The Inside Story Behind VTech Storio Max Vulnerability - CVE-2018-16618 - ERP Spain.com - España y América Latina

SureCloud's Senior Security Consultant will be discussing a critical disclosure discovered on the children's VTech Storio Max tablet, which allowed attackers full access to the device including access to the webcam, speakers and microphone. The disclosure was reported to VTech, and a patch fixing the vulnerability was released within 30 days. The vulnerability was granted a CVE, and the story was featured on the BBC and at InfoSec’s Geek Street. Learning outcomes from the session: •Gain a better understanding of how to approach unusual devices from a methodology standpoint •Identify how manufacturers can break a secure base (Android phone with Vtech software) •Triaging of the custom parts of devices •Learn how accessible ARM assembly can be •See a live demonstration showing the impact of proof of concept and how writing an exploit code made the manufacturer resolve the issue quickly. Elliot comments: “It’s always better to show than merely tell.”