
Hardwear Track 2021
Este año gracias a Hardwear.io, tenemos contenidos específicos de seguridad informática orientada al hardware, por primera vez en la eko en un formato completo de dos días, con speakers de excelente calidad.
Sumamente agradecidos a Andrea y Antkrish por esta hermosa posibilidad.
Speakers
Sleight of ARM: Demystifying Intel Houdini
Brian Hong
In the recent years, we have seen some of the major players in the industry switch from x86-based processors to ARM processors. Most notable is Apple, who has supported the transition to ARM from x86 with a binary translator, Rosetta 2, which has recently gotten the attention of many researchers and reverse engineers. However, you might be surprised to know that Intel has their own binary translator, Houdini, which runs ARM binaries on x86.
In this talk, we will discuss Intel's proprietary Houdini translator, which is primarily used by Android on x86 platforms, such as higher-end Chromebooks and desktop Android emulators. We will start with a high-level discussion of how Houdini works and is loaded into processes. We will then dive into the low-level internals of the Houdini engine and memory model, including several security weaknesses it introduces into processes using it. Lastly, we will discuss methods to escape the Houdini environment, execute arbitrary ARM and x86, and write Houdini-targeted malware that bypasses existing platform analysis
Brian Hong
Brian Hong is a security consultant at NCC Group, a global information assurance specialist providing organizations with expert security consulting services. He specializes in hardware penetration testing, reverse engineering, and has performed security research related to embedded systems, firmware analysis, web application penetration testing, and Android security and malware analysis. Brian has a B. Eng. in Electrical Engineering and Computer Science from The Cooper Union.
Martin Abbatemarco
Argentinian security researcher working at OpenZeppelin, the leading company in smart contract security on the Ethereum blockchain. Formerly penetration tester at a big-four, he decided to jump into the blockchain space to help secure the future open economy and individual empowerment that this technology can achieve. He's currently enrolled in a Master’s degree on Cybersecurity and Cyberdefense at UBA, and I has spoken at different meetups, conferences, and workshops about smart contract security (such as a 2-hour workshop at Ekoparty 2018, or a recent talk at DEFCON Blockchain Village in August 2020).
TBA
Pronto publicaremos la agenda completa. Mientras tanto, ¡seguí recorriendo la #eko2020!
Mooltipass Mini BLE
Mathieu Stephan
The Mooltipass project is a completely open-source ecosystem aimed at providing hardware-based authentication solutions. Its latest family member, the Mooltipass Mini BLE, features a dual microcontroller architecture aimed at separating the communications and security domains, together with an OLED screen and dedicated flash memories for credentials and graphics storage. The Mooltipass project is an ongoing 7-year adventure with contributors from around the globe. It has produced 3 hardware devices, multiple browser extensions, a cross-platform user interface and software daemon, an SSH agent and a python library.
Mathieu Stephan
TBD
Martin Abbatemarco
Argentinian security researcher working at OpenZeppelin, the leading company in smart contract security on the Ethereum blockchain. Formerly penetration tester at a big-four, he decided to jump into the blockchain space to help secure the future open economy and individual empowerment that this technology can achieve. He's currently enrolled in a Master’s degree on Cybersecurity and Cyberdefense at UBA, and I has spoken at different meetups, conferences, and workshops about smart contract security (such as a 2-hour workshop at Ekoparty 2018, or a recent talk at DEFCON Blockchain Village in August 2020).
TBA
Pronto publicaremos la agenda completa. Mientras tanto, ¡seguí recorriendo la #eko2020!
Machine Learning vs. Hardware Integrity Protection: Who will prevail?
Dominik Sisejkovic
TAs the designated root of trust, hardware is undoubtedly the most critical layer to security in modern electronic systems. However, due to the involvement of third parties in the integrated circuit design and fabrication flow, protecting the hardware against malicious modification, i.e., hardware Trojans, has become ever more complex. This challenge has triggered great interest in the academic and industrial sector to explore novel hardware design for trust methodologies. In particular, logic locking—a hardware obfuscation technique—has evolved as a prominent method to safeguard hardware designs throughout the integrated circuit supply chain. However, the widespread proliferation of machine learning has recently introduced a new pathway to evaluating and breaking locking schemes, thereby uncovering fundamental security vulnerabilities.
In this talk, we will first take a look at the concept of hardware integrity protection w.r.t the mitigation of malicious design modifications known as hardware Trojans. Second, we will analyze the impact of data-driven attacks on modern hardware obfuscation policies.
Finally, we will discuss future steps in designing machine-learning-resilient locking schemes.
