Transportation Electrification Cybersecurity Threatscape
World-Wide Electric Vehicle (EV) Charging Infrastructure Trends The global push to meet rising EV adoption with sufficient EV smart charger infrastructure is astoundingly challenging. Bloomberg estimates the global charging infrastructure market opportunity to be $1.9T between 2022 and 2050. That opportunity will be seized upon by a host of organizations large and small, public and private. From EV fleet depots to fast charging stations along highways, parking garages, smart chargers for employees, and home chargers,…
IOActive Security Advisory | Nokia Industrial Fieldrouter (CPE) Multiple Vulnerabilities
Nokia developed 5G field routers to address the challenge of connecting older industrial equipment and vehicles reliably to private wireless networks. This aids mining companies, port operators, manufacturers, and other enterprises in adopting Industry 4.0 applications such as autonomous operations.
Field-Programmable Chips (FPGAs) in Critical Applications – What are the Risks?
What is an FPGA? Field-Programmable Gate Arrays (FPGAs) are a type of Integrated Circuit (IC) that can be programmed or reprogrammed after manufacturing. They consist of an array of logic blocks and interconnects that can be configured to perform various digital functions. FPGAs are commonly used in applications where flexibility, speed, and parallel processing capabilities are required, such as telecommunications, automotive, aerospace, and industrial sectors. FPGAs are often found in products that are low volume or demand short turnaround time because they can be purchased off the shelf and programmed…
Evolving Cyber Threatscape: What’s Ahead and How to Defend
The digital world is a dangerous place. And by all accounts, it’s not getting a whole lot better. Damages from cybercrime will top a staggering $8 trillion this year, up from an already troubling $1 trillion just five years ago and rocketing toward $14 trillion by 2028. Supply chains are becoming juicier targets, vulnerabilities are proliferating, and criminals with nation-state support are growing more active and more sophisticated. Ransomware, cryptojacking, cloud compromises, and AI-powered shenanigans are all on a hockey-stick growth trajectory. Looking ahead, there are few sure…
Always Updated Awards 2024 Blog
We are excited to announce that IOActive received multiple prestigious awards wins this year! Keep this blog bookmarked to always stay up-to-date on the company’s accomplishments throughout 2024. Last updated May 9, 2024 IOActive was honored for its ability to maximize security investments and enhance clients’ overall security posture and business resilience. Unlike many organizations that default to defensive strategies, we at IOActive go beyond standard penetration testing to provide clients with red and purple team services that exceed typical assessments. We prioritize a comprehensive understanding of cyber adversaries through…
Untested Is Untrusted: Penetration Tests and Red Teaming Key to Mature Security Strategy
Organizations need to know how well their defenses can withstand a targeted attack. Red team exercises and penetration tests fit the bill, but which is right for your organization? Information security at even well-defended enterprises is often a complex mesh of controls, policies, people, and point solutions dispersed across critical systems both inside and outside the corporate perimeter. Managing that murky situation can be challenging for security teams, many of whom are understaffed and forced to simply check as many of the boxes as they can on the organization’s framework…
Bits to Binary to Bootloader to Glitch: Exploiting ROM for Non-invasive Attacks
In this paper, we explore how ROM can be leveraged to perform a non-invasive attack (i.e., voltage glitching) by a relatively unsophisticated actor without a six-figure budget. We begin by explaining what ROM is, why it is used, and how it can be extracted. What exactly is ROM? Put simply, Read-Only Memory (ROM) is a type of Non-Volatile Memory (NVM) that is constructed as physical structures within chips. The structures are patterned as ones and zeroes on one, and only one, of several layers of the chip. Why just…
Lessons Learned and S.A.F.E. Facts Shared During Lisbon’s OCP Regional Summit
I don’t recall precisely what year the change happened, but at some point, the public cloud became critical infrastructure with corresponding high national security stakes. That reality brought rapid maturity and accompanying regulatory controls for securing and protecting the infrastructure and services of cloud service providers (CSPs). Next week at the 2024 OCP Regional Summit in Lisbon, teams will be sharing new security success stories and diving deeper into the technical elements and latest learnings in securing current generation cloud infrastructure devices. IOActive will be present throughout the event,…
Accessory Authentication – part 3/3
This is Part 3 of a 3-Part series. You can find Part 1 here and Part 2 here. Introduction In this post, we continue our deep dive comparison of the security processors used on a consumer product and an unlicensed clone. Our focus here will be identifying and characterizing memory arrays. Given a suitably deprocessed sample, memories can often be recognized as such under low magnification because of their smooth, regular appearance with distinct row/address decode logic on the perimeter, as compared to analog circuitry (which contains many…
Accessory Authentication – part 2/3
This is Part 2 of a 3-Part series. You can find Part 1 here and Part 3 here. Introduction In this post, we continue our deep dive comparison of the security processors used on a consumer product and an unlicensed clone. Our focus here will be comparing manufacturing process technology. We already know the sizes of both dies, so given the gate density (which can be roughly estimated from the technology node or measured directly by locating and measuring a 2-input NAND…