hardware security

Andrew "bunnie" Huang examines how realistic hardware supply chain attacks are, from rogue insiders to nation states, in the wake of the Bloomberg Businessweek report. He explains how undocumented components could be hidden on boards and how hard they are to spot.

A 36C3 talk by Bunnie Huang arguing that open source is necessary but not sufficient for trustworthy hardware, because verifying hardware is destructive and so creates a time-of-check/time-of-use gap. It surveys supply chain security and classes of hardware attacks, and presents the Betrusted approach to narrowing that gap.

Tony Chen of Microsoft explains at BlueHat Seattle 2019 how the Xbox One was designed to resist physical attacks. He covers the security design and hypervisor-based OS architecture that kept the console uncracked for years.

Microsoft's Tony Chen explains how the Xbox One was designed to resist physical attacks, including secure boot, encrypted memory, a security processor and a hypervisor. The goal was to make any hardware attack cost more than the price of many games.

Ivan Krstic's Black Hat talk on Apple platform security, including the Find My design that uses elliptic curve key diversification to locate offline devices privately. It also covers hardware features such as the T2 chip and secure boot hardening.

Apple security head Ivan Krstic gives a Black Hat 2016 talk on iOS security, covering HomeKit, Auto Unlock and iCloud Keychain. He explains key hierarchies and how data can stay safe even in adversarial clouds.

A WIRED Future Cities documentary on Shenzhen, covering its hardware-prototyping culture and shanzhai copycat manufacturing. It looks at how the city's ecosystem evolved and what the rest of the world can learn.

Christopher Domas presents research at DEF CON 26 showing a hidden alternate instruction set and undocumented hardware backdoor in some x86 processors, found on a third-party CPU. He uses it to ask how feasible wider hardware backdoors are.

Lock-picking YouTuber Bill Johnson (BosnianBill) explains how to choose a high-security lock and why, showing examples and comparing designs. It covers what makes some padlocks more pick-resistant than others.

A Wendover Productions explainer on how airport security is designed, covering screening layers, x-ray scanning, and the contrast with Israel's profiling-based approach. It walks through the logic behind why security works the way it does.

Christopher Domas's Black Hat talk demonstrates a hardware backdoor in a third-party x86 processor, a hidden core that grants root from userland. He uses it to discuss how feasible broader hardware backdoors might be.

James Mickens's humorous USENIX Security keynote argues that improving security and trusting opaque technology like machine learning is far harder than the industry admits.

Timothy Roscoe of ETH Zurich delivers the joint USENIX ATC/OSDI 2021 keynote arguing that operating systems must reckon with modern hardware, which is a heterogeneous collection of processors, firmware and coprocessors rather than a simple machine. It shows how much runs below and beside Linux.

Meredith Patterson and Sergey Bratus argue that networked software stays insecure because protocols and inputs are too complex to recognize safely. They propose using formal language theory and grammars to build secure, verifiable input handling.

David Weston's BlueHat IL 2023 talk traces the evolution of Windows security and previews Windows 11 and hardware advances. It ends with upcoming changes such as Rust in the kernel and fonts, signed binaries and adminless Windows.

Lieutenant General Mark Hertling gives a TEDx talk arguing that obesity and poor youth fitness are a national security problem because too few young Americans can meet military physical requirements.

A 34C3 talk on the security architecture of the Nintendo Switch and the early progress breaking it. It introduces the Switch's custom OS and software stack, with the hackers' reverse-engineering and glitching work.

Dan Geer's Black Hat 2014 keynote argues that cybersecurity is a matter of power and policy rather than wishful thinking. He covers surveillance, the vulnerability market, software liability and privacy as the capacity to misrepresent yourself.

Cliff Click of Azul Systems gives a Google Tech Talk on running Java business applications on a machine with about a thousand cores. He covers hardware and software codesign, including garbage collection hardware and the JIT.

Deviant Ollam shows that most physical attacks on doors bypass the lock, with photo and video examples of how doors, frames and hardware get defeated. It is a physical security talk from Shakacon.

Joe Grand recounts being hired to hack a Trezor One hardware wallet and recover $2 million of cryptocurrency. He describes three months of experimentation, voltage glitching, failures and high-stakes attempts with only one chance to get it right.

Bill Dally of NVIDIA gives a University of Washington lecture on trends in deep learning hardware. It covers numeric formats, specialized instructions, energy per operation and co-design of hardware and software.

A 35C3 talk presenting a proof-of-concept SPI bus hardware implant with capabilities like those alleged in the Bloomberg Supermicro story, plus countermeasures for detecting such modchips.

A short Apple Get a Mac ad that mocks Windows Vista's constant security pop-up prompts.

Deviant Ollam's two-hour conference talk explains how elevators work, from the pit and buffers to the car top, controller logic and access-control features. It shows how this knowledge can be used for optimization and for bypassing building security.

Locksport historian Schuyler Towne's RVASec 2012 talk on why people lock their doors, tracing the history of locks and the assumptions about security behind them.

A long Gamers Nexus investigation into how volatile US tariffs affect the computer hardware industry. It interviews manufacturers and sellers about costs, margins and why moving production to the US is hard.

A DEF CON 20 talk by RenderMan on the security weaknesses of ADS-B, the unencrypted, unauthenticated aircraft tracking broadcast. It shows how easily the data can be spoofed and what that means for security designed in too late.

Jayson E. Street's DEF CON 19 talk shows photos from real security engagements where he was already inside client facilities, illustrating how social engineering and physical intrusion can cause huge losses. For each attack he also explains what defenses would have stopped him.

Theo de Raadt presents pledge, a new OpenBSD security mechanism that kills processes which exceed the system calls they declared they need. The talk was given late at night at Hackfest 2015.

Bill Dally of NVIDIA gives a Hot Chips 2023 keynote on the challenges of building hardware for deep learning. He traces how GPUs have been adapted for machine learning, especially training.

A roughly 3.5-hour Gamers Nexus investigation into rising PC component prices, driven largely by AI data-center demand for memory and other hardware. It draws on interviews with industry figures to argue that personal computing and ownership are being eroded.

A two-hour Oxide and Friends session answering questions after shipping the first Oxide rack. Topics include making hardware as a startup and why Oxide chose illumos.

Louis Rossmann, a Macbook repair shop owner, goes through a long list of Apple hardware engineering failures, from GPU defects to keyboards and repair practices.

A UC Berkeley CS 161 lecture by Nicholas Weaver on cryptocurrency and blockchains, covering how they work and the case against them. It is aimed at a computer security course audience.

A 36C3 talk that systematically evaluates OpenBSD's exploit mitigations, asking how effective they really are and what they cost in performance, complexity and inspectability. It challenges the project's security marketing.

2kliksphilip examines UserBenchmark, a hardware comparison site known for strongly biased, pro-Intel writing. The video explains the site's credibility problems and points viewers to better sources for CPU and GPU information.

Karsten Nohl and Jakob Lell present BadUSB at Black Hat 2014, showing that USB controller firmware can be reprogrammed to impersonate other device types. They demonstrate system compromise and a self-replicating USB threat that current defenses cannot detect.

John Oliver's Last Week Tonight segment on US voting machines, covering how they work, their security weaknesses, and how elections could be made more secure.

A short video explaining the Intel Management Engine, a hidden embedded computer inside Intel machines with deep access to hardware. It is presented from an insider's perspective and raises backdoor and NSA concerns.