Cybersecurity solutions for the whole lifecycle of IoT and embedded systems.| River Loop Security
Cybersecurity solutions for the whole lifecycle of IoT and embedded systems.| riverloopsecurity.com
Cybersecurity solutions for the whole lifecycle of IoT and embedded systems.| riverloopsecurity.com
Hashashin is a library which implements algorithms for basic block and graph aware hashing to allow security researchers to conduct comparisons and program analysis across different compiled binaries.| Home on River Loop Security
KillerBee software is intended for students, researchers, engineers, and security professionals to use for evaluating the security of IEEE 802.15.4/ZigBee systems. River Loop is a leader in IEEE 802.15.4 and ZigBee security research and penetration testing, and is proud to contribute to the open-source and security community through the continued development of KillerBee along with other contributors.| Home on River Loop Security
The ApiMote v4beta version is beta hardware intended for students, researchers, engineers, and security professionals to use for learning about and evaluating the security of IEEE 802.15.4/ZigBee systems.| Home on River Loop Security
A GoodFET is an opensource JTAG adaptor and universal bus interface. We have made contributions to the GoodFET code base, specifically the CCSPI app (for ChipCon radio communications on IEEE 802.15.4), Facedancer code (for low level USB fuzzing), testing, and hardware production.| Home on River Loop Security
Scapy dot15d4 is a IEEE 802.15.4 dissection/construction layer for the popular Scapy packet manipulation framework. Others have joined in to extend this to make it a leading tool for evaluating the security of IEEE 802.15.4/ZigBee systems.| Home on River Loop Security
This article in PoC||GTFO is a “quick-start” style guide for reversing engineering embedded systems. The goal is to get the reader situated with the ARM Cortex M architecture as quickly as possible, so they can apply their other reversing experience to this platform.| Home on River Loop Security
This article in PoC||GTFO is a “quick-start” style guide for reversing engineering embedded systems. The goal is to get the reader situated with the MSP430 architecture as quickly as possible, so they can apply their other reversing experience to this platform.| Home on River Loop Security
Any channel crossing the perimeter of a system provides an attack surface to the adversary. Standard network interfaces, such as TCP/IP stacks, constitute one such channel, and security researchers and exploit developers have invested much effort into exploring the attack surfaces and defenses there. However, channels such as USB have been overlooked, even though such code is at least as complexly layered as a network stack, and handles even more complex structures; drivers are notorious as ...| Home on River Loop Security
Presents methods for injecting raw frames at Layer 1 from within upper-layer protocols by abuse of in-band signaling mechanisms common to most digital radio protocols. This packet piggy-backing technique allows attackers to hide malicious packets inside packets that are permitted on the network.| Home on River Loop Security
Security is critical for the wireless interface offered by soon-to-be-ubiquitous smart meters; if not secure, this technology provides an remotely accessible attack surface distributed throughout many homes and businesses. History shows, however, that new network interfaces remained brittle and vulnerable (although believed otherwise) until security researchers could thoroughly explore their attack surface.| Home on River Loop Security
Cybersecurity solutions for the whole lifecycle of IoT and embedded systems.| River Loop Security
Cybersecurity solutions for the whole lifecycle of IoT and embedded systems.| River Loop Security
Cybersecurity solutions for the whole lifecycle of IoT and embedded systems.| River Loop Security
Cybersecurity solutions for the whole lifecycle of IoT and embedded systems.| River Loop Security
Cybersecurity solutions for the whole lifecycle of IoT and embedded systems.| River Loop Security
Cybersecurity solutions for the whole lifecycle of IoT and embedded systems.| River Loop Security
Cybersecurity solutions for the whole lifecycle of IoT and embedded systems.| River Loop Security
Cybersecurity solutions for the whole lifecycle of IoT and embedded systems.| River Loop Security
Cybersecurity solutions for the whole lifecycle of IoT and embedded systems.| River Loop Security
A year ago, we released a series of blogposts documenting our research into the world of binary hashing. While we speculated about the efficacy of this technique for binary diffing, our primary goal was to recognize similar code between binaries for the purpose of porting annotations from one analyzed binary to another and many of our design choices reflected this end-goal. Luckily, we’ve been given the opportunity to explore how these hashing techniques could be applied to the world of “...| Home on River Loop Security
Proactive cybersecurity protections are critical to overall product success due to increasing risk, combined with consumer and enterprise awareness of cyber practices and their impact. River Loop Security works with a wide variety of organizations to secure their products; as a result we have seen the effectiveness proactive security has on their success. One tool that we often draw upon is penetration testing (‘pentest’ for short), or the act of simulating a scenario in which a malicious...| Home on River Loop Security
