5 ms·
> Now the exploit was rewritten to read memory, and blink out the contents using the LCD backlight. A LEGO construction was built and a webcam would register t
by uticus 3y ago
> Now the exploit was rewritten to read memory, and blink out the contents using the LCD backlight. A LEGO construction was built and a webcam would register the binary stream of a few megabytes of memory contents. Slooooow.
It both amazes me and cracks me up how exploits are accomplished. Given enough time and determination...
- HumblyTossed 3y agoIt's really cool how they did this and not to diminish it in any way, but this is really a form of bit banging that a lot of devs already understand how to do.
- echelon_musk 3y agoYou would probably appreciate this clip [0] from the AMC show Halt and Catch Fire where the character reads out the entire firmware from an IBM PC using lights. [0] https://youtube.com/watch?v=jSZwtrnKxf4 https://youtube.com/watch?v=jSZwtrnKxf4
- bogantech 3y agoCouldn't even make it through the whole thing it's so cringe. Checking voltages and they have a sine wave on the oscilloscope lol. You could just read out the whole rom contents quite easily with whatever computer you had handy. There was no read back protection or scrambling - You give it an address and read out the bytes
- ndiddy 3y agoAlso IBM put a listing of the BIOS ROM in the PC technical reference manual so none of this was necessary to begin with.
- derwiki 3y agoA character in Cryptonomicon did something similar, using the lights to blink out morse code so he could gain information without his captors realizing it.
- epcoa 3y agoThere’s virtually nothing in that clip that is factual and it’s not internally consistent. There would be no mystery about which chip is the BIOS, it’s not even self consistent with the claim of it being “off the shelf” junk. You could just dump the thing. And even if you couldn’t, 7 segment displays and other niceties were available. The oscilloscope stuff has no basis in reality. HCF is a fine series with good storytelling, but the technical stuff is all window dressing and should not be examined too closely or confused with the real deal.
- fmj 3y agoIIRC they used a variation of this a second time on a newer model of iPod. They found a way to trigger the click speaker, wrote a program to dump the ROM via the clicker Morse code style, and left it sitting next to a microphone in a foam lined box for a few days.
- qingcharles 3y agoI went for some "security training" with a grayhat once for a company I was developing for. He showed me his SQL injection script that exfiltrated the remote DB by using pauses in the SQL query depending on each letter of the table names/col names/etc. He had a script that would just keep firing blind queries through a textarea and recording the delay before the page returned.
- derwiki 3y agoBlind SQL injection is what I’ve heard this called, if anyone wants to read more. I used this concept to exfiltrate sensitive material from our database using PgHero’s analyze feature for an in-house incident response workshop once.
- qingcharles 3y agoThank you, I never knew if it had a name. https://owasp.org/www-community/attacks/Blind_SQL_Injection https://owasp.org/www-community/attacks/Blind_SQL_Injection
- uticus 3y agoI'm struggling to understand. I can understand how a timing attack would reveal enough details to differentiate between data being touched (but not expected to be returned). But I can't understand how this would cause SQL injection... do you mean it's a way to perform unauthorized queries, or do you mean data-altering statements could also be executed?
- qingcharles 3y agoSibling poster knew the name for it: https://owasp.org/www-community/attacks/Blind_SQL_Injection https://owasp.org/www-community/attacks/Blind_SQL_Injection