12 - BruCON 0x0F - Firmware vulnerabilities in critical infrastructure - Nate Warfield
Channel: BruCON Security Conference
Date: 29/09/2023

"Firmware is the immutable law that governs the machine, the commandments etched into its very being."
In today's interconnected world, critical infrastructure is increasingly reliant on complex systems and networks to operate efficiently. This reliance on technology has opened up new avenues for attacks that can compromise the safety and security of these systems. Defending these systems is complex, as the attack surface extends beyond the visibility of most security solutions, into the foundation of all computing: firmware.
In this talk, I will demonstrate how I use open source tools to perform deep security analysis of device firmware. I will provide a comprehensive overview of the tools and techniques used to uncover vulnerabilities in connected enterprise systems, transit system hardware, network infrastructure and physical security controls. I will provide practical examples of how open source tools and systems like ChatGPT can be leveraged to simplify both research and reverse engineering, including a real world example of identifying supply chain risk and how I found a vendor silently patching vulnerabilities. There are many commercial solutions available which claim to solve this problem, and I will show the audience how they can achieve the same goal for a fraction of the cost (or free!).
Finally, the audience will be presented with an egregious number of vulnerabilities, misconfigurations and poor security controls I discovered across a myriad of enterprise systems. Attendees will leave with a better understanding of the hidden risks in their environments, the importance of identifying them and the tools, techniques & procedures for doing it.