Free Daily Podcast Summary
Below the Surface (Audio) - The Supply Chain Security Podcast: Daily Summaries Delivered
by Eclypsium
Get key takeaways, quotes, and insights from Below the Surface (Audio) - The Supply Chain Security Podcast in a 5-minute read. Delivered straight to your inbox.
Latest Episodes
The most recent episodes — sign up to get AI-powered summaries of each one.
- 1 weeks ago55 min
Uncovering Firmware Risks: From Y2K to Modern Malware - BTS #73
In this episode of Below the Surface, hosts Paul Asadoorian, Chase Snyder, and guest Brian Richardson explore the evolution of firmware security, the risks of supply chain vulnerabilities, and the latest threats targeting network edge devices like Cisco ASA and FTD. They discuss historical malware like the Chernobyl virus, modern malware campaigns such as Firestarter, and the challenges of securing complex network infrastructure in a rapidly evolving threat landscape. Links: https://www.linkedin.com/news/story/white-house-pushes-back-on-anthropics-mythos-expansion-8741242/ https://www.tomshardware.com/tech-industry/cyber-security/the-chernobyl-virus-turned-27-today-and-it-could-brick-your-pc-in-ways-modern-malware-cant https://blog.talosintelligence.com/uat-4356-firestarter/ Chapters 00:00 Introduction to Below the Surface 02:20 Brian's Transition to Eclipseum 03:50 The Y2K Experience and Early Virus Detection 06:31 The CIH Virus and Its Impact 10:12 BIOS Security and Vulnerabilities 14:10 The Importance of Firmware Lockdown 18:09 Modern Threats and UEFI Attacks 22:13 Targeted Malware and Ransomware Risks 25:21 Creative Concepts in Cybersecurity 26:20 Emerging Threats: Firestarter Malware 30:54 The Security of Network Devices 35:17 Challenges in Managing Security Appliances 39:52 Persistence of Malware and Its Implications 43:02 The Evolving Landscape of Cyber Threats 49:44 AI and Cybersecurity: The Anthropic Dilemma
- Apr 17, 202658 min
AI-Powered Firmware Hacking: The Future of Vulnerability Discovery - BTS #72
In this episode, the hosts explore the latest in cybersecurity, including AI-driven vulnerability discovery, firmware analysis tools, secure boot complexities, and recent CVE trends. They discuss practical techniques for hacking devices, the challenges of firmware emulation, and the implications of new security policies on consumer and enterprise hardware. Chapters 00:00 Introduction to Hacking and Security Updates 03:24 Exploring Samsung TV Hacking 06:34 AI in Vulnerability Research 11:17 The Role of AI in Exploiting Vulnerabilities 15:18 CVE Disclosure and Ethical Considerations 20:43 AI Tools and Instrumentation in Development 24:41 Emerging Tools for Firmware Analysis 28:14 Navigating Linux Security Challenges 29:12 The Surge of CVEs: Understanding the Growth 31:29 The Role of AI in Vulnerability Discovery 34:50 CVE Enrichment: The Need for Contextual Data 36:57 Microsoft's Secure Boot: A Double-Edged Sword 46:43 Vulnerabilities in Bootloaders: A Case Study 51:25 The Complexity of Secure Boot Management 53:24 Regulatory Challenges in Router Security
- Apr 7, 20261h 1m
What Makes a Device a Router? - BTS #71
summary In this episode, the hosts discuss the new FCC regulations regarding consumer routers, exploring the implications for cybersecurity, the definitions of what constitutes a router, and the challenges of manufacturing compliant devices. They delve into the debate surrounding the effectiveness of these regulations in mitigating cyber risks, the role of hardware versus software vulnerabilities, and the potential impact on consumers and existing devices in homes. In this conversation, the hosts discuss the implications of the FCC's decision to decertify routers and firmware, the challenges posed by the conditional approval process, and the potential impact on router security and availability. They explore conspiracy theories surrounding the regulations, compare US and EU cybersecurity standards, and address the complexities of hardware backdoors and default credentials. The conversation highlights the need for better security practices and the importance of addressing vulnerabilities in enterprise devices. Chapters 00:00 Introduction to FCC Regulations on Routers 02:35 The Impact of FCC Regulations on Consumer Devices 05:03 Defining What Constitutes a Router 09:51 The Security Implications of Router Regulations 12:41 The Role of Hardware vs. Software in Cybersecurity 17:11 Challenges in Manufacturing and Compliance 21:40 Consumer Impact and Existing Devices 25:59 The Future of Networking Devices and Regulations 29:48 Decertification of Routers and Firmware Challenges 31:58 Conditional Approval Process and Its Implications 34:40 Proposed Solutions for Router Security Standards 36:53 Conspiracy Theories Surrounding Router Regulations 39:26 The Impact of Regulations on Router Availability and Pricing 42:05 Comparing US and EU Cybersecurity Regulations 46:11 The Complexity of Hardware Backdoors and Security 49:11 Addressing Default Credentials and Vulnerabilities 52:02 Conditional Approval Guidance and Its Flaws 54:56 Recent Vulnerabilities in Enterprise Devices
