22 ms·
Bypassing Android MDM Using a $1.50 Electric Gas Lighter
- moron4hire 6y agoUsing an electrical shock to bypass a subsystem in Android makes me think of Data in Star Trek glitching out when he got stuck in an EPS conduit once.
- ben_w 6y agoPhrasing it like that makes him sound like a cat, which is a fantastic mental image for the entirety of TNG.
- benjaminjackman 6y agoMakes me wish there was a Data / spot consciousness swap episode.
- jacquesm 6y agoThis was a pretty common trick to glitch slot machines, they are hardened quite a bit against this sort of trickery. A mobile phone is much more delicate in general construction and doesn't have access to a handy ground wire.
- grishka 6y agoSlot machines are on someone else's premises and (disclaimer: I've never been to a casino myself) are most likely under surveillance, so they'll probably void your winnings and ban you if you start doing something sketchy. Devices that implement any restrictions against the end user like DRM or MDM, on the other hand, are in possession of the said user. I heard a saying that getting root privileges on a device you physically possess is only a matter of time and effort. In other words, you can totally take your phone apart as much as your tools and skills allow, but you'll get arrested if you try taking a slot machine apart.
- jacquesm 6y agoSure, the owners would not be happy. But slot machines are installed all over the world and not just in casinos. The idea was not to take the machine apart but to try to glitch it by hitting metal parts that were not properly grounded. This would then allow the voltage spike to make it into the circuitry, either leading to breakage, no effect, or fault injection. The latter could sometimes be converted into a win on a subsequent spin. This is 80's stuff, I'm pretty sure todays' slot machines are tamper proof to the point that trying this is totally pointless, and even back then hardening against this was common.
- mschuster91 6y ago> This is 80's stuff, I'm pretty sure todays' slot machines are tamper proof to the point that trying this is totally pointless, and even back then hardening against this was common. They are. Source: I own a modern-ish computer based slot machine and tried my fair share of tricks against it.
- dan000892 6y agoThe very first technical standards for slot machines in Nevada are ESD testing to confirm it’s safe for the player and that the integrity of the device is unimpacted by 27kV discharge to any point on the exterior of the machine while it’s being played (and the test labs really go to town finding gaps in panels and really trying to make something bad happen). Given the absence of mechanical reels and the fact that the components likely to be susceptible to glitching aren’t remotely close to the outside of the machine this isn’t a viable attack method for machines in operation. Source: NV Tech Standard 1 [1] also have zapped modern slot machines with an ESD gun. [1]: https://gaming.nv.gov/modules/showdocument.aspx?documentid=2919 https://gaming.nv.gov/modules/showdocument.aspx?documentid=2...
- xxpor 6y agoI happened to be in AP Stats back in HS with the son of the owner of the business who certified all electronic casino games for the state of NJ. We took a field trip to the business and his dad gave us all a tour and explained all of the testing they do for this sort of stuff, the code reviews, making sure the machine's odds were actually what they said they were etc. I don't remember many details at this point (it was 12 years ago, which is insane), but I do distinctly remember the scale and just the amount of stuff they did. It's very serious business, because it was in both the casino owners and NJ's interest to make sure the machines were in fact not hackable as much as possible.
- w0mbat 6y agoIt was a similar story with gas pumps, which truck drivers used to glitch to get most of their fill-up for free.
- p1mrx 6y agoAttacking a gas pump with a high voltage lighter sounds like a good way to win a Darwin Award.
- ideals 6y agoThis looks like what we used to do with electric lighters to turn them into weak tasers and zap each other at school. Disposable cameras had a little more umph though.
- ocdtrekkie 6y agoMy first lesson in "capacitors store electricity" when I was a kid was when I took the battery out of a disposable camera... and then managed to shock myself with the flash discharge anyways.
- thelazydogsback 6y agoI did it by sticking a screwdriver where I shouldn't have and touching the flyback cap on an old (CRT) TV that was only recently unplugged. Luckily I wasn't well-grounded and the part of the screwdriver shunted the current turned to slag.
