Below the Surface (Audio) - The Supply Chain Security Podcast

Eclypsium

A lively discussion of the threats affecting supply chain, specifically focused on firmware and low-level code that is a blind spot for many organizations. This podcast will feature guests from the cybersecurity industry discussing the problems surrounding supply chain-related issues and potential solutions.

Get the Supply Chain Security Toolkit from Eclypsium here: https://eclypsium.com/go

Play

Open in

21 episodes
fortnightly
Avg 58 min
English

Episodes 21

Newest Oldest Longest

All20 Unplayed20 In progress0 Played0

Counted on this page — what you have heard stays on this device, so it is not something the list can be paged by.

#81
September 3 · 51 min
Infratrust Pulse, AI's Role in Security - BTS #81
In this episode, Paul and Vlad discuss the latest Infratrust Pulse report, highlighting vulnerability trends, the role of AI in cybersecurity, and the importance of visibility and control in network security. They delve into threats posed by BMCs and management planes, the challenges of persistence mechanisms, and the need for better vendor responsiveness and API practices to strengthen security. In this conversation, Vlad and Paul discuss the evolving role of AI in cybersecurity, particularly its use by threat actors to exploit vulnerabilities. They explore the implications of AI in vulnerability discovery, the importance of secure software development practices, and the risks associated with backdoors in surveillance technology. The discussion emphasizes the need for organizations to adopt better security measures and the potential of AI to enhance software quality and security. Articles: * https://pulse.infra-trust.org/august-2026/ * https://blog.quarkslab.com/defeating-ai-assisted-reverse-engineering-or-at-least-trying-to.html * https://securityaffairs.com/197764/hacking/slovakia-warns-of-cyber-risks-in-road-speed-cameras.html * https://cyberscoop.com/ubiquiti-unifi-critical-vulnerabilities-patched/ * https://blog.talosintelligence.com/uat-10147-chinese-speaking-adversary-integrates-agentic-ai-into-post-compromise-operations/ * https://blog.trailofbits.com/2026/08/26/vms-wont-contain-cyber-capable-agents/ Chapters 00:00 Introduction to Infratrust Pulse and AI in Cybersecurity 05:56 Trends in Vulnerabilities and AI's Role 09:36 The Threat Landscape: BMCs and Management Planes 13:52 Persistence Mechanisms and Forensic Challenges 18:34 Visibility and Control in Network Security 23:41 Vendor Responsiveness and API Best Practices 26:08 AI in Cybersecurity: Threats and Opportunities 30:00 The Role of AI in Vulnerability Discovery 34:00 AI's Impact on Software Development and Security 39:06 Best Practices for Secure Software Development 44:14 Addressing Backdoors in Surveillance Technology
#80
August 13 · 59 min
Exploring BMC Vulnerabilities - BTS #80
Summary In this episode, the hosts discuss various cybersecurity topics, including the lack of media coverage from the Black Hat conference, the implications of AI in cybersecurity, and the vulnerabilities associated with Baseboard Management Controllers (BMCs). They explore the challenges of patch management, the role of embedded Linux in security vulnerabilities, and the emerging trends in threat actor behavior. The conversation emphasizes the need for better awareness and action regarding BMC vulnerabilities and the importance of understanding the risks associated with AI in security. In this conversation, the speakers delve into the complexities of operational risks associated with AI models, particularly in the context of patch management and firmware security. They discuss the challenges of relying on AI for code reviews and the implications of backdoors found in firmware. The conversation also highlights the critical importance of true randomness in cryptographic applications and the ongoing risks posed by speculative execution attacks. Chapters 00:00 Introduction and Technical Setup 03:01 Black Hat Conference Coverage and Media Silence 06:00 AI and Cybersecurity: Responsibility and Ethics 08:51 BMC Vulnerabilities: Research and Findings 11:57 Scanning Techniques and Tools for BMCs 15:02 Cisco Vulnerabilities and Patch Management Challenges 17:54 The Role of AI in Vulnerability Discovery and Management 21:13 Emerging Threats and Trends in Cybersecurity 24:00 Conclusion and Future Considerations 34:03 Understanding Operational Risks in AI Models 37:10 The Challenges of Patch Management and Configuration 41:26 The Dangers of AI in Code Review 43:00 Backdoors in Firmware: A Growing Concern 49:13 The Importance of True Randomness in Cryptography 58:08 The Implications of Speculative Execution Attacks
