Rick Altherr's guest appearances

Rick Altherr

The Amp Hour Electronics Podcast

Decipher Security Podcast

On The Metal

Craig Williams

Michael Bailey

Scott Lewis

Brian Donohue

Trammell Hudson

Tanya Sam

Patrick Wardle

Parker Thompson

Joe FitzPatrick

Ken Shirriff

Johnny Mnemonic

Joe Grand

Jonathan Mayer

Robert Hansen

Joe Slowik

OwlTail

Rick Altherr of Eclypsium joins Dennis Fisher to talk about the new research the company published this week on the dangers of unsigned firmware in a wide range of peripherals used in enterprises and home networks.

Rick Altherr of Eclypsium joins Dennis Fisher to talk about the new <a href="https://eclypsium.com/2020/2/18/unsigned-peripheral-firmware/" rel="nofollow" target="_blank">research</a> the company published this week on the dangers of unsigned firmware in a wide range of peripherals used in enterprises and home networks.

You can find Rick on Twitter at https://twitter.com/kc8apf and read his blog at https://www.kc8apf.net/. Some of the highlights of the show include:  USBAnywhere: https://eclypsium.com/2019/09/03/usbanywhere-bmc-vulnerability-opens-servers-to-remote-attack/  Rick's talk at OSFC: https://www.youtube.com/watch?v=QrcdHHsfaKQ  OpenBMC: https://github.com/openbmc/openbmc https://lwn.net/Articles/683320/  Wireshark: https://www.wireshark.org/ https://github.com/wireshark/wireshark  Ghidra: https://www.nsa.gov/resources/everyone/ghidra/ https://ghidra-sre.org/ https://github.com/NationalSecurityAgency/ghidra  ASPEED: https://www.aspeedtech.com/products.php?fPath=20&amp;rId=440  Nuvoton: https://www.nuvoton.com/products/cloud-computing/ibmc/?__locale=en  CRAY 1: http://bitsavers.trailing-edge.com/pdf/cray/CRAY-1/2240004C_CRAY-1_Hardware_Reference_Nov77.pdf https://en.wikipedia.org/wiki/Cray-1  Deutsches Museum: https://www.deutsches-museum.de/en/exhibitions/communication/computers/  Seymour Cray: https://www.cray.com/company/history/seymour-cray https://www.britannica.com/biography/Seymour-R-Cray  CDC 6600: https://en.wikipedia.org/wiki/CDC_6600 https://conservancy.umn.edu/handle/11299/104327  Alpha Station: https://web.archive.org/web/20060701073452/http://h18002.www1.hp.com/alphaserver/workstations.html https://en.wikipedia.org/wiki/AlphaStation  Tru64: https://groups.google.com/forum/?hl=en#!original/bit.listserv.esl-l/BovGe3q9yWE/cqlcCYfxmbAJ https://en.wikipedia.org/wiki/Tru64_UNIX  Windows NT: https://web.archive.org/web/20040610122846/http://www.microsoft.com/presspass/features/1998/winntfs.asp https://web.archive.org/web/20020503172231/http://www.win2000mag.com/Articles/Print.cfm?ArticleID=4494 https://en.wikipedia.org/wiki/Windows_NT  Windows NT on Mips: https://gunkies.org/wiki/Installing_Windows_NT_4.0_on_Qemu(MIPS)  Palo Alto Goodwill: https://goodwillsv.org/store/palo-alto-store/  SGI: https://en.wikipedia.org/wiki/Silicon_Graphics https://en.wikipedia.org/wiki/SGI_Visual_Workstation  Cray 1 on ebay: https://www.theregister.co.uk/2010/05/24/cray_1_gate_module_ebay/  root calvin: https://www.dell.com/support/article/us/en/04/sln306783/dell-poweredge-what-is-the-default-username-and-password-for-idrac?lang=en https://www.reddit.com/r/sysadmin/comments/2wem6s/is_there_any_story_or_history_behind_rootcalvin/  Redfish: https://www.dmtf.org/standards/redfish https://redfish.dmtf.org/  iKVM: https://www.ikvm.net/ http://www.ikvm.net/userguide/intro.html  IPMI: https://www.intel.com/content/www/us/en/products/docs/servers/ipmi/ipmi-home.html https://en.wikipedia.org/wiki/Intelligent_Platform_Management_Interface  I2C: https://i2c.info/  Non maskable interrupt: https://en.wikipedia.org/wiki/Non-maskable_interrupt  Read and write heads: https://www.computerhistory.org/storageengine/thin-film-heads-introduced-for-large-disks/ https://www.tomshardware.com/reviews/hard-drive-magnetic-storage-hdd,3005-2.html https://en.wikipedia.org/wiki/Disk_read-and-write_head  Fly height: https://en.wikipedia.org/wiki/Flying_height http://maeresearch.ucsd.edu/callafon/publications/2011/UweIEEETonM.pdf  The legend of the walking drives: http://catb.org/jargon/html/W/walking-drives.html http://msgboard.snopes.com/cgi-bin/ultimatebb.cgi?ubb=get_topic;f=103;t=000500;p=1  Open Source Firmware Conference: https://osfc.io/  Coreboot: https://www.coreboot.org/  ChromeOS Firmware: https://www.chromium.org/chromium-os/developer-information-for-chrome-os-devices/custom-firmware  EDK II: https://github.com/tianocore/edk2  Open Compute Project: https://www.opencompute.org/  Width of a Horse's butt: http://www.naute.com/stories/rail.phtml 

