3 ms·
Roughly 10 years ago, I knew a guy who sold various exfil/border-extraction products to state actors including FireWire dongles similar to Inception (they may e
by anonsivalley652 7y ago
Roughly 10 years ago, I knew a guy who sold various exfil/border-extraction products to state actors including FireWire dongles similar to Inception (they may even be effectively the same thing, IDK). He specialized in memory dumping attacks on several platforms including Windows, FreeBSD, Linux and macOS.
The core problem is that buses should be authenticated, authorized, encrypted, and selective-/least-privileged channels. Exposing a memory and expansion bus to the outside world in the name of "convenience" is insane. A trusted set of components in the OS and in hardware should:
0. Be able to do a HwIDS checksumming of all firmwares to detect tampering.
1. Limit devices' ability to connect unless they are authorized by the user, much like a "hardware firewall" UI.. vaguely similar to say VMware Workstation/Fusion's dialog when plugging in a new USB device mixed with something like Little Snitch'es dialog for a process wanting to connect to a particular port.
2. Authenticate devices with public/private key certs that are burned in, a function where the device can answer challenge requests, and Signal protocol-like construction properly modified for PKI. Then, and only then, can a host talk securely to a device over an encrypted channel.
- hoistbypetard 7y agoWe never sold anything for it, but for some demos back around 2004/2005 we flashed some firewire iPods with custom firmware that performed the attack described here: https://web.archive.org/web/20071011191205/http://md.hudora.de/presentations/firewire/PacSec2004.pdf https://web.archive.org/web/20071011191205/http://md.hudora.... (To be clear, those slides aren't mine, but I can no longer find the firmware we based ours off of, and never did get permission to post source to our mods, which were never distributed.) I know a couple of our customers took entirely the wrong lesson from our demonstrations and banned mp3 players from their office buildings entirely afterwards :)
- anonsivalley652 7y agoHahaha. That's awesome. :) Speaking of things that look silly dept.: Many moons ago around 1998 in uni, I had an HP 48 graphing calculator which was both programmable and had a very powerful IR LED that was usually used for serial transfers between similar devices. It so happened that some enterprising soul made a customizable, preset and code-learning IR remote control app for it that worked, so I put the brand of the lecture hall's 4 TVs in it. From the back of the room, some 15 meters away, I subtly turned on all of the TVs with a phreak'n calculator. Disbelief, confusion and hilarity ensued.
- hoistbypetard 7y agoTV-B-gone before its time. That’s great. I hope I’d have done exactly the same.
- userbinator 7y agoAuthenticate devices with public/private key certs that are burned in Hell no! That's how you get the dystopia of vendor lock-in and absolute control. If I may be controversial: a little insecurity is a good thing. It prevents such authoritarian monopolies from forming.
- anonsivalley652 7y agoWoah, relax there before you have a stroke. You're over-reacting and jumping to erroneous conclusions while fetishing and trivializing gross insecurity. Open standards are obvious and essential, and as such a CA for one doesn't have to be owned by any corporation, and are best run by a real non-profit that is independent of governments and bias towards any particular vendor. The hardware manufactures would pay a nominal fee to have a perpetual certificate and millions/billions of people get devices that can't be snooped on from the outside by authoritarian regimes.
- userbinator 7y agoI've seen enough of how such "security" works out in practice to know that such idealism is simply unrealistic.