#79
August 7 · 54 min
InfraTrust - Understanding Infrastructure Vulnerabilities & Risk - BTS #79
Check out our free and no-registration-required site for understanding and tracking infrastructure vulnerabilities and advisories: https://infra-trust.org In this episode, the hosts discuss the challenges of collecting and aggregating vulnerability data, the introduction of Infratrust and Infratrust Pulse, and the importance of actionable data for cybersecurity teams. They explore the differences between vendor advisories and CVEs, the role of Eclipsium in data aggregation, and the ongoing challenges in vulnerability management and patching. The conversation highlights the need for a centralized source of truth for infrastructure vulnerabilities and the evolving landscape of cybersecurity threats. In this conversation, the speakers delve into the complexities of vulnerability management, particularly in the context of AI's rapid evolution in vulnerability discovery. They discuss the biases affecting vulnerability prioritization, the implications of AI on both offensive and defensive capabilities, and the critical risks associated with exposing Baseboard Management Controllers (BMCs) to the internet. The conversation emphasizes the need for better security practices and awareness in the face of evolving threats. Chapters 00:00 Technical Challenges in Data Collection 02:58 Introduction to Infratrust and Infratrust Pulse 05:57 The Evolution of Infrastructure Pulse 09:02 Understanding Vendor Advisories vs CVEs 11:49 The Importance of Actionable Data 14:46 Navigating Vendor Advisory Inconsistencies 17:51 The Role of Eclipsium in Data Aggregation 20:46 Patching Challenges and Vulnerability Management 24:09 Interpreting Risk Scores and Vulnerability Impact 30:34 Understanding Vulnerability Management Challenges 32:43 The Impact of AI on Vulnerability Discovery 35:24 The Arms Race: Offensive vs Defensive Capabilities 38:41 The Dangers of Exposing BMCs to the Internet 41:31 BMC Vulnerabilities: A Deep Dive 49:29 Mitigating Risks: Best Practices for BMC Security
#78
July 16 · 56 min
Patching: The Race Against Time - BTS #78
In this episode, the hosts discuss various vulnerabilities affecting network devices, the importance of timely patching in enterprises, and the implications of AI on security. They explore the challenges of compliance programs, the significance of dependency management in software, and the need for better privilege separation in network devices. The conversation also touches on the risks of supply chain attacks and the detection of orphaned packages in software ecosystems. Chapters 00:00 Introduction to Vulnerabilities and Security Trends 02:49 Router Choices and Security Implications 10:41 The Need for Faster Patching in Enterprises 12:22 The Impact of AI on Security and Exploits 18:31 Challenges with Compliance and Vulnerability Management 24:17 The Importance of Dependency Management in Software 30:54 Supply Chain Attacks and Their Consequences 35:34 Privilege Separation and Device Security 40:40 The Role of AI in Exploit Development 53:43 Detecting Orphaned Packages and Security Risks
#77
June 30 · 54 min
FortiBleed Uncovered: How Attackers Harvest Credentials from Fortinet Devices - BTS #77
In this episode, we delve into the recent FortiBleed campaign, exploring how attackers harvest credentials from Fortinet devices, the vulnerabilities in password management, and best practices for defenders to mitigate such threats. Key topics FortiBleed campaign details and impact Password hash vulnerabilities in FortiOS AI's role in analyzing large security breaches Credential harvesting techniques and defenses Importance of layered security and best practices Chapters 00:00 Introduction and Initial Thoughts on AI Models 10:04 Credential Harvesting and Security Weaknesses 19:58 Hash Management and Security Appliances 30:15 Incident Response and Vulnerability Management 39:46 The Future of Security in the Age of AI
