BIOS Password Cracking, Secure Boot, and Stackwarp - BTS #67
Below the Surface (Audio) - The Supply Chain Security Podcast
Release Date: 01/27/2026
BIOS Password Cracking, Secure Boot, and Stackwarp - BTS #67
Below the Surface (Audio) - The Supply Chain Security Podcast
In this episode, the hosts discuss various cybersecurity topics, including the challenges of BIOS password cracking, the implications of AMD's Stack Warp vulnerability, and the importance of up-to-date secure boot certificates. They also explore the risks associated with network security appliances, the costs of cybersecurity, and the role of marketing in raising awareness. Additionally, they share insights from an X-ray analysis of USB cables, highlighting the differences between quality and counterfeit products. BIOS password cracking can be complex and time-consuming. Physical...
info_outline
Beyond the Label: The Truth About Hardware Trust - BTS #66
Below the Surface (Audio) - The Supply Chain Security Podcast
In this episode of Below the Surface, host Paul Asadoorian is joined by co-hosts Larry Pesci, Joshua Marpet, and Vlad Babkin to delve into the complexities of hardware supply chain security. The discussion is sparked by a presentation from Andrew 'Bunny' Wong at Black Hat Asia, which raised critical questions about how we can trust the silicon in our devices. The conversation explores the challenges of validating hardware components, the potential for backdoors in devices, and the implications of counterfeit components in the supply chain. The hosts share anecdotes and insights about their...
info_outline
Exploring AI in Firmware Analysis - BTS #65
Below the Surface (Audio) - The Supply Chain Security Podcast
Summary In this episode, special guest Matt Brown joins us to discuss the integration of AI in firmware analysis, exploring its benefits and challenges. We delve into the transition from traditional methods to AI-driven approaches, emphasizing the importance of prompt specificity for effective vulnerability discovery. The conversation also covers the role of open-source components, the need for guardrails in AI use, and the implications of AI-generated reports in cybersecurity. Additionally, they touch on man-in-the-middle techniques and the future of AI in firmware development, highlighting...
info_outline
Patching, Evil AI, Supply Chain Breaches - BTS #64
Below the Surface (Audio) - The Supply Chain Security Podcast
Summary In this episode, the hosts discuss various cybersecurity topics, including recent vulnerabilities in Fortinet products, the implications of supply chain breaches, the evolving role of AI in cybersecurity, and updates to the OWASP Top 10 list. They emphasize the importance of firmware security and the need for better visibility and standards in the industry. The conversation highlights the challenges faced by defenders in a rapidly changing threat landscape and the necessity for proactive measures to secure systems. Takeaways Fortinet vulnerabilities are critical and require immediate...
info_outline
F5 Breach, Linux Malware, and Hacking Banks - BTS #63
Below the Surface (Audio) - The Supply Chain Security Podcast
Summary In this episode of Below the Surface, Paul Asadoorian and Chase Snyder delve into various cybersecurity topics, including the use of Raspberry Pi in cyber attacks, the implications of the F5 breach, and the emergence of Polar Edge malware targeting QNAP devices. They also discuss the innovative Two-Face Rust binary technique, the critical nature of authentication bypass vulnerabilities, and the evolving landscape of air-gapped systems. The conversation highlights the increasing risk posed by old vulnerabilities and the need for improved security measures in the face of advancing...
info_outline
Unpacking the F5 Breach, Framework UEFI Shells - BTS #62
Below the Surface (Audio) - The Supply Chain Security Podcast
In this episode, the hosts discuss the recent F5 breach, exploring the implications of the attack, the tactics used by threat actors, and the importance of vulnerability disclosure. They delve into the complexities of securing network edge devices, the challenges posed by Linux security, and the need for standardization in security practices. The conversation also touches on the future of firmware security and the necessity for proactive measures in incident response. We also close out the show taking about the recent Framework UEFI shell vulnerability. Chapters 00:00 Introduction to F5...
