2 ms·
As FW engineer, I am both horrified and intrigued. The fact that there are so many devices lack even basic security features horrified me. A webcam that activi
by mrheosuper 2mo ago
As FW engineer, I am both horrified and intrigued.
The fact that there are so many devices lack even basic security features horrified me. A webcam that activity light can be turned off remotely, that's a big no no for me.
But the use of LLM is also very interesting, we may put LLM in the loop to harden our devices.
Sorry community, but it's our job to make the reverse engineer harder.
- webprofusion 2mo agoIf you can use a custom chip yep, if it's commodity hardware probably not. You could use secure boot/secure memory etc but that can be a footgun in itself later.
- mrheosuper 2mo agoWhat do you mean "Custom chip", like ASIC ? Never in my career that i feel the need to make our own ASIC.
- menaerus 2mo agoParent comment was likely about how are you supposed to put LLM into your chip. Commodity ICs are already optimized down to their minimums wrt compute/memory/storage. Ultimately, I think it will prove that RE examples like this are going to become a difficult problem to solve.
- mrheosuper 2mo agoOh no, i mean using LLM in the loop, keep forcing it to break our device, gives it every tool that an average tinker can access.
- menaerus 2mo agoI misunderstood you then, sorry. Yes, that makes complete sense but ultimately I think this will likely not be enough. Implementation will be hardened but new models with better capabilities will be released, and will discover vulnerabilities that would not have been caught or discovered with prior models.
- panta 2mo agoWhy is your job to make the reverse engineer harder? When the user buys a product, it should be theirs to do whatever they want, even brick it. Your job should be creating the product the user wants to use, not building obstacles, otherwise you are creating something actively user-hostile. What if your company goes out of business and the user ends up with a device that can't be updated, that depends on cloud services that don't exist anymore, or worse with security vulnerabilities?
- mrheosuper 2mo ago"Making reverse engineer harder" is just a side product of "improving security" that upper-level people like to hear. I definitely don't want my C-suite people reading "The product X of company Y has been reversed engineered" on their newspaper.
- panta 2mo agoIn the old days, when businesses were not governed by pure greed, many electronic products, if not the majority, included schematics in their user manual. If a product today made a point of pride of having fully open source firmware and included a github/gitlab link, there would be no reverse engineering to write about. Security can be obtained also with an open source firmware.