Beyond the Label: The Truth About Hardware Trust - BTS #66
Below the Surface (Audio) - The Supply Chain Security Podcast
Release Date: 01/15/2026
Exploring BMC Vulnerabilities - BTS #80
Below the Surface (Audio) - The Supply Chain Security Podcast
Summary In this episode, the hosts discuss various cybersecurity topics, including the lack of media coverage from the Black Hat conference, the implications of AI in cybersecurity, and the vulnerabilities associated with Baseboard Management Controllers (BMCs). They explore the challenges of patch management, the role of embedded Linux in security vulnerabilities, and the emerging trends in threat actor behavior. The conversation emphasizes the need for better awareness and action regarding BMC vulnerabilities and the importance of understanding the risks associated with AI in security. In...
info_outline
InfraTrust - Understanding Infrastructure Vulnerabilities & Risk - BTS #79
Below the Surface (Audio) - The Supply Chain Security Podcast
Check out our free and no-registration-required site for understanding and tracking infrastructure vulnerabilities and advisories: https://infra-trust.org In this episode, the hosts discuss the challenges of collecting and aggregating vulnerability data, the introduction of Infratrust and Infratrust Pulse, and the importance of actionable data for cybersecurity teams. They explore the differences between vendor advisories and CVEs, the role of Eclipsium in data aggregation, and the ongoing challenges in vulnerability management and patching. The conversation highlights the need for a...
info_outline
Patching: The Race Against Time - BTS #78
Below the Surface (Audio) - The Supply Chain Security Podcast
In this episode, the hosts discuss various vulnerabilities affecting network devices, the importance of timely patching in enterprises, and the implications of AI on security. They explore the challenges of compliance programs, the significance of dependency management in software, and the need for better privilege separation in network devices. The conversation also touches on the risks of supply chain attacks and the detection of orphaned packages in software ecosystems. Chapters 00:00 Introduction to Vulnerabilities and Security Trends 02:49 Router Choices and Security Implications 10:41...
info_outline
FortiBleed Uncovered: How Attackers Harvest Credentials from Fortinet Devices - BTS #77
Below the Surface (Audio) - The Supply Chain Security Podcast
In this episode, we delve into the recent FortiBleed campaign, exploring how attackers harvest credentials from Fortinet devices, the vulnerabilities in password management, and best practices for defenders to mitigate such threats. Key topics FortiBleed campaign details and impact Password hash vulnerabilities in FortiOS AI's role in analyzing large security breaches Credential harvesting techniques and defenses Importance of layered security and best practices Chapters 00:00 Introduction and Initial Thoughts on AI Models 10:04 Credential Harvesting and Security Weaknesses 19:58 Hash...
info_outline
Binwalk, Brickstorm, AI Model Madness - BTS #76
Below the Surface (Audio) - The Supply Chain Security Podcast
summary In this episode of Below the Surface, Paul Asadoorian, Chase Snyder, and Vlad Babkin discuss the implications of AI in cybersecurity, the challenges posed by AI guardrails, and the operational risks associated with applying patches. They also explore vulnerabilities in security tools like Binwalk, the complexities of firmware update tools, and the importance of transparency in software signing, particularly in the context of open source software. In this conversation, the speakers delve into the complexities of cybersecurity, focusing on the limitations of security through...
info_outline
Secure Boot Certificates Expiring: What You Need to Know - BTS #75
Below the Surface (Audio) - The Supply Chain Security Podcast
In this episode of Below the Surface, the team discusses recent cybersecurity trends, including the Verizon DBIR 2026 report, secure boot certificate expirations, and the evolving threat landscape with AI and hardware vulnerabilities. They explore how organizations can adapt their defense strategies to stay ahead of attackers and share insights on supply chain security and malware analysis. YellowKey update: Chapters 00:00 Introduction and Technical Issues 02:56 Verizon DBIR Insights 05:50 Trends in Vulnerability...
