4 ms·

Give me four weeks, $5,000, and I'll find at least one viable exploit. Considering the audience here, I don't think this kind of joke is really too far fetched.

Give me four weeks, $5,000, and I'll find at least one viable exploit. Considering the audience here, I don't think this kind of joke is really too far fetched. "Every solution breeds new problems" as one of the Murphy's Law axioms goes. Not saying this channel is a bad idea! I'm just the kind of guy who likes breaking things to see how they work. Criminals are almost always one step ahead because they see things in ways others might not imagine. Those errant use-cases are the ones to try to bulwark against...better when for fun than when the stakes are really high, know what I mean?

tyingq 10y ago
They don't seem any worse than typical badges used today. It's just replacing printed info and lamination, which is just as hackable. That's how I would hack this...print something that resembles the epaper display with suitable clearish plastic over it and something for a slight bezel effect. These would still need whatever separate RFID or NFR tech is used to swipe and open gates, doors, etc. Edit: Here's a higher res version of the product image: https://wuqqf55242.i.lithium.com/t5/image/serverpage/image-id/636i34B020A44A85635B https://wuqqf55242.i.lithium.com/t5/image/serverpage/image-i...
- 6stringmerc 10y ago
  Fair points! I don't disagree, and also think what we can find in common is that effort is usually a precursor to execution. As in, it's not easy to make laminated / official looking ID type things. The whole "Fake IDs" thing that is always a reasonable market - they don't have to be great, they just have to be good enough, right? So that's the flip side, an escalation in confidence factor - oh this is new and it's not as exploitable! - is perfectly reasonable at first. I'm not trying to be sarcastic about this, but I remember reading that some crew found an exploit in pacemaker protocols (e.g. connectivity) that could be manipulated if a person had bad intentions. Who sits around and tries to figure out that kind of stuff? Oh, right, guys like me sitting in their garage. Spiritual kin of Woz. My kidding-but-not-really musing is that I've been an employee of 12+ different companies in my life, and I've seen how things work in practical terms. The biggest security penetration vector that can't be digitized is human behavior, because if you act like you belong and your badge looks like you belong, yippee! Now you've got physical access, and that's 9/10s of any penetration objective. I mean, if I was a KGB agent, that's how I'd think about these things...
ChuckMcM 10y ago
As I understand the product that would be like exploiting paper. In the sense that the 'badge' part is just the e-ink screen with no electronics (so the two color 'pixels' that are alternately positively and negatively charged on either hemisphere). There are lots of exploits for paper already, its called 'forgery' :-)
- 6stringmerc 10y ago
  So if seeing is believing, like with paper, how does this new innovation "fix the glitch" as it might be called? An RFID handshake? I know that we're living in a time where manufacturing small things for reasonable cost is possible, but at some point it's Turtles All The Way Down.

tyingq 10y ago

They don't seem any worse than typical badges used today. It's just replacing printed info and lamination, which is just as hackable. That's how I would hack this...print something that resembles the epaper display with suitable clearish plastic over it and something for a slight bezel effect. These would still need whatever separate RFID or NFR tech is used to swipe and open gates, doors, etc. Edit: Here's a higher res version of the product image: https://wuqqf55242.i.lithium.com/t5/image/serverpage/image-id/636i34B020A44A85635B https://wuqqf55242.i.lithium.com/t5/image/serverpage/image-i...

6stringmerc 10y ago
Fair points! I don't disagree, and also think what we can find in common is that effort is usually a precursor to execution. As in, it's not easy to make laminated / official looking ID type things. The whole "Fake IDs" thing that is always a reasonable market - they don't have to be great, they just have to be good enough, right? So that's the flip side, an escalation in confidence factor - oh this is new and it's not as exploitable! - is perfectly reasonable at first. I'm not trying to be sarcastic about this, but I remember reading that some crew found an exploit in pacemaker protocols (e.g. connectivity) that could be manipulated if a person had bad intentions. Who sits around and tries to figure out that kind of stuff? Oh, right, guys like me sitting in their garage. Spiritual kin of Woz. My kidding-but-not-really musing is that I've been an employee of 12+ different companies in my life, and I've seen how things work in practical terms. The biggest security penetration vector that can't be digitized is human behavior, because if you act like you belong and your badge looks like you belong, yippee! Now you've got physical access, and that's 9/10s of any penetration objective. I mean, if I was a KGB agent, that's how I'd think about these things...

ChuckMcM 10y ago

As I understand the product that would be like exploiting paper. In the sense that the 'badge' part is just the e-ink screen with no electronics (so the two color 'pixels' that are alternately positively and negatively charged on either hemisphere). There are lots of exploits for paper already, its called 'forgery' :-)

6stringmerc 10y ago
So if seeing is believing, like with paper, how does this new innovation "fix the glitch" as it might be called? An RFID handshake? I know that we're living in a time where manufacturing small things for reasonable cost is possible, but at some point it's Turtles All The Way Down.