Interview with Brian Mullen from AMI - BTS #57
Below the Surface (Audio) - The Supply Chain Security Podcast
Release Date: 08/15/2025
YellowKey, CVE Enrichment, Chipmaker Breach - BTS #74
Below the Surface (Audio) - The Supply Chain Security Podcast
In this episode, we explore recent vulnerabilities, the YellowKey BitLocker bypass, supply chain security, CVE data analysis, and the implications of hardware breaches like the one at Foxconn. We also delve into AI's role in vulnerability research and the evolving landscape of cybersecurity threats. Topics Chapters 00:00 Introduction to Vulnerability Research and AI 03:42 NIST and CVE Growth Challenges 06:46 Building Tools for CVE Analysis 10:58 The Complexity of CVSS Scoring 15:08 CISA's Role in Vulnerability Enrichment 18:06 Challenges in CWE and CPE...
info_outline
Uncovering Firmware Risks: From Y2K to Modern Malware - BTS #73
Below the Surface (Audio) - The Supply Chain Security Podcast
In this episode of Below the Surface, hosts Paul Asadoorian, Chase Snyder, and guest Brian Richardson explore the evolution of firmware security, the risks of supply chain vulnerabilities, and the latest threats targeting network edge devices like Cisco ASA and FTD. They discuss historical malware like the Chernobyl virus, modern malware campaigns such as Firestarter, and the challenges of securing complex network infrastructure in a rapidly evolving threat landscape. Links: https://www.linkedin.com/news/story/white-house-pushes-back-on-anthropics-mythos-expansion-8741242/ ...
info_outline
AI-Powered Firmware Hacking: The Future of Vulnerability Discovery - BTS #72
Below the Surface (Audio) - The Supply Chain Security Podcast
In this episode, the hosts explore the latest in cybersecurity, including AI-driven vulnerability discovery, firmware analysis tools, secure boot complexities, and recent CVE trends. They discuss practical techniques for hacking devices, the challenges of firmware emulation, and the implications of new security policies on consumer and enterprise hardware. Chapters 00:00 Introduction to Hacking and Security Updates 03:24 Exploring Samsung TV Hacking 06:34 AI in Vulnerability Research 11:17 The Role of AI in Exploiting Vulnerabilities 15:18 CVE Disclosure and Ethical Considerations 20:43 AI...
info_outline
What Makes a Device a Router? - BTS #71
Below the Surface (Audio) - The Supply Chain Security Podcast
summary In this episode, the hosts discuss the new FCC regulations regarding consumer routers, exploring the implications for cybersecurity, the definitions of what constitutes a router, and the challenges of manufacturing compliant devices. They delve into the debate surrounding the effectiveness of these regulations in mitigating cyber risks, the role of hardware versus software vulnerabilities, and the potential impact on consumers and existing devices in homes. In this conversation, the hosts discuss the implications of the FCC's decision to decertify routers and firmware, the...
info_outline
How Cheap KVMs Could Be Your Network's Weak Link - BTS #70
Below the Surface (Audio) - The Supply Chain Security Podcast
In this episode, we explore the security vulnerabilities of low-cost IP-based KVMs, including firmware flaws, default credentials, and insecure update mechanisms. Two Eclypsium researchers, Paul and Rey, discovered the vulnerabilities and shared the details and behind-the-scenes details! We also discuss real-world testing, vendor responses, and best practices for securing remote management devices in enterprise environments. Chapters 00:00 Introduction to KVM Vulnerabilities 03:00 Research Background and Team Introduction 05:57 Exploring GLINet and Initial Findings 09:03 Firmware Analysis and...
info_outline
Navigating Network Edge Vulnerabilities - BTS #69
Below the Surface (Audio) - The Supply Chain Security Podcast
In this episode of Below the Surface, Paul Asadoorian, Vlad Babkin, and Adrian Sanabria discuss the ongoing vulnerabilities in network edge devices, the implications of legacy systems like Avanti, and the strategies employed by threat actors. They explore the importance of monitoring and detection in cybersecurity, as well as innovative deception techniques to enhance security measures against exploitation. In this conversation, the speakers delve into various aspects of cybersecurity, including innovative strategies to enhance security, the challenges posed by vendor cooperation, the...