- tgsovlerkhgsel 6y agoDid you get shocked at all? I'm trying to understand what the return path for the current would be in this situation.
- throwanem 6y agoThrough the screwdriver shank, as it's placed across the capacitor terminals. This creates a dead short through which the differing potentials on the capacitor plates can equalize - and if the capacitor is large enough, they do so quite enthusiastically. I ruined a screwdriver of my own that way once, discharging a photoflash cap in a flash head whose control circuit had died with the cap at full charge. Didn't do my hearing any good, either, I'm sure - it took fully half an hour for the ringing to go away.
- JJMcJ 6y agoTV repair shops use a special tool to discharge those caps, basically a high voltage rated resistor pack. Largely a disappeared skill. I believe if you are really lucky if you discharge with a screwdriver, the cap can explode, not just melt the screwdriver. Same with batteries, like auto batteries, extra points there with boiling acid and hunks of thick plastic flying around.
- danbruc 6y agoWhat is the point of those color gradients in the photos? [1] Are they supposed to conceal the chip? If so, that didn't work very well. [2] Just make it completely black, people have failed often enough to properly redact information because they tried to do something fancy, something more visually pleasing. At least unless they did this intentionally, either because they wanted it to be visible but also wanted some deniability as an accident, or to mislead by embedding false information. [1] https://payatu.com/static/images/remoteblogs/arun/emfi_blog/4.png?raw=true https://payatu.com/static/images/remoteblogs/arun/emfi_blog/... [2] http://www.unisoc.com/sc9863a http://www.unisoc.com/sc9863a
- arunmagesh 6y agoOuch. That was not an intended one. Those colourful overlays are just android stickers. I didn't expect them to be translucent. . :( I fixed it. I would kindly request you to modify / remove the link part please . :(
- kspacewalk2 6y ago>I would kindly request you to modify / remove the link part please . :( But... why?
- arunmagesh 6y agoThis might give out information about the device we used. That should be a secret.
- dylan604 6y agoI'm sorry, but this is your fault. You improperly tried to conceal a picture by being cute instead of effective while trying to earn bragging points with a very public announcement about your hack. You brought the eye of Sauron upon yourself. It'll be a painful lesson to learn, but I'm guessing you won't make this mistake again. Some of us have been there before. Welcome to the club. We've got jackets.
- Hasz 6y agoNext step in cheap but effective is building a small waveguide for your arc lighter -- probably easier to target what you want vs the point source you have now. Can basically be a few pieces of carefully sized tinfoil, or some copper wire with copper clad soldered around it. Also, the term "Jugaad" for Indian macgyverism is excellent!
- marunmagesh 6y agoHey Guys! I am the OP for this blog. Please direct your queries to me.
- arunmagesh 6y agohuh?? If you're me. who am i???
- mcraiha 6y agoWill the real OP please stand up?
- arunmagesh 6y agoI don't see any point in others making a profile for me. Not worth it mate!
- magesharun 6y agoHe is not you, I am you.
- arunmagesh 6y agoif you're you. then I'm me.
- namanaggarwal 6y agoI would like to report this if this is not genuine
- FriedPickles 6y agoThe author claimed to use a “cheap electric Arc Gas lighter”, which I had never heard of. I think they actually just mean an electric arc lighter because I wasn’t able to find such a thing (which would presumably mean a butane lighter with an electric arc igniter rather than piezo).
- arunmagesh 6y agoah my bad!! I get the confusion. It is a arc lighter for gas stoves. :/
- tdeck 6y agoI wondered about this too, since I have never seen on of these. Perhap the author is in a country where manual-light gas stoves are more common? In the US I have never encountered such a stove, and searching target.com (good proxy for common household items) brings up no lighters of this style.
- segfaultbuserr 6y agoI have one because the electric lighter in my stove was broken.
