Profile picture
, 7 tweets, 3 min read
My Authors
Read all threads
Honored to be on the judging panel for Hack-a-Sat at DefCon this year.

Satellite hacking has been around for a while but it’s going mainstream!

DARPA/CFT performers continue to show up, involved in a broad range of technologies. Very involved here too!

hackasat.com
The #nyansat ground station, from @redballoonsec, is looking awesome. It significantly lowers the barrier to entry for satellite communications.

Just like #hackrf, by @michaelossmann, did for RF a few years back.

Both were Cyber Fast Track (CFT) performers!
In fact, there was a fair amount of satellite/RF/etc. focused efforts in CFT.

Antenna Recognition

Electro Magnetic Pulses

Electro Magnetic Injection

HackRF

NFC fuzzing

Secure Two Party Satellite Collision Checking

Securing Legacy Radio Data Links
I keep getting pleasantly reminded that CFT continues to live on in so many meaningful ways.

It has continuing impact.

It even spawned/inspired entire organizations [ DIUx en.m.wikipedia.org/wiki/Defense_I… ].

People ask me why I shut it down nearing the end of my appointed term.
To have the greatest impact and impart long lasting innovation...

It had to leave a beautiful corpse.

CFT needed to show the possible, shock and surprise the establishment, and ultimately not be co-opted and abused.

I was the primary “checks & balance” mechanism.
Thank you to all of the CFT performers for tacking a chance on me and the program.

Thank you to AFRL, West Point, and @drolph for taking the risk and fighting alongside me.

Thanks also to my most amazing SETA team.

CFT was a team effort with truly amazing people throughout!
Oh yeah, big ups to Richard Guidorizzi. He was instrumental in correctly shepherding CFT across the rainbow bridge.

Big love.

Lots and lots of people and lots and lots of awesome stories.

Hacking the system from the inside invariably results in a wild ride and some wild tales.
Missing some Tweet in this thread? You can try to force a refresh.

Keep Current with Mudge

Profile picture

Stay in touch and get notified when new unrolls are available from this author!

Read all threads

This Thread may be Removed Anytime!

Twitter may remove this content at anytime, convert it as a PDF, save and print for later use!

Try unrolling a thread yourself!

how to unroll video

1) Follow Thread Reader App on Twitter so you can easily mention us!

2) Go to a Twitter thread (series of Tweets by the same owner) and mention us with a keyword "unroll" @threadreaderapp unroll

You can practice here first or read more on our help page!

Related hashtags

#nyansat #hackrf

More from @dotMudge see all

Profile picture
Mudge
@dotMudge
Advice for IoT vendors to improve security?

Build and use modern compiler toolchains w/ safety features enabled.

Read the CITL study that evaluated 1.3k IoT products across 15 years; showing the largest poor security issues and downward trends:

cyber-itl.org/2019/08/26/iot…
This isn’t as straight forward as it may seem.

Many think ARM is the dominant architecture but it’s not. MIPS is more common for IoT by far.

MIPS has by far the weakest basic security hygiene.

Yellow bars are arch binaries (y axis right), red is SDLC hygiene (y, axis left)
But on MIPS if a Linux Kernel if 2.4.3.4 thru 2.7 means your app will likely crash if you try to make the stack non-executable.

So you need your IoT device to be at least Linux kernel 2.8 to support this **most basic exploit mitigation**!!

But it gets even trickier...
Read 12 tweets
Profile picture
Mudge
@dotMudge
Unfortunately this large density of defects in IoT is not unexpected.

A study across 15 years and 3millon binaries showed that core security hygiene products in the base of IoT showed no trends towards improvement.

In fact, things more often got worse.

cyber-itl.org/2019/08/26/iot…
Left to their own accord vendors of embedded systems are not demonstrating that they improve basic security hygiene in their products.

There needs to be a more global incentive structure to address this issue.
For example Ubiquity, who’s products I like, simultaneously had their best and worst hygiene product in 2018.

You can see products in their portfolio getting random improvements and products *losing* basic safety features in the dev process.
Read 9 tweets
Profile picture
Mudge
@dotMudge
[Thread]

The kind folk at cyber-itl.org shared a new @zoom_us security issue with me.

I want to take this opportunity to describe:

The issue

How Zoom et al should fix it

How purchasers should identify it before corporate purchasing

What individuals should do

1/
Zoom has been in the news for security issues a lot lately.

I’m choosing to share this info because Zoom has been very good in responding to security researchers and security problems.

It is apparent they care now... but how bad is their security deficit?

Let’s quantify

2/
To avoid adding to the FUD let me state this up front:

If you use Zoom at home for personal reasons to remain connected to loved ones during the pandemic - that’s very important.

You should probably continue using the product.

Hopefully Zoom will update and improve.

3/
Read 21 tweets

Embed code for your website

×
Follow Us on Twitter!

Did Thread Reader help you today?

Support us! We are indie developers!

This site is made by just two indie developers on a laptop doing marketing, support and development! Read more about the story.

Become a Premium Member ($3.00/month or $30.00/year) and get exclusive features!

Become Premium

Too expensive? Make a small donation by buying us coffee ($5) or help with server cost ($10)

Donate via Paypal Become our Patreon

Thank you for your support!