Hacking the Supply Chain: The Story of Ripple20
JSOF researchers chronicle the discovery and coordinated disclosure of Ripple20, a series of critical vulnerabilities in a widely embedded TCP/IP stack affecting millions of IoT devices.
Summary
Uncovering Systemic Flaws in Embedded TCP/IP Stacks
In 2020, JSOF researchers uncovered Ripple20, a set of 19 critical zero-day vulnerabilities in a proprietary TCP/IP software stack developed by Treck in the late 1990s.
The Hidden Proliferation of Supply Chain Code
Shlomi Oberman, Moshe Kol, and Ariel Schön trace how the vulnerable code was licensed, re-branded, and integrated into hundreds of millions of enterprise, medical, and industrial IoT devices.
Exploiting Remote Code Execution Across Diverse Hardware
Dissecting DNS, DHCP, and IPv6 packet parsing flaws illustrates achieving unauthenticated remote code execution on power grid controllers, smart printers, and patient monitors.
Coordinating a Multi-Vendor Global Disclosure
The speakers share the unprecedented 8-month global disclosure campaign involving CERT/CC, CISA, and hundreds of device manufacturers to coordinate patches.
Related talks
Main Stage·31 min
Shlomi Oberman · Moshe Kol · Ariel Schön
JSOF researchers answer audience questions regarding Ripple20 embedded TCP/IP flaws, multi-vendor disclosure challenges, and IoT patching.
Main Stage·44 min
Dennis Giese
Dennis Giese demonstrates rooting flagship robotic vacuum cleaners across four vendors, exposing cloud telemetry risks and enabling offline open-source control.
Main Stage·38 min
Matteo Beccaro · Matteo Collura
Matteo Beccaro and Matteo Collura demonstrate penetrating interconnected smart city infrastructure, including municipal sensor networks and electronic signage.