You can find Rick on Twitter at <a href="https://twitter.com/kc8apf" rel="nofollow" target="_blank">https://twitter.com/kc8apf</a> and read his blog at <a href="https://www.kc8apf.net/" rel="nofollow" target="_blank">https://www.kc8apf.net/</a>. Some of the highlights of the show include: <ul> <li>USBAnywhere: <a href="https://eclypsium.com/2019/09/03/usbanywhere-bmc-vulnerability-opens-servers-to-remote-attack/" rel="nofollow" target="_blank">https://eclypsium.com/2019/09/03/usbanywhere-bmc-vulnerability-opens-servers-to-remote-attack/</a> </li> <li>Rick's talk at OSFC: <a href="https://www.youtube.com/watch?v=QrcdHHsfaKQ" rel="nofollow" target="_blank">https://www.youtube.com/watch?v=QrcdHHsfaKQ</a> </li> <li>OpenBMC: <a href="https://github.com/openbmc/openbmc" rel="nofollow" target="_blank">https://github.com/openbmc/openbmc</a> <a href="https://lwn.net/Articles/683320/" rel="nofollow" target="_blank">https://lwn.net/Articles/683320/</a> </li> <li>Wireshark: <a href="https://www.wireshark.org/" rel="nofollow" target="_blank">https://www.wireshark.org/</a> <a href="https://github.com/wireshark/wireshark" rel="nofollow" target="_blank">https://github.com/wireshark/wireshark</a> </li> <li>Ghidra: <a href="https://www.nsa.gov/resources/everyone/ghidra/" rel="nofollow" target="_blank">https://www.nsa.gov/resources/everyone/ghidra/</a> <a href="https://ghidra-sre.org/" rel="nofollow" target="_blank">https://ghidra-sre.org/</a> <a href="https://github.com/NationalSecurityAgency/ghidra" rel="nofollow" target="_blank">https://github.com/NationalSecurityAgency/ghidra</a> </li> <li>ASPEED: <a href="https://www.aspeedtech.com/products.php?fPath=20&amp;rId=440" rel="nofollow" target="_blank">https://www.aspeedtech.com/products.php?fPath=20&amp;rId=440</a> </li> <li>Nuvoton: <a href="https://www.nuvoton.com/products/cloud-computing/ibmc/?__locale=en" rel="nofollow" target="_blank">https://www.nuvoton.com/products/cloud-computing/ibmc/?__locale=en</a> </li> <li>CRAY 1: <a href="http://bitsavers.trailing-edge.com/pdf/cray/CRAY-1/2240004C_CRAY-1_Hardware_Reference_Nov77.pdf" rel="nofollow" target="_blank">http://bitsavers.trailing-edge.com/pdf/cray/CRAY-1/2240004C_CRAY-1_Hardware_Reference_Nov77.pdf</a> <a href="https://en.wikipedia.org/wiki/Cray-1" rel="nofollow" target="_blank">https://en.wikipedia.org/wiki/Cray-1</a> </li> <li>Deutsches Museum: <a href="https://www.deutsches-museum.de/en/exhibitions/communication/computers/" rel="nofollow" target="_blank">https://www.deutsches-museum.de/en/exhibitions/communication/computers/</a> </li> <li>Seymour Cray: <a href="https://www.cray.com/company/history/seymour-cray" rel="nofollow" target="_blank">https://www.cray.com/company/history/seymour-cray</a> <a href="https://www.britannica.com/biography/Seymour-R-Cray" rel="nofollow" target="_blank">https://www.britannica.com/biography/Seymour-R-Cray</a> </li> <li>CDC 6600: <a href="https://en.wikipedia.org/wiki/CDC_6600" rel="nofollow" target="_blank">https://en.wikipedia.org/wiki/CDC_6600</a> <a href="https://conservancy.umn.edu/handle/11299/104327" rel="nofollow" target="_blank">https://conservancy.umn.edu/handle/11299/104327</a> </li> <li>Alpha