Wheel of Fortune Outcome Prediction – Taking the Luck out of Gambling

Authored by: Jesús Miguel Calderón Marín Introduction Two years ago I carried out research into online casino games specifically focusing on roulette. As a result, I composed a detailed guide with information on classification of online roulette, potential vulnerabilities and the ways to detect them[1]. Although this guideline was particularly well-received by the security community, … Continue reading Wheel of Fortune Outcome Prediction – Taking the Luck out of Gambling

Five Essential Machine Learning Security Papers

We recently published "Practical Attacks on Machine Learning Systems", which has a very large references section - possibly too large - so we've boiled down the list to five papers that are absolutely essential in this area. If you're beginning your journey in ML security, and have the very basics down, these papers are a … Continue reading Five Essential Machine Learning Security Papers

Hardware & Embedded Systems: A little early effort in security can return a huge payoff

Editor's note: This piece was originally published by embedded.com There’s no shortage of companies that need help configuring devices securely, or vendors seeking to remediate vulnerabilities. But from our vantage point at NCC Group, we mostly see devices when working directly with OEMs confronting security issues in their products — and by this point, it’s … Continue reading Hardware & Embedded Systems: A little early effort in security can return a huge payoff

Exploring the Security & Privacy of Canada’s Digital Proof of Vaccination Programs

by Drew Wade, Emily Liu, and Siddarth Adukia TL; DR We studied a range of Canadian provinces' proof-of-vaccination apps to analyze their associated security and privacy properties. In particular, building on prior work in which some of us created an assessment framework for evaluating the security & privacy of vaccine passports, in this post, we … Continue reading Exploring the Security & Privacy of Canada’s Digital Proof of Vaccination Programs

Choosing the Right MCU for Your Embedded Device — Desired Security Features of Microcontrollers

The Microcontroller Unit (MCU) is the heart of an embedded device, where the main firmware executes its instructions to carry out the system’s functions. These come in many varieties. Relatively simple microcontrollers with limited-resource processors may bundle only a few IO peripherals, a small amount of memory, and be intended to run a small real-time … Continue reading Choosing the Right MCU for Your Embedded Device — Desired Security Features of Microcontrollers

Why IoT Security Matters

Introduction Internet of Things security can mean any number of things for your product and its users. This will depend largely on the context of the product and its deployment, and can include specific requirements, such as integrity, confidentiality, availability, safety, privacy, consent, authenticity, and more. Understanding how security fits into the product’s threat modelling … Continue reading Why IoT Security Matters

CertPortal: Building Self-Service Secure S/MIME Provisioning Portal

tl;dr NCC Group's Research & Development team designed and built CertPortal which allows users to create and manage S/MIME certificates automating the registration and renewal to allow enterprise scale deployment. The core of the system integrates DigiCert to create an S/MIME certificate and then storing both the certificate, the password, creation and expiry dates in … Continue reading CertPortal: Building Self-Service Secure S/MIME Provisioning Portal

Domestic IoT Nightmares: Smart Doorbells

Preface Half way through 2020, UK independent consumer champion Which? magazine reached out to us and asked if we could assist investigating the security of a series of domestic IoT devices and to perform a vulnerability assessment of each device. The assessments included smart plugs and smart/connected doorbells. We also worked on a number of … Continue reading Domestic IoT Nightmares: Smart Doorbells