River Loop Security’s team members presented at IEEE International Conference on Physical Assurance and Inspection of Electronics (PAINE). The presentation provided a background on hardware implants, secure boot, and background on the Trusted Platform Module (TPM). We then focused on explaining and demonstrating our team’s work developing an TPM interposer and decoder. It concluded in discussing defending agaisnt malicious hardware implants.| Home on River Loop Security
On November 17, 2020 the senate passed H.R. 1668, the Internet of Things Cybersecurity Improvement Act of 2020, by unanimous consent. It is expected to be signed into law, making it a major step in describing and enforcing Internet of Things (IoT) cybersecurity. In short, this bill requires that the National Institute of Standards and Technology (NIST) set standards, guidelines, and best practices for IoT devices that are procured or used by federal agencies. While the scope of the bill is li...| Home on River Loop Security
Introduction Welcome back to our hardware hacking series! We are excited to share the “glitching” techniques we use in our device assessment process. Glitching, or voltage or fault injection, is the process of changing voltage levels in a digital system in a manner that causes disruption of the system under test or corruption of data. If timed correctly, a glitch of even 1 millisecond can cause a system to fail open into a potentially privileged state.| Home on River Loop Security
While fuzzing a NITF Extract utility extract75 utility published by the US Air Force Sensor Data Management System, we found a global buffer overflow that leads to a write-what-where condition. This flaw has been assigned CVE-2020-13995 and is disclosed in this blog post. See our Coordinated Vulnerability Disclosure process for more information on how we go about disclosing vulnerabilities we find.| Home on River Loop Security
The National Imagery Transmission Format (NITF) was brought to our attention under the DARPA SafeDocs program. In this program, we are using binary instrumentation and static analysis to understand parsers’ de facto file format specifications. The NITF format is a container format for other image files. It details a large amount of metadata, such as classification info for each file and sub-section. A single NITF file can contain, for example, multiple images, text annotations, and graphics...| Home on River Loop Security
In late May 2020, we were asked to help triage the root cause of a bug where an image, when parsed by Android SystemUI, caused the Android process to crash. This could cause a boot loop if, for example, the image was set as the phone’s background. We quickly identified the root cause which we found interesting from an ecosystem perspective. This blog shares parts of our analysis, and covers our trace of the relevant code path and diagnosis of the root cause. We describe how the fixes work, ...| Home on River Loop Security
This is the first post in a series that describes how we built tools to rapidly identify and characterize “format extensions”: modifications and new feature additions in parsers of complex formats. In this puzzle, we were given a set of binaries and a few input files – in this instance PDFs. Our task was to precisely characterize any new feature(s) present in the binaries and describe how the input files triggered them. Moreover, our goal was to build tools to enable a human to do this ...| Home on River Loop Security
Cybersecurity solutions for the whole lifecycle of IoT and embedded systems.| River Loop Security
Introduction Welcome back to our series on an introduction to hardware hacking! In this post we will be covering the Serial Peripheral Interface (SPI) protocol, a commonly used serial bus protocol which allows hardware components to communicate with each other. The goal of this post is to serve as a guide for security researchers and hardware hackers to easily interface with target devices. Many embedded devices use SPI to access persistent data stored on flash memory.| Home on River Loop Security
Welcome to an introduction to hardware hacking! This series will discuss the basics of interacting with an embedded device though various hardware interfaces. Our team performs penetration testing on IoT / embedded devices every day, and we’re excited to share some of our knowledge and experiences to help those getting started with hardware security learn the ropes. This is a multi-part series which discusses the fundamental concepts, useful tools, and practical techniques which you can use...| Home on River Loop Security
In our previous blog, we described some examples of where binary hashing can help solve problems and compared a number of algorithms for both basic block and graph aware hashing. Today we are releasing a tool, Hashashin, which combines some of these algorithms to allow security researchers to port Binary Ninja annotations from one binary to another.| Home on River Loop Security
As security researchers, we often spend a lot of time looking into the internals of libraries in products we are assessing. With this come some common time sinks, such as identifying library versions. While library version identification is relatively straightforward on the surface, other tasks are clearly more challenging – such as applying signatures to stripped binaries, porting defined types across libraries, and similar codebases.| Home on River Loop Security
