12 ms·
HDMI Firewall
- codethief 4y agoReminds me of the USB Condom: https://int3.cc/products/usbcondoms https://int3.cc/products/usbcondoms
- post_break 4y agoThis is interesting, I didn't know this was an active attack vector for devices.
- jacquesm 4y agoBlackhat.com talk: "Andy Davis HDMI - Hacking Displays Made Interesting Picture this scene, which happens thousands of times every day all around the world: Someone walks into a meeting room, sees a video cable and plugs it into their laptop. The other end of the cable is out of sight – it just disappears through a hole in the table. What is it connected to? Presumably the video projector bolted to the ceiling, but can it be trusted to just display their PowerPoint presentation?... This presentation discusses the security of video drivers which interpret and process data supplied to them by external displays, projectors and KVM switches. It covers all the main video standards, including VGA, DVI, HDMI and DisplayPort. It also details the construction of a hardware-based EDID fuzzer using an Arduino Microcontroller and a discussion of some of its findings."
- jaywalk 4y agoI'm not sure it actually is. Seems purely theoretical.
- hatware 4y agoYou can bet there's 0-days that exploit this, whether they are useful is another thing entirely. HDMI has way too much feature creep.
- buildbot 4y agoThis would also be really useful for monitors with broken/missing EDID info But yeah HDMI can have Ethernet too! Very overlooked and potentially dangerous attack vectors in HDMI
- andrewia 4y agoHEC isn't a concern because it's disconnected in any computer, and unsupported by home theater devices that support eARC. Here's my comment explaining more: https://news.ycombinator.com/item?id=31830551 https://news.ycombinator.com/item?id=31830551
- deleted 4y ago[deleted]
- josephcsible 4y agoWouldn't dip switches be better than breaking circuit boards and cutting traces? After all, this can't protect against physically present attackers anyway, since they could just unplug it and plug directly in.
- bee_rider 4y agoThey have some little pads you can solder across to re-enable writes. Perhaps it would be possible to put a switch across those?
- jasomill 4y agoSure, or just affix a short length of wire with a bit of gaffer tape and peel it off when done reprogramming.
- sudobash1 4y agoAs for a physically present attacker, many projector systems are out of reach and have a cable running through the wall or table to produce a socket for users to plug in to. Or they are mounted inside a cabinet with a similar cable reaching to the outside. If the "firewall" device is present at the (inaccessible) projector, this would not be a problem.
- josephcsible 4y agoSure, but dip switches would still be fine then, since attackers wouldn't be able to reach them to change them.
- myself248 4y agoOh, good. Glad to see this getting some attention. Malicious HDMI (and VGA, and DisplayPort) devices can feed bogus i2c data into the video drivers, which are probably never security audited. With VCP / DDC-CI, the attack surface grows.
- mschuster91 4y agoYou can in theory hijack the projector/monitor, okay. But the chances of reverse-hijacking are really REALLY slim - virtually all HDMI devices employ a retimer/redriver chip in front of the output, which means the only way "in" would be to exploit the CEC stack. HEC (Ethernet over HDMI) support is extremely rare in support.
- myself248 4y ago> But the chances of reverse-hijacking are really REALLY slim - virtually all HDMI devices employ a retimer/redriver chip in front of the output So what? The retimer chip doesn't touch the i2c lines, or even if it provides some ESD protection and buffering, it doesn't alter their data content. Software running in the PC is still talking to software running in the monitor's scaler chip. You can play with i2c-tools under linux to verify this. I've been using HDMI's i2c port to talk to the i2c EEPROMs on SFP transceivers: https://i.imgur.com/T7cY01m.png https://i.imgur.com/T7cY01m.png Nothing's getting in my way, it's just a generic i2c interface. There are other folks abusing it even worse: https://hackaday.com/2022/04/01/making-your-own-technically-hdmi-oled-monitor/ https://hackaday.com/2022/04/01/making-your-own-technically-...
- mschuster91 4y agoThe EDID i2c eeprom is 256 bytes in size. Even if a malicious laptop overwrites the content, there is utterly no way that a piece of malware can embed itself in there that can cause an adverse reaction on a computer that attaches later on.