#76
June 16 · 1 hr
Binwalk, Brickstorm, AI Model Madness - BTS #76
summary In this episode of Below the Surface, Paul Asadoorian, Chase Snyder, and Vlad Babkin discuss the implications of AI in cybersecurity, the challenges posed by AI guardrails, and the operational risks associated with applying patches. They also explore vulnerabilities in security tools like Binwalk, the complexities of firmware update tools, and the importance of transparency in software signing, particularly in the context of open source software. In this conversation, the speakers delve into the complexities of cybersecurity, focusing on the limitations of security through obscurity, the challenges posed by UEFI shells and secure boot, and the operational risks associated with DBX updates. They discuss the difficulties in vulnerability management and the role of AI in cybersecurity, highlighting how it may benefit attackers more than defenders. The conversation also touches on emerging threats like Brickstorm malware and the need to rethink edge device security in light of these challenges. Finally, they emphasize the necessity for all companies to adopt robust cybersecurity measures. Chapters 00:00 Introduction to Below the Surface Podcast 01:16 The Rise of AI and Its Implications 06:42 Challenges with AI Guardrails and Restrictions 10:53 Operational Risks in Cybersecurity 17:01 Vulnerabilities in Security Tools 20:11 Exploring Firmware Update Tools 29:07 The Importance of Open Source in Security 34:07 The Need for Transparency in Software Signing 35:12 The Fallacy of Security Through Obscurity 36:36 The Challenges of UEFI Shells and Secure Boot 39:58 The Complexity of DBX Updates and Operational Risks 43:20 The Difficulty of Vulnerability Management 48:11 AI's Role in Cybersecurity: A Double-Edged Sword 52:59 Emerging Threats: The Rise of Brickstorm Malware 55:54 Rethinking Edge Device Security 01:00:08 The Future of Cybersecurity Infrastructure
#75
June 3 · 55 min
Secure Boot Certificates Expiring: What You Need to Know - BTS #75
In this episode of Below the Surface, the team discusses recent cybersecurity trends, including the Verizon DBIR 2026 report, secure boot certificate expirations, and the evolving threat landscape with AI and hardware vulnerabilities. They explore how organizations can adapt their defense strategies to stay ahead of attackers and share insights on supply chain security and malware analysis. https://eclypsium.com/blog/microsoft-secure-boot-certificates-expire-2026/ https://eclypsium.com/blog/verizon-dbir-2026/ https://github.com/iss4cf0ng/OpenPetya https://gbhackers.com/exploit-f5-big-ip-ssh-access/ https://www.microsoft.com/en-us/security/blog/2026/05/22/from-edge-appliance-to-enterprise-compromise-multi-stage-linux-intrusion-via-f5-and-confluence/ https://cybersecuritynews.com/china-linked-hackers-target-southeast-asian-edge-routers/ https://qiita.com/Y4er/items/0b6071745e4b7b240b3e https://www.greynoise.io/blog/sonicwall-scanning-spike-echoes-pattern-preceded-cve-2026-0400 YellowKey update: https://www.reddit.com/r/sysadmin/comments/1tkq3x9/yellowkey_bitlocker_exploit_repo_taken_down/ Chapters 00:00 Introduction and Technical Issues 02:56 Verizon DBIR Insights 05:50 Trends in Vulnerability Management 09:04 The Role of AI in Cybersecurity 12:11 Challenges in Vulnerability Management 14:46 Secure Boot Certificates and Their Implications 29:52 Managing Updates and Security Risks 32:57 The Open Petya Project: A Historical Perspective 36:11 Understanding the Yellow Key Attack 39:34 The Dilemma of Independent Researchers 41:34 The Future of Bug Bounty Programs 43:59 The Evolving Landscape of Vulnerabilities 49:51 Visibility Challenges in Network Security 56:16 The Need for Better Information Sharing
#74
May 19 · 54 min
YellowKey, CVE Enrichment, Chipmaker Breach - BTS #74