In this post, we continue our series on RF4CE by discussing the mechanisms the protocol uses for security. We encourage you to read the first post for background on the purpose of this post and discussion of security levels and keying techniques. This post will explain how RF4CE devices pair and how payloads are encrypted and protected. Additionally, we’ll explain some of the problems with RF4CE security, and discuss potential remediations.| Home on River Loop Security
My team talks a lot about “proactive security” – the concept of baking cybersecurity measures into architecture and design as opposed to responding to vulnerabilities and breaches when they occur. However, I lacked a quantitative answer when recently asked: “how do you convince businesses to start being proactive?”| Home on River Loop Security
In the course of security assessments we often come across protocols and communication methods that are not widely known outside of specific industry use. This article is the first in a series of deep dives on one such protocol, RF4CE. In this article, we talk about the background of RF4CE and its use cases, as well as providing an introduction to the basics of RF4CE.| Home on River Loop Security
River Loop Security’s team members were invited to provide the opening presentation at DARPA’s 2019 Electronics Resurgence Initiative (ERI)1 Summit Workshop on “Security: From Chip to Board”. Ryan Speers, Partner at River Loop Security, and Sophia d’Antoine, Program Analysis Lead at River Loop Security, will be presenting “Supply Chain Security at the Hardware Level”. DARPA’s Microsystems Technology Office is hosting the 2019 ERI Summit to highlight advances in electronics for...| Home on River Loop Security
River Loop Security taught an interactive seminar at the CREDC Summer Symposium on June 25th, 2019 in St. Charles, IL.1 Ryan Speers, a Partner with the team, provided attendees an introduction to security assessments on IEEE 802.15.4 and other related protocols like ZigBee. River Loop has done numerous such engagements and maintains KillerBee, the most widely used open-source tool for conducting penetration tests and research on these protocols. Attendees at the symposium included utility ope...| Home on River Loop Security
This year at INFILTRATE 2019, I got together with fellow RPISEC alumnus and Boston Cybernetics Institute co-founder Jeremy Blackthorne to present “Three Heads Are Better Than One: Mastering NSA’s Ghidra Reverse Engineering Tool”. Around 50 minutes into that presentation, I presented a demo of a proof of concept script I built to trace out how inputs to malloc are derived. In this blog post, we’ll take a deeper look at that script.| Home on River Loop Security
Windows developers may be familiar with “banned.h” or “strsafe” libraries. Introducing safe libraries to development is nothing new, as was covered in the 2007 presentation on SDL for Windows Vista (slide 7). While basic, these basic libraries have been shown to provide significant value - as discussed later in the deck, 41% of bugs that Microsoft removed in Vista early on were due to removal of ‘banned’ API function calls.| Home on River Loop Security
This is the first of a multi-part series where we will share some of our methodology for supply chain verification in situations where there is very limited information. This content was previously shared by Sophia d’Antoine at Square’s r00ted1 Conference on November 14th, 2018 in NYC. We have previously shared our thoughts on the importance of supply chain validation with regard to hardware attacks, but this blog series will delve deeper into the specifics related to case alleged in Bloo...| Home on River Loop Security
It’s not often that one can get excited reading draft regulatory guidance. However, our team was pleasantly surprised by the quality and quantity of specific and actionable cybersecurity recommendations in the US Food and Drug Administration (FDA) draft Content of Premarket Submissions for Management of Cybersecurity in Medical Devices, published October 18, 2018.| Home on River Loop Security
In the past few months, media reporting1 2 on alleged Chinese backdoors via one or more types of hardware implants which compromised American products and companies has raised the public’s awareness of the risk of security compromise via hardware. For those of us who deal with hardware security daily, such allegations are not a big surprise. Our team has worked on designing, securing, and hacking hardware used in places ranging from startups to security-critical government applications, and...| Home on River Loop Security
In the hardware hacking community, one of the tried-and-true “go to” tools for serial communication, dumping SPI flash chips, and interacting with basic JTAG interfaces is the GoodFET, developed by our neighbor Travis Goodspeed. Some of the GoodFET instructions are a bit outdated and fragmented, and we recently were asked for help installing this on a modern Debian-based system, namely the Kali Linux security distribution. We have written up those procedures here in the hope that they are...| Home on River Loop Security