- myself248 4y ago
- sudobash1 4y agoI could see this also becoming useful with Smart TVs. I don't want my TV to be having Ethernet-over-HDMI or other non-video/audio connection to any hardware that I connect to it (EG laptops). I'm not sure how much of a concern this is, but I don't trust the security of them, nor do I trust the manufacturers intent.
- javajosh 4y agoOh I see, you're worried that the TV manufacturer could hack your laptop if you connect it via HDMI. This is the point at which I have to wonder: what on earth can HDMI do?? What is the vector? I assume you have to break out of the target driver, which is probably OS/version specific. Then I suppose normal hackery applies, in terms of planting something on the disk. I assume that the HDMI driver does NOT have any legit API for writing to arbitrary locations on disk. I assume.
- michaelmior 4y agoI know nothing about the HDMI spec, but according to other comments, Ethernet over HDMI is a thing. So in theory perhaps the TV could present itself as a network device and then MITM your traffic. Not sure if that's actually possible though.
- nix0n 4y agoThis might not be adequate for keeping your TV off the Internet, they've been rumored to connect to unsecured WiFi.
- lancesells 4y agoHas anyone ever confirmed this? I did a search and only found a thread on HN asking the same question: https://news.ycombinator.com/item?id=25275350 https://news.ycombinator.com/item?id=25275350
- netsharc 4y agoFeels like some beliefs like this are like the Korean superstition that leaving the fan on while you sleep will kill you.
- hobo_mark 4y agoDoes anything actually use Ethernet over HDMI?
- __alexs 4y agoNo, HEC is dead.
- gwbas1c 4y agoCool, but why can't the device just automatically copy the EDID from the monitor?
- ncmncm 4y agoThat would be a nice improvement.
- dasv 4y agoThe readme says there is also an additional device that can be used for copying the ERPROM, instead of doing it via the computer. It would be possible to integrate the copier in the firewall dongle but that would mean having a microcontroller in each device that is just used once, driving the unit cost and the size up. The firewall dongle as it is is just holds an EEPROM, ancillary components, and the video passthrough traces.
- Dylan16807 4y agoA chip that can do that would be less secure and cost more than like two cents.
- gwbas1c 4y agoFYI: It seems strange to use branches to differentiate between entirely different projects. Normally different projects have different branches; a branch is used to make a change in isolation and is then merged back into master.
- nix0n 4y agoThis is kind of a neat hack, if you want to use the same build setup for all of these projects: just check out whichever project you're working on. Shared stuff can go into a separate repo. You could still have feature branches, it's just not master that they're merged into.
- gwbas1c 4y agoThat will get confusing extremely fast, especially when collaborating in groups.
- throw0101a 4y agoThe main thing I'd be interested in blocking is Ethernet: * https://en.wikipedia.org/wiki/HDMI_Ethernet_Channel https://en.wikipedia.org/wiki/HDMI_Ethernet_Channel With televisions having all sorts of questionable software installed that wants to phone home, it's probably best not to connect them directly, but rather stream things to the display from either your mobile device or a box (e.g., Apple TV). Of course if you accidentally do connect it online via a box that does have Internet access, who knows what kind of Lovecraftian horrors will be enabled on the television.
- codeulike 4y ago“I think my TV is spying on me.” Old days: “You should talk to a psychiatrist.” Modern times: “You should talk to my cousin Ernie, he's an IT whiz.” (via https://twitter.com/kennwhite/status/403584069923270656 https://twitter.com/kennwhite/status/403584069923270656 )
- js2 4y agoHEC is dead. Those pins are used for ARC/eARC on every device I know of.
- ncmncm 4y agoWouldn't be surprised if it muxes ethernet and ARC on the same pins. And, just because it is "dead" commercially does not mean there are not drivers in your OS watching for any traffic claiming to be ethernet, and eager to respond to it.
