Cryptotronix Podcast

Episodes

1. 11

   Ep:1.11 How to handle time on embedded systems

   How to securely handle time on embedded systems? Do you trust your time or not? What should you do if the certificate expires? Where do you sync your time from? These are all questions that routinely come up during the design of an embedded system and they often have very real security impacts. I...

   Jul 8, 2022

   9m
2. 10

   Ep:1.10 What is DICE (Device Identifier Composition Engine)?

   In this episode, I introduce the DICE (Device Identifier Composition Engine). I mentioned the motivation for the Trusted Computing Group (TCG) to make this standard and why its specifically tailored for embedded devices like MCUs and smaller controllers. Then I give a quick overview of the…

   more
   Jun 23, 2022

   9m
3. 9

   Ep:1.09 Hardware hacking does not always go according to plan

   Sometimes hardware hacking doesn't always go according to plan and you end up destroying the target. It happens. In this episode, I get a pair of connected shoes to remove the tracker and things start to go wrong.

   Jun 16, 2022

   9m
4. 8

   Ep:1.08 ATECC608 on the SAMA7G Eval Kit

   In this episode I talk about the ATECC608 that's on the SAMA7G Eval Kit and why, even though the SAMA7 includes TrustZone, you would want an external IC. I think talk about how we included some nice ATECC608 python support in Spearf1sh (the embedded Linux distro) to let you hack on this more easily.

   Jun 12, 2022

   9m
5. 7

   Ep:1.07 Spearf1sh on the Microchip SAMA7G5

   There's a new Linux SoC by Microchip, the SAMA7G5! It's a single-core, low power, ARM Cortex-A7 with some nice security features. Because of the nice Linux4SAM project, I was able to port Spearf1sh, our embedded hacking Linux distro onto it pretty quickly!...

   Jun 8, 2022

   8m
6. 6

   Ep: 1:06 A quick intro to fs-verity for use in embedded Linux

   Embedded Linux devices are generally lacking in security, but especially file system security. While I'm seeing the ship start to turn with respect to secure boot, there is still a wide lack of file system prevention and monitoring security. In this episode, I describe and provide a quick demo on...

   May 4, 2022

   9m
7. 5

   Ep: 1.05 How a text file will help your security program

   RFC 9116 was recently RFC'd and it describes a simple concept: listing your security contact details in a simple text file. While this concept has been floating around for a while, it is now an official RFC. Companies that adopt this concept will hopefully have a much easier time receiving...

   Apr 29, 2022

   7m
8. 4

   Ep:1.04 How to increase your revenue with more security

   Security is typically thought of as a cost center -- something you have to do, but are probably not very excited to do. But what if, by actually building a decently secure device, you could enable additional revenue streams for your business? I discuss some proven models on how to do just that in...

   Apr 19, 2022

   9m
9. 3

   Ep:1.3 New UK Device Cybersecurity Law

   The UK is proposing a Product Security and Telecommunications Infrastructure Bill that has _international_ ramifications and impacts not only devices OEMs, but importers and distributors! Let's take a look at the proposed legislation and discuss why what they are proposing are activities you…

   more
   Apr 18, 2022

   9m
10. 2

    Ep:1.2 Mistakes in Custom Embedded Protocols

    Having audited a few custom protocols, as nearly every embedded project decides to implement them, nearly every one has had a security issue. In this video I discuss the top three issues I’ve seen.

    Apr 18, 2022

    9m
11. 1

    Infosec's Midlife Crisis

    Using the latest issue of IEEE Security & Privacy as a front to discuss this topic, I talked about the different focus areas of information security. Then, I question whether we are doing any good or making any progress as an industry. Best watched when you are in the mood to question your life...

    Apr 18, 2022

    9m