info_outline
Red November, Cisco Vulnerabilities, and Supply Chain Security - BTS #61
Below the Surface (Audio) - The Supply Chain Security Podcast
In this episode of Below the Surface, the hosts discuss various cybersecurity topics, including the Red November campaign targeting network edge devices, the implications of the Cisco SNMP vulnerability, and the recent vulnerabilities associated with Cisco ASA devices. They also delve into the hybrid Petya ransomware and its connection to supply chain security, emphasizing the need for better visibility and security measures in network devices. Chapters: 00:00 Introduction and Overview of Cybersecurity Trends 02:09 Red November Campaign: Targeting Network Edge Devices 11:06 The Shift in Attack...
info_outline
HybridPetya and UEFI Threats - BTS #60
Below the Surface (Audio) - The Supply Chain Security Podcast
In this episode of Below the Surface, the hosts discuss various cybersecurity topics, including the evolution of malware with a focus on Hybrid Petya, the implications of UEFI vulnerabilities, and the security risks associated with Windows 10's end of life. They also explore the vulnerabilities of Cisco ASA devices, the rise of supply chain attacks exemplified by NPM worms, and the persistent threat of Row Hammer attacks on DDR5 technology. The conversation highlights the significance of visibility in cybersecurity and the necessity for enhanced security practices to counter evolving threats....
info_outline
Exploit Marketplaces - BTS #59
Below the Surface (Audio) - The Supply Chain Security Podcast
In this episode of Below the Surface, host Paul Asadoorian speaks with Evan Dornbush, CEO of Desired Effect, about the evolving landscape of exploit marketplaces and vulnerability research. They discuss the challenges researchers face in monetizing their findings, the ethical implications of selling exploits, and the importance of timely intelligence for defenders. The conversation also touches on the role of AI in vulnerability research, the dynamics between buyers and sellers in the marketplace, and the impact of end-of-life devices on cybersecurity. Overall, the episode provides valuable...
info_outline
UEFI Vulnerabilities and Hardware Risks - BTS #58
Below the Surface (Audio) - The Supply Chain Security Podcast
In this episode, the hosts discuss various cybersecurity topics, focusing on hardware vulnerabilities, UEFI attack vectors, and the implications of new regulations on device security. They explore the evolution of Mirai variants targeting IoT devices and the challenges of securing firmware. The conversation highlights the need for improved security measures and the complexities of managing vulnerabilities in a rapidly changing technological landscape. 00:00 Introduction and Technical Challenges 02:37 Exploring UEFI Settings and Hardware Vulnerabilities 10:14 The Risks of UEFI Control...
info_outlineIn this episode, the hosts discuss various cybersecurity topics, including the challenges of BIOS password cracking, the implications of AMD's Stack Warp vulnerability, and the importance of up-to-date secure boot certificates. They also explore the risks associated with network security appliances, the costs of cybersecurity, and the role of marketing in raising awareness. Additionally, they share insights from an X-ray analysis of USB cables, highlighting the differences between quality and counterfeit products.
- BIOS password cracking can be complex and time-consuming.
- Physical access to hardware can significantly impact security measures.
- The Stack Warp vulnerability poses serious risks to virtual machines.
- Secure boot certificates need regular updates to maintain security.
- Network security appliances can introduce new vulnerabilities.
- Cybersecurity costs often outweigh the perceived benefits of cloud solutions.
- Marketing plays a crucial role in raising awareness about cybersecurity issues.
- X-ray analysis can reveal the quality of electronic components.
- Understanding the shared responsibility model is essential for IT teams.
- The balance between security and operational efficiency is a constant challenge.
Chapters
01:59 Introduction to Below the Surface Podcast
04:46 BIOS Password Cracking Techniques
10:14 Exploring AMD's Stack Warp Vulnerability
22:03 Migration Trends in Cloud Computing
23:22 Cost vs. Security in On-Premises Solutions
24:37 Shared Responsibility in Network Security Appliances
27:03 The Risks of Network Security Appliances
28:14 Exploitation of Vulnerabilities in Network Devices
31:18 Challenges in Updating Network Security Appliances
34:59 The Slow Response to Vulnerabilities
39:05 The Complexity of Firmware Updates
45:45 Secure Boot Certificates and Future Vulnerabilities
49:12 Fun Innovations: X-ray Machine in the Office