Night of the living vulnerabilities

on YouTube ↗39m

" summary

Firmware review and pen tests find format string bugs and classic stack overflows alongside hardcoded credentials (default user with password left unchanged) and an FTP update flow that accepts any login during the first five minutes and executes uploaded startup scripts. Real results: one lab-tested industrial robot has unstripp ed binaries and buffer overflows, 28 robots reachable from the Internet, and searches find 85,000 industrial routers with 5,000 exposed without passwords. Tools that work: flawfinder, cppcheck, Clang/clang-analyzer, AFL, AddressSanitizer, mender; fixes: enable stack protector on ARM, apply MISRA/JPL C guidelines and run static analysis and safe libraries.

AI-written summary · about

" chapters (36)

1. 0:00Introduction and speakers
2. 0:46Zombie vulnerabilities in IoT
3. 2:36Scary IoT devices examples
4. 3:42Threat modeling in IoT
5. 4:24Code review and old vulnerabilities
6. 5:54Buffer overflow in thermostat
7. 6:37Industrial robot vulnerabilities
8. 8:22Robot software update flaws
9. 9:48Default credentials and FTP access
10. 11:37Custom FTP server flaws
11. 13:03Zombie vulnerability matryoshka
12. 13:46Industrial routers exposed online
13. 15:10Copy-paste vulnerabilities in routers
14. 16:11Why old vulnerabilities persist
15. 17:15Lack of developer awareness
16. 19:20Technical debt in embedded systems
17. 20:22Missing security features in embedded
18. 21:47Stack canaries disabled by default
19. 22:49Lack of security tools for embedded
20. 24:17Why Rust and Go won't save us
21. 25:23Threat modeling challenges
22. 26:52Memory constraints in embedded
23. 27:55Patching standard libraries
24. 28:38How to kill zombie vulnerabilities
25. 29:00Safe libraries for embedded
26. 29:43NASA JPL secure coding guidelines
27. 31:07Checklists for embedded developers
28. 31:28Reinventing the wheel in updates
29. 32:09Static analysis tools for embedded
30. 33:35Enabling stack protector in ARM
31. 34:18Battle plan for legacy code
32. 35:40Finding vulnerabilities with grep
33. 36:27Updating systems and custom crypto
34. 37:30Resources and final advice
35. 38:11Summary and call to action
36. 38:31Q&A

" related talks

• 44mNight of the living vulnerabilitiesS. Zanero, R. Clapis · Codemotion Amsterdam 2018
• 45mOutside the box: pwning IoT devices through their applicationsAlexei Kojenov · Global AppSec US 2021 Virtual
• 01h 16mClassic VulnerabilitiesPatricia Aas · ACCU 2022
• 01h 08mAutomated Dynamic Fireware Analysis At Scale: A Case Study on Embedded Web InterfacesAndrei Costin · Black Hat Asia 2016
• 41mLive Hacking: Breaking into Your Web AppBrian Vermeer · GOTO Amsterdam 2022
• 43m50 Shades of AppSecTroy Hunt · OWASP AppSec Research (AppSecEU) 2015
• 26mHacking buildings: Security flaws in embedded building control systemsKen Munro · IoTSF Conference 2017
• 51mLocknote: Conclusions and Key TakeawaysChris Wysopal, Dino Dai Zovi, Jeff Moss, Vincenco Iozzo · Black Hat Asia 2016