Error Code

EP 22: Applying Zero Trust to OT Systems

How might we mitigate the risk to millions of unauthenticated devices already out in the field?  Ron Fabela, Field CTO at XONA Systems, has some ideas about how to achieve zero trust in either legacy or new OT systems. Really, it’s just a matter of reducing the attack surface.

EP 21: Exploiting OPC-UA in OT Environments

In a talk at Black Hat USA 2023, Sharon Brizinov and Noam Moshe from Claroty Team82, disclosed a significant vulnerability in the Open Platform Communications Universal Architecture or OPC-UA, a univsersal protocol used to synchronize different OT devices. In this episode they also discuss a new open source OPC exploit framework designed to help OT vendors check their devices in development.
Transcript.

EP 20: Securing Satellite Communications With Quantum Cryptography

What would happen if someone stole the encryption keys for a major satellite? Well, it’d be game over. Unless the satellite used quantum cryptography. Skip Sanzeri from QuSecure explains how using “quantum tunnels” will allow even legacy satellites in orbit today to become secure in a rapidly approaching post-quantum world.

EP 19: Hack-A-Sat 4

This is a story of what's needed for the Capture The Flag competition at DEF CON 31 to be hosted for the first time on a live satellite orbiting 400 kilometers above the Earth. Mike Walker continues his conversation, focusing more on the game to be played in Hack-A-Sat 4.

EP 18: Hacking Moonlighter

Moonlighter is the world’s first and only hacking sandbox in space. Currently orbiting the earth near the International Space Station, the satellite is the playground for this year’s Hack-A-Sat 4 competition at DEF CON 31. Mike Walker, from Cromulence, discusses the difference between hacking a live satellite in orbit vs the previous Hack-A-Sat CTFs which only simulated the experience. We discuss limited contact windows, latency, and other aspects of orbital mechanics which will surely influence how Hack-a-Sat 4 will be played.

EP 17: Hacking Personal Medical Devices

Could a personal medical device be a threat for an organization? Turns out it’s similar to protecting against an attack on a mobile device. Except a denial of service here could prove fatal. Todd Brasel, the author of Security Issues of Personal Medical Devices: Concerns, Characteristics, and Controls, discusses with Error Code the research he’s done on devices either inside the body or just outside, the vulnerabilities in communications they sometimes have, and the mitigations available today.

EP 16: Hackers At The Capital, Doing Good

Josh Corman, VP of Cyber Safety Strategy at Claroty, is a hacker who knows U.S. public policy well. Ten years ago he created a volunteer organization, I Am The Cavalry, to help educate sitting legislators on active cybersecurity issues. In this episode of Error Code, Josh talks about the recently passed PATCH ACT and how it addresses some of the issues around patching medical devices over the lifetime of the device rather than just at the time of FDA certification. He also talks about his experience working for CISA during COVID-19 and how that helped inform issues within the PATCH ACT.

EP 15: Tracking Threats (and Risks) Against OT Devices

This is the story about researchers who monitor the threats against IoT and OT systems, and the steps being taken to mitigate them.  Ishmael Valenzuela, Vice President of the threat research and Intelligence Team at BlackBerry, shares the latest insights from his company’s Cybersecurity Global Threat Intelligence Report. We talk about threats from Latin America and elsewhere, how firewalls alone won’t necessarily protect OT devices, how attackers and defenders are using AI technology, and how hospitals are seeing perhaps the most increase in threats.

EP 14: Hacking the Power Grid

There’s a lot of FUD around hacking the power grid. Most often, there’s a more common cause: Soot. Even Squirrels. Jori VanAntwerp, CEO of SynSaber. talks about the realities of the US power grid vs the myths. While there’s room to improve, there’s also a great amount of resilience already in the electrical system today.

EP 13: Hacking EV Charging Stations

How the rapid proliferation of EV charging stations is already leading to attacks on the stations and the vehicles themselves, and what we should do about it.  Charles Eagan, CTO of BlackBerry, talks about the rush to create these charging stations and the traditional problems with IoT – vulnerable versions of the OS, of the open source, and even some of the protocols being used. He also talks about how we can improve the security of software defined vehicles and their ecosystems.