info_outline
YellowKey, CVE Enrichment, Chipmaker Breach - BTS #74
Below the Surface (Audio) - The Supply Chain Security Podcast
In this episode, we explore recent vulnerabilities, the YellowKey BitLocker bypass, supply chain security, CVE data analysis, and the implications of hardware breaches like the one at Foxconn. We also delve into AI's role in vulnerability research and the evolving landscape of cybersecurity threats. Topics Chapters 00:00 Introduction to Vulnerability Research and AI 03:42 NIST and CVE Growth Challenges 06:46 Building Tools for CVE Analysis 10:58 The Complexity of CVSS Scoring 15:08 CISA's Role in Vulnerability Enrichment 18:06 Challenges in CWE and CPE...
info_outline
Uncovering Firmware Risks: From Y2K to Modern Malware - BTS #73
Below the Surface (Audio) - The Supply Chain Security Podcast
In this episode of Below the Surface, hosts Paul Asadoorian, Chase Snyder, and guest Brian Richardson explore the evolution of firmware security, the risks of supply chain vulnerabilities, and the latest threats targeting network edge devices like Cisco ASA and FTD. They discuss historical malware like the Chernobyl virus, modern malware campaigns such as Firestarter, and the challenges of securing complex network infrastructure in a rapidly evolving threat landscape. Links: https://www.linkedin.com/news/story/white-house-pushes-back-on-anthropics-mythos-expansion-8741242/ ...
info_outline
AI-Powered Firmware Hacking: The Future of Vulnerability Discovery - BTS #72
Below the Surface (Audio) - The Supply Chain Security Podcast
In this episode, the hosts explore the latest in cybersecurity, including AI-driven vulnerability discovery, firmware analysis tools, secure boot complexities, and recent CVE trends. They discuss practical techniques for hacking devices, the challenges of firmware emulation, and the implications of new security policies on consumer and enterprise hardware. Chapters 00:00 Introduction to Hacking and Security Updates 03:24 Exploring Samsung TV Hacking 06:34 AI in Vulnerability Research 11:17 The Role of AI in Exploiting Vulnerabilities 15:18 CVE Disclosure and Ethical Considerations 20:43 AI...
info_outline
What Makes a Device a Router? - BTS #71
Below the Surface (Audio) - The Supply Chain Security Podcast
summary In this episode, the hosts discuss the new FCC regulations regarding consumer routers, exploring the implications for cybersecurity, the definitions of what constitutes a router, and the challenges of manufacturing compliant devices. They delve into the debate surrounding the effectiveness of these regulations in mitigating cyber risks, the role of hardware versus software vulnerabilities, and the potential impact on consumers and existing devices in homes. In this conversation, the hosts discuss the implications of the FCC's decision to decertify routers and firmware, the...
info_outlineIn this episode of Below the Surface, host Paul Asadoorian is joined by co-hosts Larry Pesci, Joshua Marpet, and Vlad Babkin to delve into the complexities of hardware supply chain security. The discussion is sparked by a presentation from Andrew 'Bunny' Wong at Black Hat Asia, which raised critical questions about how we can trust the silicon in our devices. The conversation explores the challenges of validating hardware components, the potential for backdoors in devices, and the implications of counterfeit components in the supply chain. The hosts share anecdotes and insights about their experiences with hardware security, emphasizing the need for independent testing and the importance of understanding the provenance of hardware components.
00:00 Introduction to Hardware Supply Chain Security
02:53 Understanding Trust in Silicon
05:55 Challenges in Validating Hardware Components
09:01 Historical Context of Hardware Tampering
11:58 The Complexity of Supply Chains
14:55 Operationalizing Hardware Validation
18:01 The Role of Independent Researchers
20:59 Bounties and Community Involvement
23:56 Innovative Techniques for Hardware Analysis
27:06 The Future of Hardware Security
31:57 The Evolution of Computing: From Transistors to Quantum
36:11 Understanding Hardware Trust and Supply Chain Risks
41:52 The Need for Continuous Monitoring and Assurance
55:31 The Future of High Assurance Devices and Backdoors