- andrewia 4y agoNo, the HEC pins are probably disconnected in any modern computer/dGPU. Background: HEC uses 3 pins. Those pins can be used for 3 different protocols: HEC (100Mbps differential signal slightly modified from the Ethernet standard)(1), ARC (1 Mpbs SPDIF signal over a single wire)(2), and eARC (~40 Mbps SPDIF differential signal)(3). Modern computers with integrated graphics send the HDMI signal from the CPU pins. But in all the examples I could find, those pins are all Displayport (4)(5)! This is because DisplayPort supports HDMI video data wthin its signal. This allows manufacturers to convert that to HDMI with a cheap IC (that is mostly a redriver and level shifter). So they just have a DisplayPort signal exit the CPU/GPU and convert it to HDMI if necessary. At this point I should note that DisplayPort does not support high-bandwidth auxiliary channels. So higher bandwidth features like HEC would require the converter IC to have a separate data channel to the CPU/GPU. But I couldn't find a DP-to-HDMI IC that supports HEC or eARC. I guess there's just not enough interest. In theory, some computer/GPU manufacturer could connect the HEC pins to an FPGA that has a high-bandwidth connection to the CPU/GPU to support eARC. But even with that, your hacker would need to reprogram the FPGA to stop being a SPDIF encoder and start being an ethernet bridge. And this hypothetical FPGA can't support just ARC - it would be way too slow to be reprogrammed for Ethernet. Of course, this leaves out home theater devices. They support eARC, and if their ICs are flexible enough, might be able to speak Ethernet with a lot of programming. But since no devices support HEC, you would have to reprogram devices on both sides of the HDMI cable. And at that point, you could just transmit data over SPDIF. In short, there's a 99.9% chance that HEC pins are physically disconnected in any computer's HDMI port. Even if they were connected, a hacker wouldn't be able to establish an Ethernet connection unless the device under attack is using a very obscure IC or is ridiculously over-engineered. 1: https://patents.google.com/patent/US20110096793 https://patents.google.com/patent/US20110096793 2: https://www.ap.com/technical-library/more-about-arc/ https://www.ap.com/technical-library/more-about-arc/ 3 (PDF warning): https://www.latticesemi.com/-/media/LatticeSemi/Documents/WhitePapers/AG/Lattice_eARC_WP_FINAL.ashx?document_id=52269 https://www.latticesemi.com/-/media/LatticeSemi/Documents/Wh... 4: https://www.reddit.com/r/Amd/comments/gzkxux/the_am4_pinout_diagram/ https://www.reddit.com/r/Amd/comments/gzkxux/the_am4_pinout_... 5: https://images.anandtech.com/doci/14657/ASUS%20Pro%20WS%20X570-Ace%20Block%20Diagram.JPG https://images.anandtech.com/doci/14657/ASUS%20Pro%20WS%20X5...
- giobox 4y agoNeat idea, but lack of HDCP support could be deal breaker for a lot of applications - I'd even consider listing this limitation nearer the top, it's currently at the end of a long README. HDCP is used in a huge number of HDMI devices.
- js2 4y agoYou could combine with an HDFury device such as https://www.hdfury.com/product/dr-hdmi/ https://www.hdfury.com/product/dr-hdmi/ to fix that. Of course the HDFury device would have to be before the HDMI Firewall (closer to the source), so you have to trust the HDFury not to be hackable on its own.
- jfim 4y agoIs it used outside of playing DVDs and other copy protected content? It seems like the use case presented in the link (malicious presenter connecting a laptop that hacks the projector) would not need HDCP.
- api 4y agoThings like Netflix often query HDCP via browser extensions. There are workarounds but sometimes they won't play full screen without it. It's dumb though because it will usually play on DisplayPort which has nothing like HDCP.
- happyopossum 4y agoThat would fall under the ‘other’ playback GP mentioned. Still wouldn’t apply to a PowerPoint preso…
- randombits0 4y agoOr could. With the push to “secure data”, DRMed internal docs already exist.
- 4y ago
- gzer0 4y agoLet's start with the theory: if you have access to the television, you should be able to install your own custom firmware. Then there's the HDMI constraint; HDMI is a bidirectional interface by design, and while it looks nice, it's built for packet streams rather than data blocks. From a user's perspective, this is a dead-end; however, for a hacker, there must be a way to wrap data blocks into packet streams; especially since the HDMI port/cable does transfer data from PC to TV, such as information about the movie you're watching, time left, and so on, in addition to commands and selections from TV to PC, this is known as HDMI-CEC (Consumer Electronics Control), and there is also the HDMI-HEC (High-speed Ethernet Channel) which provides internet sharing for devices connected with the HDMI cable. So yes, it's a possible threat vector as is everything nowadays. Does it fit inside your cybersecurity threat scenario/risk scheme? Up to you to decide.
