PSW #781 - Ivan Arce

<p>We will talk about Supply chain security, the TPM 2.0 vulnerabilities recently discovered by a Quarkslab researcher, bugs in reference implementations, vulnerability disclosure and perhaps various other topics.</p> <p>Segment Resources:</p> <p>Vulnerabilities in the TPM2.0 reference implementation <a href= "https://blog.quarkslab.com/vulnerabilities-in-the-tpm-20-reference-implementation-code.html">https://blog.quarkslab.com/vulnerabilities-in-the-tpm-20-reference-implementation-code.html</a></p> <p>Vulnerabilities in High Assurance Boot of NXP i.MX microprocessors <a href= "https://blog.quarkslab.com/vulnerabilities-in-high-assurance-boot-of-nxp-imx-microprocessors.html"> https://blog.quarkslab.com/vulnerabilities-in-high-assurance-boot-of-nxp-imx-microprocessors.html</a></p> <p>Heap memory corruption in ASN.1 parsing code generated by Objective Systems Inc. ASN1C compiler for C/C++ <a href= "https://github.com/programa-stic/security-advisories/blob/master/ObjSys/CVE-2016-5080/README.md"> https://github.com/programa-stic/security-advisories/blob/master/ObjSys/CVE-2016-5080/README.md</a></p> <p> </p> <p>In the security news: Blizzards, Sleet, Typhoons, Sandstorms and Tsunamis, masking your car stealing tech in a Nokia phone, kill -64, Google doesn't want to fix an RCE, hijacking packages, monitoring macs, beating Roulette, lame advice from Microsoft, are post-authentication vulnerabilities even vulnerabilities?, Ghosts, burpgpt, and do you trust Google? All that and more on this episode of Paul’s Security Weekly.</p> <p> </p> <p>Visit <a href= "https://www.securityweekly.com/psw">https://www.securityweekly.com/psw</a> for all the latest episodes!</p> <p>Visit <a href= "https://securityweekly.com/acm">https://securityweekly.com/acm</a> to sign up for a demo or buy our AI Hunter!</p> <p>Follow us on Twitter: <a href= "https://www.twitter.com/securityweekly">https://www.twitter.com/securityweekly</a></p> <p>Like us on Facebook: <a href= "https://www.facebook.com/secweekly">https://www.facebook.com/secweekly</a></