519: The Password Is All Zeros

Mark Omo and James Rowley spoke with us about safecracking, security, and the ethics of doing a bad job.

Mark and James gave an excellent talk on the development of their safecracking tools at DEF CON 33: Cash, Drugs, and Guns: Why Your Safes Aren't Safe. It included a section of interaction involving the lock maker's lawyers bullying them and how the Electronic Frontier Foundation (EFF) has a Coders' Rights Project to support security research.

As mentioned in the show, the US Cyber Trust Mark baseline has a very straightforward checklist; NISTIR 8259 is the overall standard, NISTIR 8259A is the technical checklist, NISTIR 8259B is the non-technical (process/maintenance) checklist. Roughly the process is NISTIR 8259 -> Plan/Guidance; NISTIR 8259A -> Build; NISTIR 8259B -> Support.

We discussed ETSI EN 303 645 V3.1.3 (2024-09) Cyber Security for Consumer Internet of Things: Baseline Requirement and the EU's CRA: Cyber Resilience Act which requires manufacturers to implement security by design, have security by default, provide free security updates, and protect confidentiality. See more here: How to prepare for the Cyber Resilience Act (CRA): A guide for manufacturers.

We didn't mention Ghidra in the show specifically, but it is a tool for reverse engineering software: given a binary image, what was the code?

Some of the safecracking was helped by the lock maker using the same processor in the PS4 which has many people looking to crack it. See fail0verflow :: PS4 Aux Hax 1: Intro & Aeolia for an introduction.

Mark and James have presented multiple times at Hardwear.io, a series of conferences and webinars about security (not wearables). Some related highlights:

2024: Breaking Into Chips By Reading The Datasheet is about the exploit developed for the older lock version on the safes discussed in the show.
USA 2025: Extracting Protected Flash With STM32-TraceRip is about STM32 exploits.

Tämä jakso on lisätty Podme-palveluun avoimen RSS-syötteen kautta eikä se ole Podmen omaa tuotantoa. Siksi jakso saattaa sisältää mainontaa.

Jaksot(576)

529: The Narwhal Looked Amazing

Chris Svec returns to the show to discuss the messy, non-linear realities of engineering management and onboarding new college graduates. We explore why companies should bother hiring fresh grads in t...

9 Heinä 1h 22min

528: Goldfish Chunks

Tyler Hoffman returns to the show to discuss diagnostics and observability data in embedded systems. We catch up on his life after startup acquisition, explore the hows and whys of keeping product dat...

25 Kesä 1h 10min

527: At The Jellyfish Conference

Chris and Elecia talk about pushing out of their comfort zone, networking advice, adding STARs and action verbs to resumes, using rust, thermo forming plastics, soldering together audio gear, and winn...

12 Kesä 1h 9min

526: Take A Taste Of Engineers

Dr. Victoria Serrano spoke with us about STEM outreach, fostering curiosity, and inspiring students with engineering education. Victoria is a professor at the Technological University of Panama (her ...

28 Touko 1h 1min

525: Some Sort of Metal

Dr. Tom Williams spoke with us about robots, ethics, teaching, and books. Then we talked about mines, umpires, water, and more books. Tom is the author of Degrees of Freedom: On Robotics and Social J...

14 Touko 1h 3min

524: This Isn't a Movie

Nathan Jones spoke with us about hardware security, motivation, conference talks, and writing. Nathan wrote an in-depth series of posts about the benefits of superloops vs RTOS: You Don't Need an RTOS...

16 Huhti 1h 14min

523: Bad Experience With Donuts

Chris and Elecia chat about Leapfrog toys, things they like, large company politics, awards, and open source governance. The Toy Story 5 Trailer with LilyPad toy which is suspiciously similar to the ...

2 Huhti 1h 10min

522: The Information Is In Poop

Sonia Grego speaks with us about a topic no one likes to talk about, but could be used to monitor personal dietary health and widespread disease outbreaks. Toilets! Sonia leads Duke University's Smart...

6 Maalis 54min