Patterns and Anti-Patterns in Embedded Development: What Security Incidents...
summary
Covers concrete 2023 incidents: GPS-locked trains whose firmware embeds location/date conditions and per-unit build paths; leaked signing keys from an MSI ransomware incident with no revocation mechanism so keys remain usable; HTTP/2 Rapid Reset CVE-2023-44487 causing amplification DoS mitigated by per-client in‑flight limits (flighthttpd, nghttp2 patches); kernel failures including BPF verifier and a driver bug — two of 11 CVEs scoring 9+ — and an XZ backdoor in 5.60/5.61 that slipped in via maintainer scripts.
AI-written summary · about
chapters (11)
- 0:00Embedded security incidents
- 1:29Speaker background and talk overview
- 2:12Bricked trains and GPS locks
- 8:35HTTP/2 rapid reset
- 12:14MSI ransomware and secure boot
- 15:55Linux kernel 2023 security
- 20:58XZ backdoor in liblzma
- 24:37Security lessons and best practices
- 27:06Q&A on build failures
- 30:49Q&A on CVSS tracking
- 34:00Q&A and closing
related talks
35mPatterns and Anti-Patterns in Embedded Development: What Security Incidents...
17mEmbedded Security's Weakest Link: Lessons From Simple Mistakes
44mNight of the living vulnerabilities
14mHow not to secure your embedded system, lessons from automotive testing
51mLocknote: Conclusions and Key Takeaways
23mSecure Code, Safe Future: Mastering Security in Critical Software Development
39mNight of the living vulnerabilities
33mUnderstanding the Impact of Critical Vulnerabilities in Critical Infrastructure: A De...