In this episode, we explore recent vulnerabilities, the YellowKey BitLocker bypass, supply chain security, CVE data analysis, and the implications of hardware breaches like the one at Foxconn. We also delve into AI's role in vulnerability research and the evolving landscape of cybersecurity threats. Topics https://www.nist.gov/news-events/news/2026/04/nist-updates-nvd-operations-address-record-cve-growth https://github.com/Nightmare-Eclipse/YellowKey https://socket.dev/blog/tanstack-npm-packages-compromised-mini-shai-hulud-supply-chain-attack https://x.com/AlvieriD/status/2053835732658143416 Chapters 00:00 Introduction to Vulnerability Research and AI 03:42 NIST and CVE Growth Challenges 06:46 Building Tools for CVE Analysis 10:58 The Complexity of CVSS Scoring 15:08 CISA's Role in Vulnerability Enrichment 18:06 Challenges in CWE and CPE Data 19:55 The Future of Vulnerability Research 27:18 BitLocker Bypass: A Case Study 33:05 Exploring the Complexity of Windows Features 34:49 Speculation on Microsoft and Conspiracy Theories 35:57 The Impact of BIOS Passwords on Security 39:12 The Foxconn Breach: A Major Data Compromise 47:34 Supply Chain Attacks on Package Managers 51:13 Deceptive Techniques in Cybersecurity
#73
May 7 · 55 min
Uncovering Firmware Risks: From Y2K to Modern Malware - BTS #73
In this episode of Below the Surface, hosts Paul Asadoorian, Chase Snyder, and guest Brian Richardson explore the evolution of firmware security, the risks of supply chain vulnerabilities, and the latest threats targeting network edge devices like Cisco ASA and FTD. They discuss historical malware like the Chernobyl virus, modern malware campaigns such as Firestarter, and the challenges of securing complex network infrastructure in a rapidly evolving threat landscape. Links: https://www.linkedin.com/news/story/white-house-pushes-back-on-anthropics-mythos-expansion-8741242/ https://www.tomshardware.com/tech-industry/cyber-security/the-chernobyl-virus-turned-27-today-and-it-could-brick-your-pc-in-ways-modern-malware-cant https://blog.talosintelligence.com/uat-4356-firestarter/ Chapters 00:00 Introduction to Below the Surface 02:20 Brian's Transition to Eclipseum 03:50 The Y2K Experience and Early Virus Detection 06:31 The CIH Virus and Its Impact 10:12 BIOS Security and Vulnerabilities 14:10 The Importance of Firmware Lockdown 18:09 Modern Threats and UEFI Attacks 22:13 Targeted Malware and Ransomware Risks 25:21 Creative Concepts in Cybersecurity 26:20 Emerging Threats: Firestarter Malware 30:54 The Security of Network Devices 35:17 Challenges in Managing Security Appliances 39:52 Persistence of Malware and Its Implications 43:02 The Evolving Landscape of Cyber Threats 49:44 AI and Cybersecurity: The Anthropic Dilemma
#72
April 17 · 58 min
AI-Powered Firmware Hacking: The Future of Vulnerability Discovery - BTS #72
In this episode, the hosts explore the latest in cybersecurity, including AI-driven vulnerability discovery, firmware analysis tools, secure boot complexities, and recent CVE trends. They discuss practical techniques for hacking devices, the challenges of firmware emulation, and the implications of new security policies on consumer and enterprise hardware. Chapters 00:00 Introduction to Hacking and Security Updates 03:24 Exploring Samsung TV Hacking 06:34 AI in Vulnerability Research 11:17 The Role of AI in Exploiting Vulnerabilities 15:18 CVE Disclosure and Ethical Considerations 20:43 AI Tools and Instrumentation in Development 24:41 Emerging Tools for Firmware Analysis 28:14 Navigating Linux Security Challenges 29:12 The Surge of CVEs: Understanding the Growth 31:29 The Role of AI in Vulnerability Discovery 34:50 CVE Enrichment: The Need for Contextual Data 36:57 Microsoft's Secure Boot: A Double-Edged Sword 46:43 Vulnerabilities in Bootloaders: A Case Study 51:25 The Complexity of Secure Boot Management 53:24 Regulatory Challenges in Router Security
#71
April 7 · 1 hr 1 min
What Makes a Device a Router? - BTS #71
