Secret Life of a Rogue Device: Lost IT Assets on the Public Marketplace
Investigation into enterprise and government IT assets sold on public marketplaces containing unencrypted data and sensitive firmware.
Summary
The Problem of Secondary Market IT Hardware
An ex-employee's work laptop, a secret hardware prototype, the company backup server, and classified government computers. What do these things have in common? They should never end up on the public market. Ask any IT department and they'll tell you that "it happens", but how serious is the problem and what's really at stake? This talk explores the interesting journey of a research project to learn the surprising answers to these questions.
Auditing Hardware from Public Marketplaces
Along the way we'll scrape over 150 million images from online listings in Western and Eastern second hand markets, hack together an OCR cluster out of old iPhones, reverse engineer well-obfuscated Chinese apps, and converse with secretive underground groups of collectors.
Related talks
Main Stage·43 min
Yaniv Balmas · Lior Oppenheim
Yaniv Balmas and Lior Oppenheim demonstrate reverse engineering KVM switch firmware, subverting the 8051 microcontroller to install an undetectable, persistent hardware keylogger.
Wireless Village·33 min
Travis Goodspeed
Travis Goodspeed provides an update on the Goodwatch open-source wrist-worn RF radio hacking and packet manipulation platform.
War Stories·39 min
Thomas Boejstrup Johansen
Details a year-long investigation running eight wpad.tld domains that received over one billion DNS requests and enabled unauthenticated traffic interception.