Hardware Hackers Encourage Vendor Collaboration for Enhanced Security

While hardware once stood as a cornerstone of trustworthy systems, ongoing concerns over compromised supply chains and security vulnerabilities have significantly diminished that trust. As noted at the recent Hardware.io conference in Amsterdam, industry leaders underscore the pivotal role of addressing hardware security concerns through collaboration and transparent communication.

Vulnerabilities are intrinsic to the lifecycle of tech products. Alex Guzman, CISO at Cisco Network Devices, addressed the audience, stating, “Hardware security vulnerabilities are ultimately a business challenge.” He elaborated on how organizations often make trade-offs between security and speed, highlighting a recurring dilemma in development lifecycles. He emphasized the necessity for security teams to articulate risks in business terms to ensure appropriate mitigating actions are taken.

The responsibility also lies with clients, who may overlook vendor guidance on patching and vulnerability management. Guzman broadened the discourse, comparing effective cybersecurity measures to personal hygiene: “No one’s going to brush your teeth for you.”

Adam Laurie, a seasoned hardware hacker and head of product security at Alpitronic, recounted real-world experiences with vulnerabilities, particularly in electric vehicle chargers vulnerable to exposure on the public internet. Despite efforts to educate operators on best practices for securing their devices, reminders are often necessary to enforce the initial password changes required upon installation.

The consistent emergence of similar cybersecurity oversights throughout the years poses philosophical questions about the industry’s learning curve. Laurie has observed that foundational lessons in cybersecurity need reinforcement with the introduction of new technologies. “Security challenges evolve, but the lessons remain constant,” he noted.

The conference sparked dialogue around whether vendors should increase their proactive security measures. Many presenters shared positive insights into vendors who efficiently addressed reported vulnerabilities and facilitated timely security alerts and firmware updates. However, some manufacturers required additional motivation to enhance their security responses, as evidenced by a viral video questioning the latency of vulnerability patches.

Bug bounty programs have emerged as effective tools for enhancing security, with some vendors initiating or outsourcing these initiatives. These programs encourage skilled individuals to identify vulnerabilities, sometimes in conjunction with hacking competitions that foster engagement with the community.

Notably, products such as the Google Pixel Phone 9a and Cisco’s network devices were featured in contests that unveiled new vulnerabilities previously reported to their manufacturers. Participants were permitted to keep certain devices for further analysis—potentially leading to further discoveries in the weeks to come.

Vendors like Cisco advocate for continuous engagement in penetration testing, emphasizing that security assessments can be routine rather than isolated events. Justin Searle, director of ICS security at InGuardians, suggested that key infrastructure manufacturers consider invite-only bug bounty initiatives. Such programs might offer rewards beyond cash, including access to specialized equipment or engaging promotional items.