summary In this episode, the hosts discuss the new FCC regulations regarding consumer routers, exploring the implications for cybersecurity, the definitions of what constitutes a router, and the challenges of manufacturing compliant devices. They delve into the debate surrounding the effectiveness of these regulations in mitigating cyber risks, the role of hardware versus software vulnerabilities, and the potential impact on consumers and existing devices in homes. In this conversation, the hosts discuss the implications of the FCC's decision to decertify routers and firmware, the challenges posed by the conditional approval process, and the potential impact on router security and availability. They explore conspiracy theories surrounding the regulations, compare US and EU cybersecurity standards, and address the complexities of hardware backdoors and default credentials. The conversation highlights the need for better security practices and the importance of addressing vulnerabilities in enterprise devices. Chapters 00:00 Introduction to FCC Regulations on Routers 02:35 The Impact of FCC Regulations on Consumer Devices 05:03 Defining What Constitutes a Router 09:51 The Security Implications of Router Regulations 12:41 The Role of Hardware vs. Software in Cybersecurity 17:11 Challenges in Manufacturing and Compliance 21:40 Consumer Impact and Existing Devices 25:59 The Future of Networking Devices and Regulations 29:48 Decertification of Routers and Firmware Challenges 31:58 Conditional Approval Process and Its Implications 34:40 Proposed Solutions for Router Security Standards 36:53 Conspiracy Theories Surrounding Router Regulations 39:26 The Impact of Regulations on Router Availability and Pricing 42:05 Comparing US and EU Cybersecurity Regulations 46:11 The Complexity of Hardware Backdoors and Security 49:11 Addressing Default Credentials and Vulnerabilities 52:02 Conditional Approval Guidance and Its Flaws 54:56 Recent Vulnerabilities in Enterprise Devices
#70
March 25 · 1 hr 2 min
How Cheap KVMs Could Be Your Network's Weak Link - BTS #70
In this episode, we explore the security vulnerabilities of low-cost IP-based KVMs, including firmware flaws, default credentials, and insecure update mechanisms. Two Eclypsium researchers, Paul and Rey, discovered the vulnerabilities and shared the details and behind-the-scenes details! We also discuss real-world testing, vendor responses, and best practices for securing remote management devices in enterprise environments. Chapters 00:00 Introduction to KVM Vulnerabilities 03:00 Research Background and Team Introduction 05:57 Exploring GLINet and Initial Findings 09:03 Firmware Analysis and Security Expectations 11:58 Vulnerability Disclosure and Response 15:07 Enterprise Risks and Deployment Concerns 17:59 Security Best Practices for KVMs 21:06 Vendor Responses and Community Engagement 23:49 Unique Vulnerabilities in SiP and JetKVM 27:01 Conclusion and Future Directions 31:26 Vulnerability Research and Tool Development 34:14 Vendor Communication and Disclosure Challenges 37:51 Firmware Update Issues and Security Concerns 39:12 The Importance of Reviews and Brand Trust 41:42 Security Best Practices for KVMs 45:38 Network Segmentation and Device Security 49:26 Discovering IoT Devices on the Network 52:11 Open Source Solutions and Community Engagement 55:58 The Future of KVM Security and Regulation
#69
March 5 · 1 hr 4 min
Navigating Network Edge Vulnerabilities - BTS #69
In this episode of Below the Surface, Paul Asadoorian, Vlad Babkin, and Adrian Sanabria discuss the ongoing vulnerabilities in network edge devices, the implications of legacy systems like Avanti, and the strategies employed by threat actors. They explore the importance of monitoring and detection in cybersecurity, as well as innovative deception techniques to enhance security measures against exploitation. In this conversation, the speakers delve into various aspects of cybersecurity, including innovative strategies to enhance security, the challenges posed by vendor cooperation, the implications of cyber insurance, and the importance of visibility in threat detection. They discuss the use of canary tokens, the exploitation of edge devices, and the reality of zero-day vulnerabilities. The conversation also touches on the need for firmware updates, the shift towards open-source solutions, and the role of AI in developing cybersecurity tools. Chapters 00:00 Introduction to Below the Surface Podcast 03:27 Network