You have also historically been able to dump some secure MCUs with the same equipment. The problem is that NDAs stop those chips from being more widely audited, so we don't *know* if they really are more secure. In theory they are, but we don't have enough evidence.
-
This Tweet is unavailable.
-
This Tweet is unavailable.
-
This is an endemic problem in parts of the industry, where half-competent people are the ones doing the audits, while access is denied to those who could actually find problems quicker (but might not work for a big auditing firm).
Big auditing firms excel at filing a lot of paperwork and certifying a lot of PowerPoint bullet points. They do not excel at finding actual problems. They might find some, but not nearly as many as would be found if the product were auditable at large.
-
-
I have experienced this problem myself, when I was brought in to do a black-box audit for a vendor, and immediately identified a risk area, requested access to do a white-box audit, and was denied (and there was insufficient time to get that access myself via attacks).
-
Months later it turned out there was a problem that I would've absolutely found in a few hours tops, had I had access to the binary (not even source code!). Not trusting more people to audit your stuff just leads to insecure garbage.
End of conversation
New conversation -
Loading seems to be taking a while.
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.