Thought leaders in information security, we conduct radical, world-changing research and deliver renowned presentations around the world.
Blogs | GUEST BLOG | June 9, 2021

Cybersecurity Alert Fatigue: Why It Happens, Why It Sucks, and What We Can Do About It | Andrew Morris, GreyNoise

Introduction “Although alert fatigue is blamed for high override rates in contemporary clinical decision support systems, the concept of alert fatigue is poorly defined. We tested hypotheses arising from two possible alert fatigue mechanisms: (A) cognitive overload associated with amount of work, complexity of work, and effort distinguishing informative from uninformative alerts, and (B) desensitization from repeated exposure to the same alert over time.” Ancker, Jessica S., et al. “Effects of workload, work complexity, and repeated alerts on alert fatigue in a clinical decision support system.” BMC…

Library | WHITEPAPER | May 17, 2021

Cross-Platform Feature Comparison

For an Intel-commissioned study, IOActive compared security-related technologies from both 11th Gen Intel Core vPro mobile processors and AMD Ryzen PRO 4000 series mobile processors. Our comparison was based on a set of objectives bundled into five categories: Below the OS, Platform Update, Trusted Execution, AdvancedThreat Protection, and Crypto Extension. Based on IOActive research, we conclude that AMD offers no corresponding technologies in the Below the OS, Platform Update, Advanced Threat Protection, or Crypto Extension categories, while Intel offers features in all of these categories. Intel and AMD have equivalent…

Launch PDF
IOActive Research
Blogs | EDITORIAL | April 8, 2021

Trivial Vulnerabilities, Serious Risks

Introduction The digital transformation brought about by the social distancing and isolation caused by the global COVID-19 pandemic was both extremely rapid and unexpected. From shortening the distance to our loved ones to reengineering entire business models, we’re adopting and scaling new solutions that are as fast-evolving as they are complex. The full impact of the decisions and technological shifts we’ve made in such short a time will take us years to fully comprehend. Unfortunately, there’s a darker side to this rapid innovation and growth which is often performed to…

Tiago Assumpcao & Robert Connolly
Library | COLLATERAL | April 7, 2021

Trivial Vulnerabilities, Big Risks

IOActive case study detailing the trivial vulnerabilities with big risks for the users of the Brazilian National Justice Council Processo Judicial Eletrônico (CNJ PJe) judicial data processing system.

Launch PDF
Tiago Assumpcao & Robert Connolly
Blogs | RESEARCH | April 6, 2021

Watch Your Step: Research Into the Concrete Effects of Fault Injection on Processor State via Single-Step Debugging

Fault injection, also known as glitching, is a technique where some form of interference or invalid state is intentionally introduced into a system in order to alter the behavior of that system. In the context of embedded hardware and electronics generally, there are a number of forms this interference might take. Common methods for fault injection in electronics include: Clock glitching (errant clock edges are forced onto the input clock line of an IC) Voltage fault injection (applying voltages higher or lower than the expected voltage to IC power lines)…

Ethan Shackelford
Disclosures | ADVISORIES | March 2, 2021

CNJ PJeOffice Remote Code Execution in Update Mechanism

Brasil CNJ’s Processo Judicial Eletrônico (PJe) system processes judicial data with the objective of fulfilling the needs of the Brazilian Judiciary Power: the Superior, Military, Labor, and Electoral Courts; the courts of both the Federal Union and individual states; and specialized justice systems that handle ordinary law and employment tribunals at both the federal and state level. The main goal of PJeOffice is to guarantee the legal authenticity and integrity of documents and processes through digital signatures. It is employed by lawyers, judges, and high-level officials, such as prosecutors and…

Launch PDF
Tiago Assumpcao & Robert Connolly
Blogs | RESEARCH | February 23, 2021

A Practical Approach to Attacking IoT Embedded Designs (II)

In this second and final blog post on this topic, we cover some OTA vulnerabilities we identified in wireless communication protocols, primarily Zigbee and BLE. As in the previous post, the findings described herein are intended to illustrate the type of vulnerabilities a malicious actor could leverage to attack a specified target to achieve DoS, information leakage, or arbitrary code execution. These vulnerabilities affect numerous devices within the IoT ecosystem. IOActive worked with the semiconductor vendors to coordinate the disclosure of these security flaws, but it is worth mentioning that…

Ruben Santamarta
Blogs | RESEARCH |

Probing and Signal Integrity Fundamentals for the Hardware Hacker, part 2: Transmission Lines, Impedance, and Stubs

This is the second post in my ongoing series on the troubles posed by high-speed signals in the hardware security lab. What is a High-speed Signal? Let’s start by defining “high-speed” a bit more formally: A signal traveling through a conductor is high-speed if transmission line effects are non-negligible. That’s nice, but what is a transmission line? In simple terms: A transmission line is a wire of sufficient length that there is nontrivial delay between signal changes from one end of the cable to the other. You may also see…

Andrew Zonenberg
Blogs | RESEARCH | February 11, 2021

A Practical Approach To Attacking IoT Embedded Designs (I)

The booming IoT ecosystem has meant massive growth in the embedded systems market due to the high demand for connected devices. Nowadays, designing embedded devices is perhaps easier than ever thanks to the solutions, kits, chips, and code that semiconductor manufacturers provide to help developers cope with the vast number of heterogeneous requirements IoT devices should comply with. This never-ending race to come up with new features within tight deadlines comes at a cost, which usually is paid in the security posture of the commercialized device.

Ruben Santamarta

Arm IDA and Cross Check: Reversing the 787’s Core Network

IOActive has documented detailed attack paths and component vulnerabilities to describe the first plausible, detailed public attack paths to effectively reach the avionics network on a 787, commercial airplane from either non-critical domains, such as Passenger Information and Entertainment Services, or even external networks.