Edge Vulnerabilities and Trends 10:02 Understanding Avanti and Its Impact 12:44 The Consequences of Legacy Systems 18:03 Exploitation Techniques and Threat Actor Strategies 26:50 The Importance of Monitoring and Detection 31:14 Deception Techniques for Enhanced Security 32:55 Leveraging Canary Tokens for Enhanced Security 34:41 The Challenge of Vendor Cooperation in Cybersecurity 35:30 Understanding Cyber Insurance and Its Implications 36:25 The Importance of Visibility in Cyber Defense 39:12 Utilizing Low-Interaction Honeypots for Threat Intelligence 41:48 Exploiting Vulnerabilities in Edge Devices 43:27 The Reality of Zero-Day Vulnerabilities 45:04 Analyzing Recent Exploits in Network Devices 49:02 The Need for Firmware Updates and Alternatives 50:33 Exploring Tailscale and Remote Access Solutions 54:33 Building Secure Lab Environments 56:52 The Shift Towards Open Source in Cybersecurity 01:00:27 Innovations in Memory Forensics 01:03:02 AI's Role in Enhancing Cybersecurity Tools
#68
February 11 · 1 hr 2 min
Attacking Power Grids - BTS #68
In this episode, the hosts discuss various cybersecurity threats, including Russian cyber attacks on critical infrastructure, the vulnerabilities in firewalls and VPNs, and the implications of AI in cybersecurity. They explore the increasing trend of using Python for malicious purposes and the challenges posed by gaming anti-cheat drivers. The conversation also touches on the escalation of cyber warfare and the confused deputy problem in AI, highlighting the need for better security measures and awareness in the industry. Chapters 00:00 Introduction to Cybersecurity Threats 02:52 Russian Cyber Attacks on Poland's Power Grid 10:33 The Flaws in Firewall Security 15:02 AI and the Future of Cybersecurity 22:22 Exploiting Vulnerabilities in Gaming Anti-Cheat Drivers 29:47 Driver Attestation and Security Transparency 35:17 Critical Infrastructure and Cybersecurity Threats 39:50 Linux Malware and Python Exploits 45:47 Firmware Complexity and Security Risks 51:19 Cyber Insurance and Responsibility in Cybersecurity 56:52 Confused Deputy Attack and AI Security Risks
#67
January 27 · 1 hr
BIOS Password Cracking, Secure Boot, and Stackwarp - BTS #67
In this episode, the hosts discuss various cybersecurity topics, including the challenges of BIOS password cracking, the implications of AMD's Stack Warp vulnerability, and the importance of up-to-date secure boot certificates. They also explore the risks associated with network security appliances, the costs of cybersecurity, and the role of marketing in raising awareness. Additionally, they share insights from an X-ray analysis of USB cables, highlighting the differences between quality and counterfeit products. BIOS password cracking can be complex and time-consuming. Physical access to hardware can significantly impact security measures. The Stack Warp vulnerability poses serious risks to virtual machines. Secure boot certificates need regular updates to maintain security. Network security appliances can introduce new vulnerabilities. Cybersecurity costs often outweigh the perceived benefits of cloud solutions. Marketing plays a crucial role in raising awareness about cybersecurity issues. X-ray analysis can reveal the quality of electronic components. Understanding the shared responsibility model is essential for IT teams. The balance between security and operational efficiency is a constant challenge. Chapters 01:59 Introduction to Below the Surface Podcast 04:46 BIOS Password Cracking Techniques 10:14 Exploring AMD's Stack Warp Vulnerability 22:03 Migration Trends in Cloud Computing 23:22 Cost vs. Security in On-Premises Solutions 24:37 Shared Responsibility in Network Security Appliances 27:03 The Risks of Network Security Appliances 28:14 Exploitation of Vulnerabilities in Network Devices 31:18 Challenges in Updating Network Security Appliances 34:59 The Slow Response to Vulnerabilities 39:05 The Complexity of Firmware Updates 45:45 Secure Boot Certificates and Future Vulnerabilities 49:12 Fun Innovations: X-ray Machine in the Office
#66
January 15 · 56 min
Beyond the Label: The Truth About Hardware Trust - BTS #66
