Security Weekly
Paul's Security WeeklySubscribe
Remote access, Physical security, Malware

Firmware Hacking! Reversing and Exploitation – Philippe Laulheret – PSW #778

How to get into reversing embedded firmware? Can the planet really be hacked? We'll go over a couple of fun exploitation examples, see what mistakes were made and maybe what could have been done better to make these devices tougher to break into.

Segment Resources: Voip phone hacking: Blog: https://www.mcafee.com/blogs/other-blogs/mcafee-labs/avaya-deskphone-decade-old-vulnerability-found-in-phones-firmware/ Def Con presentation (intro to hardware hacking): https://www.youtube.com/watch?v=HuCbr2588-w&ab_channel=DEFCONConference

Medical Research: BBraun infusion pump: https://www.youtube.com/watch?v=6agtnfPjd64&ab_channel=hardwear.io Medical devices under attack: https://www.rsaconference.com/USA/agenda/session/Code%20Blue%20Medical%20Devices%20Under%20Attack

Hacking DrayTek routers: https://www.youtube.com/watch?v=CD8HfjdDeuM&ab_channel=Hexacon

Philippe's public work: https://github.com/philippelaulheret/talksblogsand_fun

Full episode and show notes

Announcements

  • Security Weekly listeners: Identiverse 2023 is heading to Vegas! Join the digital identity community at the ARIA Resort & Casino in Las Vegas, May 30th to June 2nd. Identiverse is a must-attend annual event that brings together over 2,500 security professionals for 4 days of world-class learning, engagement, and entertainment.

    As a community member, you’re able to receive 20% off your Identiverse 2023 tickets using code IDV23-SW20!

    Register today: securityweekly.com/identiverse2023

Guest

Philippe Laulheret
Philippe Laulheret
Senior Security Researcher (currently funemployed)

Philippe Laulheret is a Senior Security Researcher who loves hacking all the things. With a focus on Reverse Engineering and Vulnerability Research, Philippe uses his background in Embedded Security and Software Engineering to poke at complex systems and get them behave in interesting ways. Philippe presented multiple projects covering hardware hacking, reverse engineering and exploitation at DEF CON, Hardwear.io, Eko Party and more. In his spare time, Philippe enjoys playing CTFs, immersing himself in the beauty of the Pacific Northwest, and exploring the realm of Creative Coding.

Philippe holds a MSc in Computer Science from Georgia Tech and a MSc in Electrical and Computer Engineering from Supélec (France).

Hosts

Paul Asadoorian
Paul Asadoorian
Founder at Security Weekly
Doug White
Doug White
Professor at Roger Williams University
Josh Marpet
Josh Marpet
Executive Director at RM-ISAO
Mandy Logan
Mandy Logan
Brainstem Hacker and InfoSec Enthusiast at Redacted
Sam Bowne
Sam Bowne
Founder at Infosec Decoded, Inc.
Tyler Robinson
Tyler Robinson
Director of Offensive Security & Research at Trimarc Security, Founder & CEO at Dark Element

Related

Managed services
Work-from-Anywhere: Securing the Blurry Edges of Your Network – CFH #19

In the last few years, many companies have found that their home offices and their internal on-prem networks are no longer always the central core around which their business operations revolve. Even with more employees returning to the office now, remote and hybrid workforce models are here to stay, thanks to an exponentially increased reliance on...
Managed services
Remote Monitoring & Management Hijackings: Don’t Lose Control – CFH #10

In late January, CISA, the NSA and the MS-ISAC released an advisory warning about the malicious the use of legitimate remote monitoring and management software, after uncovering illegal hacking activity on two federal civilian executive branch networks. Whether compromised via social engineering or through exploits, RMM tools can grant unauthorized...
prestitial ad