If You Can't Open It, You Don't Own It

on YouTube ↗59m

" summary

Examples start with pacemakers and insulin pumps being reachable over Wi‑Fi, move to ShadowHammer infecting about 500,000 systems, then a researcher scanning ~1,300 undocumented MSRs with a Sandsifter timing scan to find a bit that yields ring‑0 access, and cover side‑channels (power, Tempest, cachebleed), supply‑chain interdiction, and dirty‑cow style local exploits. Practical fixes include separating trust zones, signing and verifying binaries, encrypting transports, auditing third‑party libs, and upcoming language help like secure_clear proposal, Concepts, Ranges and atomic_shared_ptr.

AI-written summary · about

" chapters (46)

1. 0:00Intro
2. 0:30Dick Cheneys pacemaker
3. 1:30Shadow hammer
4. 2:50Roots of trust
5. 3:50Trust landscape
6. 4:45Trust layers
7. 7:15What can we trust
8. 8:30A case of a printer getting hacked
9. 10:00Signing your code
10. 12:30Who you connect with
11. 16:10Takeaways
12. 18:40Hardware Hacking
13. 19:05Security Researcher Patent
14. 21:45Timing Attack
15. 22:50Scale It Up
16. 23:30Timing Power Attack
17. 24:00Differential Fault Analysis
18. 25:10Sideband Analysis
19. 25:45Software
20. 29:30Logs
21. 30:45Licensing
22. 33:15Certificate Authority
23. 35:30Physical Access
24. 36:00Destructive Access
25. 36:25Reverse Engineering
26. 37:10Reverse Engineering Software
27. 40:00CLIs
28. 40:35Takeaway
29. 41:05Super Micro Hack
30. 41:25The Controversy
31. 42:05Interdiction
32. 43:10Random Testing
33. 44:20Trust
34. 45:00ThirdParty Libraries
35. 46:45Practice Tough Love
36. 47:35Test Your ThirdParty Libraries
37. 48:15Black Duck White Source
38. 49:05Type System
39. 50:05Concepts
40. 51:45Filter
41. 52:25Thread Safe
42. 53:15atomic shared pointer
43. 54:25volatile
44. 55:45enum
45. 56:40contracts
46. 58:15secure codes

" related talks

• 24mIf They Can Touch It, They Own It: The Stories We Tell...Michael Rushanan · USENIX Security '26
• 39mNight of the living vulnerabilitiesRoberto Clapis, Stefano Zanero · Codemotion Milan 2017
• 51mExploiting Hardware Glitches And Side Channels In Perfect SoftwareHerbert Bos · OWASP Global AppSec Amsterdam 2019
• 41mThinking Outside the Sandbox - Violating Trust Boundaries in Uncommon WaysBrian Gorenc, Jasiel Spelman · Black Hat USA 2014
• 01h 06mBackdoors in Back DoorsKen Munro · 31st Annual FIRST Conference
• 55mHow hacking worksEspen Sande-Larsen · NDC Security 2023
• 24mSecurity through Transparency: Tales from the RP2350 Hacking ChallengeAedan Cullen, Thomas Roth, Marius Muench, Andrew D. Zonenberg, Kévin Courdesses · 19th USENIX WOOT Conference on Offensive Technologies (WOOT '25)
• 21mIndustrial IoT security issues and countermeasuresChris Shire · IoTSF Conference 2016