In this episode of Below the Surface, host Paul Asadoorian is joined by co-hosts Larry Pesci, Joshua Marpet, and Vlad Babkin to delve into the complexities of hardware supply chain security. The discussion is sparked by a presentation from Andrew 'Bunny' Wong at Black Hat Asia, which raised critical questions about how we can trust the silicon in our devices. The conversation explores the challenges of validating hardware components, the potential for backdoors in devices, and the implications of counterfeit components in the supply chain. The hosts share anecdotes and insights about their experiences with hardware security, emphasizing the need for independent testing and the importance of understanding the provenance of hardware components. 00:00 Introduction to Hardware Supply Chain Security 02:53 Understanding Trust in Silicon 05:55 Challenges in Validating Hardware Components 09:01 Historical Context of Hardware Tampering 11:58 The Complexity of Supply Chains 14:55 Operationalizing Hardware Validation 18:01 The Role of Independent Researchers 20:59 Bounties and Community Involvement 23:56 Innovative Techniques for Hardware Analysis 27:06 The Future of Hardware Security 31:57 The Evolution of Computing: From Transistors to Quantum 36:11 Understanding Hardware Trust and Supply Chain Risks 41:52 The Need for Continuous Monitoring and Assurance 55:31 The Future of High Assurance Devices and Backdoors
#65
Dec 15, 2025 · 1 hr
Exploring AI in Firmware Analysis - BTS #65
Summary In this episode, special guest Matt Brown joins us to discuss the integration of AI in firmware analysis, exploring its benefits and challenges. We delve into the transition from traditional methods to AI-driven approaches, emphasizing the importance of prompt specificity for effective vulnerability discovery. The conversation also covers the role of open-source components, the need for guardrails in AI use, and the implications of AI-generated reports in cybersecurity. Additionally, they touch on man-in-the-middle techniques and the future of AI in firmware development, highlighting the creative monetization of vulnerabilities in IoT devices. Takeaways * AI is revolutionizing firmware analysis and vulnerability discovery. * Specificity in prompts is crucial for effective AI usage. * Open-source components can enhance analysis results significantly. * Guardrails are necessary to prevent AI from executing harmful commands. * AI can assist in code refactoring and documentation generation. * NTP spoofing can reveal vulnerabilities in time-sensitive applications. * AI-generated reports may lead to false positives in vulnerability assessments. * Man-in-the-middle techniques are essential for testing device security. * The future of AI in firmware development is promising but complex. * Understanding the context of vulnerabilities is key to accurate reporting. Chapters 00:00 Introduction to Firmware Analysis and AI Tools 01:54 Transitioning from Traditional Tools to AI 04:28 Specific Techniques for Vulnerability Discovery 06:29 Dynamic Analysis vs. Static Analysis 08:30 Using AI for Code Generation and Documentation 11:43 Interacting with Firmware and Devices 15:57 Creating Custom Tools and Skills for AI 18:53 Recent Projects and Use Cases in Firmware Analysis 22:48 Challenges and Risks of Using AI in Security Research 28:36 The Future of AI in Firmware Development 29:43 AI in Code Review and Vulnerability Detection 33:35 Limitations of AI in Understanding Logic 37:54 Challenges with AI-Generated Vulnerability Reports 43:13 Man-in-the-Middle Techniques and Tools 53:24 Exploring IoT Device Vulnerabilities
#64
Nov 24, 2025 · 1 hr 8 min
Patching, Evil AI, Supply Chain Breaches - BTS #64
