Hardwear.io Netherlands 2024
2024-10-24..2024-10-25
Amsterdam, Netherlands
[hardwear.io Netherlands 2019, Hardwear.io Netherlands 2024]
| title | author | length |
|---|---|---|
| Escaping The Sandbox: Side Channel Shenanigans On Our DIY Chip | Jasper | 42m |
Project moves from simulation to a DIY tapeout on Efabless Caravel after funding cuts, hitting a 10K tapeout 6‑week deadline. Open RV32 and AES cores undergo… | ||
| ARM MTE: The End Of Memory Corruption? Not Yet | Juhee Kim | 37m |
Hardware MTE uses 4‑bit tags (16 values) so blind brute force succeeds ~1/16 (≈6%) and is noisy; this work combines cache timing and speculative execution to… | ||
| HAWKEYE – Recovering Symmetric Cryptography From Hardware Circuits | Julian | 34m |
An automated netlist analyzer called Hawkeye finds symmetric cipher implementations by structural graph reduction to flip‑flop connections, extracting round… | ||
| Bluetooth Low Energy GATT Fuzzing: Specification To Implementation | Baptiste | 32m |
Built a Python fuzzer on top of the w framework and ran nine scenario-driven tests against open-source stacks (Zephyr/BlueZ-derived, NimBLE, Android BlueDroid)… | ||
| Fuzzing GPRS Layer-2 For Fun And Profit | Dyon Goos, Marius Muench | 39m |
Fuzzing focuses on GPRS layer‑2 LLC by injecting a fuzz task into firmwire emulation and driving inputs from AFL++; initialization requires handcrafted state… | ||
| Google Nest Wifi Pro Bypassing Android Verified Boot | Sergei Volokitin | 22m |
Root access to the Nest Wifi Pro comes from a simple chip-off eMMC modification that adds an SBL environment partition and supplies a valid CRC so U-Boot uses… | ||
| MIFARE Classic: Exposing The Static Encrypted Nonce Variant | Philippe Teuwen | 47m |
A family of MIFARE Classic S‑variant cards uses a static encrypted nonce that is predictable by sector and key and a hidden backdoor read key in multiple… | ||
| Reading Between The Lines Of Law Enforcement Press Releases | Donatas Mazeika | 46m |
Europol cyber teams specialize in attribution, infrastructure takedowns and crypto tracing, running an in‑house decryption farm that uses hashcat and hopis on… | ||
| Is Your Memory Protected? Uncovering Vul In Automotive MPU | Nimrod Stoler | 41m |
Two hardware bugs in 32-bit PowerPC automotive MCUs let a privileged attacker flip the S‑MPU global valid bit and bypass region locks; tested on an SPC58 board… | ||
| Byepervisor: How We Broke The PS5 Hypervisor | SpecterDev | 33m |
Claims a full hypervisor break on PS5 v2 (firmware ≤2.70) by combining a kernel read/write primitive with jump-table mirroring and ROP-style chains to hijack… | ||
| EL3XIR: Fuzzing COTS Secure Monitors | Marcel Busch, Christian Lindenmeier | 39m |
EL3XIR rehosts commercial EL3 binaries into QEMU + AFL, uses Avatar2 memory hooks to intercept MMIO, and auto-generates fuzz harnesses from Linux drivers via… | ||
| Side Channel Attacks: Lessons Learned Or Troubles Ahead? | Daniel Genkin | 38m |
A new exploit called ey leakage reads secrets from Safari’s renderer on Apple M‑series chips by turning speculative type confusion into 64‑bit reads and hiding… | ||
| EUCLEAK | Thomas Roche | 44m |
New side‑channel recovers ECDSA nonces from Infineon SLE78 by analyzing the EA modular‑inverse loop with an EM probe and a Ledger smartcard bench, then… | ||
| nothing matches | ||