white-house-pushes-back-on-anthropics-mythos-expansion-8741242/ https://www.tomshardware.com/tech-industry/cyber-security/the-chernobyl-virus-turned-27-today-and-it-could-brick-your-pc-in-ways-modern-malware-cant https://blog.talosintelligence.com/uat-4356-firestarter/
Chapters
00:00 Introduction to Below the Surface 02:20 Brian's Transition to Eclipseum 03:50 The Y2K Experience and Early Virus Detection 06:31 The CIH Virus and Its Impact 10:12 BIOS Security and Vulnerabilities 14:10 The Importance of Firmware Lockdown 18:09 Modern Threats and UEFI Attacks 22:13 Targeted Malware and Ransomware Risks 25:21 Creative Concepts in Cybersecurity 26:20 Emerging Threats: Firestarter Malware 30:54 The Security of Network Devices 35:17 Challenges in Managing Security Appliances 39:52 Persistence of Malware and Its Implications 43:02 The Evolving Landscape of Cyber Threats 49:44 AI and Cybersecurity: The Anthropic Dilemma
In this episode, the hosts explore the latest in cybersecurity, including AI-driven vulnerability discovery, firmware analysis tools, secure boot complexities, and recent CVE trends. They discuss practical techniques for hacking devices, the challenges of firmware emulation, and the implications of new security policies on consumer and enterprise hardware.
Chapters
00:00 Introduction to Hacking and Security Updates 03:24 Exploring Samsung TV Hacking 06:34 AI in Vulnerability Research 11:17 The Role of AI in Exploiting Vulnerabilities 15:18 CVE Disclosure and Ethical Considerations 20:43 AI Tools and Instrumentation in Development 24:41 Emerging Tools for Firmware Analysis 28:14 Navigating Linux Security Challenges 29:12 The Surge of CVEs: Understanding the Growth 31:29 The Role of AI in Vulnerability Discovery 34:50 CVE Enrichment: The Need for Contextual Data 36:57 Microsoft's Secure Boot: A Double-Edged Sword 46:43 Vulnerabilities in Bootloaders: A Case Study 51:25 The Complexity of Secure Boot Management 53:24 Regulatory Challenges in Router Security
summary
In this episode, the hosts discuss the new FCC regulations regarding consumer routers, exploring the implications for cybersecurity, the definitions of what constitutes a router, and the challenges of manufacturing compliant devices. They delve into the debate surrounding the effectiveness of these regulations in mitigating cyber risks, the role of hardware versus software vulnerabilities, and the potential impact on consumers and existing devices in homes. In this conversation, the hosts discuss the implications of the FCC's decision to decertify routers and firmware, the challenges posed by the conditional approval process, and the potential impact on router security and availability. They explore conspiracy theories surrounding the regulations, compare US and EU cybersecurity standards, and address the complexities of hardware backdoors and default credentials. The conversation highlights the need for better security practices and the importance of addressing vulnerabilities in enterprise devices.
Chapters
00:00 Introduction to FCC Regulations on Routers 02:35 The Impact of FCC Regulations on Consumer Devices 05:03 Defining What Constitutes a Router 09:51 The Security Implications of Router Regulations 12:41 The Role of Hardware vs. Software in Cybersecurity 17:11 Challenges in Manufacturing and Compliance 21:40 Consumer Impact and Existing Devices 25:59 The Future of Networking Devices and Regulations 29:48 Decertification of Routers and Firmware Challenges 31:58 Conditional Approval Process and Its Implications 34:40 Proposed Solutions for Router Security Standards 36:53 Conspiracy Theories Surrounding Router Regulations 39:26 The Impact of Regulations on Router Availability and Pricing 42:05 Comparing US and EU Cybersecurity Regulations 46:11 The Complexity of Hardware Backdoors and Security 49:11 Addressing Default Credentials and Vulnerabilities 52:02 Conditional Approval Guidance and Its Flaws 54:56 Recent Vulnerabilities in Enterprise Devices
In this episode, we explore the security vulnerabilities of low-cost IP-based KVMs, including firmware flaws, default credentials, and insecure update mechanisms. Two Eclypsium researchers, Paul and Rey, discovered the vulnerabilities and shared the details and behind-the-scenes details! We also discuss real-world testing, vendor responses, and best practices for securing remote management devices in enterprise environments.
Chapters
00:00 Introduction to KVM Vulnerabilities 03:00 Research Background and Team Introduction 05:57 Exploring GLINet and Initial Findings 09:03 Firmware Analysis and Security Expectations 11:58 Vulnerability Disclosure and Response 15:07 Enterprise Risks and Deployment Concerns 17:59 Security Best Practices for KVMs 21:06 Vendor Responses and Community Engagement 23:49 Unique Vulnerabilities in SiP and JetKVM 27:01 Conclusion and Future Directions 31:26 Vulnerability Research and Tool Development 34:14 Vendor Communication and Disclosure Challenges 37:51 Firmware Update Issues and Security Concerns 39:12 The Importance of Reviews and Brand Trust 41:42 Security Best Practices for KVMs 45:38 Network Segmentation and Device Security 49:26 Discovering IoT Devices on the Network 52:11 Open Source Solutions and Community Engagement 55:58 The Future of KVM Security and Regulation
In this episode of Below the Surface, Paul Asadoorian, Vlad Babkin, and Adrian Sanabria discuss the ongoing vulnerabilities in network edge devices, the implications of legacy systems like Avanti, and the strategies employed by threat actors. They explore the importance of monitoring and detection in cybersecurity, as well as innovative deception techniques to enhance security measures against exploitation. In this conversation, the speakers delve into various aspects of cybersecurity, including innovative strategies to enhance security, the challenges posed by vendor cooperation, the implications of cyber insurance, and the importance of visibility in threat detection. They discuss the use of canary tokens, the exploitation of edge devices, and the reality of zero-day vulnerabilities. The conversation also touches on the need for firmware updates, the shift towards open-source solutions, and the role of AI in developing cybersecurity tools.
Chapters
00:00 Introduction to Below the Surface Podcast
03:27 Network Edge Vulnerabilities and Trends
10:02 Understanding Avanti and Its Impact
12:44 The Consequences of Legacy Systems
18:03 Exploitation Techniques and Threat Actor Strategies
26:50 The Importance of Monitoring and Detection
31:14 Deception Techniques for Enhanced Security
32:55 Leveraging Canary Tokens for Enhanced Security
34:41 The Challenge of Vendor Cooperation in Cybersecurity
35:30 Understanding Cyber Insurance and Its Implications
36:25 The Importance of Visibility in Cyber Defense
39:12 Utilizing Low-Interaction Honeypots for Threat Intelligence
41:48 Exploiting Vulnerabilities in Edge Devices
43:27 The Reality of Zero-Day Vulnerabilities
45:04 Analyzing Recent Exploits in Network Devices
49:02 The Need for Firmware Updates and Alternatives
50:33 Exploring Tailscale and Remote Access Solutions
54:33 Building Secure Lab Environments
56:52 The Shift Towards Open Source in Cybersecurity
01:00:27 Innovations in Memory Forensics
01:03:02 AI's Role in Enhancing Cybersecurity Tools
In this episode, the hosts discuss various cybersecurity threats, including Russian cyber attacks on critical infrastructure, the vulnerabilities in firewalls and VPNs, and the implications of AI in cybersecurity. They explore the increasing trend of using Python for malicious purposes and the challenges posed by gaming anti-cheat drivers. The conversation also touches on the escalation of cyber warfare and the confused deputy problem in AI, highlighting the need for better security measures and awareness in the industry.
