computer security

Apple security head Ivan Krstic gives a Black Hat 2016 talk on iOS security, covering HomeKit, Auto Unlock and iCloud Keychain. He explains key hierarchies and how data can stay safe even in adversarial clouds.

Ivan Krstic's Black Hat talk on Apple platform security, including the Find My design that uses elliptic curve key diversification to locate offline devices privately. It also covers hardware features such as the T2 chip and secure boot hardening.

James Mickens's humorous USENIX Security keynote argues that improving security and trusting opaque technology like machine learning is far harder than the industry admits.

Meredith Patterson and Sergey Bratus argue that networked software stays insecure because protocols and inputs are too complex to recognize safely. They propose using formal language theory and grammars to build secure, verifiable input handling.

Andrew "bunnie" Huang examines how realistic hardware supply chain attacks are, from rogue insiders to nation states, in the wake of the Bloomberg Businessweek report. He explains how undocumented components could be hidden on boards and how hard they are to spot.

A 34C3 talk on the security architecture of the Nintendo Switch and the early progress breaking it. It introduces the Switch's custom OS and software stack, with the hackers' reverse-engineering and glitching work.

Tony Chen of Microsoft explains at BlueHat Seattle 2019 how the Xbox One was designed to resist physical attacks. He covers the security design and hypervisor-based OS architecture that kept the console uncracked for years.

Dan Geer's Black Hat 2014 keynote argues that cybersecurity is a matter of power and policy rather than wishful thinking. He covers surveillance, the vulnerability market, software liability and privacy as the capacity to misrepresent yourself.

A WGBH/NOVA re-enactment of Clifford Stoll's hunt for KGB-linked hacker Markus Hess, based on his book The Cuckoo's Egg. It starts from a 75-cent accounting discrepancy at Lawrence Berkeley Laboratory.

David Weston's BlueHat IL 2023 talk traces the evolution of Windows security and previews Windows 11 and hardware advances. It ends with upcoming changes such as Rust in the kernel and fonts, signed binaries and adminless Windows.

A showcase of the author's fifth-generation quad-core computer built entirely from Minecraft redstone, after two years of development. It features cache, a hardware stack, a GPU driving a 15x15 display, and serial I/O ports.

Locksport historian Schuyler Towne's RVASec 2012 talk on why people lock their doors, tracing the history of locks and the assumptions about security behind them.

Deviant Ollam shows that most physical attacks on doors bypass the lock, with photo and video examples of how doors, frames and hardware get defeated. It is a physical security talk from Shakacon.

A DEF CON 20 talk by RenderMan on the security weaknesses of ADS-B, the unencrypted, unauthenticated aircraft tracking broadcast. It shows how easily the data can be spoofed and what that means for security designed in too late.

A 57-minute account of Clifford Stoll's tracking of a KGB-linked hacker through Lawrence Berkeley Lab computers in 1986, the story of The Cuckoo's Egg. It covers the FBI and Chaos Computer Club involvement.

Jayson E. Street's DEF CON 19 talk shows photos from real security engagements where he was already inside client facilities, illustrating how social engineering and physical intrusion can cause huge losses. For each attack he also explains what defenses would have stopped him.

Theo de Raadt presents pledge, a new OpenBSD security mechanism that kills processes which exceed the system calls they declared they need. The talk was given late at night at Hackfest 2015.

The 1990 NOVA documentary follows astronomer Clifford Stoll as he tracks a hacker through military and research computer networks, a story that involved the CIA and KGB. It is based on The Cuckoo's Egg.

A 36C3 talk that systematically evaluates OpenBSD's exploit mitigations, asking how effective they really are and what they cost in performance, complexity and inspectability. It challenges the project's security marketing.

C-SPAN footage of the L0pht hacker collective testifying before the US Senate Governmental Affairs Committee on May 19, 1998. The members discuss internet and computer security weaknesses. The uploader says the media remembered only the claim that they could take down the internet in 30 minutes.

Rory McCune's AppSec EU 2015 talk on security risks in modern software deployment. It covers weaknesses in package ecosystems like npm, RubyGems and PyPI, and repository compromise.

A 1953 US Navy training film explaining the basic mechanisms in mechanical fire control computers aboard ships. It shows how gears, differentials and cams solved mathematical problems in permanent mechanical form.

CuriousMarc's Apollo Guidance Computer restoration series looks at core rope memory, the ROM that held the Moon landing programs. Mike Stewart builds a custom reader to recover lost AGC programs.

Microsoft's Tony Chen explains how the Xbox One was designed to resist physical attacks, including secure boot, encrypted memory, a security processor and a hypervisor. The goal was to make any hardware attack cost more than the price of many games.

A HOPE conference talk by Howard Payne and Deviant Ollam on common keys, such as elevator and fire service keys, that open many buildings. It covers physical security weaknesses from shared key standards.

Netanel Rubin's 31C3 talk chains Perl's syntax quirks into a powerful remote code execution attack, taking down popular Perl-based projects.

A 36C3 talk on the AMD Platform Security Processor, an undocumented ARM core inside AMD CPUs that runs before the main processor. The speakers present their reverse engineering of its internals.

Craig Heffner's Black Hat 2013 talk on exploiting network surveillance cameras, covering how insecure their firmware is. It shows how easily such devices can be compromised.

Dr Mike Pound of Computerphile shows how a modern laptop can crack Enigma, using a ciphertext-only attack based on an older paper. He compares it with the tooling in CrypTool.

A 1995 episode of The Computer Chronicles devoted to Gary Kildall, creator of CP/M. It works as a retrospective and tribute to the personal computer pioneer.

Rob Miles explains on Computerphile how language models generate plausible text and how transformers improved on recurrent networks, with a look at what comes next.

Rob Miles explains on Computerphile why implementing an off switch for a general AI is hard. A capable agent would resist being stopped because shutdown prevents it from achieving its goal.

A 1987 episode of The Computer Chronicles on Apple's HyperCard, showing users building their own applications. Gary Kildall appears and Bill Atkinson discusses the program, with credit given to earlier influences.

A 1993 episode of The Computer Chronicles on the early Internet, with guests including Howard Rheingold discussing online community. It is a window into how the internet was seen and what hardware was in use at the time.

Rob Miles discusses GPT-3 on Computerphile, covering how scaling parameters kept improving results over GPT-2 and how the model nearly learned arithmetic without anyone knowing exactly how.

First lecture of MIT 6.00, an introductory computer science course taught in Python by Eric Grimson and John Guttag. It covers the goals of the course, what computation is, and data types, operators and variables.

Ben Eater explains why he builds computers on breadboards, including testing their signal behavior on an oscilloscope. It is a companion to his 6502 breadboard computer series.

The first episode of the BBC's 1982 television series The Computer Programme, introducing home computing to a general audience. It surveys mainframes, early personal computers such as the BBC Micro and Commodore PET, and the changing computer market of the time.

Moxie Marlinspike's DEF CON 19 talk on the weaknesses of SSL and the certificate authority system. He explains how CA trust became a problem and proposes an alternative that removes the CA oligopoly without reducing security.

Ronald Minnich of Google explains how UEFI firmware is a large closed attack surface and describes Google's work replacing it with Linux-based boot firmware. It also touches on Intel ME and other security coprocessors.