Source: www.govinfosecurity.com – Author:
Endpoint Security , Governance & Risk Management , Internet of Things Security
Researcher Lennert Wouters on Benefits of Device Hacking Contests, Collaboration Athira Nair • December 4, 2024
Lennert Wouters made waves in the tech world when he uncovered a major security flaw in Starlink, the satellite internet service owned by Elon Musk. Starlink, with more than 6,600 satellites in orbit, is renowned for its cutting-edge technology. But even the best systems can have vulnerabilities.
See Also: The Healthcare CISO’s Guide to Medical IoT Security
Using a $25 custom-built modchip, Wouters hacked into a Starlink dish in 2022. His tool performed a fault injection attack, temporarily bypassing the system’s security to access restricted areas.
Instead of exploiting the flaw, Wouters notified Starlink. The company rewarded him through its bug bounty program and rolled out security updates. For Wouters, the discovery was an extension of his passion for mastering hardware security.
“My interest in security began during my studies, although there weren’t many academic courses on the subject,” Wouters said, a researcher at KU Leuven University in Belgium. Wouters has spent the past eight years studying embedded security, analyzing the vulnerabilities of everyday devices and commercial products. “It was through conference talks and learning from pioneers that I developed a focus on hardware security,” he said.
Wouters started by researching ways to unlock vehicles including Tesla, Toyota and Hyundai models for his master’s thesis on automotive security. Most recently, he joined in the bug bounty program HardPwn, a hardware hacking contest hosted by Hardwear.io in Amsterdam to analyze Xiaomi devices, including e-scooters, cameras and Mi Bands.
“These events allow me to learn from others, test new techniques and apply them to my research. Plus, I’ve met incredible people at events like HardPwn, who became my friends,” he said.
An Expanding Field of Research
Hardware security dates back to the 1970s, but Wouters said there’s still much to do, and bug bounty programs are vital to securing devices. “Bug bounty programs help future-proof devices. You assume anything that can go wrong will go wrong. These events and bug bounty programs show companies what someone with malicious intent could achieve. That knowledge is invaluable for strengthening products,” he said.
The hardware security field spans a wide range of devices – from automotive systems to Bluetooth hacking and wireless technology. Wouters noted that capture-the-flag competitions such as the one at Hardwear.io provide challenges that push participants to quickly learn and apply new skills.
“Xiaomi devices are new to me, so it’s exciting to dive into them,” he said.
Xiaomi, a Chinese maker of consumer electronics and smart home devices, awarded cash bounties and event-specific bonuses for vulnerability reports across multiple IoT product categories, per the Xiaomi Bug Bounty Program policy.
“It is a token of appreciation to HardPwn researchers who have helped us strengthen security and stability of Xiaomi products, ultimately benefiting our users. Events such as HardPwn provide an invaluable platform for in-depth technical discussions between OEMs and the security community,” said Kuan Song, information security director at Xiaomi Group. “We recognize the significant role that the external community plays in helping us identify and address potential security blind spots, complementing our internal efforts in embedded security.”
Hacking events foster community and collaboration, sparking innovation. Wouters believes these events highlight business opportunities in the security sector, particularly for affordable device analysis tools.
The Impact of Regulation
The hardware security landscape is changing with the EU Cyber Resilience Act, which requires manufacturers to design and maintain products that meet cybersecurity standards, conduct risk assessments, implement security measures throughout a product’s lifecycle, and provide updates for at least five years. Companies also must comply with conformity assessments, ranging from internal checks to third-party audits. Authorities can recall non-compliant products.
Wouters sees this as both a challenge and an opportunity. “Affordable security analysis tools are in high demand. There’s a market for effective products in various price ranges,” he said.
Another challenge for researchers is reporting vulnerabilities in products. Wouters noted that some companies have sued researchers for publishing findings, although attitudes are changing.
“Responses vary. Some companies are open and responsive, while others don’t engage at all. But many businesses learn from research and improve their security,” he said.
As demand for secure devices grows, so do the opportunities for researchers and businesses to make an impact. Collaboration between researchers, developers and businesses is crucial to address evolving device security challenges. By working together, they can share knowledge, identify vulnerabilities and develop robust security solutions, he said. This effort ensures new technologies are better protected against potential threats, safeguarding users and data.
Original Post URL: https://www.govinfosecurity.com/bug-bounties-bringing-hackers-manufacturers-together-a-26969
Category & Tags: –
Views: 3
