519: The Password Is All Zeros

Mark Omo and James Rowley spoke with us about safecracking, security, and the ethics of doing a bad job.

Mark and James gave an excellent talk on the development of their safecracking tools at DEF CON 33: Cash, Drugs, and Guns: Why Your Safes Aren't Safe. It included a section of interaction involving the lock maker's lawyers bullying them and how the Electronic Frontier Foundation (EFF) has a Coders' Rights Project to support security research.

As mentioned in the show, the US Cyber Trust Mark baseline has a very straightforward checklist; NISTIR 8259 is the overall standard, NISTIR 8259A is the technical checklist, NISTIR 8259B is the non-technical (process/maintenance) checklist. Roughly the process is NISTIR 8259 -> Plan/Guidance; NISTIR 8259A -> Build; NISTIR 8259B -> Support.

We discussed ETSI EN 303 645 V3.1.3 (2024-09) Cyber Security for Consumer Internet of Things: Baseline Requirement and the EU's CRA: Cyber Resilience Act which requires manufacturers to implement security by design, have security by default, provide free security updates, and protect confidentiality. See more here: How to prepare for the Cyber Resilience Act (CRA): A guide for manufacturers.

We didn't mention Ghidra in the show specifically, but it is a tool for reverse engineering software: given a binary image, what was the code?

Some of the safecracking was helped by the lock maker using the same processor in the PS4 which has many people looking to crack it. See fail0verflow :: PS4 Aux Hax 1: Intro & Aeolia for an introduction.

Mark and James have presented multiple times at Hardwear.io, a series of conferences and webinars about security (not wearables). Some related highlights:

2024: Breaking Into Chips By Reading The Datasheet is about the exploit developed for the older lock version on the safes discussed in the show.
USA 2025: Extracting Protected Flash With STM32-TraceRip is about STM32 exploits.

Det här avsnittet är hämtat från ett öppet RSS-flöde och publiceras inte av Podme. Det kan innehålla reklam.

Avsnitt(584)

537: Quiet Time Innovation

Christopher and Elecia catch up on life, firmware consulting, daydreams, and projects. Elecia thinks aloud about low-stimulation education toys. Christopher shares his experience using AI tools to bu...

29 Okt 1h 19min

536: I've Seen a Giraffe

David Such joins us to discuss his new book, Embedded AI: Intelligence at the Deep Edge. We explore the boundary between classical signal processing, heuristics, and edge machine learning; IMU process...

15 Okt 59min

535: The You in the Machine

Adam Smith from UC Santa Cruz joins us to discuss local Small Language Models (SLMs) and building open, autonomous tools. We explore his BayLeaf AI counterplatform, transagency (the "me-and-the-car" c...

1 Okt 1h 29min

534: I Think We'll Add a Head

Aaed Musa joins us to talk about building robot dogs, custom actuators, and his YouTube channel. He shares how he moved from 3D-printing servo robots in his parents' garage to designing capstan drives...

17 Sep 1h 13min

533: The Garage Is Open

Author Susan Lammers joins the show to discuss the 40th anniversary edition of her classic book, Programmers at Work. We discuss what it was like to interview young and pioneering software developers ...

4 Sep 59min

532: It's Still Real Fire

Kevin Santo Cappuccio, founder of Architeuthis Flux, joins the show to discuss creating Jumperless, an open-source breadboard that replaces physical jumper wires with software-controlled analog crossb...

20 Aug 1h 9min

531: Sequestering the Mess

Elecia and Christopher celebrate winning the IEEE Educational Activities Board Meritorious Achievement Award in Outreach and Informal Education! A huge thank you to Mark Omo and the wonderful listener...

6 Aug 1h 7min

530: A Living Highlighter

Marine biologist Dr. Steven Haddock joins the show to share the alien, glowing, and transparent wonders of the deep ocean. We discuss his beautiful new book, The Radiant Sea, and explore the complex e...

25 Juli 1h 8min