info_outline
Attacking Power Grids - BTS #68
Below the Surface (Audio) - The Supply Chain Security Podcast
In this episode, the hosts discuss various cybersecurity threats, including Russian cyber attacks on critical infrastructure, the vulnerabilities in firewalls and VPNs, and the implications of AI in cybersecurity. They explore the increasing trend of using Python for malicious purposes and the challenges posed by gaming anti-cheat drivers. The conversation also touches on the escalation of cyber warfare and the confused deputy problem in AI, highlighting the need for better security measures and awareness in the industry. Chapters 00:00 Introduction to Cybersecurity Threats 02:52...
info_outline
BIOS Password Cracking, Secure Boot, and Stackwarp - BTS #67
Below the Surface (Audio) - The Supply Chain Security Podcast
In this episode, the hosts discuss various cybersecurity topics, including the challenges of BIOS password cracking, the implications of AMD's Stack Warp vulnerability, and the importance of up-to-date secure boot certificates. They also explore the risks associated with network security appliances, the costs of cybersecurity, and the role of marketing in raising awareness. Additionally, they share insights from an X-ray analysis of USB cables, highlighting the differences between quality and counterfeit products. BIOS password cracking can be complex and time-consuming. Physical...
info_outline
Beyond the Label: The Truth About Hardware Trust - BTS #66
Below the Surface (Audio) - The Supply Chain Security Podcast
In this episode of Below the Surface, host Paul Asadoorian is joined by co-hosts Larry Pesci, Joshua Marpet, and Vlad Babkin to delve into the complexities of hardware supply chain security. The discussion is sparked by a presentation from Andrew 'Bunny' Wong at Black Hat Asia, which raised critical questions about how we can trust the silicon in our devices. The conversation explores the challenges of validating hardware components, the potential for backdoors in devices, and the implications of counterfeit components in the supply chain. The hosts share anecdotes and insights about their...
info_outline
Exploring AI in Firmware Analysis - BTS #65
Below the Surface (Audio) - The Supply Chain Security Podcast
Summary In this episode, special guest Matt Brown joins us to discuss the integration of AI in firmware analysis, exploring its benefits and challenges. We delve into the transition from traditional methods to AI-driven approaches, emphasizing the importance of prompt specificity for effective vulnerability discovery. The conversation also covers the role of open-source components, the need for guardrails in AI use, and the implications of AI-generated reports in cybersecurity. Additionally, they touch on man-in-the-middle techniques and the future of AI in firmware development, highlighting...
info_outlineIn this episode of Below the Surface, host Paul Asadoorian is joined by Brian Mullen, head of SSDLC at AMI, to discuss the complexities of supply chain and firmware security. They explore the challenges of maintaining security in a complicated supply chain, the importance of proactive and reactive security measures, and the implications of end-of-life software. The conversation also touches on the gaming industry's push for secure boot, recent vulnerabilities discovered in firmware, and the role of BMCs in security. Brian shares insights into AMI's approach to vulnerability management and the future of firmware security, including the significance of Software Bill of Materials (SBOMs).
Whitepaper: https://eclypsium.com/wp-content/uploads/OpenBMC-Security-in-Practice.pdf
Chapters
00:00 Introduction and Technical Setup
01:46 The Challenges of Podcasting and Marketing
03:42 Understanding AMI and Its Role in Firmware Security
06:13 Supply Chain Complexity and Security Measures
08:49 Proactive vs Reactive Security in Firmware
11:17 The Importance of Stable Firmware in Security
13:54 Navigating Vulnerabilities in UEFI and OpenSSL
16:24 The Impact of Cherry-Picking Security Updates
19:11 Tracking Vulnerabilities Across the Supply Chain
21:50 Solutions for Data Center Firmware Management
24:21 Future Directions in Vulnerability Management
24:38 Navigating Vulnerability Management
28:30 End of Life and Support Challenges
31:55 Gaming Security and Anti-Cheat Mechanisms
35:38 The Complexity of Secure Boot Implementation
36:50 Recent Vulnerabilities and Security Research
39:44 Understanding BMC Security
43:34 Open Source and BMC Development
46:30 The Role of SBOMs in Security Compliance