Chapters
00:00 Introduction to Cybersecurity Threats
02:52 Russian Cyber Attacks on Poland's Power Grid
10:33 The Flaws in Firewall Security
15:02 AI and the Future of Cybersecurity
22:22 Exploiting Vulnerabilities in Gaming Anti-Cheat Drivers
29:47 Driver Attestation and Security Transparency
35:17 Critical Infrastructure and Cybersecurity Threats
39:50 Linux Malware and Python Exploits
45:47 Firmware Complexity and Security Risks
51:19 Cyber Insurance and Responsibility in Cybersecurity
56:52 Confused Deputy Attack and AI Security Risks
In this episode, the hosts discuss various cybersecurity topics, including the challenges of BIOS password cracking, the implications of AMD's Stack Warp vulnerability, and the importance of up-to-date secure boot certificates. They also explore the risks associated with network security appliances, the costs of cybersecurity, and the role of marketing in raising awareness. Additionally, they share insights from an X-ray analysis of USB cables, highlighting the differences between quality and counterfeit products.
- BIOS password cracking can be complex and time-consuming.
- Physical access to hardware can significantly impact security measures.
- The Stack Warp vulnerability poses serious risks to virtual machines.
- Secure boot certificates need regular updates to maintain security.
- Network security appliances can introduce new vulnerabilities.
- Cybersecurity costs often outweigh the perceived benefits of cloud solutions.
- Marketing plays a crucial role in raising awareness about cybersecurity issues.
- X-ray analysis can reveal the quality of electronic components.
- Understanding the shared responsibility model is essential for IT teams.
- The balance between security and operational efficiency is a constant challenge.
Chapters
01:59 Introduction to Below the Surface Podcast
04:46 BIOS Password Cracking Techniques
10:14 Exploring AMD's Stack Warp Vulnerability
22:03 Migration Trends in Cloud Computing
23:22 Cost vs. Security in On-Premises Solutions
24:37 Shared Responsibility in Network Security Appliances
27:03 The Risks of Network Security Appliances
28:14 Exploitation of Vulnerabilities in Network Devices
31:18 Challenges in Updating Network Security Appliances
34:59 The Slow Response to Vulnerabilities
39:05 The Complexity of Firmware Updates
45:45 Secure Boot Certificates and Future Vulnerabilities
49:12 Fun Innovations: X-ray Machine in the Office
In this episode of Below the Surface, host Paul Asadoorian is joined by co-hosts Larry Pesci, Joshua Marpet, and Vlad Babkin to delve into the complexities of hardware supply chain security. The discussion is sparked by a presentation from Andrew 'Bunny' Wong at Black Hat Asia, which raised critical questions about how we can trust the silicon in our devices. The conversation explores the challenges of validating hardware components, the potential for backdoors in devices, and the implications of counterfeit components in the supply chain. The hosts share anecdotes and insights about their experiences with hardware security, emphasizing the need for independent testing and the importance of understanding the provenance of hardware components.
00:00 Introduction to Hardware Supply Chain Security
02:53 Understanding Trust in Silicon
05:55 Challenges in Validating Hardware Components
09:01 Historical Context of Hardware Tampering
11:58 The Complexity of Supply Chains
14:55 Operationalizing Hardware Validation
18:01 The Role of Independent Researchers
20:59 Bounties and Community Involvement
23:56 Innovative Techniques for Hardware Analysis
27:06 The Future of Hardware Security
31:57 The Evolution of Computing: From Transistors to Quantum
36:11 Understanding Hardware Trust and Supply Chain Risks
41:52 The Need for Continuous Monitoring and Assurance
55:31 The Future of High Assurance Devices and Backdoors
Summary
In this episode, special guest Matt Brown joins us to discuss the integration of AI in firmware analysis, exploring its benefits and challenges. We delve into the transition from traditional methods to AI-driven approaches, emphasizing the importance of prompt specificity for effective vulnerability discovery. The conversation also covers the role of open-source components, the need for guardrails in AI use, and the implications of AI-generated reports in cybersecurity. Additionally, they touch on man-in-the-middle techniques and the future of AI in firmware development, highlighting the creative monetization of vulnerabilities in IoT devices.
Takeaways
- AI is revolutionizing firmware analysis and vulnerability discovery. * Specificity in prompts is crucial for effective AI usage. * Open-source components can enhance analysis results significantly. * Guardrails are necessary to prevent AI from executing harmful commands. * AI can assist in code refactoring and documentation generation. * NTP spoofing can reveal vulnerabilities in time-sensitive applications. * AI-generated reports may lead to false positives in vulnerability assessments. * Man-in-the-middle techniques are essential for testing device security. * The future of AI in firmware development is promising but complex. * Understanding the context of vulnerabilities is key to accurate reporting.
Chapters
00:00 Introduction to Firmware Analysis and AI Tools 01:54 Transitioning from Traditional Tools to AI 04:28 Specific Techniques for Vulnerability Discovery 06:29 Dynamic Analysis vs. Static Analysis 08:30 Using AI for Code Generation and Documentation 11:43 Interacting with Firmware and Devices 15:57 Creating Custom Tools and Skills for AI 18:53 Recent Projects and Use Cases in Firmware Analysis 22:48 Challenges and Risks of Using AI in Security Research 28:36 The Future of AI in Firmware Development 29:43 AI in Code Review and Vulnerability Detection 33:35 Limitations of AI in Understanding Logic 37:54 Challenges with AI-Generated Vulnerability Reports 43:13 Man-in-the-Middle Techniques and Tools 53:24 Exploring IoT Device Vulnerabilities
Summary
In this episode, the hosts discuss various cybersecurity topics, including recent vulnerabilities in Fortinet products, the implications of supply chain breaches, the evolving role of AI in cybersecurity, and updates to the OWASP Top 10 list. They emphasize the importance of firmware security and the need for better visibility and standards in the industry. The conversation highlights the challenges faced by defenders in a rapidly changing threat landscape and the necessity for proactive measures to secure systems.
Takeaways
Fortinet vulnerabilities are critical and require immediate attention. Silent patches can lead to significant security risks. AI is being used by both attackers and defenders in cybersecurity. The OWASP Top 10 has been updated to include software supply chain failures. Firmware security is often overlooked but is essential for device safety. Supply chain breaches can have far-reaching implications for organizations. Visibility into firmware and device security is lacking in the industry. Standards for software security are necessary to protect against vulnerabilities. Defenders need better tools to combat evolving threats. The cybersecurity landscape is becoming increasingly complex and interconnected.