- MBCook 4y ago> For example, let's imagine you invite an external guest for a presentation inside your company. You offer to connect to a video-projector so he can show his slides. This is the perfect opportunity for the guest to hack the video-projector. Next time an employee connects to this projector, his laptop is hacked back. Is there a single proof of concept of this out there? This seems wildly theoretical to me. Seems like you have to know: * the projector/TV model/firmware * the employee laptop and firmware * a bug in the projector/TV that would let you insert arbitrary data in a way that will stay around and be sent to other devices that connect to HDMI * a bug in the laptop that would let you install something malicious with the data could get the projector to send * your hack wont be detected by software on the laptop or the IDS/whatever on their network That’s pretty heavy lifting. I mean is any of that reasonable outside of nation-state level attacks?
- gruez 4y ago>For example, let's imagine you invite an external guest for a presentation inside your company. You offer to connect to a video-projector so he can show his slides. This is the perfect opportunity for the guest to hack the video-projector. Next time an employee connects to this projector, his laptop is hacked back. And voila, the innocent guest managed to infiltrate your company network, and can exfiltrate confidential information. This seems like a very unlikely attack vector. For one, you have to identify the projector used, develop an exploit for the projector (assuming it's even vulnerable), and also develop a projector for windows/mac/linux that allows the payload to spread. This seems like a lot of trouble to go through compared to visiting the office, "accidentally" leaving a usb drive/dongle, and hoping someone ends up using it. Bonus: usb dongles allow you to spoof input devices, so you don't even need to develop an exploit.
- rtkwe 4y agoYou might be able to get a persistent hack attacking the HDMI controller chip directly instead of having to develop one specific to each projector, that's a more generic component. That said though this does feel a bit like a very hypothetical attack because you'd have to package both an exploit for the projector and target
- ncmncm 4y agoIf your organization often gets outsiders in to present, it could slurp off the interesting contents of anything plugged in. Or, if you can get access to the projectors (or just the HDMI cables) at e.g. DEFCON. For certain selected targets, it might install something for later. Or maybe just everybody, and you only use the one on the target's machine, and ignore the rest. Note, you don't need to hack the projector. You just interpose between the computer and the projector, just like this thing does.
- bentcorner 4y agoDefense in depth - after you're done gluing USB and ethernet ports closed, this might be something to consider. I agree it's unlikely but if it's a low cost mitigation then why not? And if you're at a shop that doesn't do anything about open physical ports in the office then yes, this is way down on your risk assessment checklist. It's good education though. Much like there's danger in plugging your phone into random USB chargers, there's danger in plugging your PC into random HDMI cables. I didn't know that. It would be nice if there was a way it could preserve the EDID information without needed to manually clone it. It looks like this device is good for protecting the display, but I'd be more interested in a device that can protect my laptop when I travel.
- alin23 4y agoHDMI offers so many protocols I didn’t know of. Before finding a way to use DDC on Apple Silicon [1] for Lunar (https://lunar.fyi https://lunar.fyi), I contemplated creating a universal DDC/CI device that can change brightness, contrast, volume, input and colors of a monitor, by either receiving commands through HTTP, or acting as an Adaptive Brightness standalone device. In my mind, it would have been an HDMI dongle with an ESP32 that gets power through the 5V line of the HDMI port, and which has an ambient light sensor to adapt brightness by itself. In the end, I found the I2C APIs on M1 so this was not so sorely needed anymore, but given the limitations of the M1 Display Coprocessor, I still think it might be a good idea. I just have no idea where would I start with hardware distribution and mass production, this domain seems so intangible from the software development side. [1] https://alinpanaitiu.com/blog/journey-to-ddc-on-m1-macs/ https://alinpanaitiu.com/blog/journey-to-ddc-on-m1-macs/
- alana314 4y agoI found Lunar through your blogs and love both!
- alin23 4y agoThanks! Happy to hear that it’s so useful!
