GPS, also referred to as the broader term GNSS, is a fundamental technology for IoT positioning and time estimation. Developers typically regard GPS as a trusted input to the system because the difficulty of manipulating GPS signals is presumed to be too difficult for the casual attacker. Lab testing at Carve shows us that this isn't the case. There are easy software tools for manipulating GPS inputs to find software flaws. Time to rethink the threat model.
Implementing systems that securely authenticate users and authorize their activities within applications can involve multiple interactions that cross trust boundaries. When applications are written in different languages, live in different environments, but still want to share data with each other what are the options?
There have been a lot of new terms floating around the internet these last few days: Meltdown, Spectre, etc... What does it all mean? In this post, I will explain the high-level pieces, what systems are affected by this, and what you can do to better protect yourself against it.
Performing security assessments of complex systems sometimes requires some technical gymnastics to "man-in-the-middle" (MITM) communications between components. MITM techniques are essential for observing and manipulating communications in ways that a developer may not have anticipated. As system defenses improve the task of setting up a MITM environment for a system …