Chapters
00:00 Introduction and Technical Setup 03:08 Fortinet Vulnerabilities and Exploits 06:05 Public Exploits and Path Traversal Vulnerabilities 09:00 Chaining Vulnerabilities and Risk Assessment 11:50 Authentication and Vulnerability Scoring 15:04 Operational Complexity in Patch Management 17:55 Silent Patches and Their Implications 20:58 Challenges with Network Device Security 24:55 Cyber Insurance and Vulnerability Trends 27:58 The Impact of Silent Patches 30:46 End of Life Devices and Legacy Systems 34:58 Supply Chain Security and Source Code Theft 39:44 AI in Cybersecurity: Opportunities and Threats 47:17 Navigating AI's Guardrails and Malicious Use Cases 49:24 The Dilemma of AI and Harmful Intentions 52:44 The Need for Researcher Access to AI Tools 58:36 OWASP Top 10 Updates and Supply Chain Security 01:05:12 The Challenges of Firmware and Device Security
Summary
In this episode of Below the Surface, Paul Asadoorian and Chase Snyder delve into various cybersecurity topics, including the use of Raspberry Pi in cyber attacks, the implications of the F5 breach, and the emergence of Polar Edge malware targeting QNAP devices. They also discuss the innovative Two-Face Rust binary technique, the critical nature of authentication bypass vulnerabilities, and the evolving landscape of air-gapped systems. The conversation highlights the increasing risk posed by old vulnerabilities and the need for improved security measures in the face of advancing cyber threats.
Articles:
- https://reporter.deepspecter.com/f5-is-misleading-the-market-the-breach-is-nowhere-near-contained-a766d932c582
- https://blog.sekoia.io/polaredge-backdoor-qnap-cve-2023-20118-analysis/
- https://www.group-ib.com/blog/unc2891-bank-heist/
- https://www.synacktiv.com/en/publications/creating-a-two-face-rust-binary-on-linux
- https://www.dell.com/support/kbdoc/en-us/000382899/dsa-2025-393-security-update-for-storage-center-dell-storage-manager-vulnerabilities
- https://www.trendmicro.com/en_us/research/25/j/operation-zero-disco-cisco-snmp-vulnerability-exploit.html
In this episode, the hosts discuss the recent F5 breach, exploring the implications of the attack, the tactics used by threat actors, and the importance of vulnerability disclosure. They delve into the complexities of securing network edge devices, the challenges posed by Linux security, and the need for standardization in security practices. The conversation also touches on the future of firmware security and the necessity for proactive measures in incident response. We also close out the show taking about the recent Framework UEFI shell vulnerability.
Chapters
00:00 Introduction to F5 Breach and UEFI Secure Boot Bypass
02:16 Details of the F5 Breach
04:59 Threat Actor Analysis and Implications
07:18 Vulnerability Disclosure and Exploitation Risks
10:17 Security Measures and Key Management
12:57 Proactive Defense Strategies
15:52 The Evolving Threat Landscape
18:41 Challenges in Securing Network Devices
21:10 Linux Security and Customization Issues
25:16 Kernel Customization Challenges
27:08 Security Through Obscurity
29:04 Application Security and Development Practices
33:59 Framework's UEFI Shell Vulnerability
38:22 Interdependency in Technology Ecosystems
41:48 The Need for Transparency in Signed Software
In this episode of Below the Surface, the hosts discuss various cybersecurity topics, including the Red November campaign targeting network edge devices, the implications of the Cisco SNMP vulnerability, and the recent vulnerabilities associated with Cisco ASA devices. They also delve into the hybrid Petya ransomware and its connection to supply chain security, emphasizing the need for better visibility and security measures in network devices.
Chapters:
00:00 Introduction and Overview of Cybersecurity Trends
02:09 Red November Campaign: Targeting Network Edge Devices
11:06 The Shift in Attack Vectors: From Windows to Network Edge
14:59 Cisco SNMP Vulnerability: A Legacy Issue
21:21 The Implications of Targeting Network Edge Devices
28:20 Addressing Legacy Issues in Cybersecurity
29:41 Emerging Threats in Cybersecurity
32:19 The Age of Vulnerabilities
33:40 The Importance of Asset Inventory
35:38 Challenges in Device Security
37:22 Visibility and Detection Limitations
39:28 Vendor Responses to Vulnerabilities
41:24 Supply Chain Security Crisis
46:59 Understanding Hybrid Petya
52:11 The Evolution of Attack Techniques
In this episode of Below the Surface, the hosts discuss various cybersecurity topics, including the evolution of malware with a focus on Hybrid Petya, the implications of UEFI vulnerabilities, and the security risks associated with Windows 10's end of life. They also explore the vulnerabilities of Cisco ASA devices, the rise of supply chain attacks exemplified by NPM worms, and the persistent threat of Row Hammer attacks on DDR5 technology. The conversation highlights the significance of visibility in cybersecurity and the necessity for enhanced security practices to counter evolving threats.
Chapters
00:00 Introduction and Podcast Overview
02:55 Hybrid Petya: The New Threat Landscape
06:03 Understanding UEFI and Secure Boot Vulnerabilities
09:00 The Evolution of Ransomware Techniques
11:54 Windows 10 End of Life Concerns
14:56 The Future of Secure Boot and User Responsibility
22:50 The Shift in Consumer Trust Towards Microsoft
25:11 The Rise of Alternatives: Linux and SteamOS
28:41 Security Concerns with Windows 10 and 11
31:57 Exploiting End-of-Life Devices
36:39 The Challenge of Legacy Infrastructure
39:41 VPN Security: Risks and Solutions
45:40 The Dilemma of Compliance and Visibility
50:16 Supply Chain Vulnerabilities and NPM Attacks
55:54 The Rowhammer Attack and Hardware Security
01:03:40 The Need for Visibility and Signatures in Security
In this episode of Below the Surface, host Paul Asadoorian speaks with Evan Dornbush, CEO of Desired Effect, about the evolving landscape of exploit marketplaces and vulnerability research. They discuss the challenges researchers face in monetizing their findings, the ethical implications of selling exploits, and the importance of timely intelligence for defenders. The conversation also touches on the role of AI in vulnerability research, the dynamics between buyers and sellers in the marketplace, and the impact of end-of-life devices on cybersecurity. Overall, the episode provides valuable insights into the complexities of the exploit marketplace and the need for a more proactive approach to cybersecurity.
Chapters
00:00 Introduction to Desired Effect and Evan Dornbush
02:35 The Evolution of Exploit Marketplaces
05:06 Monetizing Vulnerability Research
07:46 The Role of Disclosure in Exploit Sales
10:28 Understanding the Value of Exploits
13:14 Ethics and Motivations in Vulnerability Research
15:51 Validation of Vulnerabilities and Exploits
18:29 Buyer Vetting and Market Dynamics
21:31 Proactive Defense Strategies
24:32 Market Insights and Future Trends
27:43 The Marketplace for Exploits
31:08 The Role of Researchers and Vendors
34:51 The Asymmetry in Cybersecurity
38:03 Economic Incentives in Cybersecurity
40:25 The Complexity of Risk Management
43:57 The Future of Exploit Disclosure
47:23 The Role of AI in Cybersecurity
53:31 Closing Thoughts on Exploit Ethics
In this episode, the hosts discuss various cybersecurity topics, focusing on hardware vulnerabilities, UEFI attack vectors, and the implications of new regulations on device security. They explore the evolution of Mirai variants targeting IoT devices and the challenges of securing firmware. The conversation highlights the need for improved security measures and the complexities of managing vulnerabilities in a rapidly changing technological landscape.