Summary In this episode, the hosts discuss various cybersecurity topics, including recent vulnerabilities in Fortinet products, the implications of supply chain breaches, the evolving role of AI in cybersecurity, and updates to the OWASP Top 10 list. They emphasize the importance of firmware security and the need for better visibility and standards in the industry. The conversation highlights the challenges faced by defenders in a rapidly changing threat landscape and the necessity for proactive measures to secure systems. Takeaways Fortinet vulnerabilities are critical and require immediate attention. Silent patches can lead to significant security risks. AI is being used by both attackers and defenders in cybersecurity. The OWASP Top 10 has been updated to include software supply chain failures. Firmware security is often overlooked but is essential for device safety. Supply chain breaches can have far-reaching implications for organizations. Visibility into firmware and device security is lacking in the industry. Standards for software security are necessary to protect against vulnerabilities. Defenders need better tools to combat evolving threats. The cybersecurity landscape is becoming increasingly complex and interconnected. Chapters 00:00 Introduction and Technical Setup 03:08 Fortinet Vulnerabilities and Exploits 06:05 Public Exploits and Path Traversal Vulnerabilities 09:00 Chaining Vulnerabilities and Risk Assessment 11:50 Authentication and Vulnerability Scoring 15:04 Operational Complexity in Patch Management 17:55 Silent Patches and Their Implications 20:58 Challenges with Network Device Security 24:55 Cyber Insurance and Vulnerability Trends 27:58 The Impact of Silent Patches 30:46 End of Life Devices and Legacy Systems 34:58 Supply Chain Security and Source Code Theft 39:44 AI in Cybersecurity: Opportunities and Threats 47:17 Navigating AI's Guardrails and Malicious Use Cases 49:24 The Dilemma of AI and Harmful Intentions 52:44 The Need for Researcher Access to AI Tools 58:36 OWASP Top 10 Updates and Supply Chain Security 01:05:12 The Challenges of Firmware and Device Security
#63
Oct 30, 2025 · 1 hr
F5 Breach, Linux Malware, and Hacking Banks - BTS #63
Summary In this episode of Below the Surface, Paul Asadoorian and Chase Snyder delve into various cybersecurity topics, including the use of Raspberry Pi in cyber attacks, the implications of the F5 breach, and the emergence of Polar Edge malware targeting QNAP devices. They also discuss the innovative Two-Face Rust binary technique, the critical nature of authentication bypass vulnerabilities, and the evolving landscape of air-gapped systems. The conversation highlights the increasing risk posed by old vulnerabilities and the need for improved security measures in the face of advancing cyber threats. Articles: https://reporter.deepspecter.com/f5-is-misleading-the-market-the-breach-is-nowhere-near-contained-a766d932c582 https://blog.sekoia.io/polaredge-backdoor-qnap-cve-2023-20118-analysis/ https://www.group-ib.com/blog/unc2891-bank-heist/ https://www.synacktiv.com/en/publications/creating-a-two-face-rust-binary-on-linux https://www.dell.com/support/kbdoc/en-us/000382899/dsa-2025-393-security-update-for-storage-center-dell-storage-manager-vulnerabilities https://www.trendmicro.com/en_us/research/25/j/operation-zero-disco-cisco-snmp-vulnerability-exploit.html
#62
Oct 21, 2025 · 53 min
Unpacking the F5 Breach, Framework UEFI Shells - BTS #62
In this episode, the hosts discuss the recent F5 breach, exploring the implications of the attack, the tactics used by threat actors, and the importance of vulnerability disclosure. They delve into the complexities of securing network edge devices, the challenges posed by Linux security, and the need for standardization in security practices. The conversation also touches on the future of firmware security and the necessity for proactive measures in incident response. We also close out the show taking about the recent Framework UEFI shell vulnerability. Chapters 00:00 Introduction to F5 Breach and UEFI Secure Boot Bypass 02:16 Details of the F5 Breach 04:59 Threat Actor Analysis and Implications 07:18 Vulnerability Disclosure and Exploitation Risks 10:17 Security Measures and Key Management 12:57 Proactive Defense Strategies 15:52 The Evolving Threat Landscape 18:41 Challenges in Securing Network Devices 21:10 Linux Security and Customization Issues 25:16 Kernel Customization Challenges 27:08 Security Through Obscurity 29:04 Application Security and Development Practices 33:59 Framework's UEFI Shell Vulnerability 38:22 Interdependency in Technology Ecosystems 41:48 The Need for Transparency in Signed Software

Showing 1–20 of 21 episodes