3 ms·
I didn't read the article, but is the lock RF shielded? Also, slides show a 1/4" hole, and then the lock and an EEPROM; could it be feasible to melt plastic en
by peterwwillis 10y ago
I didn't read the article, but is the lock RF shielded?
Also, slides show a 1/4" hole, and then the lock and an EEPROM; could it be feasible to melt plastic enough through this hole that one could then expose and flash the EEPROM with UV, resetting it?
- teuobk 10y agoThe 1/4" hole is in the steel of the safe door, and then behind that is the hardened steel body of the lock-proper, so no, I don't think that would be feasible.
- jdeeny 10y agoAn EEPROM (Electrically Erasable Programmable Read Only Memory) is erased electrically rather than with UV light like an EPROM. Even if there isn't a possible attack with light, there might be a way to alter the contents of the EEPROM if you can manage some amount of control over the signals entering the IC.
- teuobk 10y agoIt turns out that part of the attack does exactly that. It was glossed over in the Wired article, but the slides describe how the lockout-penalty feature in the lock was defeated by manipulating the EEPROM. Basically, if you kill power to the lock at just the right time (i.e., midway through the EEPROM erase cycle as part of the larger/longer EEPROM write cycle), those bytes in EEPROM will be left with a value of 0 instead of whatever had been there.