Eclypsium, Inc.

Paul Asadoorian sharing never-before-seen hardware hacking tips and tricks?! FlipperZero, ESP32, and more! Join live!

The rapid growth in the popularity of hardware platforms like the #ESP32 has democratized security research, but has also introduced critical risks. Security researchers and threat actors may be using the same tools, which could lead to the targeting of firmware-based devices of all types. From state-sponsored APTs like Volt Typhoon and Velvet Ant exploiting zero-day vulnerabilities in Cisco NX-OS and F5 load balancers, to commodity hardware like the $11 CYD being repurposed for BLE tracking, the attack surface is expanding faster than many organizations can defend. Our new blog post gives an overview of the various #hacking devices and the impact they're having. https://hubs.ly/Q035QdBt0 #hackingdevice #securityresearch #firmwaresecurity #zeroday #Eclypsium

Eclypsium has earned a spot in the prestigious 2025 CRN Partner Program Guide! ?? We are deeply invested in the success of our channel partners, and we're thrilled to have Eclypsium's growing global Partner Program recognized as a leader in delivering best-of-breed supply chain security solutions and services to enterprises everywhere. Read more about Eclypsium and the 2025 #CRNPPG here: https://hubs.ly/Q03d67d00 #channelpartners #partnerprogram #PPG #supplychainsecurity #Eclypsium

Stringent new rules from Criminal Justice Information Services (#CJIS) define how law enforcement agencies must protect criminal justice information, requiring agencies to manage risk, vulnerabilities, and threats down to the #firmware within their assets—well below the level covered by traditional security tools. By partnering with Eclypsium, multiple FL law enforcement agencies were able to easily meet these new regulatory requirements and greatly enhance their #cybersecurity, without burdening IT and security staff. Learn how: https://hubs.ly/Q037nlV80 #lawenforcement #firmwaresecurity #casestudy #customersuccess

Hardware hacking is more accessible than ever—are you prepared? Join Paul Asadoorian for next week's #webinar to explore the rise of #FlipperZero, #ESP32, and other affordable hacking tools, along with their risks, and the security implications. Register now! https://hubs.ly/Q03cNmvq0 #HardwareHacking #Eclypsium

Firmware attacks are the silent threat expanding your attack surface. Join us at the virtual SANS Cyber Solutions Fest TODAY at 2pm EST for a presentation by Paul Asadoorian, Principal Security Researcher at Eclypsium, on "Firmware Attacks Uncovered." Learn how attackers exploit firmware vulnerabilities for persistence, supply chain risks, and the latest research on emerging threats, and how you can protect your enterprise—register now! https://hubs.ly/Q03cL9SV0 #SANS #SANSCyberFest #cybersecurity #firmwaresecurity #supplychainsecurity #Eclypsium

What if you were playing a game but couldn't see the enemies? ?? With Supply Chain Invaders, that's just the kind of attack you face. Supply chain invaders aren’t coming; they’re already here. The invasion starts before your devices are even assembled, taking advantage of a huge, unprotected attack surface. Ready player one? ??????? https://hubs.ly/Q02Yn12M0

Our Below The Surface Podcast is live! Join Paul Asadoorian, Vladislav Babkin and Chase Snyder to talk about the latest AMI BMC vulnerability we discovered (CVE-2024-54085). This vulnerability received a CVSS score of 10, indicating a high level of risk. Watch the live stream or check out the recording later on. What does this mean for datacenters and IT Infrastructure supply chains? When something like a BMC, which is foundational in the IT infrastructure supply chain, has a vulnerability, the urgency of patching it goes way up. The breadth of impact is potentially enormous, since AMI provides Baseboard Management Controllers for numerous vendors. This vulnerability is likely present in many datacenters and other IT infrastructure providers. Fortunately, AMI was fantastic to work with in the disclosure process for these vulnerabilities, and they have issued patches to their customers, who can deploy the patches for their own customers. https://lnkd.in/g_GxA_qT

The Eclypsium research team has discovered a previously unknown remotely exploitable #vulnerability in #AMI’s #MegaRAC software that allows attackers to bypass authentication remotely. #BMC vulnerabilities like this one pose a significant risk to the technology supply chain that underlies cloud computing. Read the details of the research — and how you can bolster your defenses — in our latest blog post: https://hubs.ly/Q03ch-HQ0 #Redfish #VulnerabilityAlert #CloudSecurity #FirmwareSecurity #SupplyChainSecurity

In Dark Reading last week, Rob Wright da covered how Mandiant researchers discovered that US carrier-grade Juniper MX routers of several organizations were hacked by China-backed UNC3886, infecting them with a custom backdoor known as TinyShell. The threat group targeted network and edge devices, which typically lack security monitoring tools like EDR agents. The research suggests ISPs and telecom carriers are at risk. Eclypsium has developed, and is developing, ways of analyzing proprietary network devices — including those from Juniper, Cisco, Citrix, and other commonly attacked vendors — to help protect enterprises and governments from these vulnerabilities. As the only IT supply chain security company offering continuous baselining of firmware against network infrastructure devices, we are striving to eliminate this attack surface that is increasingly targeted by nation state adversaries and empower organizations to defend their critical networks against these attacks. https://hubs.ly/Q03c8z550 #UNC3886 #TinyShell #Mandiant #Juniper #telecom #criticalinfrastructure #networkdevices #networksecurity #cybersecurity #SupplyChainSecurity #Eclypsium