Dominik Sisejkovic
Dominik Šišejković received the B.Sc. and M.Sc. degree in computing (software engineering and information systems) from the Faculty of Electrical Engineering and Computing, University of Zagreb, Croatia, in 2014 and 2016 respectively. In September 2016, he started working as a Ph.D. student and research assistant at the Institute for Communication Technologies and Embedded Systems. Since September 2017, he is working as the Technical Project Officer of the EU-funded project TETRAMAX; facilitating technology transfer from academia to European SMEs. From October 2018, he is the Chief Engineer of the Chair for Software for Systems on Silicon. In addition, he was directly involved in the design and implementation of the logic locking framework that was applied for the production of the first logic locked RISC-V processor core on the market. Since 2019, he co-organizes the annual SeHAS workshop on secure hardware, architectures and operating systems at the HiPEAC conference. Since 2020, he is part of the technical committee for the hardware and systems security track at the International Symposium on Quality Electronic Design (ISQED). He received the ICT Young Researcher Award 2020 by RWTH Aachen University for significant contributions in the ICT research area. Moreover, he was awarded the HiPEAC Technology Transfer Award 2020 for successfully transferring a scalable logic locking framework for hardware integrity protection to industry. In 2021, he received the best Ph.D award at the IFIP/IEEE VLSI-SoC conference. Since 2020, he is an ACM professional member.
Martin Abbatemarco
Argentinian security researcher working at OpenZeppelin, the leading company in smart contract security on the Ethereum blockchain. Formerly penetration tester at a big-four, he decided to jump into the blockchain space to help secure the future open economy and individual empowerment that this technology can achieve. He's currently enrolled in a Master’s degree on Cybersecurity and Cyberdefense at UBA, and I has spoken at different meetups, conferences, and workshops about smart contract security (such as a 2-hour workshop at Ekoparty 2018, or a recent talk at DEFCON Blockchain Village in August 2020).
TBA
Pronto publicaremos la agenda completa. Mientras tanto, ¡seguí recorriendo la #eko2020!
3PAA: A Private PUF Protocol for Anonymous Authentication
Urbi Chatterjee
Anonymous authentication (AA) schemes are used by an application provider to grant services to its n users for pre-defined k times after they have authenticated themselves anonymously. These privacy-preserving cryptographic schemes are essentially based on the secret key that is embedded in a trusted platform module (TPM). In this work, we propose a private physically unclonable function (PUF) based scheme that overcomes the shortcomings of prior attempts to incorporate PUF for AA schemes. Traditional PUF based authentication protocols have their limitations as they only work based on challenge-response pairs (CRPs) exposed to the verifier, thus violating the principle of anonymity. Here, we ensure that even if the PUF instance is private to the user, it can be used for authentication to the application provider. Besides, no raw CRPs need to be stored in a secure database, thus making it more difficult for an adversary to launch model-building attacks on the deployed PUFs. We reduce the execution time from O(n) to O(1) and storage overhead from O(nk) to O(n) compared to state-of-the-art AA protocols and also dispense the necessity of maintaining a revocation list for the compromised keys. In addition, we provide security proofs of the protocol under Elliptic Curve Diffie-Hellman assumption and decisional uniqueness assumption of a PUF. A prototype of the protocol has been implemented on a Z-Turn board integrated with dual-core ARM Cortex-A9 processor and Artix-7 FPGA. The resource footprint and performance characterization results show that the proposed scheme is suitable for implementation on resource-constrained platforms.
Urbi Chatterjee
Urbi Chatterjee is an Assistant Professor in the department of Computer Science and Engineering, Indian Institute of Technology Kanpur. She completed her Ph. D. under the supervision of Dr. Rajat Subhra Chakraborty and Prof. Debdeep Mukhopadhyay in the department of Computer Science and Engineering, Indian Institute of Technology Kharagpur. Her broad area of research is Hardware Security. She is actively involved in the design of authentication and key exchange protocols based on PUFs, Reliability Analysis of PUFs, Cryptanalysis and Machine Learning Analysis of PUFs.
Martin Abbatemarco
Argentinian security researcher working at OpenZeppelin, the leading company in smart contract security on the Ethereum blockchain. Formerly penetration tester at a big-four, he decided to jump into the blockchain space to help secure the future open economy and individual empowerment that this technology can achieve. He's currently enrolled in a Master’s degree on Cybersecurity and Cyberdefense at UBA, and I has spoken at different meetups, conferences, and workshops about smart contract security (such as a 2-hour workshop at Ekoparty 2018, or a recent talk at DEFCON Blockchain Village in August 2020).
TBA
Pronto publicaremos la agenda completa. Mientras tanto, ¡seguí recorriendo la #eko2020!
A practical guide to fuzz testing embedded software in a CI pipeline
Dennis Kengo Oka
Dennis Kengo Oka
Dr. Dennis Kengo Oka is an automotive cybersecurity expert with more than 15 years of global experience in the automotive industry. He received his Ph.D. in automotive security focusing on solutions for the connected car. As a Principal Automotive Security Strategist at Synopsys, he focuses on security solutions for the automotive software development lifecycle and supply chain. Dennis has over 70 publications consisting of conference papers, journal articles and books, and is a frequent public speaker at international automotive and cybersecurity conferences and events.
