logo
Dates

Author


Conferences

Tags

Sort by:  

Conference:  Black Hat Asia 2023
Authors: Alex Matrosov, Richard Hughes, Kai Michaelis
2023-05-12

Over the past two years, attacks on multiple targets in the semiconductor industry have consistently led to leaks of firmware source code. A compromised developer device could potentially give an attacker access to the source code repository, adding a major gap in the security of the software supply chain. There are multiple policies in place to improve transparency in the firmware supply chain in general, but implementing and adopting them will take years. The technology industry is in the midst of active discussions about the use of "software bill of materials" (SBOMs) to address supply chain security risks.In order to implement supply chain security practices, there must be better transparency on software dependencies. Previously, any piece of software shipped as black-box without providing any information related to software dependencies and third-party components. Firmware has largely been looked at in the same way. We already discussed in our previous talks the multiple levels of complexity in the UEFI firmware ecosystem and supply chain taxonomy and we already discussed the firmware supply chain complexity topics regarding the firmware update delivery and how the timing plays a negative role to give an attackers advantage to adopt already known vulnerabilities (N-days) to their attacks in last year's research "The Firmware Supply-Chain Security Is Broken: Can We Fix It?".The silicon vendor reference code vulnerabilities are always the worst since impacting the whole industry and all the device vendors have used the same chips on their devices. When it comes to applying mitigations, how does the industry take advantage of them, and who controls their adoption in the firmware? Those are all good questions, but unfortunately, no positive news can be shared. The system firmware attack vectors will be discussed in this talk from the perspective of attacking the operating system or hypervisor. The nature of these attacks breaks the foundation of confidential computing and often creates problems for the entire industry.This talk will focus on practical examples of such attacks and how they are dangerous.
Authors: Nick Santos
2021-10-13

tldr - powered by Generative AI

Kubernetes is a simple and elegant library for managing control loops that has allowed for the management of complex cloud resources. The Kubernetes community has broken down the system into small repos with clear division of responsibilities that layer on top of each other.
  • Kubernetes is a library for managing control loops
  • The community has broken down the system into small repos with clear division of responsibilities
  • Kubernetes has allowed for the management of complex cloud resources
Authors: Vickie Li
2021-09-24

tldr - powered by Generative AI

The presentation discusses the basics of conducting a security code review to find vulnerabilities in an application's source code.
  • Manual code reviews are valuable for finding security issues caused by insecure coding practices
  • Prioritizing analysis and using automated tools can speed up the process
  • Combining automated tools with manual code analysis can ensure fewer bugs make it to production