Saving the Day by Stack Smashing a Hundred Streetlights before Sunrise
summary
Customer deployment has a bad update that reconfigures the external flash chip select and breaks remote updates; an off-by-one bug in an undocumented API allows 120 bytes to overflow a three‑byte stack buffer. The recovery uses a stack smash attack to inject a 48‑byte patch into RAM, sent over an active TLS connection, takes about 5–10 minutes per node and completes a hotfix plus proper firmware update across 100 streetlights in roughly two hours, and it works.
AI-written summary · about
chapters (4)
related talks
29mFrom an URGENT/11 Vulnerability to a Full Take-Down of a Factory, Using a Single Packet
44mExposing Critical Threats In Millions Of Connected Devices
40mOver the Air, Under the Radar: Attacking and Securing the Pixel Modem
38mFail Harder: Finding Critical 0-Days in Spite of Ourselves
29mLike Lightning From the Cloud: Finding RCEs in an Embedded TLS Library
39mNight of the living vulnerabilities
29mBackdooring of Real Time Automotive OS Devices
26mA Lightbulb Worm?