Below the Surface (Audio) - The Supply Chain Security Podcast

Eclypsium

A lively discussion of the threats affecting supply chain, specifically focused on firmware and low-level code that is a blind spot for many organizations. This podcast will feature guests from the cybersecurity industry discussing the problems surrounding supply chain-related issues and potential solutions.

Get the Supply Chain Security Toolkit from Eclypsium here: https://eclypsium.com/go

Play

Open in

25 episodes
fortnightly
Avg 57 min
English

Episodes 25

Newest Oldest Longest

All20 Unplayed20 In progress0 Played0

Counted on this page — what you have heard stays on this device, so it is not something the list can be paged by.

#85
Tuesday · 52 min
Unveiling AI Infrastructure Vulnerabilities - BTS #85
n this episode, the hosts and special guest Jesse Michael discuss new research on AI infrastructure security, focusing on vulnerabilities in Data Processing Units (DPUs) and Baseboard Management Controllers (BMCs). They explore the implications of IOMMU settings, the performance-security trade-offs, and the complex architecture of AI systems. The conversation highlights attack paths and methods for manipulating AI models, emphasizing the need to understand these vulnerabilities in the evolving AI landscape. The speakers also discuss advanced techniques for manipulating AI models, including memory manipulation, model behavior modification, and fine-tuning tools. They discuss how these techniques affect trust and security in AI systems, highlighting the importance of partnerships in strengthening AI infrastructure security. Chapters 00:00 Introduction to AI Infrastructure Security Research 02:02 Exploring the DPU and Its Capabilities 05:07 Understanding IOMMU and Its Security Implications 08:02 Performance vs. Security: The Trade-offs 11:05 The Complex Architecture of AI Infrastructure 14:04 Vulnerabilities in BMC and IPMI 17:01 Accessing the DPU: Attack Paths and Methods 20:07 Manipulating AI Models: Techniques and Risks 25:53 Exploring Memory Manipulation Techniques 31:01 Modifying Model Behavior and System Prompts 35:06 Tools for Model Manipulation and Fine-Tuning 40:37 Trusting AI Models and Security Concerns 45:20 Partnerships and Advancements in AI Security
#84
October 22 · 52 min
Memory Safety, AI security, Auth Challenges - BTS #84
summary In this episode, the hosts discuss various cybersecurity vulnerabilities, focusing on a recent remote code execution vulnerability in Nginx, the role of AI in discovering vulnerabilities, and the importance of memory safety in programming languages. They also explore the challenges of authentication in IoT devices and the need for better secure development practices. The conversation highlights the fragility of IoT infrastructure and the ongoing threat posed by attackers leveraging AI for malicious purposes. In this conversation, the speakers delve into the complexities of cybersecurity, focusing on the challenges posed by AI models, regulatory capture, and the implications of public firmware for critical infrastructure. They discuss how attackers are often better positioned due to fewer restrictions, leading to market manipulation and exploitation of vulnerabilities. The conversation emphasizes the need for a balanced approach to security that does not hinder defenders while addressing the evolving threat landscape. https://securityaffairs.com/201106/security/f5-addressed-critical-rce-flaws-in-nginx.html https://www.streetinsider.com/Investing/Palo+Alto+Networks+drops+on+zero-day+security+flaw+concerns/27196703.html https://www.streetinsider.com/Investing/Palo+Alto+Networks+drops+on+zero-day+security+flaw+concerns/27196703.html https://www.greynoise.io/blog/proxyjacking-edge-devices-residential-proxies https://securityaffairs.com/201106/security/f5-addressed-critical-rce-flaws-in-nginx.html https://unit42.paloaltonetworks.com/ai-campaign-targets-linux-infrastructure/ https://thehackernews.com/2026/10/researchers-demonstrate-openbsd-root.html
#83
October 7 · 50 min
AI's Impact on Cybersecurity - BTS #83