- Mar 25, 20261h 2m
How Cheap KVMs Could Be Your Network's Weak Link - BTS #70
In this episode, we explore the security vulnerabilities of low-cost IP-based KVMs, including firmware flaws, default credentials, and insecure update mechanisms. Two Eclypsium researchers, Paul and Rey, discovered the vulnerabilities and shared the details and behind-the-scenes details! We also discuss real-world testing, vendor responses, and best practices for securing remote management devices in enterprise environments. Chapters 00:00 Introduction to KVM Vulnerabilities 03:00 Research Background and Team Introduction 05:57 Exploring GLINet and Initial Findings 09:03 Firmware Analysis and Security Expectations 11:58 Vulnerability Disclosure and Response 15:07 Enterprise Risks and Deployment Concerns 17:59 Security Best Practices for KVMs 21:06 Vendor Responses and Community Engagement 23:49 Unique Vulnerabilities in SiP and JetKVM 27:01 Conclusion and Future Directions 31:26 Vulnerability Research and Tool Development 34:14 Vendor Communication and Disclosure Challenges 37:51 Firmware Update Issues and Security Concerns 39:12 The Importance of Reviews and Brand Trust 41:42 Security Best Practices for KVMs 45:38 Network Segmentation and Device Security 49:26 Discovering IoT Devices on the Network 52:11 Open Source Solutions and Community Engagement 55:58 The Future of KVM Security and Regulation
- Mar 5, 20261h 4m
Navigating Network Edge Vulnerabilities - BTS #69
In this episode of Below the Surface, Paul Asadoorian, Vlad Babkin, and Adrian Sanabria discuss the ongoing vulnerabilities in network edge devices, the implications of legacy systems like Avanti, and the strategies employed by threat actors. They explore the importance of monitoring and detection in cybersecurity, as well as innovative deception techniques to enhance security measures against exploitation. In this conversation, the speakers delve into various aspects of cybersecurity, including innovative strategies to enhance security, the challenges posed by vendor cooperation, the implications of cyber insurance, and the importance of visibility in threat detection. They discuss the use of canary tokens, the exploitation of edge devices, and the reality of zero-day vulnerabilities. The conversation also touches on the need for firmware updates, the shift towards open-source solutions, and the role of AI in developing cybersecurity tools. Chapters 00:00 Introduction to Below the Surface Podcast 03:27 Network Edge Vulnerabilities and Trends 10:02 Understanding Avanti and Its Impact 12:44 The Consequences of Legacy Systems 18:03 Exploitation Techniques and Threat Actor Strategies 26:50 The Importance of Monitoring and Detection 31:14 Deception Techniques for Enhanced Security 32:55 Leveraging Canary Tokens for Enhanced Security 34:41 The Challenge of Vendor Cooperation in Cybersecurity 35:30 Understanding Cyber Insurance and Its Implications 36:25 The Importance of Visibility in Cyber Defense 39:12 Utilizing Low-Interaction Honeypots for Threat Intelligence 41:48 Exploiting Vulnerabilities in Edge Devices 43:27 The Reality of Zero-Day Vulnerabilities 45:04 Analyzing Recent Exploits in Network Devices 49:02 The Need for Firmware Updates and Alternatives 50:33 Exploring Tailscale and Remote Access Solutions 54:33 Building Secure Lab Environments 56:52 The Shift Towards Open Source in Cybersecurity 01:00:27 Innovations in Memory Forensics 01:03:02 AI's Role in Enhancing Cybersecurity Tools
- Feb 11, 20261h 2m
Attacking Power Grids - BTS #68