00:00 Introduction and Technical Challenges
02:37 Exploring UEFI Settings and Hardware Vulnerabilities
10:14 The Risks of UEFI Control and Physical Damage
16:33 Static Tundra: Cyber Espionage and Exploits
22:23 Targeting Vulnerable Infrastructure in Cyber Attacks
26:27 Emerging Threats in IoT and Network Devices
31:55 The Evolution of Malware: A Deep Dive
34:30 The Challenge of Securing IoT Devices
35:13 Impact of EU Cyber Resilience Act
38:14 Vulnerability Management and Vendor Responsibilities
41:54 Living Outside the Operating System: New Attack Vectors
In this episode of Below the Surface, host Paul Asadoorian is joined by Brian Mullen, head of SSDLC at AMI, to discuss the complexities of supply chain and firmware security. They explore the challenges of maintaining security in a complicated supply chain, the importance of proactive and reactive security measures, and the implications of end-of-life software. The conversation also touches on the gaming industry's push for secure boot, recent vulnerabilities discovered in firmware, and the role of BMCs in security. Brian shares insights into AMI's approach to vulnerability management and the future of firmware security, including the significance of Software Bill of Materials (SBOMs).
Whitepaper: https://eclypsium.com/wp-content/uploads/OpenBMC-Security-in-Practice.pdf
Chapters
00:00 Introduction and Technical Setup 01:46 The Challenges of Podcasting and Marketing 03:42 Understanding AMI and Its Role in Firmware Security 06:13 Supply Chain Complexity and Security Measures 08:49 Proactive vs Reactive Security in Firmware 11:17 The Importance of Stable Firmware in Security 13:54 Navigating Vulnerabilities in UEFI and OpenSSL 16:24 The Impact of Cherry-Picking Security Updates 19:11 Tracking Vulnerabilities Across the Supply Chain 21:50 Solutions for Data Center Firmware Management 24:21 Future Directions in Vulnerability Management 24:38 Navigating Vulnerability Management 28:30 End of Life and Support Challenges 31:55 Gaming Security and Anti-Cheat Mechanisms 35:38 The Complexity of Secure Boot Implementation 36:50 Recent Vulnerabilities and Security Research 39:44 Understanding BMC Security 43:34 Open Source and BMC Development 46:30 The Role of SBOMs in Security Compliance
In this episode, the hosts discuss various cybersecurity topics, focusing on Nvidia vulnerabilities, the implications of backdoors in technology, and the importance of secure boot and certificate management. They also delve into SonicWall's security challenges and the ongoing debate of building versus buying security solutions, particularly in the context of AI infrastructure and cloud services.
Articles and topics for this week:
- https://blog.trailofbits.com/2025/08/04/uncovering-memory-corruption-in-nvidia-triton-as-a-new-hire/
- https://mjg59.dreamwidth.org/72892.html - Secure Boot and certificates
- https://www.tomshardware.com/pc-components/gpus/nvidia-defiant-over-backdoors-and-kill-switches-in-gpus-as-u-s-mulls-tracking-requirements-calls-them-permanent-flaws-that-are-a-gift-to-hackers -
- https://www.bleepingcomputer.com/news/security/sonicwall-urges-admins-to-disable-sslvpn-amid-rising-attacks/ -
-
https://www.darkreading.com/endpoint-security/shade-bios-technique-beats-security -
- Researcher’s previous paper on SMM and malware: https://arxiv.org/abs/2405.04355
- He presented at Blackhat last year on Option ROMS: https://www.blackhat.com/us-24/briefings/schedule/index.html#youve-already-been-hacked-what-if-there-is-a-backdoor-in-your-uefi-orom-39579 - YouTube video: https://www.youtube.com/watch?v=_S6EymfaBqQ
In this episode of Below the Surface, the hosts discuss critical cybersecurity topics including vulnerabilities in Netgear and Gigabyte devices, the importance of asset inventory, and the implications of Row Hammer attacks on memory integrity. They emphasize the need for organizations to implement compensating controls and monitor for potential threats, especially in the context of supply chain security and IoT devices.
Chapters
00:00 Introduction to Cybersecurity Challenges
02:20 Exploring Netgear's Role in Enterprise Security
09:08 The Impact of Shadow IT on Network Security
15:04 Firmware Integrity and Security Measures
18:05 Gigabyte's UEFI Vulnerabilities and Industry Implications
22:25 Understanding UEFI Vulnerabilities
28:46 Consumer vs. Enterprise Hardware Security
35:06 Monitoring and Mitigating Firmware Risks
41:11 The Impact of ECC on AI Performance
In this episode, the hosts delve into the critical vulnerabilities associated with Baseboard Management Controllers (BMCs), with a particular focus on CVE-2024-54085. They discuss the ease of exploitation, the potential threat actors involved, and the implications for data center security. The conversation highlights the challenges in detecting and mitigating these vulnerabilities, the importance of firmware updates, and the need for community tools to aid in vulnerability detection and mitigation. The episode concludes with a call to action for organizations to patch their systems and implement robust security measures.
Chapters
00:00 Introduction to BMC Vulnerabilities
02:21 Exploring CVE 2024-54085
05:04 Understanding Exploitation and Threat Actors
07:47 The Implications of BMC Vulnerabilities
10:46 Mitigation Strategies and Challenges
13:35 The Future of BMC Security
28:36 Understanding BMC Vulnerabilities
36:24 The Importance of Disclosure and Community Tools
45:13 Navigating Firmware Updates and Vendor Challenges
52:19 Community Engagement and Future Considerations
In this episode, the hosts discuss the evolving landscape of AI infrastructure security, focusing on the complexities of building and maintaining AI data centers. They explore the critical role of Baseboard Management Controllers (BMCs) as an attack surface, the importance of supply chain security, and best practices for hardware procurement. The conversation underscores the importance of validating hardware and firmware integrity for organizations while also addressing the significant security risks associated with AI workloads. As AI data centers continue to grow, understanding these challenges and implementing robust security measures will be essential for future success.
Chapters
00:00 Introduction to Zero Trust and Its Evolution
03:33 Current State of Zero Trust Implementation
05:22 Micro-Segmentation and Infrastructure Security
10:02 Zero Trust and Lateral Movement Prevention
11:32 The Role of Zero Trust in Ransomware Defense
14:51 Chase Cunningham's Insights on Cyber Warfare
16:23 The Intersection of Cyber Warfare and Modern Conflicts
21:35 The Future of Warfare: Drones and Cybersecurity
24:01 Understanding the Drone Threat
28:28 The Evolution of Cyber Warfare
35:00 The State of Critical Infrastructure
39:26 The Economics of Breaches
44:29 Incentivizing Cybersecurity Improvements
In this episode, the hosts discuss the evolving landscape of AI infrastructure security, focusing on the complexities of building and maintaining AI data centers. They explore the critical role of Baseboard Management Controllers (BMCs) as an attack surface, the importance of supply chain security, and best practices for hardware procurement. The conversation underscores the importance of validating hardware and firmware integrity for organizations while also addressing the significant security risks associated with AI workloads. As AI data centers continue to grow, understanding these challenges and implementing robust security measures will be essential for future success.