While we are always excited to both learn and share the latest technical developments in cybersecurity (the recent Black Hat and DEF CON conferences were no exception), we also enjoy stepping back once in a while to look at macro trends in the embedded security industry. While security is a top priority in many enterprise and industrial settings, here are three key concepts that we think are important for us all to keep in mind:| Home on River Loop Security
Cybersecurity solutions for the whole lifecycle of IoT and embedded systems.| River Loop Security
Cybersecurity solutions for the whole lifecycle of IoT and embedded systems.| River Loop Security
SummerCon is a different type of conference than most, and honestly sometimes it’s tough to hear the talks over the noise of the crowd at the bar. This year, the organizers added a second venue to try to spread out the noise from the great conversations and impromptu meetings, so some of the talks could be heard. We wanted to share a few notes on our teams’ key takeaways from the weekend.| Home on River Loop Security
At River Loop Security, we are always looking to advance the state of cybersecurity research alongside our work tackling our clients’ toughest problems. Presenting our research at computer security conferences is one way that we hope to share our lessons learned with the community. This summer, we’re excited to present at BlackHat USA and DefCon. We’ll be showcasing some select areas of our team’s research: 1) RF Fuzzing and Hardware Tools, 2) Reversing a Windows Antivirus Emulator, 3...| Home on River Loop Security
This is the second of two blog posts where we will share a summary of the differences. We encourage you to read the first post for background on the purpose of this post and discussion of security levels and keying techniques. The ZigBee and ZWave protocols have both undergone numerous revisions and support many different security modes and edge cases. In this discussion, we will try to focus on core design decisions and features, and leave out discussion or investigation of edge cases for br...| Home on River Loop Security
We have performed in-depth evaluations of many products built on ZigBee and Z-Wave for clients, and we are often helping clients understand vulnerabilities in IoT products built on standard protocols such as these. We believe that it will benefit the overall community to share a brief summary of our comparisons between these two popular protocols based on the recent ZigBee 3.0 and Z-Wave S2 specifications which both aimed in-part to update the protocols to an increased level of security.| Home on River Loop Security
Cybersecurity solutions for the whole lifecycle of IoT and embedded systems.| River Loop Security
Cybersecurity solutions for the whole lifecycle of IoT and embedded systems.| River Loop Security
As part of our continued commitment to supporting open-source tools, we have added support to KillerBee for the Sewino Open-Sniffer 802.15.4 capture interface. This is the first supported device capable of 900 MHz sniffing. The KillerBee code is available to use it, although we are not actively maintaining and testing this integration. We welcome improvements to the integration or collaborations to expand the supported interfaces further. You can also read about the integration on their site.| Home on River Loop Security
We have announced the ApiMote v4beta design and released it as open-source hardware at the TROOPERS14 security conference. This hardware was designed specifically with security researchers and assessors in mind, and is supported by the KillerBee software toolkit and GoodFET. We believe it offers unique capabilities unfulfilled by other interfaces currently available. If you want to use this board, you can build it based on the open-source design files or obtain a pre-built, tested, and progra...| Home on River Loop Security
We have released BeeKeeper Wireless Intrusion Detection System (WIDS), an open-source IEEE 802.15.4 Wireless IDS at the TROOPERS14 security conference. This beta version demonstrates a strong framework for multiple sensors and a centralized analytic engine. A few simple detection scripts are included to demonstrate detecting common attacks. You can read about it on our projects page or review our presentation. The source code is available and we encourage anyone interested to submit updates t...| Home on River Loop Security
Cybersecurity solutions for the whole lifecycle of IoT and embedded systems.| River Loop Security
Presented our project to create the ApiMote hardware at the Wireless Village. The ApiMote platform is designed specifically to fulfill the needs of security assessors, based on experience from both lab-research and field assessments. It is inexpensive, easy to program, supports expansion and battery power, uses an internal or external antenna, and has low-level support for cutting-edge RF research (low-level registers exposed, in support of PIP, POOP, etc).| Home on River Loop Security
Cybersecurity solutions for the whole lifecycle of IoT and embedded systems.| River Loop Security
Cybersecurity solutions for the whole lifecycle of IoT and embedded systems.| River Loop Security
Cybersecurity solutions for the whole lifecycle of IoT and embedded systems.| riverloopsecurity.com
Cybersecurity solutions for the whole lifecycle of IoT and embedded systems.| riverloopsecurity.com
Cybersecurity solutions for the whole lifecycle of IoT and embedded systems.| riverloopsecurity.com
Cybersecurity solutions for the whole lifecycle of IoT and embedded systems.| River Loop Security