Shakedown Social

BSides BoulderTwo days until <a href="https://infosec.exchange/tags/BSidesBoulder25" class="mention hashtag" rel="nofollow noopener" target="_blank">#BSidesBoulder25</a> and only 15 tickets remain! Today we highlight, two <a href="https://infosec.exchange/tags/BSidesBoulder25" class="mention hashtag" rel="nofollow noopener" target="_blank">#BSidesBoulder25</a> talks: Andrew Brandt's "Smashing Smishing by Quashing Quishing" and Eric Harashevsky's "Firmware Readout Bypass in STM92 (Don't put this in an alarm control panel). Andrew's talk will examine QR-based phishing attacks, how attackers are exploiting QR codes and SMS to steal credentials and MFA tokens, and how a cross-industry collaboration between mobile vendors, telcos, and the infosec community could finally slam the door on mobile phishing. Think SafeBrowsing, but for QR scans! And we promise that our BSidesBoulder event QR codes will not redirect you to an Andrew-controlled C2 server. Eric's talk will explore his adventure tinkering with an old STM92's firmware - the talk will explore his findings, reverse engineering the legacy microcontroller, bypassing firmware protections, and what that means for devices still hanging on your wall! Expect a live demo that is sure to excite your future hardware hacking journey. <a href="https://infosec.exchange/tags/BSides" class="mention hashtag" rel="nofollow noopener" target="_blank">#BSides</a> <a href="https://infosec.exchange/tags/BSidesBoulder" class="mention hashtag" rel="nofollow noopener" target="_blank">#BSidesBoulder</a> <a href="https://infosec.exchange/tags/CyberSecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#CyberSecurity</a> <a href="https://infosec.exchange/tags/Quishing" class="mention hashtag" rel="nofollow noopener" target="_blank">#Quishing</a> <a href="https://infosec.exchange/tags/Smishing" class="mention hashtag" rel="nofollow noopener" target="_blank">#Smishing</a> <a href="https://infosec.exchange/tags/MobileSecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#MobileSecurity</a> <a href="https://infosec.exchange/tags/PhishingDefense" class="mention hashtag" rel="nofollow noopener" target="_blank">#PhishingDefense</a> <a href="https://infosec.exchange/tags/HardwareHacking" class="mention hashtag" rel="nofollow noopener" target="_blank">#HardwareHacking</a> <a href="https://infosec.exchange/tags/FirmwareSecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#FirmwareSecurity</a>Check out our full schedule at <a href="https://bsidesboulder.org/schedule/" rel="nofollow noopener" translate="no" target="_blank">https://bsidesboulder.org/schedule/</a>Tickets are available for purchase for our 13 June event here: <a href="https://www.eventbrite.com/e/bsides-boulder-2025-registration-1290129274389" rel="nofollow noopener" translate="no" target="_blank">https://www.eventbrite.com/e/bsides-boulder-2025-registration-1290129274389</a>

Tyson, Chicken Rancher 🐓Tomorrow, I start as Director of Product Marketing at Eclypsium, Inc. I am excited to work alongside an extremely smart and thoughtful team.Increasingly, attackers are targeting firmware to evade OS-level protections and maintain persistence. It's an "out of sight, out of mind" attack vector, but extremely critical. Watch this space because it could get real messy, real fast. Think of what an APT can do with with root access to enterprise network appliances, or what malware syndicates could do with an easy-to-use boot kit.What controls do you currently have in place to assess and mitigate the risk of firmware attacks, especially those delivered through your supply chain? Eclypsium makes this easy for IT and security teams. Delivered as SaaS, the platform helps you to establish trust in your software, firmware, and hardware supply chain. Eclypsium has the largest library of firmware profiles and can verify the observed firmware matches the firmware profile that should be on the device, as well as report on firmware configurations.This blog post from <a href="https://infosec.exchange/@paulasadoorian" class="u-url mention" rel="nofollow noopener" target="_blank">@paulasadoorian</a> chronicles recent real-world firmware attacks and explains why attackers focus on firmware: <a href="https://eclypsium.com/blog/endpoint-firmware-attack-timeline-introduction/" rel="nofollow noopener" target="_blank">https://eclypsium.com/blog/endpoint-firmware-attack-timeline-introduction/</a><a href="https://infosec.exchange/tags/supplychainsecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#supplychainsecurity</a> <a href="https://infosec.exchange/tags/firmwaresecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#firmwaresecurity</a> <a href="https://infosec.exchange/tags/blacklotus" class="mention hashtag" rel="nofollow noopener" target="_blank">#blacklotus</a> <a href="https://infosec.exchange/tags/malware" class="mention hashtag" rel="nofollow noopener" target="_blank">#malware</a>

Recent searches

Search options

Administered by:

Server stats:

#firmwaresecurity