Station: <a href="https://web.archive.org/web/20060701073452/http://h18002.www1.hp.com/alphaserver/workstations.html" rel="nofollow" target="_blank">https://web.archive.org/web/20060701073452/http://h18002.www1.hp.com/alphaserver/workstations.html</a> <a href="https://en.wikipedia.org/wiki/AlphaStation" rel="nofollow" target="_blank">https://en.wikipedia.org/wiki/AlphaStation</a> </li> <li>Tru64: <a href="https://groups.google.com/forum/?hl=en#!original/bit.listserv.esl-l/BovGe3q9yWE/cqlcCYfxmbAJ" rel="nofollow" target="_blank">https://groups.google.com/forum/?hl=en#!original/bit.listserv.esl-l/BovGe3q9yWE/cqlcCYfxmbAJ</a> <a href="https://en.wikipedia.org/wiki/Tru64_UNIX" rel="nofollow" target="_blank">https://en.wikipedia.org/wiki/Tru64_UNIX</a> </li> <li>Windows NT: <a href="https://web.archive.org/web/20040610122846/http://www.microsoft.com/presspass/features/1998/winntfs.asp" rel="nofollow" target="_blank">https://web.archive.org/web/20040610122846/http://www.microsoft.com/presspass/features/1998/winntfs.asp</a> <a href="https://web.archive.org/web/20020503172231/http://www.win2000mag.com/Articles/Print.cfm?ArticleID=4494" rel="nofollow" target="_blank">https://web.archive.org/web/20020503172231/http://www.win2000mag.com/Articles/Print.cfm?ArticleID=4494</a> <a href="https://en.wikipedia.org/wiki/Windows_NT" rel="nofollow" target="_blank">https://en.wikipedia.org/wiki/Windows_NT</a> </li> <li>Windows NT on Mips: <a href="https://gunkies.org/wiki/Installing_Windows_NT_4.0_on_Qemu(MIPS)" rel="nofollow" target="_blank">https://gunkies.org/wiki/Installing_Windows_NT_4.0_on_Qemu(MIPS)</a> </li> <li>Palo Alto Goodwill: <a href="https://goodwillsv.org/store/palo-alto-store/" rel="nofollow" target="_blank">https://goodwillsv.org/store/palo-alto-store/</a> </li> <li>SGI: <a href="https://en.wikipedia.org/wiki/Silicon_Graphics" rel="nofollow" target="_blank">https://en.wikipedia.org/wiki/Silicon_Graphics</a> <a href="https://en.wikipedia.org/wiki/SGI_Visual_Workstation" rel="nofollow" target="_blank">https://en.wikipedia.org/wiki/SGI_Visual_Workstation</a> </li> <li>Cray 1 on ebay: <a href="https://www.theregister.co.uk/2010/05/24/cray_1_gate_module_ebay/" rel="nofollow" target="_blank">https://www.theregister.co.uk/2010/05/24/cray_1_gate_module_ebay/</a> </li> <li>root calvin: <a href="https://www.dell.com/support/article/us/en/04/sln306783/dell-poweredge-what-is-the-default-username-and-password-for-idrac?lang=en" rel="nofollow" target="_blank">https://www.dell.com/support/article/us/en/04/sln306783/dell-poweredge-what-is-the-default-username-and-password-for-idrac?lang=en</a> <a href="https://www.reddit.com/r/sysadmin/comments/2wem6s/is_there_any_story_or_history_behind_rootcalvin/" rel="nofollow" target="_blank">https://www.reddit.com/r/sysadmin/comments/2wem6s/is_there_any_story_or_history_behind_rootcalvin/</a> </li> <li>Redfish: <a href="https://www.dmtf.org/standards/redfish" rel="nofollow" target="_blank">https://www.dmtf.org/standards/redfish</a> <a href="https://redfish.dmtf.org/" rel="nofollow" target="_blank">https://redfish.dmtf.org/</a> </li> <li>iKVM: <a