Patching, Evil AI, Supply Chain Breaches - BTS #64
Below the Surface (Audio) - The Supply Chain Security Podcast
Release Date: 11/24/2025
Exploring BMC Vulnerabilities - BTS #80
Below the Surface (Audio) - The Supply Chain Security Podcast
Summary In this episode, the hosts discuss various cybersecurity topics, including the lack of media coverage from the Black Hat conference, the implications of AI in cybersecurity, and the vulnerabilities associated with Baseboard Management Controllers (BMCs). They explore the challenges of patch management, the role of embedded Linux in security vulnerabilities, and the emerging trends in threat actor behavior. The conversation emphasizes the need for better awareness and action regarding BMC vulnerabilities and the importance of understanding the risks associated with AI in security. In...
info_outline
InfraTrust - Understanding Infrastructure Vulnerabilities & Risk - BTS #79
Below the Surface (Audio) - The Supply Chain Security Podcast
Check out our free and no-registration-required site for understanding and tracking infrastructure vulnerabilities and advisories: https://infra-trust.org In this episode, the hosts discuss the challenges of collecting and aggregating vulnerability data, the introduction of Infratrust and Infratrust Pulse, and the importance of actionable data for cybersecurity teams. They explore the differences between vendor advisories and CVEs, the role of Eclipsium in data aggregation, and the ongoing challenges in vulnerability management and patching. The conversation highlights the need for a...
info_outline
Patching: The Race Against Time - BTS #78
Below the Surface (Audio) - The Supply Chain Security Podcast
In this episode, the hosts discuss various vulnerabilities affecting network devices, the importance of timely patching in enterprises, and the implications of AI on security. They explore the challenges of compliance programs, the significance of dependency management in software, and the need for better privilege separation in network devices. The conversation also touches on the risks of supply chain attacks and the detection of orphaned packages in software ecosystems. Chapters 00:00 Introduction to Vulnerabilities and Security Trends 02:49 Router Choices and Security Implications 10:41...
info_outline
FortiBleed Uncovered: How Attackers Harvest Credentials from Fortinet Devices - BTS #77
Below the Surface (Audio) - The Supply Chain Security Podcast
In this episode, we delve into the recent FortiBleed campaign, exploring how attackers harvest credentials from Fortinet devices, the vulnerabilities in password management, and best practices for defenders to mitigate such threats. Key topics FortiBleed campaign details and impact Password hash vulnerabilities in FortiOS AI's role in analyzing large security breaches Credential harvesting techniques and defenses Importance of layered security and best practices Chapters 00:00 Introduction and Initial Thoughts on AI Models 10:04 Credential Harvesting and Security Weaknesses 19:58 Hash...
info_outline
Binwalk, Brickstorm, AI Model Madness - BTS #76
Below the Surface (Audio) - The Supply Chain Security Podcast
summary In this episode of Below the Surface, Paul Asadoorian, Chase Snyder, and Vlad Babkin discuss the implications of AI in cybersecurity, the challenges posed by AI guardrails, and the operational risks associated with applying patches. They also explore vulnerabilities in security tools like Binwalk, the complexities of firmware update tools, and the importance of transparency in software signing, particularly in the context of open source software. In this conversation, the speakers delve into the complexities of cybersecurity, focusing on the limitations of security through...
info_outline
Secure Boot Certificates Expiring: What You Need to Know - BTS #75
Below the Surface (Audio) - The Supply Chain Security Podcast
In this episode of Below the Surface, the team discusses recent cybersecurity trends, including the Verizon DBIR 2026 report, secure boot certificate expirations, and the evolving threat landscape with AI and hardware vulnerabilities. They explore how organizations can adapt their defense strategies to stay ahead of attackers and share insights on supply chain security and malware analysis. YellowKey update: Chapters 00:00 Introduction and Technical Issues 02:56 Verizon DBIR Insights 05:50 Trends in Vulnerability...
info_outline
YellowKey, CVE Enrichment, Chipmaker Breach - BTS #74
Below the Surface (Audio) - The Supply Chain Security Podcast
In this episode, we explore recent vulnerabilities, the YellowKey BitLocker bypass, supply chain security, CVE data analysis, and the implications of hardware breaches like the one at Foxconn. We also delve into AI's role in vulnerability research and the evolving landscape of cybersecurity threats. Topics Chapters 00:00 Introduction to Vulnerability Research and AI 03:42 NIST and CVE Growth Challenges 06:46 Building Tools for CVE Analysis 10:58 The Complexity of CVSS Scoring 15:08 CISA's Role in Vulnerability Enrichment 18:06 Challenges in CWE and CPE...