summary In this episode, Paul and Vlad discuss the increasing role of AI in cybersecurity, particularly in vulnerability discovery and exploit creation. They explore the implications of AI on the speed and efficiency of attacks, the state of network edge appliances, and the necessity for device hardening. The conversation also touches on the challenges of monitoring and forensics in network devices, emphasizing the ongoing cat-and-mouse game between attackers and defenders. In this conversation, Vlad and Paul delve into various aspects of cybersecurity, focusing on network appliances, AI safety, and the challenges posed by vulnerabilities in management platforms. They discuss the importance of anomaly detection in network appliances, the implications of NVIDIA's new safety platform, and the ongoing issues with AI sandboxing. The conversation also highlights the difficulties in accessing advanced AI tools for cybersecurity professionals, the trust issues surrounding network appliances, and the risks associated with VPNs. Additionally, they explore the proliferation of Linux privilege escalation vulnerabilities and the novel attack vectors presented by file notification systems. Chapters 00:00 Audio Setup and Technical Issues 02:03 Introduction to AI in Cybersecurity 04:08 AI's Role in Vulnerability Discovery 08:02 Speed vs. Sophistication in Attacks 12:05 The State of Network Edge Appliances 15:45 The Need for Device Hardening 19:52 Challenges with eBPF and Monitoring 23:57 Forensics and Anomaly Detection 25:10 Understanding Network Appliances and Anomaly Detection 28:10 NVIDIA's Open Agent Safety Platform 29:56 AI Safety and Sandboxing Challenges 33:03 Access to AI Tools for Cybersecurity 35:00 Vulnerabilities in Management Platforms 38:58 Trust Issues with Network Appliances 40:03 VPN Appliances and Their Attack Surface 44:00 Proliferation of Linux Privilege Escalation Vulnerabilities 47:03 File Notification System Attacks
#82
September 16 · 59 min
Firmware Analysis, Linux Malware, Future of AI - BTS #82
In this episode of Below the Surface, the hosts discuss cybersecurity topics, including vulnerabilities in UEFI shells, vendor trust issues, Citrix's new dual-boot solution, and techniques for bypassing Windows Defender. They also explore the implications of AI in Linux environments and the ongoing controversy surrounding AI math theft. In this conversation, Vlad and Paul discuss OpenAI's recent controversial achievement in solving a significant mathematical problem, raising ethical concerns about data usage and the implications for the AI community. They explore the future of local AI models, innovations in firmware analysis tools, and techniques attackers use on Linux systems. The discussion emphasizes the importance of cybersecurity practices and the need to stay vigilant about potential vulnerabilities. Articles: https://nerds.xyz/2026/08/citrix-uniconos-linux-dual-boot-windows-recovery/ https://ipurple.team/2026/09/09/windows-security-center/ https://x.com/rynorhn/status/2097223532438487463 https://brownfinesecurity.com/blog/introducing-moria-and-mithril https://sansec.io/research/stylesmuggler-0day Chapters 00:00 Introduction to Below the Surface Podcast 02:06 Vulnerability in UEFI Shells 14:16 Trust Issues with Vendors 15:46 Citrix's Unicon OS: A Dual Boot Solution 21:28 Windows Defender Bypass Techniques 26:54 AI and Linux: New Developments 32:06 The Controversy Over AI Math Theft 32:10 OpenAI's Controversial AI Achievement 35:13 The Ethics of AI and Data Usage 38:12 The Future of Local AI Models 39:19 Innovations in Firmware Analysis Tools 44:58 Understanding Linux Malware Techniques 52:05 Best Practices for Securing Linux Systems
#81
September 3 · 51 min
Infratrust Pulse, AI's Role in Security - BTS #81
