Infecting The Embedded Supply Chain

Presented at DEF CON 26 (2018), Aug. 11, 2018, 1:30 p.m. (45 minutes).

With a surge in the production of internet of things (IoT) devices, embedded development tools are becoming commonplace and the software they run on is often trusted to run in escalated modes. However, some of the embedded development tools on the market contain serious vulnerabilities that put users at risk. In this talk we discuss the various attack vectors that these embedded development tools expose users to, and why users should not blindly trust their tools. This talk will detail a variety reverse engineering, fuzzing, exploit development and protocol analysis techniques that we used to analyze and exploit the security of a common embedded debugger.

Presenters:

• Zach - Security Researcher at Somerset Recon
  Zach is a security researcher with Somerset Recon, a security consulting firm in San Diego. In this role he focuses on reverse engineering and web application penetration testing. In his free time Zach loves reading and long walks through the PE file format. Prior to working at Somerset Recon, Zach was a goat farmer in Maryland.
• Alex / DeMiNe0 - Security Researcher at Somerset Recon   as Alex
  Alex is a security researcher with Somerset Recon, a security consulting firm in San Diego. In this role he focuses on hardware security and reverse engineering.

Links:

• https://defcon.org/html/defcon-26/dc-26-speakers.html#Zach
• https://infocon.org/cons/DEF CON/DEF CON 26/DEF CON 26 video and slides/DEF CON 26 - Zach and Alex - Infecting The Embedded Supply Chain.mp4
• https://infocon.org/cons/DEF CON/DEF CON 26/DEF CON 26 video and slides/DEF CON 26 - Zach and Alex - Infecting The Embedded Supply Chain.srt (subtitles)
• https://www.youtube.com/watch?v=XeiET4FuGjE

Similar Presentations:

• DEF CON 11 (2003) / Embedded Reverse Engineering
• DEF CON 11 (2003) / More Embedded Systems
• ToorCon San Diego 20 (2018) / Infecting the Embedded Supply Chain