info_outline
Uncovering Firmware Risks: From Y2K to Modern Malware - BTS #73
Below the Surface (Audio) - The Supply Chain Security Podcast
In this episode of Below the Surface, hosts Paul Asadoorian, Chase Snyder, and guest Brian Richardson explore the evolution of firmware security, the risks of supply chain vulnerabilities, and the latest threats targeting network edge devices like Cisco ASA and FTD. They discuss historical malware like the Chernobyl virus, modern malware campaigns such as Firestarter, and the challenges of securing complex network infrastructure in a rapidly evolving threat landscape. Links: https://www.linkedin.com/news/story/white-house-pushes-back-on-anthropics-mythos-expansion-8741242/ ...
info_outline
AI-Powered Firmware Hacking: The Future of Vulnerability Discovery - BTS #72
Below the Surface (Audio) - The Supply Chain Security Podcast
In this episode, the hosts explore the latest in cybersecurity, including AI-driven vulnerability discovery, firmware analysis tools, secure boot complexities, and recent CVE trends. They discuss practical techniques for hacking devices, the challenges of firmware emulation, and the implications of new security policies on consumer and enterprise hardware. Chapters 00:00 Introduction to Hacking and Security Updates 03:24 Exploring Samsung TV Hacking 06:34 AI in Vulnerability Research 11:17 The Role of AI in Exploiting Vulnerabilities 15:18 CVE Disclosure and Ethical Considerations 20:43 AI...
info_outline
What Makes a Device a Router? - BTS #71
Below the Surface (Audio) - The Supply Chain Security Podcast
summary In this episode, the hosts discuss the new FCC regulations regarding consumer routers, exploring the implications for cybersecurity, the definitions of what constitutes a router, and the challenges of manufacturing compliant devices. They delve into the debate surrounding the effectiveness of these regulations in mitigating cyber risks, the role of hardware versus software vulnerabilities, and the potential impact on consumers and existing devices in homes. In this conversation, the hosts discuss the implications of the FCC's decision to decertify routers and firmware, the...
info_outlineSummary
In this episode, the hosts discuss various cybersecurity topics, including recent vulnerabilities in Fortinet products, the implications of supply chain breaches, the evolving role of AI in cybersecurity, and updates to the OWASP Top 10 list. They emphasize the importance of firmware security and the need for better visibility and standards in the industry. The conversation highlights the challenges faced by defenders in a rapidly changing threat landscape and the necessity for proactive measures to secure systems.
Takeaways
Fortinet vulnerabilities are critical and require immediate attention.
Silent patches can lead to significant security risks.
AI is being used by both attackers and defenders in cybersecurity.
The OWASP Top 10 has been updated to include software supply chain failures.
Firmware security is often overlooked but is essential for device safety.
Supply chain breaches can have far-reaching implications for organizations.
Visibility into firmware and device security is lacking in the industry.
Standards for software security are necessary to protect against vulnerabilities.
Defenders need better tools to combat evolving threats.
The cybersecurity landscape is becoming increasingly complex and interconnected.
Chapters
00:00 Introduction and Technical Setup
03:08 Fortinet Vulnerabilities and Exploits
06:05 Public Exploits and Path Traversal Vulnerabilities
09:00 Chaining Vulnerabilities and Risk Assessment
11:50 Authentication and Vulnerability Scoring
15:04 Operational Complexity in Patch Management
17:55 Silent Patches and Their Implications
20:58 Challenges with Network Device Security
24:55 Cyber Insurance and Vulnerability Trends
27:58 The Impact of Silent Patches
30:46 End of Life Devices and Legacy Systems
34:58 Supply Chain Security and Source Code Theft
39:44 AI in Cybersecurity: Opportunities and Threats
47:17 Navigating AI's Guardrails and Malicious Use Cases
49:24 The Dilemma of AI and Harmful Intentions
52:44 The Need for Researcher Access to AI Tools
58:36 OWASP Top 10 Updates and Supply Chain Security
01:05:12 The Challenges of Firmware and Device Security