In this episode, Paul and Vlad discuss the latest Infratrust Pulse report, highlighting vulnerability trends, the role of AI in cybersecurity, and the importance of visibility and control in network security. They delve into threats posed by BMCs and management planes, the challenges of persistence mechanisms, and the need for better vendor responsiveness and API practices to strengthen security. In this conversation, Vlad and Paul discuss the evolving role of AI in cybersecurity, particularly its use by threat actors to exploit vulnerabilities. They explore the implications of AI in vulnerability discovery, the importance of secure software development practices, and the risks associated with backdoors in surveillance technology. The discussion emphasizes the need for organizations to adopt better security measures and the potential of AI to enhance software quality and security. Articles: * https://pulse.infra-trust.org/august-2026/ * https://blog.quarkslab.com/defeating-ai-assisted-reverse-engineering-or-at-least-trying-to.html * https://securityaffairs.com/197764/hacking/slovakia-warns-of-cyber-risks-in-road-speed-cameras.html * https://cyberscoop.com/ubiquiti-unifi-critical-vulnerabilities-patched/ * https://blog.talosintelligence.com/uat-10147-chinese-speaking-adversary-integrates-agentic-ai-into-post-compromise-operations/ * https://blog.trailofbits.com/2026/08/26/vms-wont-contain-cyber-capable-agents/ Chapters 00:00 Introduction to Infratrust Pulse and AI in Cybersecurity 05:56 Trends in Vulnerabilities and AI's Role 09:36 The Threat Landscape: BMCs and Management Planes 13:52 Persistence Mechanisms and Forensic Challenges 18:34 Visibility and Control in Network Security 23:41 Vendor Responsiveness and API Best Practices 26:08 AI in Cybersecurity: Threats and Opportunities 30:00 The Role of AI in Vulnerability Discovery 34:00 AI's Impact on Software Development and Security 39:06 Best Practices for Secure Software Development 44:14 Addressing Backdoors in Surveillance Technology
#80
August 13 · 59 min
Exploring BMC Vulnerabilities - BTS #80
Summary In this episode, the hosts discuss various cybersecurity topics, including the lack of media coverage from the Black Hat conference, the implications of AI in cybersecurity, and the vulnerabilities associated with Baseboard Management Controllers (BMCs). They explore the challenges of patch management, the role of embedded Linux in security vulnerabilities, and the emerging trends in threat actor behavior. The conversation emphasizes the need for better awareness and action regarding BMC vulnerabilities and the importance of understanding the risks associated with AI in security. In this conversation, the speakers delve into the complexities of operational risks associated with AI models, particularly in the context of patch management and firmware security. They discuss the challenges of relying on AI for code reviews and the implications of backdoors found in firmware. The conversation also highlights the critical importance of true randomness in cryptographic applications and the ongoing risks posed by speculative execution attacks. Chapters 00:00 Introduction and Technical Setup 03:01 Black Hat Conference Coverage and Media Silence 06:00 AI and Cybersecurity: Responsibility and Ethics 08:51 BMC Vulnerabilities: Research and Findings 11:57 Scanning Techniques and Tools for BMCs 15:02 Cisco Vulnerabilities and Patch Management Challenges 17:54 The Role of AI in Vulnerability Discovery and Management 21:13 Emerging Threats and Trends in Cybersecurity 24:00 Conclusion and Future Considerations 34:03 Understanding Operational Risks in AI Models 37:10 The Challenges of Patch Management and Configuration 41:26 The Dangers of AI in Code Review 43:00 Backdoors in Firmware: A Growing Concern 49:13 The Importance of True Randomness in Cryptography 58:08 The Implications of Speculative Execution Attacks
#79
August 7 · 54 min
InfraTrust - Understanding Infrastructure Vulnerabilities & Risk - BTS #79
Check out our free and no-registration-required site for understanding and tracking infrastructure vulnerabilities and advisories: https://infra-trust.org In this episode, the hosts discuss the challenges of collecting and aggregating vulnerability data, the introduction of Infratrust and Infratrust Pulse, and the importance of actionable data for cybersecurity teams. They explore the differences between vendor advisories and CVEs, the role of Eclipsium in data aggregation, and the ongoing challenges in vulnerability management and patching. The conversation highlights the need for a centralized source of truth for infrastructure vulnerabilities and the evolving landscape of cybersecurity threats. In this conversation, the speakers delve into