In this episode, the hosts discuss the impending end of life for Windows 10 and the necessary preparations for upgrading to Windows 11. They explore the specific hardware requirements for Windows 11, including the importance of Secure Boot and TPM 2.0, and the challenges enterprises face in managing large-scale migrations. The conversation underscores the importance of meticulous planning to prevent costly failures and the influence of legacy systems on the upgrade process. In this conversation, the speakers discuss the implications of transitioning to Windows 11, focusing on the challenges posed by legacy systems, supply chain issues, and the importance of modern hardware for security. They delve into the Black Lotus UEFI boot kit and the necessary mitigations, emphasizing the need for organizations to validate their security controls and establish a robust trust framework. The discussion also highlights the growing importance of third-party risk management in cybersecurity, particularly in relation to supply chain security.
Summary
In this episode, Paul Asadoorian and Joshua Marpet delve into the complexities of compliance, inventory management, and the emerging concepts of SBOMs, HBOMs, and FBOMs (no, not that FBOM). They discuss the importance of understanding the components and origins of hardware and software, the challenges of managing technology lifecycles, and the need for clear standards and regulations in the tech industry. The conversation emphasizes the critical role of asset inventories in maintaining security and compliance in an ever-evolving technological landscape. In this conversation, Joshua Marpet and Paul Asadoorian delve into the complexities of hardware security, the cultural shifts needed in security practices, and the importance of transparency in software and firmware management. They discuss the challenges posed by hardware backdoors, the necessity of Software Bill of Materials (SBOMs), and the hidden risks associated with firmware updates. The dialogue emphasizes the need for a cultural change in how organizations approach security and compliance, advocating for continuous management and transparency to inspire confidence in security practices.
Chapters
00:00 Introduction and Technical Challenges 02:02 Exploring Compliance and Frameworks 05:06 Understanding S-bombs, H-bombs, and F-bombs 10:10 The Importance of Inventory and Asset Management 15:01 Navigating Hardware and Software Lifecycle 19:58 Standards and Regulations in Technology 23:56 The Manchurian Microchip and Hardware Backdoors 27:44 Cultural Change in Security Practices 30:47 The Importance of Transparency and SBOMs 36:39 Challenges in Compliance and Risk Management 42:42 The Hidden Risks of Firmware and Hardware Updates
In this episode, Paul Asadorian and Josh Bressers delve into the complexities of open source supply chain security, discussing the prevalence of open source components in modern software, the challenges posed by legacy systems, and the critical importance of vulnerability management. They explore the regulatory landscape surrounding software liability and the need for better tools and practices to ensure secure product development. The conversation highlights the necessity of understanding dependencies and the implications of consumer security in a market driven by features rather than security. In this conversation, Josh Bressers and Paul discuss the importance of Software Bill of Materials (SBOMs) in enhancing supply chain security and vulnerability management. They explore the role of metadata in programming languages like Go and Rust, the challenges of accurately identifying vulnerabilities through CVEs, and the need for better automation in vulnerability detection. The discussion also touches on the potential of AI in identifying vulnerabilities, the introduction of tools like SIFT and GRIPE for generating SBOMs and scanning for vulnerabilities, and the future implications of these technologies in software security.
In this episode, Paul and Chase delve into the world of hardware hacking, focusing on devices like the Flipper Zero and ESP32. They discuss the various applications of these tools, their impact on awareness in the hacking community, and the security implications surrounding their use. The conversation also touches on vulnerabilities in hotel security systems, challenges in remediating legacy systems, and the commoditization of hacking tools. Through practical examples and insights, the hosts explore the evolving landscape of cybersecurity and the role of hardware in it. In this conversation, Paul and Chase delve into the world of hardware hacking, discussing the accessibility of devices like the Flipper Zero and ESP32, the importance of supply chain security, and the real-world implications of vulnerabilities in firmware and bootloaders. They emphasize the need for validation in the supply chain and explore the growing interface between hardware hacking and enterprise risk.
In this episode, Paul Asadoorian, Vlad Babkin, and Chase Snyder delve into the latest vulnerability disclosures related to Baseboard Management Controllers (BMCs), specifically focusing on AMI Megarac and Redfish. They discuss the nature of the vulnerabilities, the discovery process, and the potential impacts of a BMC compromise. The conversation highlights the importance of understanding BMCs in the context of supply chain security and the risks associated with exposing these components to the internet. The conversation delves into the vulnerabilities associated with Baseboard Management Controllers (BMCs), particularly focusing on the Redfish API and the potential for exploitation. The speakers discuss the implications of these vulnerabilities on hardware, the challenges faced by vendors in patching, and the importance of network segmentation and monitoring. They also highlight the limitations of logging and the effectiveness of Web Application Firewalls (WAFs) in this context. The discussion emphasizes the need for robust security measures to protect enterprise networks from potential attacks.
In this episode, Paul Asadoorian, Vlad Babkin, and Chase Snyder delve into the recent leaks from the Black Basta ransomware group, exploring the implications of the leaked chat logs, the operational tactics of the group, and the evolving landscape of ransomware attacks. The conversation highlights the importance of understanding threat intelligence derived from these leaks, the significance of targeting exposed devices, and the necessity of robust security measures to mitigate risks. In this conversation, the speakers delve into the evolving tactics of ransomware groups, emphasizing the importance of understanding their operational scale and methodologies. They discuss the significance of early detection and the necessity for organizations to adopt robust defensive strategies, particularly in credential management and vulnerability monitoring. The conversation highlights the need for enterprises to harden their defenses against potential intrusions and the critical role of effective password management in mitigating risks.
In this episode, Paul, Vlad, and Chase discuss the security challenges of Palo Alto devices and network appliances. They explore the vulnerabilities present in these devices, the importance of best practices in device management, and the need for automatic updates. The conversation highlights the evolving nature of firmware vulnerabilities and the necessity for compensating controls to mitigate risks. The hosts emphasize the responsibility of vendors to ensure their products are secure and the need for a shift in user expectations regarding security appliances. In this conversation, the speakers discuss the pressing need for improved security standards in network appliances, the challenges posed by auto updates and supply chain security, and the importance of implementing zero trust principles. They also delve into the role of firmware encryption and key management in enhancing security while emphasizing the necessity of monitoring and detection to safeguard against vulnerabilities.
In this episode, Paul Asadorian and Chase Snyder discuss the latest security threats and vulnerabilities affecting network appliances, particularly focusing on Avanti and Fortinet platforms. They explore the increasing risks associated with these devices, the need for improved security standards, and the challenges of risk management and visibility in network security. The conversation emphasizes the importance of accountability among vendors and the necessity for customers to demand better security practices. In this conversation, Chase Snyder and Paul discuss the challenges and vulnerabilities in network security, particularly focusing on network appliances and the lack of standardization in security measures. They highlight the shift of attackers towards these devices due to their low visibility and the need for better transparency and monitoring. The discussion also covers specific vulnerabilities in Fortinet products, the implications of rolling disclosures, and best practices for securing network devices.
In this episode, Paul Asidorian, Alec Summers, and Lisa Olson discuss the 25th anniversary of the CVE program, its evolution, and the importance of transparency in vulnerability management. They explore the history of CVE, the process of creating CVE records, and the role of CNAs in ensuring accountability. The conversation also addresses challenges related to end-of-life software vulnerabilities and the need for maintaining the integrity of CVE records in an ever-evolving cybersecurity landscape. In this conversation, the speakers discuss the complexities of managing and analyzing vulnerabilities in software, mainly focusing on the roles of CVE and CVSS in providing accurate and enriched data. They explore the challenges of combining vulnerabilities to assess cumulative risk, the importance of community engagement in improving CVE records, and the evolving landscape of supply chain vulnerabilities. The discussion emphasizes the need for better data analysis methods, the significance of community involvement, and the ongoing efforts to enhance the quality and accessibility of vulnerability information.
