15 subscribers
התחל במצב לא מקוון עם האפליקציה Player FM !
Offensive Cybersecurity with Ryan Torvik
Manage episode 475968346 series 3303835
Key Topics
* [03:00] Ryan's background in offensive cybersecurity and defense contracting
* [04:30] The mindset and challenges of vulnerability research and hacking
* [09:15] How security researchers approach attacking embedded devices
* [13:45] Techniques for extracting and analyzing firmware
* [19:30] Security considerations for embedded developers
* [24:00] The importance of designing security from the beginning
* [28:45] Security challenges for small companies without dedicated security staff
* [33:20] Address Space Layout Randomization (ASLR) and other security measures
* [37:00] Emulation technology for testing embedded systems
* [45:30] Tulip Tree's approach to embedded system emulation and security testing
* [50:15] Resources for learning about cybersecurity and hacking
Notable Quotes
> "When you're on the vulnerability research side, you're trying to find a time when the software does something wrong. When it does something unexpected." — Ryan Torvik
> "Don't roll your own cryptography. Use a standard library for cryptography." — Ryan Torvik
> "We're seeing that the maintenance costs are what are getting people now. You're expected to maintain this device, but now you got to be able to actually update the device." — Ryan Torvik
> "It's so much more expensive to put security in after the fact if it's possible in the first place. Why is that even something that needs to be debated?" — Luca Ingianni
Resources Mentioned
[Tulip Tree Technology](tuliptreetech.com) - Ryan's company focused on embedded system security and emulation
* IDA Pro - Interactive disassembler for firmware analysis
* Binary Ninja - Interactive disassembler from Vector35
* Ghidra - NSA's open-source software reverse engineering tool
* Microcorruption - Beginner-friendly CTF challenge for learning embedded system hacking
* National Vulnerability Database - Public database of security vulnerabilities
Things to do
* Join the Agile Embedded Podcast Slack channel to connect with the hosts and other listeners
* Check out Tulip Tree Technology's website for their emulation tools and security services
* Try Microcorruption CTF challenges to learn about embedded system security vulnerabilities
* Consider security implications early in your design process rather than as an afterthought
* Use secure programming languages like Rust that help prevent common security issues
You can find Jeff at https://jeffgable.com.
You can find Luca at https://luca.engineer.
Want to join the agile Embedded Slack? Click here
81 פרקים
Manage episode 475968346 series 3303835
Key Topics
* [03:00] Ryan's background in offensive cybersecurity and defense contracting
* [04:30] The mindset and challenges of vulnerability research and hacking
* [09:15] How security researchers approach attacking embedded devices
* [13:45] Techniques for extracting and analyzing firmware
* [19:30] Security considerations for embedded developers
* [24:00] The importance of designing security from the beginning
* [28:45] Security challenges for small companies without dedicated security staff
* [33:20] Address Space Layout Randomization (ASLR) and other security measures
* [37:00] Emulation technology for testing embedded systems
* [45:30] Tulip Tree's approach to embedded system emulation and security testing
* [50:15] Resources for learning about cybersecurity and hacking
Notable Quotes
> "When you're on the vulnerability research side, you're trying to find a time when the software does something wrong. When it does something unexpected." — Ryan Torvik
> "Don't roll your own cryptography. Use a standard library for cryptography." — Ryan Torvik
> "We're seeing that the maintenance costs are what are getting people now. You're expected to maintain this device, but now you got to be able to actually update the device." — Ryan Torvik
> "It's so much more expensive to put security in after the fact if it's possible in the first place. Why is that even something that needs to be debated?" — Luca Ingianni
Resources Mentioned
[Tulip Tree Technology](tuliptreetech.com) - Ryan's company focused on embedded system security and emulation
* IDA Pro - Interactive disassembler for firmware analysis
* Binary Ninja - Interactive disassembler from Vector35
* Ghidra - NSA's open-source software reverse engineering tool
* Microcorruption - Beginner-friendly CTF challenge for learning embedded system hacking
* National Vulnerability Database - Public database of security vulnerabilities
Things to do
* Join the Agile Embedded Podcast Slack channel to connect with the hosts and other listeners
* Check out Tulip Tree Technology's website for their emulation tools and security services
* Try Microcorruption CTF challenges to learn about embedded system security vulnerabilities
* Consider security implications early in your design process rather than as an afterthought
* Use secure programming languages like Rust that help prevent common security issues
You can find Jeff at https://jeffgable.com.
You can find Luca at https://luca.engineer.
Want to join the agile Embedded Slack? Click here
81 פרקים
כל הפרקים
×
1 BONUS: Listener Question on Repository Organization 15:42

1 Offensive Cybersecurity with Ryan Torvik 48:51

1 John Taylor on the Embedded Systems Cookbook 44:46

1 Buzzword Bingo (or: which modern technologies make sense for embedded?) 49:09

1 Exploring Rust for Embedded Systems with Philip Markgraf 50:20

1 Bailey Steinfadt on teaching git to non-developers 39:25
ברוכים הבאים אל Player FM!
Player FM סורק את האינטרנט עבור פודקאסטים באיכות גבוהה בשבילכם כדי שתהנו מהם כרגע. זה יישום הפודקאסט הטוב ביותר והוא עובד על אנדרואיד, iPhone ואינטרנט. הירשמו לסנכרון מנויים במכשירים שונים.