the complexities of vulnerability management, particularly in the context of AI's rapid evolution in vulnerability discovery. They discuss the biases affecting vulnerability prioritization, the implications of AI on both offensive and defensive capabilities, and the critical risks associated with exposing Baseboard Management Controllers (BMCs) to the internet. The conversation emphasizes the need for better security practices and awareness in the face of evolving threats. Chapters 00:00 Technical Challenges in Data Collection 02:58 Introduction to Infratrust and Infratrust Pulse 05:57 The Evolution of Infrastructure Pulse 09:02 Understanding Vendor Advisories vs CVEs 11:49 The Importance of Actionable Data 14:46 Navigating Vendor Advisory Inconsistencies 17:51 The Role of Eclipsium in Data Aggregation 20:46 Patching Challenges and Vulnerability Management 24:09 Interpreting Risk Scores and Vulnerability Impact 30:34 Understanding Vulnerability Management Challenges 32:43 The Impact of AI on Vulnerability Discovery 35:24 The Arms Race: Offensive vs Defensive Capabilities 38:41 The Dangers of Exposing BMCs to the Internet 41:31 BMC Vulnerabilities: A Deep Dive 49:29 Mitigating Risks: Best Practices for BMC Security
#78
July 16 · 56 min
Patching: The Race Against Time - BTS #78
In this episode, the hosts discuss various vulnerabilities affecting network devices, the importance of timely patching in enterprises, and the implications of AI on security. They explore the challenges of compliance programs, the significance of dependency management in software, and the need for better privilege separation in network devices. The conversation also touches on the risks of supply chain attacks and the detection of orphaned packages in software ecosystems. Chapters 00:00 Introduction to Vulnerabilities and Security Trends 02:49 Router Choices and Security Implications 10:41 The Need for Faster Patching in Enterprises 12:22 The Impact of AI on Security and Exploits 18:31 Challenges with Compliance and Vulnerability Management 24:17 The Importance of Dependency Management in Software 30:54 Supply Chain Attacks and Their Consequences 35:34 Privilege Separation and Device Security 40:40 The Role of AI in Exploit Development 53:43 Detecting Orphaned Packages and Security Risks
#77
June 30 · 54 min
FortiBleed Uncovered: How Attackers Harvest Credentials from Fortinet Devices - BTS #77
In this episode, we delve into the recent FortiBleed campaign, exploring how attackers harvest credentials from Fortinet devices, the vulnerabilities in password management, and best practices for defenders to mitigate such threats. Key topics FortiBleed campaign details and impact Password hash vulnerabilities in FortiOS AI's role in analyzing large security breaches Credential harvesting techniques and defenses Importance of layered security and best practices Chapters 00:00 Introduction and Initial Thoughts on AI Models 10:04 Credential Harvesting and Security Weaknesses 19:58 Hash Management and Security Appliances 30:15 Incident Response and Vulnerability Management 39:46 The Future of Security in the Age of AI
#76
June 16 · 1 hr
Binwalk, Brickstorm, AI Model Madness - BTS #76
summary In this episode of Below the Surface, Paul Asadoorian, Chase Snyder, and Vlad Babkin discuss the implications of AI in cybersecurity, the challenges posed by AI guardrails, and the operational risks associated with applying patches. They also explore vulnerabilities in security tools like Binwalk, the complexities of firmware update tools, and the importance of transparency in software signing, particularly in the context of open source software. In this conversation, the speakers delve into the complexities of cybersecurity, focusing on the limitations of security through obscurity, the challenges posed by UEFI shells and secure boot, and the operational risks associated with DBX updates. They discuss the difficulties in vulnerability management and the role of AI in cybersecurity, highlighting how it may benefit attackers more than defenders. The conversation also touches on emerging threats like Brickstorm malware and the need to rethink edge device security in light of these challenges. Finally, they