Only a week and a half left for USENIX WOOT '25 conference submissions - deadline March 11 AoE. We’re looking forward to seeing even more of your amazing offensive security papers this year! And still a few days for up-and-coming track (March 4). CfP at www.usenix.org/conference/w...

happy new year 🎉

to continue the tradition, here is some of my favorite firmware & embedded security research of 2024:

Defeating the new Raspberry Pi's RP2350 Security Features [1]

Reversing and Hacking Firmware of an in-orbit Satellite to Re-establish Lost Communication [2]

In case you missed it from #LABScon24: BINARLY’s @matrosov.bsky.social and @pagabuc.bsky.social reveal their research into a firmware supply-chain security issue that affected major device vendors and hundreds of models, PKfail.

📺 Watch the full video: s1.ai/PKfail

📺 #LABScon 2024 Replay: @matrosov.bsky.social
and @pagabuc.bsky.social reveal their research into a firmware supply-chain security issue that affected major device vendors and hundreds of models, PKfail.

👉 Watch the full video: s1.ai/PKfail

Code circulating in the wild hijacks the earliest stage boot process of Linux devices by exploiting a year-old UEFI vulnerability known as LogoFAIL when it remains unpatched. The ultimate objective of the exploit is to install a new Linux bootkit named Bootkitty.

arstechnica.com/security/202...