In this episode, Paul Asadoorian, Allan Alford, and Josh Corman discuss the growing threat posed by China, particularly in the context of cyber operations and geopolitical ambitions. They explore the implications of China's strategies, the vulnerabilities in critical infrastructure, and the need for transparency and trust in digital systems. The conversation highlights the urgency of addressing these threats as they relate to Taiwan and the broader global landscape. In this conversation, the speakers discuss the critical issues surrounding digital infrastructure, emphasizing the over-dependence on unreliable systems and the need for greater trust and transparency. They explore the balance between usability and security, the challenges posed by security appliances, and the regulatory landscape affecting digital trust. The conversation also highlights the importance of empowering smaller enterprises and addressing the asymmetry in cyber defense, particularly for those at the bottom of the economic pyramid. The speakers advocate for proactive measures to prepare for future disruptions and the need for collective action to improve the overall security landscape.
Takeaways:
- China's ambitions towards Taiwan are a significant concern.
- The geopolitical landscape is increasingly complex and interconnected.
- China's cyber operations are organized, funded, and strategic.
- Critical infrastructure in the U.S. is vulnerable to cyber threats.
- Cyber warfare will likely be a hybrid conflict involving multiple actors.
- Dependence on connected technology poses risks to national security.
- Malicious intent is not necessary for cyber harm to occur.
- Transparency in digital infrastructure is crucial for security.
- The threat of hardware exploits remains a significant concern.
- The recidivism rate of cyber threats is high, especially in critical sectors. There's a cost to connectivity that we haven't acknowledged.
- Usability is often prioritized over security, leading to vulnerabilities.
- Dependability in digital infrastructure is crucial for resilience.
- Security appliances can sometimes introduce more vulnerabilities than they solve.
- Regulatory frameworks need to adapt to the evolving digital landscape.
- Consumer demand can drive accountability in security practices.
- Smaller enterprises often lack the resources to secure their systems effectively.
- The asymmetry in cyber defense leaves many vulnerable to attacks.
- Proactive measures are necessary to prepare for potential disruptions.
- Collective action is needed to improve trust and transparency in digital infrastructure.
In this episode, Paul Asadorian, Larry Pesce, and Evan Dornbusch delve into the recent Sophos reports on threat actors, particularly focusing on the Pacific Rim case. They discuss the implications of the findings, including the tactics used by attackers, the vulnerabilities in network devices, and the challenges of securing appliances. The conversation also highlights the importance of network detection solutions, the impact of zero-day exploits, and the need for a shift in how appliance security is approached, especially concerning firmware backdoors and UEFI threats. In this conversation, the speakers discuss the implications of UEFI attacks, highlighting Sophos' proactive measures in cybersecurity. They emphasize the importance of observing attackers, the role of manufacturers in enhancing security, and the need for better monitoring and visibility in devices. The discussion also touches on the significance of shared responsibility in cybersecurity, learning from transparency in incidents, and the challenges posed by overpowered devices. The speakers advocate for the implementation of security software and the necessity of bills of materials to improve device security.
In this episode, Paul Ascidorian and Matt Johansen discuss the recent targeted attacks by Chinese threat actors, particularly focusing on the Volt Typhoon group. They explore the implications of back doors in cybersecurity, the role of ISPs, and the ongoing tension between privacy and security. The conversation delves into historical contexts, the evolution of threat actor tactics, and the shared responsibility model in cybersecurity. They also highlight the challenges of supply chain security and the visibility issues that make network devices vulnerable to attacks. In this conversation, Paul and Matt discuss the evolution of software security, focusing on the shift from traditional vulnerabilities to emerging threats in network devices. They emphasize the importance of observability and aligning incentives for better security practices. The discussion also highlights the need for innovation in infrastructure security, including the use of modern web frameworks and memory-safe languages to enhance security measures.
In this episode, Edwin Shuttleworth from Finite State discusses firmware security, insights from the GRRCON Security Conference, and the challenges of firmware analysis. The conversation covers various topics, including firmware scraping techniques, the IoT landscape, types of firmware, the importance of Software Bill of Materials (SBOMs), and emulation in firmware analysis. Edwin shares his experiences and offers advice for those looking to get started in firmware reverse engineering.
In this episode of Below the Surface, host Paul Ascadorian and guest Patrick Garrity discuss the complexities of vulnerability tracking and prioritization. They explore various sources of vulnerability data, the significance of known exploited vulnerabilities, and the concept of weaponization in cybersecurity. The conversation delves into the challenges posed by supply chain vulnerabilities, the importance of Software Bill of Materials (SBOM), and the impact of user behavior on security. The episode concludes with thoughts on the future of vulnerability management and the need for a more comprehensive approach to cybersecurity.
In this episode, Matt Brown joins the podcast to talk about firmware reverse engineering and supply chains. They discuss Matt's start in information security, his journey into hardware security, and the creation of his YouTube channel. They also explore the vulnerabilities and weaknesses in the supply chain of IoT devices and the challenges of extracting firmware from embedded Linux systems. Matt shares his favorite tools for firmware extraction and the complexities of creating an SBOM in the embedded Linux ecosystem. In this conversation, Paul and Allan discuss the challenges and vulnerabilities in IoT devices. They highlight the lack of security incentives in the IoT industry, the reuse of code across different devices, and the importance of validating firmware updates. They also mention the use of tools like binwalk and unblob for firmware analysis, and the benefits of UART and JTAG for hardware hacking. The conversation emphasizes the need for passion and hands-on experience in exploring IoT security.
Stewart and Trey join us to talk about driving cybersecurity policies for the nation, what makes a good policy, what makes a bad policy, supply chain research and policies, and overall how we shape policies that benefit cybersecurity.
Segment Resources:
- https://www.atlanticcouncil.org/in-depth-research-reports/report/broken-trust-lessons-from-sunburst/
- https://www.atlanticcouncil.org/in-depth-research-reports/report/open-source-software-as-infrastructure/
This segment is sponsored by Eclypsium. Visit https://securityweekly.com/eclypsium to learn more about them!
Show Notes: https://securityweekly.com/bts-36
Gain insights into the CISA KEV straight from one of the folks at CISA, Tod Beardsley. Learn how KEV was created, where the data comes from, and how you should use it in your environment.
This segment is sponsored by Eclypsium. Visit https://securityweekly.com/eclypsium to learn more about them!
Resource: https://cisa.gov/kev
Show Notes: https://securityweekly.com/bts-35
Jay Jacobs Co-Founder and Data Scientist and Wade Baker Co-Founder; Data Storyteller from The Cyentia Institute come on the show to talk about The Exploit Prediction Scoring System (EPSS).
This segment is sponsored by Eclypsium. Visit https://securityweekly.com/eclypsium to learn more about them!
Show Notes: https://securityweekly.com/bts-34
Ed Harris joins us to discuss how to secure OT environments, implement effective air gaps, and more!