href="https://www.ikvm.net/" rel="nofollow" target="_blank">https://www.ikvm.net/</a> <a href="http://www.ikvm.net/userguide/intro.html" rel="nofollow" target="_blank">http://www.ikvm.net/userguide/intro.html</a> </li> <li>IPMI: <a href="https://www.intel.com/content/www/us/en/products/docs/servers/ipmi/ipmi-home.html" rel="nofollow" target="_blank">https://www.intel.com/content/www/us/en/products/docs/servers/ipmi/ipmi-home.html</a> <a href="https://en.wikipedia.org/wiki/Intelligent_Platform_Management_Interface" rel="nofollow" target="_blank">https://en.wikipedia.org/wiki/Intelligent_Platform_Management_Interface</a> </li> <li>I2C: <a href="https://i2c.info/" rel="nofollow" target="_blank">https://i2c.info/</a> </li> <li>Non maskable interrupt: <a href="https://en.wikipedia.org/wiki/Non-maskable_interrupt" rel="nofollow" target="_blank">https://en.wikipedia.org/wiki/Non-maskable_interrupt</a> </li> <li>Read and write heads: <a href="https://www.computerhistory.org/storageengine/thin-film-heads-introduced-for-large-disks/" rel="nofollow" target="_blank">https://www.computerhistory.org/storageengine/thin-film-heads-introduced-for-large-disks/</a> <a href="https://www.tomshardware.com/reviews/hard-drive-magnetic-storage-hdd,3005-2.html" rel="nofollow" target="_blank">https://www.tomshardware.com/reviews/hard-drive-magnetic-storage-hdd,3005-2.html</a> <a href="https://en.wikipedia.org/wiki/Disk_read-and-write_head" rel="nofollow" target="_blank">https://en.wikipedia.org/wiki/Disk_read-and-write_head</a> </li> <li>Fly height: <a href="https://en.wikipedia.org/wiki/Flying_height" rel="nofollow" target="_blank">https://en.wikipedia.org/wiki/Flying_height</a> <a href="http://maeresearch.ucsd.edu/callafon/publications/2011/UweIEEETonM.pdf" rel="nofollow" target="_blank">http://maeresearch.ucsd.edu/callafon/publications/2011/UweIEEETonM.pdf</a> </li> <li>The legend of the walking drives: <a href="http://catb.org/jargon/html/W/walking-drives.html" rel="nofollow" target="_blank">http://catb.org/jargon/html/W/walking-drives.html</a> <a href="http://msgboard.snopes.com/cgi-bin/ultimatebb.cgi?ubb=get_topic;f=103;t=000500;p=1" rel="nofollow" target="_blank">http://msgboard.snopes.com/cgi-bin/ultimatebb.cgi?ubb=get_topic;f=103;t=000500;p=1</a> </li> <li>Open Source Firmware Conference: <a href="https://osfc.io/" rel="nofollow" target="_blank">https://osfc.io/</a> </li> <li>Coreboot: <a href="https://www.coreboot.org/" rel="nofollow" target="_blank">https://www.coreboot.org/</a> </li> <li>ChromeOS Firmware: <a href="https://www.chromium.org/chromium-os/developer-information-for-chrome-os-devices/custom-firmware" rel="nofollow" target="_blank">https://www.chromium.org/chromium-os/developer-information-for-chrome-os-devices/custom-firmware</a> </li> <li>EDK II: <a href="https://github.com/tianocore/edk2" rel="nofollow" target="_blank">https://github.com/tianocore/edk2</a> </li> <li>Open Compute Project: <a href="https://www.opencompute.org/" rel="nofollow" target="_blank">https://www.opencompute.org/</a> </li> <li>Width of a Horse's butt: <a href="http://www.naute.com/stories/rail.phtml" rel="nofollow" target="_blank">http://www.naute.com/stories/rail.phtml</a> </li></ul>