BH Mobile Security Summit
June 16-18, 2015
ExCeL London | London, UK
Black Hat USA
August 1-6, 2015
Mandalay Bay | Las Vegas, NV
Black Hat Europe
November 10-13, 2015
Amsterdam RAI | The Netherlands
4/29/2014
01:00 PM
Black Hat Staff
Black Hat Staff
Event Updates
50%
50%

Black Hat USA 2014: Go Around the Side

Sometimes the path of least resistance is also the path less traveled; if the software's unyielding, make an end run around it and attack the hardware. Today's two Black Hat 2014 Training highlights delve into the perhaps less familiar world of attacks on embedded hardware.

Side-channel power analysis can seem straight-up spooky in its ability to extract secrets from hardware systems without the need for exploits or coding vulnerabilities. How can you defend against such an attack, or from clock and power glitching? Advanced Embedded Hardware Hacking: Power Analysis and Glitching with the ChipWhisperer will use hands-on exercises to teach you the theory and practice of these attacks using the open-source hardware and software tools of the ChipWhisperer project. The low-cost ChipWhisperer suite makes side-channel power analysis more accessible than ever, so don't miss this opportunity to add these techniques to your arsenal.

In a world where security mechanisms like secure boot and trusted execution environments rely on the underlying hardware being trustworthy, and the lion's share of research focuses on hardening software, maybe it's easiest to just attack the hardware. This is the premise behind Breaking Into Embedded Devices: Side-Channel Analysis and Fault Injection, which will show you how to combine side-channel analysis with fault injection (pushing hardware into out-of-spec operating conditions to introduce errors) to break a DES key, for example, without fussing over software. The Training will also focus on defense, challenging you to devise effective countermeasures which will then be put to the test.

Ready to register? Early-bird rates are available until June 2. Please visit Black Hat USA 2014's registration page to get started.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Latest Comment: nice one
Current Issue
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2015-1235
Published: 2015-04-19
The ContainerNode::parserRemoveChild function in core/dom/ContainerNode.cpp in the HTML parser in Blink, as used in Google Chrome before 42.0.2311.90, allows remote attackers to bypass the Same Origin Policy via a crafted HTML document with an IFRAME element.

CVE-2015-1236
Published: 2015-04-19
The MediaElementAudioSourceNode::process function in modules/webaudio/MediaElementAudioSourceNode.cpp in the Web Audio API implementation in Blink, as used in Google Chrome before 42.0.2311.90, allows remote attackers to bypass the Same Origin Policy and obtain sensitive audio sample values via a cr...

CVE-2015-1237
Published: 2015-04-19
Use-after-free vulnerability in the RenderFrameImpl::OnMessageReceived function in content/renderer/render_frame_impl.cc in Google Chrome before 42.0.2311.90 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger renderer IPC messages ...

CVE-2015-1238
Published: 2015-04-19
Skia, as used in Google Chrome before 42.0.2311.90, allows remote attackers to cause a denial of service (out-of-bounds write) or possibly have unspecified other impact via unknown vectors.

CVE-2015-1240
Published: 2015-04-19
gpu/blink/webgraphicscontext3d_impl.cc in the WebGL implementation in Google Chrome before 42.0.2311.90 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted WebGL program that triggers a state inconsistency.

Dark Reading Radio
Archived Dark Reading Radio
Join security and risk expert John Pironti and Dark Reading Editor-in-Chief Tim Wilson for a live online discussion of the sea-changing shift in security strategy and the many ways it is affecting IT and business.