emphasize the necessity for all companies to adopt robust cybersecurity measures. Chapters 00:00 Introduction to Below the Surface Podcast 01:16 The Rise of AI and Its Implications 06:42 Challenges with AI Guardrails and Restrictions 10:53 Operational Risks in Cybersecurity 17:01 Vulnerabilities in Security Tools 20:11 Exploring Firmware Update Tools 29:07 The Importance of Open Source in Security 34:07 The Need for Transparency in Software Signing 35:12 The Fallacy of Security Through Obscurity 36:36 The Challenges of UEFI Shells and Secure Boot 39:58 The Complexity of DBX Updates and Operational Risks 43:20 The Difficulty of Vulnerability Management 48:11 AI's Role in Cybersecurity: A Double-Edged Sword 52:59 Emerging Threats: The Rise of Brickstorm Malware 55:54 Rethinking Edge Device Security 01:00:08 The Future of Cybersecurity Infrastructure
#75
June 3 · 55 min
Secure Boot Certificates Expiring: What You Need to Know - BTS #75
In this episode of Below the Surface, the team discusses recent cybersecurity trends, including the Verizon DBIR 2026 report, secure boot certificate expirations, and the evolving threat landscape with AI and hardware vulnerabilities. They explore how organizations can adapt their defense strategies to stay ahead of attackers and share insights on supply chain security and malware analysis. https://eclypsium.com/blog/microsoft-secure-boot-certificates-expire-2026/ https://eclypsium.com/blog/verizon-dbir-2026/ https://github.com/iss4cf0ng/OpenPetya https://gbhackers.com/exploit-f5-big-ip-ssh-access/ https://www.microsoft.com/en-us/security/blog/2026/05/22/from-edge-appliance-to-enterprise-compromise-multi-stage-linux-intrusion-via-f5-and-confluence/ https://cybersecuritynews.com/china-linked-hackers-target-southeast-asian-edge-routers/ https://qiita.com/Y4er/items/0b6071745e4b7b240b3e https://www.greynoise.io/blog/sonicwall-scanning-spike-echoes-pattern-preceded-cve-2026-0400 YellowKey update: https://www.reddit.com/r/sysadmin/comments/1tkq3x9/yellowkey_bitlocker_exploit_repo_taken_down/ Chapters 00:00 Introduction and Technical Issues 02:56 Verizon DBIR Insights 05:50 Trends in Vulnerability Management 09:04 The Role of AI in Cybersecurity 12:11 Challenges in Vulnerability Management 14:46 Secure Boot Certificates and Their Implications 29:52 Managing Updates and Security Risks 32:57 The Open Petya Project: A Historical Perspective 36:11 Understanding the Yellow Key Attack 39:34 The Dilemma of Independent Researchers 41:34 The Future of Bug Bounty Programs 43:59 The Evolving Landscape of Vulnerabilities 49:51 Visibility Challenges in Network Security 56:16 The Need for Better Information Sharing
#74
May 19 · 54 min
YellowKey, CVE Enrichment, Chipmaker Breach - BTS #74
In this episode, we explore recent vulnerabilities, the YellowKey BitLocker bypass, supply chain security, CVE data analysis, and the implications of hardware breaches like the one at Foxconn. We also delve into AI's role in vulnerability research and the evolving landscape of cybersecurity threats. Topics https://www.nist.gov/news-events/news/2026/04/nist-updates-nvd-operations-address-record-cve-growth https://github.com/Nightmare-Eclipse/YellowKey https://socket.dev/blog/tanstack-npm-packages-compromised-mini-shai-hulud-supply-chain-attack https://x.com/AlvieriD/status/2053835732658143416 Chapters 00:00 Introduction to Vulnerability Research and AI 03:42 NIST and CVE Growth Challenges 06:46 Building Tools for CVE Analysis 10:58 The Complexity of CVSS Scoring 15:08 CISA's Role in Vulnerability Enrichment 18:06 Challenges in CWE and CPE Data 19:55 The Future of Vulnerability Research 27:18 BitLocker Bypass: A Case Study 33:05 Exploring the Complexity of Windows Features 34:49 Speculation on Microsoft and Conspiracy Theories 35:57 The Impact of BIOS Passwords on Security 39:12 The Foxconn Breach: A Major Data Compromise 47:34 Supply Chain Attacks on Package Managers 51:13 Deceptive Techniques in Cybersecurity
#73
May 7 · 55 min
Uncovering Firmware Risks: From Y2K to Modern Malware - BTS #73