This segment is sponsored by Eclypsium. Visit https://securityweekly.com/eclypsium to learn more about them!
Show Notes: https://securityweekly.com/bts-33
We discuss the various aspects of Mitre Att&ck, including tools, techniques, supply chain aspects, and more!
This segment is sponsored by Eclypsium. Visit https://securityweekly.com/eclypsium to learn more about them!
Show Notes: https://securityweekly.com/bts-32
Cassie has a long history of successfully managing a variety of security programs. Today, she leads supply chain efforts for a very large product company. We will tackle topics such as software supply chain management, SBOMs, third-party supply chain challenges, asset management, and more!
This segment is sponsored by Eclypsium. Visit https://securityweekly.com/eclypsium to learn more about them!
Show Notes: https://securityweekly.com/bts-31
Bob Martin comes on the show to discuss systems of trust, supply chain security and more!
This segment is sponsored by Eclypsium. Visit https://securityweekly.com/eclypsium to learn more about them!
Show Notes: https://securityweekly.com/bts-30
Jason joins us to discuss the current enterprise landscape for defending against supply chain attacks, remediating firmware issues, and the current challenges with patch management.
This segment is sponsored by Eclypsium. Visit https://securityweekly.com/eclypsium to learn more about them!
Show Notes: https://securityweekly.com/bts-29
Casey recently was involved in an event that brought hackers and 5G technology together, tune-in to learn about the results and how we can use bug bounty programs to improve the security of "things".
This segment is sponsored by Eclypsium. Visit https://securityweekly.com/eclypsium to learn more about them!
Show Notes: https://securityweekly.com/bts-28
In this episode, we disccuss digital supply chain governance and compliance, featuring Josh Marpet from Guarded Risk, hosted by Paul Asadorian and Alan Alford. Specifically, we discuss:
- The importance of understanding and complying with regulations affecting digital supply chains, such as Executive Order 14028 and the NIST Cybersecurity Framework.
- The podcast highlighted the impact of EU regulations, like CRA, GDPR, and DORA, on global businesses, underscoring the shared responsibility model in data security.
- Vendors' duties in open-source security and software vulnerability management were discussed, with a call for automation in software inventory and security, including the use of SBOMs.
- The conversation included strategies for effective supply chain risk management, advising regular updates, and understanding the interconnectedness of vulnerabilities.
- International compliance, particularly with EU data security laws, presents operational challenges and necessitates robust cybersecurity measures.
- Proactive vendor communication and automated processes are crucial for managing cybersecurity threats efficiently.
- Continuous risk assessment is preferred over periodic checks, with an emphasis on a nuanced approach to cybersecurity risk management.
- (00:00) - Digital Supply Chain Governance Compliance
- (14:08) - EU Regulations on Data Security
- (21:38) - Responsibility of Vendors in Open Source
- (27:49) - Supply Chain Risk Management Program Advice
- (39:01) - Automating Software Inventory and Security
This segment is sponsored by Eclypsium. Visit https://securityweekly.com/eclypsium to learn more!
Show Notes: https://securityweekly.com/bts-27
Cheryl is super passionate about supply chain security and visibility. Tune in to our discussion on how we can collectively get better at reducing the attack surface and working to fix the wide variety of digital supply chain issues we have today.
This segment is sponsored by Eclypsium. Visit https://securityweekly.com/eclypsium to learn more about them!
Show Notes: https://securityweekly.com/bts-26
Paul and Allan will talk a little bit about Allan's background and current work at Eclypsium. Next, we'll cover some of the recent news and topics we've been discussing on our blog including Firewall and VPN appliance security struggles, Shim Shady, Glubteba and other malware targeting UEFI, and some thoughts on recent regulations affecting supply chains such as the EU CRA.
This segment is sponsored by Eclypsium. Visit https://securityweekly.com/eclypsium to learn more about them!
Show Notes: https://securityweekly.com/bts-25
Saša Zdjelar joins us on this episode to dive into how organizations can manage supply chain risk, including the current challenges we face and how best to deal with them.
This segment is sponsored by Eclypsium. Visit https://securityweekly.com/eclypsium to learn more about them!
Show Notes: https://securityweekly.com/bts-24
Short of ripping everything apart (hardware and software) and inspecting the components, which is very time-consuming, how do we solve the visibility gap in various supply chains? Dr. Olga Livingston from CISA joins us to discuss!
This segment is sponsored by Eclypsium. Visit https://securityweekly.com/eclypsium to learn more about them!
Show Notes: https://securityweekly.com/bts-23
We sit down with the father of the SBOM, Allan Friedman, to discuss examples of where we really need SBOMs, how to operationalize SBOMs, and how to identify and deal with bad things that may be in your SBOM! CISA's resources on SBOM are at cisa.gov/SBOM and anyone can find out more or ask for a meeting at SBOM@cisa.dhs.gov
This segment is sponsored by Eclypsium. Visit https://securityweekly.com/eclypsium to learn more about them!
Show Notes: https://securityweekly.com/bts-22
We talk about Supply Chain Risk Management in the context of the cloud and US federal government with David Vaughn.
This segment is sponsored by Eclypsium. Visit https://securityweekly.com/eclypsium to learn more about them!
Show Notes: https://securityweekly.com/bts-21
In this episode, we have the privilege of sitting down with renowned security expert Joe Hall to discuss three critical facets of modern cybersecurity: network device security, supply chain threats, and lateral movement. Join us as Joe Hall shares his wealth of knowledge and experience, unraveling the complexities of network device security, the invisible gatekeepers of our digital lives. Discover the vulnerabilities that hackers exploit and the strategies to fortify your network defenses.
Show Notes: https://securityweekly.com/bts-20
In this episode, we delve into the dynamic world of supply chain security, recapping the significant developments of the past year. Join us as we explore the evolution of offensive security, defensive landscapes, and the key actors shaping the cybersecurity landscape. Our featured guest, Tyler Robinson, Founder and CEO of Dark Element, brings a wealth of expertise to the discussion. With a deep understanding of cybersecurity and a track record of innovation, Tyler provides valuable insights into what these trends mean for companies, supply chains, governments, and geopolitics.
This segment is sponsored by Eclypsium. Visit https://securityweekly.com/eclypsium to learn more about them!
Show Notes: https://securityweekly.com/bts-19
Bri has spent her career investigating and defending against critical infrastructure attacks. Hear her take on the current threat landscape, supply chain security, and more!
This segment is sponsored by Eclypsium. Visit https://securityweekly.com/eclypsium to learn more about them!
Show Notes: https://securityweekly.com/bts-18
Dr. Yuriy Bulygin is the CEO and founder of Eclypsium, the digital supply chain security company. Prior to Eclypsium, Yuriy was Chief Threat Researcher at Intel Corporation. He is also the creator of CHIPSEC, the popular open-source firmware and hardware supply chain security assessment framework When enterprises started using CHIPSEC to find vulnerabilities, discover compromised firmware, or just poke around hardware systems, Yuriy founded Eclypsium with Alex Bazhaniuk. Since then Eclypsium has been on a mission to protect devices from supply chain risks.
This segment is sponsored by Eclypsium. Visit https://securityweekly.com/eclypsium to learn more about them!
