Black Hat Europe
November 10-13, 2015
Amsterdam RAI | The Netherlands
BH Executive Summit
December 8-10, 2015
Omni Montelucia | Scottsdale, AZ
Black Hat Asia
March 29 - April 1, 2016
Marina Bay Sands | Singapore
01:00 PM
Black Hat Staff
Black Hat Staff
Event Updates

Black Hat USA 2014: Go Around the Side

Sometimes the path of least resistance is also the path less traveled; if the software's unyielding, make an end run around it and attack the hardware. Today's two Black Hat 2014 Training highlights delve into the perhaps less familiar world of attacks on embedded hardware.

Side-channel power analysis can seem straight-up spooky in its ability to extract secrets from hardware systems without the need for exploits or coding vulnerabilities. How can you defend against such an attack, or from clock and power glitching? Advanced Embedded Hardware Hacking: Power Analysis and Glitching with the ChipWhisperer will use hands-on exercises to teach you the theory and practice of these attacks using the open-source hardware and software tools of the ChipWhisperer project. The low-cost ChipWhisperer suite makes side-channel power analysis more accessible than ever, so don't miss this opportunity to add these techniques to your arsenal.

In a world where security mechanisms like secure boot and trusted execution environments rely on the underlying hardware being trustworthy, and the lion's share of research focuses on hardening software, maybe it's easiest to just attack the hardware. This is the premise behind Breaking Into Embedded Devices: Side-Channel Analysis and Fault Injection, which will show you how to combine side-channel analysis with fault injection (pushing hardware into out-of-spec operating conditions to introduce errors) to break a DES key, for example, without fussing over software. The Training will also focus on defense, challenging you to devise effective countermeasures which will then be put to the test.

Ready to register? Early-bird rates are available until June 2. Please visit Black Hat USA 2014's registration page to get started.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Current Issue
E-Commerce Security: What Every Enterprise Needs to Know
The mainstream use of EMV smartcards in the US has experts predicting an increase in online fraud. Organizations will need to look at new tools and processes for building better breach detection and response capabilities.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
Published: 2015-10-15
The Direct Rendering Manager (DRM) subsystem in the Linux kernel through 4.x mishandles requests for Graphics Execution Manager (GEM) objects, which allows context-dependent attackers to cause a denial of service (memory consumption) via an application that processes graphics data, as demonstrated b...

Published: 2015-10-15
netstat in IBM AIX 5.3, 6.1, and 7.1 and VIOS 2.2.x, when a fibre channel adapter is used, allows local users to gain privileges via unspecified vectors.

Published: 2015-10-15
Cross-site request forgery (CSRF) vulnerability in eXtplorer before 2.1.8 allows remote attackers to hijack the authentication of arbitrary users for requests that execute PHP code.

Published: 2015-10-15
Directory traversal vulnerability in QNAP QTS before 4.1.4 build 0910 and 4.2.x before 4.2.0 RC2 build 0910, when AFP is enabled, allows remote attackers to read or write to arbitrary files by leveraging access to an OS X (1) user or (2) guest account.

Published: 2015-10-15
Cisco Application Policy Infrastructure Controller (APIC) 1.1j allows local users to gain privileges via vectors involving addition of an SSH key, aka Bug ID CSCuw46076.

Dark Reading Radio