If They Can Touch It, They Own It: The Stories We Tell...
summary
Two deidentified case studies show how familiar rationales produce real failures: one device yields a UART root shell and writable removable storage allowing firmware tampering, triggers an FDA additional‑information request, and is remediated with tamper evidence, depopulated debug headers, public‑key console auth, and secure boot; the other uses textbook RSA without padding for firmware signing, a pen‑test oracle proves forgery risk, and the implementation is replaced with standard libraries. Also warns that AI output can accelerate bad design choices.
AI-written summary · about
chapters (8)
- 0:00Medical device security intro
- 3:52Security decisions are human
- 7:41Medical device vulnerabilities
- 8:01Case study: physical access risks
- 16:43Case study: roll your own crypto
- 19:51AI’s flawed security role
- 22:20Better security action plan
- 23:04Q&A
related talks
59mIf You Can't Open It, You Don't Own It
14mHow not to secure your embedded system, lessons from automotive testing
21mIndustrial IoT security issues and countermeasures
43mThe Tao of Hardware the Te of Implants
17mEmbedded Security's Weakest Link: Lessons From Simple Mistakes
41mPanel: Tackling Automotive Hardware Vulnerabilities
35mPatterns and Anti-Patterns in Embedded Development: What Security Incidents...
30mWhy Open Source Firmware is Important