Show Notes: https://securityweekly.com/bts-17
Learn about the evolution of UEFI, various aspects of supply chain security surrounding UEFI, and the interactions between links in the supply chain that ultimately end up delivering you a computer or server.
Segment Resources:
- https://uefi.org/sites/default/files/resources/What%20is%20UEFI-Aug31-2023-Final.pdf
This segment is sponsored by Eclypsium. Visit https://securityweekly.com/eclypsium to learn more about them!
Show Notes: https://securityweekly.com/bts-16
Vlad is part of the Eclypsium research team and has discovered several flaws in BMC ecosystems. He comes on the show to talk about his journey and cover the details behind BMC vulnerabilities and attacks.
Segment Resources:
https://forum.defcon.org/node/245714 https://eclypsium.com/research/bmcc-lights-out-forever/
https://eclypsium.com/blog/supply-chain-vulnerabilities-put-server-ecosystem-at-risk/
Show Notes: https://securityweekly.com/bts-15
John Loucaides, SVP Strategy at Eclypsium, joins us on the show to discuss protecting the federal supply chain!
This segment is sponsored by Eclypsium. Visit https://securityweekly.com/eclypsium to learn more about them!
Show Notes: https://securityweekly.com/bts-14
We dig into network devices/appliances, why they are still around, who is attacking them, and how. Just why are attackers using network devices in ransomware campaigns and how do we stop them? Tune-in to find out as Nate Warfield, Director of Threat Research and Intelligence at Eclypsium joins us for this episode!
This segment is sponsored by Eclypsium. Visit https://securityweekly.com/eclypsium to learn more about them!
Show Notes: https://securityweekly.com/bts-13
Ramy Houssaini joins us to discuss the challenges enterprises face when dealing with supply chain threats, risks and vulnerabilities. We'll explore how to identify cybersecurity gaps in your various supply chains, discuss real-world examples such as Log4j and more!
Show Notes: https://securityweekly.com/bts-12
Supply Chain threats and industry / government initiatives like EO 14028 are driving a deeper understanding and a set of requirements for applying supply chain risk management (SCRM) and increased transparency (ex. SBOM) across the software ecosystem up and down the stack. Platform and system firmware present unique challenges for supply chain assurance from the depths of the stack.
Segment Resources:
ESF: Securing the Software Supply Chain for Customers https://media.defense.gov/2022/Nov/17/2003116444/-1/-1/0/ESF_SECURING_THE_SOFTWARE_SUPPLY_CHAIN_CUSTOMER_SLICKSHEET.PDF
https://media.defense.gov/2022/Nov/17/2003116445/-1/-1/0/ESF_SECURING_THE_SOFTWARE_SUPPLY_CHAIN_CUSTOMER.PDF
ESF: Securing the Software Supply Chain for Suppliers https://media.defense.gov/2022/Oct/31/2003105572/-1/-1/0/ESF_SECURING_THE_SOFTWARE_SUPPLY_CHAIN_SUPPLIERS_SLICKSHEET.PDF
https://media.defense.gov/2022/Oct/31/2003105368/-1/-1/0/SECURING_THE_SOFTWARE_SUPPLY_CHAIN_SUPPLIERS.PDF
ESF: Securing the Software Supply Chain for Developers https://media.defense.gov/2022/Sep/01/2003068942/-1/-1/0/ESF_
SECURING_THE_SOFTWARE_SUPPLY_CHAIN_DEVELOPERS.PDF CISA SBOM Site https://www.cisa.gov/sbom
Show Notes: https://securityweekly.com/bts-11
Firmware security is a deeply technical topic, that's hard to get started in. In this talk, Xeno will discuss some past work in firmware security, and how he has organized resources such as a low level timeline (with over 300 talks), and free MOOC classes, to help teach people about firmware security.
Segment Resources:
https://ost2.fyi
https://darkmentor.com/timeline.html
Show Notes: https://securityweekly.com/bts10
Brian Richardson didn't start out wanting to do marketing or computer security... but after starting his career as a BIOS programmer, he tripped and fell into technical marketing (aka "Binary to English translator"). Brian's here to talk about the importance of hardware & firmware security in a SaaS world.
Segment Resources:
https://www.youtube.com/watch?v=I2FwiEH6dg4
https://www.youtube.com/watch?v=i9PrWw4ljeg
https://medium.com/intel-tech/security-built-on-a-foundation-of-trust-1fa1dbb74cbc
https://archive.fosdem.org/2020/schedule/event/firmware_culisfu/
Show Notes: https://securityweekly.com/bts9
The LVFS is a project used by over 130 different vendors, from all positions of the supply chain. It decompresses, decompiles, then analyses firmware looking for issues, and then automatically builds a SBoM for each download.
Segment Resources:
https://fwupd.org/
https://github.com/fwupd
Show Notes: https://securityweekly.com/bts8
Discuss current events in firmware security, such as the techniques utilized in BlackLotus. We will compare Baton Drop with Grub2 capabilities.
Segment Resources:
https://starkeblog.com/
Show Notes: https://securityweekly.com/bts7
This session will provide an overview of the history of host firmware, or BIOS, focusing on the arc of the Unified Extensible Firmware Interface. It will include the development of defenses like UEFI Secure Boot and the challenges in scaling assurance across a broad ecosystem. It will close on works-in-progress and opportunities to build upon the school-of-hard-knocks learnings in this space.
Show Notes: https://securityweekly.com/bts6
In this edition of Below The Surface, we discuss insights Scott collected from various members of our community. Topics include supply chain threats, critical firmware attacks, and more! We also welcome special guest Tyler Robinson!
View the full report here: https://eclypsium.com/2022/12/13/december-firmware-threat-report/
This segment is sponsored by Eclypsium. Visit https://securityweekly.com/eclypsium to learn more about them!
Show Notes: https://securityweekly.com/bts5
Paul and Scott talk about supply chain threats, vulnerable drivers, leaked source code and keys, and cover what we know about the OpenSSL 3.x vulnerability.
This segment is sponsored by Eclypsium.
Visit https://securityweekly.com/eclypsium to learn more about them!
Show Notes: https://securityweekly.com/bts4
This month Scott and Paul discuss the inevitability of attacks against certain sectors, UEFI vulnerabilities galore and so much more!
Get the full report here: https://eclypsium.com/2022/10/03/september-firmware-threat-report/
This segment is sponsored by Eclypsium. Visit https://securityweekly.com/eclypsium to learn more about them!
Show Notes: https://securityweekly.com/bts3
Paul and Scott break down the Root of Trust (RoT) and other highlights from the August 2022 Below The Surface Threat Report: https://eclypsium.com/2022/08/31/august-firmware-threat-report/
This segment is sponsored by Eclypsium. Visit https://securityweekly.com/eclypsium to learn more about them!
Show Notes: https://securityweekly.com/bts2
Paul Asadoorian and Scott Scheferman sit down to discuss this month's firmware and supply chain threat report. We cover some of the history and latest developments regarding Secure Boot security research, the threats we face securing the firmware supply chain, and some insights into threat actors targeting firmware.
View the full report here:
https://eclypsium.com/2022/07/27/july-firmware-threat-report/
This segment is sponsored by Eclypsium. Visit https://securityweekly.com/eclypsium to learn more about them!
Show Notes: https://securityweekly.com/bts1