[Interview] ZIEN R&D Team Presents Dashcam Security Research at DEF CON 32's 'IoT Village'
Contents
- 11️⃣ How did it feel to present at the world's most prestigious security conference?
- 22️⃣ Why did you choose 'Analysis of Dashcam Custom Protocols and Vulnerability Exploration Methods' as your presentation topic?
- 33️⃣ What were the key points of the presentation and its significance?
- 44️⃣ What was the most challenging aspect of preparing for the presentation?
- 55️⃣ What was the most impressive experience at DEF CON?
ZIEN's R&D team made waves at 'DEF CON 32', the world's largest hacking and security conference. At this year's conference, ZIEN researchers participated in the 'IoT Village', presenting crucial research on dashcam security.
The IoT Village is a section dedicated to Internet of Things (IoT) security, where various discussions on IoT device vulnerabilities and security solutions take place. We've captured the post-presentation thoughts of ZIEN's senior researchers, HanRyeol Park and HyoJin Lee, in an interview format.
(L)HanRyeol Park, (R)HyoJin Lee
1️⃣ How did it feel to present at the world's most prestigious security conference?
Park: Successfully presenting at DEF CON 32's IoT Village was a great honor and invaluable experience. It was a precious opportunity to exchange ideas with various experts and delve deep into current and future security threats.
Lee: DEF CON has been a dream stage for me since I started studying security. Presenting at the IoT Village was a great honor, and I felt proud and excited to share our team's research results with so many people.
2️⃣ Why did you choose 'Analysis of Dashcam Custom Protocols and Vulnerability Exploration Methods' as your presentation topic?
Joint answer: In South Korea, dashcams are essential in almost every vehicle, and they're widely used overseas as well. However, we found that only three vulnerabilities in dashcams were reported in the past three years. This led us to believe that dashcam security checks were insufficient, prompting our research. We analyzed nine domestic and international dashcams and discovered about 30 CVEs after two months of research. By presenting this at DEF CON, we aimed to provide new insights to global security experts and raise awareness among dashcam manufacturers, contributing to the development of safer products.
3️⃣ What were the key points of the presentation and its significance?
Park: We focused on common security issues and vulnerabilities discovered while analyzing nine dashcams. Key content included open ports, common features, custom protocol structures, app connection methods, and an overview of the analysis process. We also proposed workarounds for problems encountered during analysis and explained serious vulnerabilities like OS Command Injection and Buffer Overflow in relation to dashcam characteristics.
Lee: A notable point is that four of the analyzed dashcams were OEM equipment. When a vulnerability is found in one OEM device, it's likely to exist in others, highlighting the importance of security. Through this presentation, we wanted to emphasize how vulnerable dashcam security can be and the need for improvement.
4️⃣ What was the most challenging aspect of preparing for the presentation?
Park: Finding words that were easy for non-expert audiences to understand while maintaining a professional tone was challenging. To address this, we explained specific terms in full sentences and replaced technical jargon with more familiar words.
Lee: The most difficult aspects were language and structuring the presentation materials. As I'm not fluent in English, I wrote the CFP in Korean first and then translated it, following the same process for the PPT and presentation script.
5️⃣ What was the most impressive experience at DEF CON?
Park: I was amazed by the sheer number of people interested in information security. It was fascinating to see over 30,000 people participating in DEF CON, showcasing their security knowledge, discussing, and sharing insights.
Besides IoT, which we research, there were many studies in various fields like cloud, soldering, AI, embedded systems, blue/red teams, and lockpicking. Each field had its own Village with interesting experiences and small presentations. The Creator Stage and Main Section Stage introduced specialized research content from various fields, and the grandeur of lecture halls accommodating hundreds of audience members was impressive.
Participating in DEF CON made me realize that the modern security market is continuously expanding, with active research in various fields. I felt that our R&D team should approach IoT security research from diverse perspectives to further enhance our expertise.
Lee: There were many impressive moments at DEF CON. The conference badges, known for their unique design and functionality each year, were Raspberry Pi-based this time. They included an internal map of the conference venue and games, even supporting firmware updates, offering more than just an entry pass.
The Pwnie Awards on the last day was particularly novel, celebrating not just achievements but also failures in the security industry with humorous mockery. This open attitude towards mistakes and mutual encouragement in the security community was a unique and refreshing experience.
Through these experiences, I realized that DEF CON is more than just a place for technical sharing; it's an opportunity to directly experience the culture and spirit of the security community.
ZIEN R&D team's participation and presentation at DEF CON 32 have significantly boosted our company's technological prowess and international standing. Building on this experience, we plan to conduct more innovative research in the IoT security field and strengthen our competitiveness in the global market. ZIEN will continue to contribute to creating a safer IoT environment through ongoing research and development.
