Hello everyone,
Another week, another list of articles I found interesting this week. As the internet is a large place, do keep sharing interesting content you come across, as I probably won’t discover it all on my own !
Till next time,
Thierry
Articles and other News
If you have not yet heard anything about the book “Open Circuits: The Inner Beauty of Electronic Components” you’re both in and out of luck. Out of luck because the book by No Starch press sold out really really quick, but you’re in luck because IEEE Spectrum is showcasing a few of the entries in this article titled The Inner Beauty of Basic Electronics . If you always wanted to know what the inside of all the components really look like, this is your chance.
I recently started going into a bit of AI/ML rabbit hole, to try and understand the failure modes and consequences of these technologies, and what to consider when evaluating them. It is quite exciting to be reading about a new topic I know hardly anything about. Microsoft have published good introductory materials on this topic:
Reverse engineering a HAM Radio firmware encryption ? The target in question is a Yaesu FT-70D with a Renesas H8SX microcontroller, and the article focuses mostly on decrypting the firmware so it can be made ready for further reverse engineering. Article is at https://landaire.net/reversing-yaesu-firmware-encryption/
This article goes into details on how to gain root access to the Hyundai Tucson’s vehicle head unit. https://xakcop.com/post/hyundai-hack-2/
Does anyone remember iPods? In the words of the author, the iPod Bootrom exploit 10 years too late
Papers
A paper was released reviewing and aggregating cyber attack taxonomies in the manufacturing space. With most of the industry hyper-focused on ransomware, I personally appreciated the consideration some of the listed taxonomies are giving to physical consequences such as energy consumption, environmental damage and human safety. The full paper can be downloaded at https://arxiv.org/abs/2301.07303
[…] this article highlights how cyberattack taxonomies can be used to better understand and characterize manufacturing cybersecurity threats. Then, it reviews and analyzes current taxonomical classifications of manufacturing cybersecurity threat attributes and countermeasures, as well as the proliferation of the scope and coverage in current taxonomies. As a result, these taxonomies are compiled into a more comprehensive and consistent meta-taxonomy for the smart manufacturing space. […]
Remaining with the idea of increasing energy consumption as a consequence of a cyberattack, this paper considers the same in the context of the Z-Wave protocol supported by a home alarm system, draining the battery of the system in a short amount of time. The paper also describes other DoS attacks. Are Home Security Systems Reliable?
Home security systems have become increasingly popular since they provide an additional layer of protection and peace of mind. These systems typically include battery-powered motion sensors, contact sensors, and smart locks. Z-Wave is a very popular wireless communication technology for these low-power systems. In this paper, we demonstrate two new attacks targeting Z-Wave devices. First, we show how an attacker can remotely attack Z-Wave security devices to increase their power consumption by three orders of mag-
nitude, reducing their battery life from a few years to just a few hours. Second, we show multiple Denial of Service (DoS) attacks which enables an attacker to interrupt the operation of security systems in just a few seconds. Our experiments show that these attacks are effective even when the attacker device is in a car 100 meters away from the targeted house.
Vulnerabilities
Binarly publishes multiple vulnerabilities in Qualcomm and Lenovo ARM-based devices, some of which can lead to a Secure Boot bypass, and some which were found in reference code published by the vendor, so we can expect a widespread occurrence of these.
Bits and Pieces
The CFP for the Secure Our Streets organized by the ASRG automotive community conference is open: https://sos.asrg.io/cfp/
While a bit out of the ordinary for this newsletter, I did want to raise this article about burnout. Many of us work in demanding roles, and managing our energy appropriately is important to maintain a sane balance. But it is not always easy to know what is really affecting our energy levels, and that is precisely what is discussed in this short article, keeping track of what really caused a burnout in people. It’s good to keep an eye on many of these, stay healthy.