In this episode of Below the Surface, hosts Paul Asadoorian, Chase Snyder, and guest Brian Richardson explore the evolution of firmware security, the risks of supply chain vulnerabilities, and the latest threats targeting network edge devices like Cisco ASA and FTD. They discuss historical malware like the Chernobyl virus, modern malware campaigns such as Firestarter, and the challenges of securing complex network infrastructure in a rapidly evolving threat landscape. Links: https://www.linkedin.com/news/story/white-house-pushes-back-on-anthropics-mythos-expansion-8741242/ https://www.tomshardware.com/tech-industry/cyber-security/the-chernobyl-virus-turned-27-today-and-it-could-brick-your-pc-in-ways-modern-malware-cant https://blog.talosintelligence.com/uat-4356-firestarter/ Chapters 00:00 Introduction to Below the Surface 02:20 Brian's Transition to Eclipseum 03:50 The Y2K Experience and Early Virus Detection 06:31 The CIH Virus and Its Impact 10:12 BIOS Security and Vulnerabilities 14:10 The Importance of Firmware Lockdown 18:09 Modern Threats and UEFI Attacks 22:13 Targeted Malware and Ransomware Risks 25:21 Creative Concepts in Cybersecurity 26:20 Emerging Threats: Firestarter Malware 30:54 The Security of Network Devices 35:17 Challenges in Managing Security Appliances 39:52 Persistence of Malware and Its Implications 43:02 The Evolving Landscape of Cyber Threats 49:44 AI and Cybersecurity: The Anthropic Dilemma
#72
April 17 · 58 min
AI-Powered Firmware Hacking: The Future of Vulnerability Discovery - BTS #72
In this episode, the hosts explore the latest in cybersecurity, including AI-driven vulnerability discovery, firmware analysis tools, secure boot complexities, and recent CVE trends. They discuss practical techniques for hacking devices, the challenges of firmware emulation, and the implications of new security policies on consumer and enterprise hardware. Chapters 00:00 Introduction to Hacking and Security Updates 03:24 Exploring Samsung TV Hacking 06:34 AI in Vulnerability Research 11:17 The Role of AI in Exploiting Vulnerabilities 15:18 CVE Disclosure and Ethical Considerations 20:43 AI Tools and Instrumentation in Development 24:41 Emerging Tools for Firmware Analysis 28:14 Navigating Linux Security Challenges 29:12 The Surge of CVEs: Understanding the Growth 31:29 The Role of AI in Vulnerability Discovery 34:50 CVE Enrichment: The Need for Contextual Data 36:57 Microsoft's Secure Boot: A Double-Edged Sword 46:43 Vulnerabilities in Bootloaders: A Case Study 51:25 The Complexity of Secure Boot Management 53:24 Regulatory Challenges in Router Security
#71
April 7 · 1 hr 1 min
What Makes a Device a Router? - BTS #71
summary In this episode, the hosts discuss the new FCC regulations regarding consumer routers, exploring the implications for cybersecurity, the definitions of what constitutes a router, and the challenges of manufacturing compliant devices. They delve into the debate surrounding the effectiveness of these regulations in mitigating cyber risks, the role of hardware versus software vulnerabilities, and the potential impact on consumers and existing devices in homes. In this conversation, the hosts discuss the implications of the FCC's decision to decertify routers and firmware, the challenges posed by the conditional approval process, and the potential impact on router security and availability. They explore conspiracy theories surrounding the regulations, compare US and EU cybersecurity standards, and address the complexities of hardware backdoors and default credentials. The conversation highlights the need for better security practices and the importance of addressing vulnerabilities in enterprise devices. Chapters 00:00 Introduction to FCC Regulations on Routers 02:35 The Impact of FCC Regulations on Consumer Devices 05:03 Defining What Constitutes a Router 09:51 The Security Implications of Router Regulations 12:41 The Role of Hardware vs. Software in Cybersecurity 17:11 Challenges in Manufacturing and Compliance 21:40 Consumer Impact and Existing Devices 25:59 The Future of Networking Devices and Regulations 29:48 Decertification of Routers and Firmware Challenges 31:58 Conditional Approval Process and Its Implications 34:40 Proposed Solutions for Router Security Standards 36:53 Conspiracy Theories Surrounding Router Regulations 39:26 The Impact of Regulations on Router Availability and Pricing 42:05 Comparing US and EU Cybersecurity Regulations 46:11 The Complexity of Hardware Backdoors and Security 49:11 Addressing Default Credentials and Vulnerabilities 52:02 Conditional Approval Guidance and Its Flaws 54:56 Recent Vulnerabilities in Enterprise Devices
