4 ms·

If you follow the Twitter thread, the secure boot password was stored as a SHA-1 hash. So someone eventually brute forced it, and it's "N%(dU32p'". But, the p

by tyingq 3y ago

If you follow the Twitter thread, the secure boot password was stored as a SHA-1 hash. So someone eventually brute forced it, and it's "N%(dU32p'". But, the prisons can't just change the default, because the design is that it writes the bios setup, including the default password, back to the device at power down. So, there didn't really appear to be any other option for the prisons other than collecting them all and sending them back for a fairly big update.

lolinder 3y ago
The article quotes the manufacturer as saying that even with the password there's basically no risk of the devices being misused: > The man who made the devices said there’s little someone inside could actually do with a hacked Securebook. They’d need to fashion a USB port, be able to install another operating system, and get access to a docking station, said Jeremy Schwartz, Justice Tech president. Even when the devices are docked, they’re not connected to the wider internet. It sounds like one very valid option they had was to just change the password as part of the regular maintenance and replacement schedule on the very reasonable assumption that no one would be able to attach a USB port to their laptop within the confines of the prison.
- teekert 3y ago
  So the (over dramatic) decision was made by someone with little knowledge but with power and probably responsibility. That happens too often in this world.
- tyingq 3y ago
  The author didn't attempt it, but it seems pretty clear 4 of the pins on the exposed docking port would be a USB bus. So all you need really is a usb stick, some wires, and some patience. The particular connector used even looks like you could directly insert/wedge thin gauge wires, no soldering required on that end: https://imgur.com/a/7T3agdg https://imgur.com/a/7T3agdg
rvnx 3y ago
Which could have been handled gracefully over time without disturbance if the person would have responsibly just contacted the IT of the prisons, instead of publishing the method and password in the wild.
molticrystal 3y ago
>So someone eventually brute forced it Just a few hours after it was starting to be brute forced, I'm sure I saw somebody finding the password being used in youtube presentation, perhaps for a related model or bios setup, and that solved the problem much quicker. They privated the video soon after so I didn't get to watch it, just saw the thumbnail.
- crtasm 3y ago
  Do you have the URL for it? The page at least may have been archived somewhere.
  - molticrystal 3y ago
    On the original thread they tweeted about people using brute force, then the next tweet after that is this [0]: >This thread is going viral, thank you all for the like and repost! Update on the password, they literally just shared the password in a video [0] https://twitter.com/zephray_wenting/status/1761738449965502686 https://twitter.com/zephray_wenting/status/17617384499655026...

by tyingq 3y ago

lolinder 3y ago

The article quotes the manufacturer as saying that even with the password there's basically no risk of the devices being misused: > The man who made the devices said there’s little someone inside could actually do with a hacked Securebook. They’d need to fashion a USB port, be able to install another operating system, and get access to a docking station, said Jeremy Schwartz, Justice Tech president. Even when the devices are docked, they’re not connected to the wider internet. It sounds like one very valid option they had was to just change the password as part of the regular maintenance and replacement schedule on the very reasonable assumption that no one would be able to attach a USB port to their laptop within the confines of the prison.

teekert 3y ago
So the (over dramatic) decision was made by someone with little knowledge but with power and probably responsibility. That happens too often in this world.
tyingq 3y ago
The author didn't attempt it, but it seems pretty clear 4 of the pins on the exposed docking port would be a USB bus. So all you need really is a usb stick, some wires, and some patience. The particular connector used even looks like you could directly insert/wedge thin gauge wires, no soldering required on that end: https://imgur.com/a/7T3agdg https://imgur.com/a/7T3agdg

rvnx 3y ago

Which could have been handled gracefully over time without disturbance if the person would have responsibly just contacted the IT of the prisons, instead of publishing the method and password in the wild.

molticrystal 3y ago

>So someone eventually brute forced it Just a few hours after it was starting to be brute forced, I'm sure I saw somebody finding the password being used in youtube presentation, perhaps for a related model or bios setup, and that solved the problem much quicker. They privated the video soon after so I didn't get to watch it, just saw the thumbnail.

crtasm 3y ago
Do you have the URL for it? The page at least may have been archived somewhere.
- molticrystal 3y ago
  On the original thread they tweeted about people using brute force, then the next tweet after that is this [0]: >This thread is going viral, thank you all for the like and repost! Update on the password, they literally just shared the password in a video [0] https://twitter.com/zephray_wenting/status/1761738449965502686 https://twitter.com/zephray_wenting/status/17617384499655026...