Survey of ICS Firmware Security

Описание: Ang Cui of Red Balloon Security worked with INL and Cyber ITL on identifying vulnerabilities in ICS firmware. The partnership made sense because:
INL has a lot of ICS firmware
Red Balloon has the capability to automate the unpacking and analysis of firmware
Cyber ITL is developing security metrics that have a lot of mindshare (partnership with Consumer Reports as an example)

The background and process is covered in the first half, and then the early results of the 40+ firmware tested begin at 20:40. A key element was determining if the vulnerability was accessible from the network.