A Measured Response to a Grain of Rice
summary
Shows concrete, tested attacks and cheap proofs of concept: fake USB security tokens (DoB key fake YubiKey), an RSA token opened and soldered with a Bluetooth board, $5 gas-pump skimmers, USB attack tools like the Rubber Ducky and Bash Bunny, and a $7 charging cable with a MediaTek cellular module and SIM that phones home. Demonstrations include reprogramming Phison-like USB controller firmware and USB‑C adapter microcontrollers; Cholesky/NCC write PoCs over I²C and BMC firmware vectors. Advice: audit vendors, verify received hardware, and prioritize realistic threat models over headline hunting.
AI-written summary · about
chapters (16)
- 0:00Introduction
- 1:30Disclaimers
- 2:51What is a Hardware Implant
- 8:57USB Hardware Implant
- 15:16External Ports
- 16:55Inside a Server
- 17:54When Hardware Makes Sense
- 22:28Hardware Advanced Persistent Threat
- 23:28The Big Hack
- 24:18Board Management Controller
- 26:59Grain of Rice Components
- 31:04Is This Real
- 35:10How Did We Get Here
- 42:22What Can We Do
- 45:29Summary
- 45:53Questions
related talks
43mThe Tao of Hardware the Te of Implants
40mWhen hardware attacks scale
44mSilicon Under Attack Physical Exploitation Of Modern Chips
45mKeynote: How to Build Hardware Trojans
31mConquer the Enterprise from Inside
24mIf They Can Touch It, They Own It: The Stories We Tell...
37mHacking a Cat — Going Beyond Traditional Attack Vectors
59mThe Less Hacked Path