In this episode, the hosts discuss various cybersecurity threats, including Russian cyber attacks on critical infrastructure, the vulnerabilities in firewalls and VPNs, and the implications of AI in cybersecurity. They explore the increasing trend of using Python for malicious purposes and the challenges posed by gaming anti-cheat drivers. The conversation also touches on the escalation of cyber warfare and the confused deputy problem in AI, highlighting the need for better security measures and awareness in the industry. Chapters 00:00 Introduction to Cybersecurity Threats 02:52 Russian Cyber Attacks on Poland's Power Grid 10:33 The Flaws in Firewall Security 15:02 AI and the Future of Cybersecurity 22:22 Exploiting Vulnerabilities in Gaming Anti-Cheat Drivers 29:47 Driver Attestation and Security Transparency 35:17 Critical Infrastructure and Cybersecurity Threats 39:50 Linux Malware and Python Exploits 45:47 Firmware Complexity and Security Risks 51:19 Cyber Insurance and Responsibility in Cybersecurity 56:52 Confused Deputy Attack and AI Security Risks
- Jan 27, 20261h 0m
BIOS Password Cracking, Secure Boot, and Stackwarp - BTS #67
In this episode, the hosts discuss various cybersecurity topics, including the challenges of BIOS password cracking, the implications of AMD's Stack Warp vulnerability, and the importance of up-to-date secure boot certificates. They also explore the risks associated with network security appliances, the costs of cybersecurity, and the role of marketing in raising awareness. Additionally, they share insights from an X-ray analysis of USB cables, highlighting the differences between quality and counterfeit products. BIOS password cracking can be complex and time-consuming. Physical access to hardware can significantly impact security measures. The Stack Warp vulnerability poses serious risks to virtual machines. Secure boot certificates need regular updates to maintain security. Network security appliances can introduce new vulnerabilities. Cybersecurity costs often outweigh the perceived benefits of cloud solutions. Marketing plays a crucial role in raising awareness about cybersecurity issues. X-ray analysis can reveal the quality of electronic components. Understanding the shared responsibility model is essential for IT teams. The balance between security and operational efficiency is a constant challenge. Chapters 01:59 Introduction to Below the Surface Podcast 04:46 BIOS Password Cracking Techniques 10:14 Exploring AMD's Stack Warp Vulnerability 22:03 Migration Trends in Cloud Computing 23:22 Cost vs. Security in On-Premises Solutions 24:37 Shared Responsibility in Network Security Appliances 27:03 The Risks of Network Security Appliances 28:14 Exploitation of Vulnerabilities in Network Devices 31:18 Challenges in Updating Network Security Appliances 34:59 The Slow Response to Vulnerabilities 39:05 The Complexity of Firmware Updates 45:45 Secure Boot Certificates and Future Vulnerabilities 49:12 Fun Innovations: X-ray Machine in the Office
- Jan 15, 202656 min
Beyond the Label: The Truth About Hardware Trust - BTS #66
In this episode of Below the Surface, host Paul Asadoorian is joined by co-hosts Larry Pesci, Joshua Marpet, and Vlad Babkin to delve into the complexities of hardware supply chain security. The discussion is sparked by a presentation from Andrew 'Bunny' Wong at Black Hat Asia, which raised critical questions about how we can trust the silicon in our devices. The conversation explores the challenges of validating hardware components, the potential for backdoors in devices, and the implications of counterfeit components in the supply chain. The hosts share anecdotes and insights about their experiences with hardware security, emphasizing the need for independent testing and the importance of understanding the provenance of hardware components. 00:00 Introduction to Hardware Supply Chain Security 02:53 Understanding Trust in Silicon 05:55 Challenges in Validating Hardware Components 09:01 Historical Context of Hardware Tampering 11:58 The Complexity of Supply Chains 14:55 Operationalizing Hardware Validation 18:01 The Role of Independent Researchers 20:59 Bounties and Community Involvement 23:56 Innovative Techniques for Hardware Analysis 27:06 The Future of Hardware Security 31:57 The Evolution of Computing: From Transistors to Quantum 36:11 Understanding Hardware Trust and Supply Chain Risks 41:52 The Need for Continuous Monitoring and Assurance 55:31 The Future of High Assurance Devices and Backdoors
Get Below the Surface (Audio) - The Supply Chain Security Podcast summaries in your inbox
Free AI-powered daily recaps. Key takeaways, quotes, and mentions — in a 5-minute read.
