519: The Password Is All Zeros

About this episode

Mark Omo and James Rowley discuss safecracking, security ethics, and relevant standards in technology.

Mark Omo and James Rowley spoke with us about safecracking, security, and the ethics of doing a bad job. Mark and James gave an excellent talk on the development of their safecracking tools at DEF CON 33: Cash, Drugs, and Guns: Why Your Safes Aren't Safe . It included a section of interaction involving the lock maker's lawyers bullying them and how the Electronic Frontier Foundation ( EFF ) has a Coders' Rights Project to support security research. As mentioned in the show, the US Cyber Trust Mark baseline has a very straightforward checklist; NISTIR 8259 is the overall standard, NISTIR 8259A is the technical checklist, NISTIR 8259B is the non-technical (process/maintenance) checklist. Roughly the process is NISTIR 8259 -> Plan/Guidance; NISTIR 8259A -> Build; NISTIR 8259B -> Support. We discussed ETSI EN 303 645 V3.1.3 (2024-09) Cyber Security for Consumer Internet of Things: Baseline Requirement and the EU's CRA: Cyber Resilience Act which requires manufacturers to implement security by design, have security by default, provide free security updates, and protect confidentiality. See more here: How to prepare for the Cyber Resilience Act (CRA): A guide for manufacturers . We…

People in this episode

Guests: Mark Omo, James Rowley

Topics covered

• safecracking
• security
• ethics
• Cyber Resilience Act
• NIST standards
• consumer IoT security
• reverse engineering

Keywords

• safecracking tools
• security research
• NISTIR
• Cyber Resilience Act
• consumer IoT
• reverse engineering
• DEF CON

Mentioned in this episode

Organizations: Electronic Frontier Foundation, NISTIR 8259, NISTIR 8259A, NISTIR 8259B, ETSI EN 303 645 V3.1.3, Cyber Resilience Act, fail0verflow

Products: Ghidra, PS4

More episodes of Embedded

• 527: At The Jellyfish Conference · June 12, 2026 · 1h 9m
• 526: Take A Taste Of Engineers · May 28, 2026 · 1h 1m
• 525: Some Sort of Metal · May 14, 2026 · 1h 3m
• 524: This Isn't a Movie · April 16, 2026 · 1h 14m
• 523: Bad Experience With Donuts · April 2, 2026 · 1h 11m
• 522: The Information Is In Poop · March 6, 2026 · 55 min