#70
March 25 · 1 hr 2 min
How Cheap KVMs Could Be Your Network's Weak Link - BTS #70
In this episode, we explore the security vulnerabilities of low-cost IP-based KVMs, including firmware flaws, default credentials, and insecure update mechanisms. Two Eclypsium researchers, Paul and Rey, discovered the vulnerabilities and shared the details and behind-the-scenes details! We also discuss real-world testing, vendor responses, and best practices for securing remote management devices in enterprise environments. Chapters 00:00 Introduction to KVM Vulnerabilities 03:00 Research Background and Team Introduction 05:57 Exploring GLINet and Initial Findings 09:03 Firmware Analysis and Security Expectations 11:58 Vulnerability Disclosure and Response 15:07 Enterprise Risks and Deployment Concerns 17:59 Security Best Practices for KVMs 21:06 Vendor Responses and Community Engagement 23:49 Unique Vulnerabilities in SiP and JetKVM 27:01 Conclusion and Future Directions 31:26 Vulnerability Research and Tool Development 34:14 Vendor Communication and Disclosure Challenges 37:51 Firmware Update Issues and Security Concerns 39:12 The Importance of Reviews and Brand Trust 41:42 Security Best Practices for KVMs 45:38 Network Segmentation and Device Security 49:26 Discovering IoT Devices on the Network 52:11 Open Source Solutions and Community Engagement 55:58 The Future of KVM Security and Regulation
#69
March 5 · 1 hr 4 min
Navigating Network Edge Vulnerabilities - BTS #69
In this episode of Below the Surface, Paul Asadoorian, Vlad Babkin, and Adrian Sanabria discuss the ongoing vulnerabilities in network edge devices, the implications of legacy systems like Avanti, and the strategies employed by threat actors. They explore the importance of monitoring and detection in cybersecurity, as well as innovative deception techniques to enhance security measures against exploitation. In this conversation, the speakers delve into various aspects of cybersecurity, including innovative strategies to enhance security, the challenges posed by vendor cooperation, the implications of cyber insurance, and the importance of visibility in threat detection. They discuss the use of canary tokens, the exploitation of edge devices, and the reality of zero-day vulnerabilities. The conversation also touches on the need for firmware updates, the shift towards open-source solutions, and the role of AI in developing cybersecurity tools. Chapters 00:00 Introduction to Below the Surface Podcast 03:27 Network Edge Vulnerabilities and Trends 10:02 Understanding Avanti and Its Impact 12:44 The Consequences of Legacy Systems 18:03 Exploitation Techniques and Threat Actor Strategies 26:50 The Importance of Monitoring and Detection 31:14 Deception Techniques for Enhanced Security 32:55 Leveraging Canary Tokens for Enhanced Security 34:41 The Challenge of Vendor Cooperation in Cybersecurity 35:30 Understanding Cyber Insurance and Its Implications 36:25 The Importance of Visibility in Cyber Defense 39:12 Utilizing Low-Interaction Honeypots for Threat Intelligence 41:48 Exploiting Vulnerabilities in Edge Devices 43:27 The Reality of Zero-Day Vulnerabilities 45:04 Analyzing Recent Exploits in Network Devices 49:02 The Need for Firmware Updates and Alternatives 50:33 Exploring Tailscale and Remote Access Solutions 54:33 Building Secure Lab Environments 56:52 The Shift Towards Open Source in Cybersecurity 01:00:27 Innovations in Memory Forensics 01:03:02 AI's Role in Enhancing Cybersecurity Tools
#68
February 11 · 1 hr 2 min
Attacking Power Grids - BTS #68
