Security Weekly
Below the Surface: The Supply Chain Security PodcastSubscribe
Network Security, Critical Infrastructure Security, Supply chain

Reverse Engineering BMCs and Other Firmware – Vladyslav Babkin – BTS #15

Vlad is part of the Eclypsium research team and has discovered several flaws in BMC ecosystems. He comes on the show to talk about his journey and cover the details behind BMC vulnerabilities and attacks.

Segment Resources: https://forum.defcon.org/node/245714 https://eclypsium.com/research/bmcc-lights-out-forever/ https://eclypsium.com/blog/supply-chain-vulnerabilities-put-server-ecosystem-at-risk/

Full episode and show notes

Announcements

  • Below the surface listeners can learn more about Eclypsium by visiting eclypsium.com/go - there you will find the “Ultimate guide to supply chain security”, an on-demand webinar I presented called “Unraveling Digital Supply Chain Threats and Risk”, a paper on the relationship between ransomware and the supply chain, and a customer case study with Digital Ocean. If you are interested in seeing our product in action you can also sign up for a demo, you can get all that at eclypsium.com/go!

Guest

Vladyslav Babkin
Vladyslav Babkin
Security Researcher at Eclypsium

Vlad is currently a Security Researcher at Eclypsium with over 10 years of experience in networking, security, firmware research and software engineering. He is a long-time member of dcua CTF team and is passionate about breaking software and firmware to make the world a safer place.

Host

Scott Scheferman
Scott Scheferman
Principal Cyber Strategist at Eclypsium

Related

Hardware Hacking – PSW #809

The Security Weekly crew dives into a discussion on the latest hardware hacking techniques, including the hardware/software/firmware used to conduct various tests and create neat projects. You may be trying to hack a specific device. You may be creating a device to accomplish a specific goal. We will discuss various aspects of hardware hacking and ...
Exploring the Intersection of Security for Edge Computing and Endpoint – Theresa Lanowitz, Mani Keerthi Nagothu – ESW #340

Once again, Theresa Lanowitz joins us to discuss Edge Computing, but with a twist this time, as Mani Keerthi Nagotu from SentinelOne joins us as well! As a field CISO, Mani knows all too well the struggles security leaders are going through, given the current market and threat landscape: Maybe not less budget, but more pressure to produce results...
The State of Internet Attack Surface – Aidan Holland – ESW #339

Today, we discuss the state of attack surface across the Internet. We've known for decades now that putting an insecure service on the public Internet is a recipe for disaster, often within minutes. How has this knowledge changed the publicly accessible Internet? We find out when we talk to Censys's Aidan Holland today.