- nom 6y agoA bit OT but this just reminded me of something I haven't thought about for many many years. Just wanted to share. I bypassed the payment procedure in a coke vending machine with a lighter. Germany, around 2004 we had a coke vending machine at school, probably from the mid 90s. Someone told me you get free coke if you flick a (non-piezo) lighter in front of the display at the right time. I didn't believe it one bit, but when I tried it, it actually worked. It quickly spread around our school until months later the service guy fixed it. Many years later I realized what has happened. The flick of the lighter emitted a strong IR impulse that triggered an infrared receiver (which was probably used for debugging, configuring etc). This must have caused an interrupt, and if triggered at the same time the machine vended the bottle, it completed vending but never got back to actually decrementing the money you put into it. You could empty out the whole machine with nothing else but 1 Euro and a lighter and you even got your money back. Lots of cokes were had.
- narwally 6y agoWhen my sister lost the "sensor bar" on her Wii I showed her how to use a pair of candles to replace it. The sensor bar is just a a set of IR lights that the camera on the wii-mote detects.
- jagraff 6y agoI'd imagine a pair of candles would cause the cursor to jump around a lot because of the flickering - how did you solve that problem?
- xyzzy_plugh 6y agoWith a clean, dry wick it's pretty easy to get a very still flame for a long, long period of time. Though if you have a fan or something blowing, you're out of luck.
- function_seven 6y agoI imagine a vigorous game of Wii Tennis will cause those candles to flicker. And will provide a convenient excuse why I was unable to return that serve.
- ComodoHacker 6y agoSo did this guy just revived a long declined market of "tough" mobile devices (rugged, EM shielded, thermoresistant etc.)?
- pjbk 6y agoBeing in the embedded safety/security industry for years, piezo igniters and sparklers are one of my go-to system test and side attack tools. They were also effective opening an August smart lock some time ago when one of my coworkers had to enter a room in a hurry and were not carrying their phone with the app. Amazingly a few zaps around the enclosure did it. The big ones for gas stoves even work some feet away on some badly shielded products. Growing complexity, size/weight reduction and low power technology have made all these devices quite flimsy these days.
- paulcarroty 6y agoOh, just remembered I need to buy the one :)
- trhway 6y agousing X-ray generator and knowing the chip layout one can probably target specific registers/memory cells
- rasz 6y agoDo not try to replicate, you will destroy your device.
- pontifier 6y agoI remember reading about a javascript sandbox escape method years ago that involved bunches of jump commands written in such a way that any bit flipped would jump to another jump command directed at your desired code. The attack relied on cosmic rays flipping bits of memory, but was accelerated by using a light bulb placed near the memory chips to induce heat based errors. edit: found it! https://www.cs.princeton.edu/~appel/papers/memerr.pdf https://www.cs.princeton.edu/~appel/papers/memerr.pdf I've often thought about these types of attacks, and wondered how advanced they've become. Disclaimer: I'm extremely paranoid about computer security to the point where I almost don't care about it anymore and assume that any machine I use is compromised.
- justaj 6y agoAs an aside: Is it not required to put a date of publication inside scientific papers? I've always thought that documentation was paramount for papers such as these, and as such the date would be one of the primary pieces of information present, but I've come across many papers (including this one) for which I had to find publication information on third party websites (for this particular paper: Researchgate)
- closeparen 6y agoThe journal issue it’s published in has a date, surely.
- whyagaindavid 6y agoThis is not strictly 'Bypassing' MDM. Sure you get a device that you can flash/root/reinstall - but will it be authenticated/allow login by Google/Your company? > Here our objective was not to break the crypto or recover the data, it was to remove any MDM application and remove all restrictions on the device. Yes you can remove - resell device. But MDM is not designed to prevent reinstall/selling/whatever. Beyond Corp principles: A particular network connection must not determine which services a user can access. Access to services is granted based on what we know about a user and the device. All access to services must be authenticated, authorized and encrypted. Are you able to authorise device with your company/google? We are listening...
- arunmagesh 6y agoHere the scope of the PT was something different than getting access to the filesystem or bypassing corp filters. Breaking the mdm implemented in the firmware was the crude target.