Rick Altherr
Rick Altherr has a career ranging from ASICs to UX with a focus on the intersection of hardware and software. During his 9 years in Google's server development group, he was responsible for key components of the infrastructure that monitored machine health across Google's datacenters, led the unification of OpenBMC as a project under Linux Foundation, and publicly explained how Titan is used to provide a root of trust for measurement. As Principal Engineer at Eclypsium, Rick is both a security researcher focused on vulnerability detection and mitigation in firmware as well as a software engineer integrating the findings of that research into Eclypsium's products. In his free time, he reverses engineers FPGA bitstream formats and ECU (engine control unit) programming protocols, tunes drag race car engines and he restores classic cars.
Common BMC vulnerabilities and how to avoid repeating them
BMCs have a notorious past of critical vulnerabilities that allow complete takeover of the host system. Worse, the same types of vulnerabilities creep up in BMC firmware over and over again. This talk looks at these repeat offenders in depth to see what can be learned. A comprehensive threat model for BMCs will be presented along with methodologies, practices, and techniques that can be used to avoid these common security mistakes.