Black Hat Europe
November 10-13, 2015
Amsterdam RAI | The Netherlands
BH Executive Summit
December 8-10, 2015
Omni Montelucia | Scottsdale, AZ
Black Hat Asia
March 29 - April 1, 2016
Marina Bay Sands | Singapore
4/29/2014
01:00 PM
Black Hat Staff
Black Hat Staff
Event Updates
50%
50%

Black Hat USA 2014: Go Around the Side

Sometimes the path of least resistance is also the path less traveled; if the software's unyielding, make an end run around it and attack the hardware. Today's two Black Hat 2014 Training highlights delve into the perhaps less familiar world of attacks on embedded hardware.

Side-channel power analysis can seem straight-up spooky in its ability to extract secrets from hardware systems without the need for exploits or coding vulnerabilities. How can you defend against such an attack, or from clock and power glitching? Advanced Embedded Hardware Hacking: Power Analysis and Glitching with the ChipWhisperer will use hands-on exercises to teach you the theory and practice of these attacks using the open-source hardware and software tools of the ChipWhisperer project. The low-cost ChipWhisperer suite makes side-channel power analysis more accessible than ever, so don't miss this opportunity to add these techniques to your arsenal.

In a world where security mechanisms like secure boot and trusted execution environments rely on the underlying hardware being trustworthy, and the lion's share of research focuses on hardening software, maybe it's easiest to just attack the hardware. This is the premise behind Breaking Into Embedded Devices: Side-Channel Analysis and Fault Injection, which will show you how to combine side-channel analysis with fault injection (pushing hardware into out-of-spec operating conditions to introduce errors) to break a DES key, for example, without fussing over software. The Training will also focus on defense, challenging you to devise effective countermeasures which will then be put to the test.

Ready to register? Early-bird rates are available until June 2. Please visit Black Hat USA 2014's registration page to get started.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Flash Poll
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-2329
Published: 2015-08-31
Multiple cross-site scripting (XSS) vulnerabilities in Check_MK before 1.2.2p3 and 1.2.3x before 1.2.3i5 allow remote authenticated users to inject arbitrary web script or HTML via the (1) agent string for a check_mk agent, a (2) crafted request to a monitored host, which is not properly handled by ...

CVE-2014-2330
Published: 2015-08-31
Multiple cross-site request forgery (CSRF) vulnerabilities in the Multisite GUI in Check_MK before 1.2.5i2 allow remote attackers to hijack the authentication of users for requests that (1) upload arbitrary snapshots, (2) delete arbitrary files, or possibly have other unspecified impact via unknown ...

CVE-2014-2331
Published: 2015-08-31
Check_MK 1.2.2p2, 1.2.2p3, and 1.2.3i5 allows remote authenticated users to execute arbitrary Python code via a crafted rules.mk file in a snapshot. NOTE: this can be exploited by remote attackers by leveraging CVE-2014-2330.

CVE-2014-2332
Published: 2015-08-31
Check_MK before 1.2.2p3 and 1.2.3x before 1.2.3i5 allows remote authenticated users to delete arbitrary files via a request to an unspecified link, related to "Insecure Direct Object References." NOTE: this can be exploited by remote attackers by leveraging CVE-2014-2330.

CVE-2014-2570
Published: 2015-08-31
Cross-site scripting (XSS) vulnerability in www/make_subset.php in PHP Font Lib before 0.3.1 allows remote attackers to inject arbitrary web script or HTML via the name parameter.

Dark Reading Radio
Archived Dark Reading Radio
Another Black Hat is in the books and Dark Reading was there. Join the editors as they share their top stories, biggest lessons, and best conversations from the premier security conference.