Hacking the Supply Chain: The Ripple20 (Q&A)
JSOF researchers answer audience questions regarding Ripple20 embedded TCP/IP flaws, multi-vendor disclosure challenges, and IoT patching.
Summary
In this live Q&A session from the DEF CON Safe Mode Main Stage, JSOF researchers Shlomi Oberman, Moshe Kol, and Ariel Schon answer community questions regarding Ripple20, a series of zero-day vulnerabilities in the Treck embedded TCP/IP stack. Opening at 00:00, the researchers recount the complex supply chain tracking that revealed Ripple20 vulnerabilities affecting millions of connected devices worldwide.
At 08:00, they discuss memory corruption exploitation, detailing how remote code execution (RCE) was achieved across different architectures—such as Schneider Electric uninterruptible power supply (UPS) systems—despite memory layout variations.
Concluding at 16:00 and 24:05, the team analyzes the operational challenges of patching embedded software dependencies and outlines proactive supply-chain auditing methods for critical infrastructure operators. (AI summary — Gemini Flash)
Related talks
Main Stage·44 min
Shlomi Oberman · Moshe Kol · Ariel Schön
JSOF researchers chronicle the discovery and coordinated disclosure of Ripple20, a series of critical vulnerabilities in a widely embedded TCP/IP stack affecting millions of IoT devices.
Main Stage·44 min
Chanin Kim · Myounghun Pak
Vulnerability analysis and exploit chains targeting Network Video Recorders from Hikvision, Dahua, and Synology Surveillance Station.
Main Stage·27 min
Sick Codes
Sick Codes discloses critical vulnerabilities across the American agricultural supply chain, hacking smart tractors, farm telemetry APIs, and grain logistics systems.