In this episode, the hosts discuss various cybersecurity threats, including Russian cyber attacks on critical infrastructure, the vulnerabilities in firewalls and VPNs, and the implications of AI in cybersecurity. They explore the increasing trend of using Python for malicious purposes and the challenges posed by gaming anti-cheat drivers. The conversation also touches on the escalation of cyber warfare and the confused deputy problem in AI, highlighting the need for better security measures and awareness in the industry. Chapters 00:00 Introduction to Cybersecurity Threats 02:52 Russian Cyber Attacks on Poland's Power Grid 10:33 The Flaws in Firewall Security 15:02 AI and the Future of Cybersecurity 22:22 Exploiting Vulnerabilities in Gaming Anti-Cheat Drivers 29:47 Driver Attestation and Security Transparency 35:17 Critical Infrastructure and Cybersecurity Threats 39:50 Linux Malware and Python Exploits 45:47 Firmware Complexity and Security Risks 51:19 Cyber Insurance and Responsibility in Cybersecurity 56:52 Confused Deputy Attack and AI Security Risks
#67
January 27 · 1 hr
BIOS Password Cracking, Secure Boot, and Stackwarp - BTS #67
In this episode, the hosts discuss various cybersecurity topics, including the challenges of BIOS password cracking, the implications of AMD's Stack Warp vulnerability, and the importance of up-to-date secure boot certificates. They also explore the risks associated with network security appliances, the costs of cybersecurity, and the role of marketing in raising awareness. Additionally, they share insights from an X-ray analysis of USB cables, highlighting the differences between quality and counterfeit products. BIOS password cracking can be complex and time-consuming. Physical access to hardware can significantly impact security measures. The Stack Warp vulnerability poses serious risks to virtual machines. Secure boot certificates need regular updates to maintain security. Network security appliances can introduce new vulnerabilities. Cybersecurity costs often outweigh the perceived benefits of cloud solutions. Marketing plays a crucial role in raising awareness about cybersecurity issues. X-ray analysis can reveal the quality of electronic components. Understanding the shared responsibility model is essential for IT teams. The balance between security and operational efficiency is a constant challenge. Chapters 01:59 Introduction to Below the Surface Podcast 04:46 BIOS Password Cracking Techniques 10:14 Exploring AMD's Stack Warp Vulnerability 22:03 Migration Trends in Cloud Computing 23:22 Cost vs. Security in On-Premises Solutions 24:37 Shared Responsibility in Network Security Appliances 27:03 The Risks of Network Security Appliances 28:14 Exploitation of Vulnerabilities in Network Devices 31:18 Challenges in Updating Network Security Appliances 34:59 The Slow Response to Vulnerabilities 39:05 The Complexity of Firmware Updates 45:45 Secure Boot Certificates and Future Vulnerabilities 49:12 Fun Innovations: X-ray Machine in the Office
#66
January 15 · 56 min
Beyond the Label: The Truth About Hardware Trust - BTS #66
In this episode of Below the Surface, host Paul Asadoorian is joined by co-hosts Larry Pesci, Joshua Marpet, and Vlad Babkin to delve into the complexities of hardware supply chain security. The discussion is sparked by a presentation from Andrew 'Bunny' Wong at Black Hat Asia, which raised critical questions about how we can trust the silicon in our devices. The conversation explores the challenges of validating hardware components, the potential for backdoors in devices, and the implications of counterfeit components in the supply chain. The hosts share anecdotes and insights about their experiences with hardware security, emphasizing the need for independent testing and the importance of understanding the provenance of hardware components. 00:00 Introduction to Hardware Supply Chain Security 02:53 Understanding Trust in Silicon 05:55 Challenges in Validating Hardware Components 09:01 Historical Context of Hardware Tampering 11:58 The Complexity of Supply Chains 14:55 Operationalizing Hardware Validation 18:01 The Role of Independent Researchers 20:59 Bounties and Community Involvement 23:56 Innovative Techniques for Hardware Analysis 27:06 The Future of Hardware Security 31:57 The Evolution of Computing: From Transistors to Quantum 36:11 Understanding Hardware Trust and Supply Chain Risks 41:52 The Need for Continuous Monitoring and Assurance 55:31 The Future of High Assurance Devices and Backdoors

Showing 1–20 of 25 episodes