Hello, welcome to the Monday, June 11th, 2018 edition of the Santernut Storm Center's Stormcast. My name is Johannes Ulrich,

and I'm recording from Jacksonville, Florida. During this podcast, I often complain about vulnerabilities in devices.

And of course, the Internet of Things is a huge topic these days. Microsoft is weighing in

with an interesting paper that they entitled the seven properties of highly secure devices.

It really describes seven common sense technologies that you should use if you do code for devices. Now I think it's a

little bit focused on probably the higher-end devices like mobile phones and the like, but

pretty much everything they are proposing does also apply to little things like famously IT cameras and the like. I in particular

like hardware-based route of trust where you do have sort of an enclave to store secrets

in also certificate-based authentication and the ability to update automatically.

The last one, the failure reporting, some people may take a little bit of exception on.

What they're suggesting here is that devices should report software failures back to the manufacturer.

Microsoft, of course, does that for a long time in Windows where they're collecting

sort of debug reports if software fails on a PC. But of course, with the PC, the user has the

option to intercept these reports and not send them. So I think this is a real good paper and if you're not a developer,

if you're not developing for devices, then this is certainly something to consider if you

are purchasing devices in bulk and something to talk with your vendor about.

Another hot topic recently, decerellization and has been kind of tricky to find

deserilization vulnerabilities in the past given that there weren't really any great tools for it.

Well the NCC group now came up with the extension for the BIRP suite that targets deserilization vulnerabilities. They are calling it

Freddy. Freddie comes with 35 modules and 88 different remote code execution payloads that allow you

to look for these deserilization vulnerabilities in dot net or in Java.

And cryptojacking certainly has been one of the big stories this year so far.

...