Patterns and Anti-Patterns in Embedded Development: What Security Incidents...
summary
Stories of real failures and fixes from 2023: trains whose firmware contains GPS- and date-triggered locks that brick units after maintenance, discovered by reverse engineers; the widespread HTTP/2 Rapid Reset (CVE-2023-44487) amplification flaw and the countermeasure of strict per-client stream limits and rate limiting; stolen MSI private signing keys with no hardware revocation and per-model keys still vulnerable; an XZ backdoor in 5.60/5.61 hidden in obfuscated M4 build scripts; kernel eBPF and driver bugs (two among 11 CVEs scoring ≥9). Practical remedies: mandatory code review, small patches, reproducible builds, offline key storage and revocation.
AI-written summary · about
chapters (11)
- 0:00Embedded security incidents
- 1:29Speaker background and talk overview
- 2:12Bricked trains and GPS locks
- 8:35HTTP/2 rapid reset
- 12:14MSI ransomware and secure boot
- 15:55Linux kernel 2023 security
- 20:58XZ backdoor in liblzma
- 24:37Security lessons and best practices
- 27:06Q&A on build failures
- 30:49Q&A on CVSS tracking
- 34:00Q&A and closing
related talks
35mPatterns and Anti-Patterns in Embedded Development: What Security Incidents...
14mHow not to secure your embedded system, lessons from automotive testing
17mEmbedded Security's Weakest Link: Lessons From Simple Mistakes
44mNight of the living vulnerabilities
41mPanel: Tackling Automotive Hardware Vulnerabilities
21mIndustrial IoT security issues and countermeasures
23mSecure Code, Safe Future: Mastering Security in Critical Software Development
39mNight of the living vulnerabilities