Get Free Summaries →Free forever for up to 3 podcasts. No credit card required.
You Might Also Like
Listeners also like.
Supply Chain Radio
Supply Chain Radio
The Security Podcast of Silicon Valley
YSecurity
Security Weekly Podcast Network (Audio)
Security Weekly Productions
Security Weekly Podcast Network (Video)
Security Weekly Productions
Secure AF - A Cybersecurity Podcast
Alias Cybersecurity
Let's Talk Supply Chain
Sarah Barnes-Humphrey
Supply Chain Now
Supply Chain Now
Enterprise Security Weekly (Audio)
Security Weekly Productions
HACKED: Into the minds of Cybersecurity leaders
Talking cybersecurity with nexus IT Security group
Talkin' Bout [Infosec] News
Black Hills Information Security
Application Security Weekly (Audio)
Security Weekly Productions
Infosecurity Magazine Podcast
Infosecurity Magazine
About Below the Surface (Audio) - The Supply Chain Security Podcast
A lively discussion of the threats affecting supply chain, specifically focused on firmware and low-level code that is a blind spot for many organizations. This podcast will feature guests from the cybersecurity industry discussing the problems surrounding supply chain-related issues and potential solutions.Get the Supply Chain Security Toolkit from Eclypsium here: https://eclypsium.com/go
Customized Recaps
AI-powered recaps with compact key takeaways, quotes, and insights.
Straight to Your Inbox
Get key takeaways from Below the Surface (Audio) - The Supply Chain Security Podcast in a 5-minute read.
Save Hours Every Week
Stay current on your favorite podcasts without falling behind.
Frequently Asked Questions
What is Podzilla's Below the Surface (Audio) - The Supply Chain Security Podcast daily summary?
It's a free AI-powered email that summarizes new episodes of Below the Surface (Audio) - The Supply Chain Security Podcast as soon as they're published. You get the key takeaways, notable quotes, and links & mentions — all in a quick read.
How does the Below the Surface (Audio) - The Supply Chain Security Podcast podcast summary work?
When a new episode drops, our AI transcribes and analyzes it, then generates a personalized summary tailored to your interests and profession. It's delivered to your inbox every morning.
Is this an official Below the Surface (Audio) - The Supply Chain Security Podcast product?
No. Podzilla is an independent service that summarizes publicly available podcast content. We're not affiliated with or endorsed by Eclypsium.
Can I get summaries of other podcasts too?
Absolutely! The free plan covers up to 3 podcasts. Upgrade to Pro for 15, or Premium for 50. Browse our full catalog at /podcasts.
How often does Below the Surface (Audio) - The Supply Chain Security Podcast release new episodes?
Below the Surface (Audio) - The Supply Chain Security Podcast publishes biweekly. Our AI generates a summary within hours of each new episode.
What topics does Below the Surface (Audio) - The Supply Chain Security Podcast cover?
Below the Surface (Audio) - The Supply Chain Security Podcast covers topics including Technology, Business. Our AI identifies the specific themes in each episode and highlights what matters most to you.
Start getting Below the Surface (Audio) - The Supply Chain Security Podcast summaries tomorrow morning.
Free forever for up to 3 podcasts. No credit card required.
Free forever for up to 3 podcasts. No credit card required.