Noticed a weird pattern at DEF CON last month with badge exploit demos

Was at DEF CON 31 in Vegas last month and something caught my eye. Like 4 different badge hacks all used the same flawed firmware update check, just with different encryption around it. Made me wonder if vendors are copy-pasting the same weak code across projects. I even asked one of the presenters about it and he said his team found the same pattern in 6 other badges. Has anyone else seen similar repetition in hardware CTF challenges lately, or is this just a bad batch of vendors?

1 comments

1 Comment

paul33010d ago

Yeah, "copy-pasting the same weak code" is exactly what's happening. I've torn down a few commercial badges for a client and it's scary how often the update mechanism is just the same insecure pattern with a different hash slapped on top. The real problem is nobody's checking the bootloader's rollback protection or even verifying the signature chain properly, so once you find one flaw, it's basically a master key for half the vendors at the con. Just assume every badge that ships with an STM32 or ESP32 has the same lazy update code until proven otherwise, and check the datasheet's reference firmware first cause that's usually the source of the copy-paste.