- bliblablub4 4y agoHave you considered using HTTPS?
- alin23 4y agoI’m not sure I understand, what should I use HTTPS for?
- ajolly 4y agoOh man, I want lunar.fyi for windows, especially auto brightness, for multiple monitors based on ambient light.
- a-dub 4y agoyou can do i2c/ddc over dvi as well... i think even old vga analog cabling supported it. has anybody actually hacked a monitor yet? has anybody actually hacked a monitor in a meaningful way yet?
- deleted 4y ago[deleted]
- thehappypm 4y agoI wonder if eventually peripherals will go back to pure analog, just aux and VGA, after a few major hacks are discovered.
- topspin 4y agoI don't. The ads and tracking enabled by digital offset the cost of manufacturing; sans that products will cost more, and price is a major factor in purchasing decisions.
- nonameiguess 4y agoI see comments here expressing skepticism that any but a nation state threat actor would try to pull off an exploit taking advantage of this, but considering the possible targets, that is exactly who you might be looking to defend against. The clearest target, to me, is air-gapped systems that also disable USB ports, but still allow workers to use external monitors. That is effectively any classified computing environment, and clearly the threat actors targeting state secrets are overwhelmingly going to be other states.
- deleted 4y ago[deleted]
- pseudojim 4y agoI was of the mind of the more skeptical commenters, but this is a great point! In the most classified environments, an esoteric vulnerability like this may be the only nonhuman thing left to exploit.
- ncmncm 4y agoIt would not be surprising if spooks rely mainly on plugging into HDMI to suborn machines now. Of course this is no help with that unless spooks have substituted a doctored monitor. Or cable. The doctored presentation-room projector would be a plausible place for that. I wonder which of the things that happen when an HDMI cable is plugged in are negotiated in hardware or laptop firmware, before the host system driver gets to talk to it. It's short odds a binary blob for that chip is loaded at startup. So, turning off services that respond at the OS level likely would not suffice. And, does code in that binary blob have full DMA access to the main memory bus, and PCI devices? Anyway this gadget should protect against the projector.
- asojfdowgh 4y agoThere are so many devices where I already want a sequel to them, HDMI Firewall 2, with the ability to solder spots to re-enable features
- danielmilnes 4y ago[flagged]
- spoonjim 4y agoI guess I just wonder, why give any extra trust to a device just because it’s in your company network? Why not have specific authorizations for specific operations? A device on your company network could be pwned by anyone.
- throwaway742 4y agoI thought I was shitposting when I suggested this the other day. https://news.ycombinator.com/item?id=31803593#31805200 https://news.ycombinator.com/item?id=31803593#31805200
- pmorici 4y agoSeems odd to focus on HDMI, the DDC/i2c mechanism described has been in every display connector from VGA on forward. DisplayPort did away with dedicated pins but the mechanism is still there encapsulated in the AUX channel.
- ardel95 4y agoThis is wishful thinking, but I really hope HDMI protocol was replaced by something more reliable one day. I’ve never had this many problems with a simple task of having device A connect to device B over a short physical cable. Having to flash firmware on a TV just so that it can successfully connect to a DVR is peak techno dystopia.
- jimmySixDOF 4y agoI wonder if this would work or is even needed in the case of HD-Base-T [1] ? [1] https://hdbaset.org/ https://hdbaset.org/
- Animux 4y agoThis looks alot like https://xkcd.com/927/ https://xkcd.com/927/
- johnwalkr 4y agoTip for solder jumpers: the ones in this PCB would allow you to use a zero ohm resistor easily, but actually would be quite difficult to get solder alone to bridge the 2 pads due to the solde mask in between. I’ve had good luck omitting (or scraping off) the solder mask in that area, and recently came a cross a product with a better design. This product, an upgrade for the original NES[1] has very nice solder jumpers. [1] http://etim.net.au/nesrgb/ http://etim.net.au/nesrgb/ (see first image, lower centre).
- Terry_Roll 4y agoTV's taking a terrestrial signal using a HDMI cable to a set top box which is connected to the internet is just another attack vector. Satellite signals are harder but any SDR can be used on a TV using terrestrial signals.
- MichaelZuo 4y agoOr use a pure analog solution like VGA.