Martin Abbatemarco
Argentinian security researcher working at OpenZeppelin, the leading company in smart contract security on the Ethereum blockchain. Formerly penetration tester at a big-four, he decided to jump into the blockchain space to help secure the future open economy and individual empowerment that this technology can achieve. He's currently enrolled in a Master’s degree on Cybersecurity and Cyberdefense at UBA, and I has spoken at different meetups, conferences, and workshops about smart contract security (such as a 2-hour workshop at Ekoparty 2018, or a recent talk at DEFCON Blockchain Village in August 2020).
TBA
Pronto publicaremos la agenda completa. Mientras tanto, ¡seguí recorriendo la #eko2020!
Assessing IoT with EXPLIoT Framework
Aseem Jakhar
Aseem Jakhar
Aseem Jakhar is the Director, R&D at Payatu https://payatu.com a research-powered cyber security services company specialized in IoT, Embedded, cloud, mobile and infrastructure security. He is the founder of null-The open security community, a registered not-for-profit organization and one of the largest security communities in Asia https://null.co.in and also organizes https://nullcon.net and https://hardwear.io security conferences. He currently spends his time trying to solve the IoT Security problem. He is an active speaker and trainer at various security conferences like AusCERT, Black Hat, Defcon, Brucon, Hack.lu, Hack in Paris, Hack In The Box, PHDays and many more. He has authored various open source security software including:
- EXPLIoT - IoT Exploitation Framework
- DIVA Android (Damn Insecure and Vulnerable App for Android)
- Jugaad/Indroid - Linux Thread injection kit for x86 and ARM
- Dexfuzzer - Dex file format fuzzer
Martin Abbatemarco
Argentinian security researcher working at OpenZeppelin, the leading company in smart contract security on the Ethereum blockchain. Formerly penetration tester at a big-four, he decided to jump into the blockchain space to help secure the future open economy and individual empowerment that this technology can achieve. He's currently enrolled in a Master’s degree on Cybersecurity and Cyberdefense at UBA, and I has spoken at different meetups, conferences, and workshops about smart contract security (such as a 2-hour workshop at Ekoparty 2018, or a recent talk at DEFCON Blockchain Village in August 2020).
TBA
Pronto publicaremos la agenda completa. Mientras tanto, ¡seguí recorriendo la #eko2020!
Rodrigo Jaramillo
Rodrigo Jaramillo is an ASIC design engineer with 15 years of industry experience. He has worked with top-tier semi companies such as Intel and AMD. His ASIC implementations included silicon process technologies such as 45nm, 22nm, and 14nm, and has participated in 3 full-chip tape-outs from rtl2gds. Currently, he is co-founder and director of a stealth mode ASIC startup whose capabilities cover IP and SoC generation of cores, ML, and DSP accelerators in advanced silicon processes. Rodrigo holds an M.Sc. in Electrical Engineering from the University of Waterloo.
Matt Venn
TBD
Martin Abbatemarco
Argentinian security researcher working at OpenZeppelin, the leading company in smart contract security on the Ethereum blockchain. Formerly penetration tester at a big-four, he decided to jump into the blockchain space to help secure the future open economy and individual empowerment that this technology can achieve. He's currently enrolled in a Master’s degree on Cybersecurity and Cyberdefense at UBA, and I has spoken at different meetups, conferences, and workshops about smart contract security (such as a 2-hour workshop at Ekoparty 2018, or a recent talk at DEFCON Blockchain Village in August 2020).
TBA
Pronto publicaremos la agenda completa. Mientras tanto, ¡seguí recorriendo la #eko2020!
Stjepan Picek
Stjepan Picek is an associate professor at Radboud University, The Netherlands. His research interests are security/cryptography, machine learning, and evolutionary computation. Prior to the associate professor position, Stjepan was an assistant professor at TU Delft, and a postdoctoral researcher at MIT, USA and KU Leuven, Belgium. Stjepan finished his PhD in 2015 with a topic on cryptology and evolutionary computation techniques. Stjepan also has several years of experience working in industry and government. Up to now, Stjepan has given more than 20 invited talks at conferences and summer schools and published more than 100 refereed papers. He is a general co-chair for Eurocrypt 2021, program committee member and reviewer for a number of conferences and journals, and a member of several professional societies.
Martin Abbatemarco
Argentinian security researcher working at OpenZeppelin, the leading company in smart contract security on the Ethereum blockchain. Formerly penetration tester at a big-four, he decided to jump into the blockchain space to help secure the future open economy and individual empowerment that this technology can achieve. He's currently enrolled in a Master’s degree on Cybersecurity and Cyberdefense at UBA, and I has spoken at different meetups, conferences, and workshops about smart contract security (such as a 2-hour workshop at Ekoparty 2018, or a recent talk at DEFCON Blockchain Village in August 2020).
TBA
Pronto publicaremos la agenda completa. Mientras tanto, ¡seguí recorriendo la #eko2020!