10 ms·
Can you get root with only a cigarette lighter?
- QuiDortDine 2y agoYou know when your employee quits how you have to block all their accounts? Now imagine they have access to the server room!
- pantulis 2y agoAnd that's why server rooms should have proper physical security.
- appendix-rock 2y agoAnd why “they’ve got physical access, so all bets are off” isn’t an excuse to stop trying
- yjftsjthsd-h 2y agoI don't follow; isn't this proof that physical access does trump everything else?
- amelius 2y agoAnd be wrapped in tinfoil.
- 0xdeadbeefbabe 2y agoThis kind of work can't be done under pressure at least not a PoC.
- hinkley 2y agoI find the idea of being escorted out of the building after giving notice a bit insulting. I’ve been interviewing for weeks, I’ve probably been holding this piece of paper since last night when I printed it out at home. I’ve had plenty of time to fuck with things before I told you I was leaving. You’re just screwing over my coworkers by taking access to me away with zero notice.
- mimentum 2y agoI read this wrong.
- CartwheelLinux 2y ago>I only want glitches to happen on-demand, not all the time. >My injected ELF also flushes the page cache The difference between a padawan and a jedi Amazing write up and bonus points for the reproducibility of this creativity.
- jojobas 2y agoBack in the day of analog electronic locks a piezo zap into the lock case would unlock 4 out of 5 apartment building locks, root access IRL.
- zephyreon 2y agoMy immediate thought was that this was a post about how someone got root access to a cigarette lighter and I was totally ready to believe it. My parents oven gets regular software updates so I didn’t even question whether the cigarette lighter was “smart.”
- onionisafruit 2y agoFrom the title I half expected an incendiary version of rubber hose cryptography.
- deleted 2y ago[deleted]
- sim7c00 2y agoooh i want a smart lighter, so i can use my phone in one hand to light the lighter in the other hand :O
- medstrom 2y agoSell pyromaniacs this product, find the lighter two months later in a burned-out building, use it to identify which phone did it, catch perp.
- deepspace 2y agoWell, the soldering iron I use most often has modifiable firmware running on a RISC-V SOC. (https://pine64.com/product/pinecil-smart-mini-portable-soldering-iron/ https://pine64.com/product/pinecil-smart-mini-portable-solde...) Who knew that melting lead could be that complicated. So I would totally believe an article about rooting a lighter.
- Lockal 2y agoI thought they are calculating square roots using the shape of flame...
- Nevermark 2y agoSo ... a lighter with a little solar panel, and a battery, which generates sparks like a tiny taser when the lidar detects a suitably proximate cigarette or cigar. But not a finger or hot dog. No button pushing. No lighter fluid refilling ... ever. The world waited a long time for this. And obviously it needs a chip to run the lidar, and generate the simultaneous brilliant LED flash and fade, haptic jolt, and accompanying sound effects. (Can some demo freak please create this? And make it look like a little revolver? But for finger and hot dog safety, you are going to have to harden the virtual memory controller...)
- ano-ther 2y agoSure, if you solder an antenna to your memory first :-) But good and thorough write-up about how to actually exploit such a glitch. And you could also use the cigarette lighter for hanging out at the data center back door and wait until the admin comes for a smoke.
- Retr0id 2y ago> This should theoretically work with bit-flips in any bit position between 29 [...] and 12 [...] Therefore, soldering the antenna wire perhaps isn't totally necessary, if you can generate strong enough electromagnetic interference
- abound 2y agoMentioned elsewhere in this thread, but you need not only "strong" but "highly directed" electromagnetic interference. Each of those pins is ~0.5mm, flipping a single bit "wirelessly" is probably impossible, as your inference will cause issues in many more places than just your target. Maybe that unlocks different and exciting hacks, maybe it just melts your machine.
- hardburn 2y agoDown in the "practical use" section, one use case is bypassing copy protection on consoles.
- vessenes 2y agoI like this. Upshot - electrostatic bit flip on memory read or write, which with solder can deterministically get a 'safe' pointer mutated into your own evil pointer. Generally the historical perspective on physical access was: "once they have it, game over." TPM and trusted execution environments have shifted this security perspective to "we can trust certain operations inside the enclave even if the user has physical access." His next steps are most interesting to me -- can you get something (semi-) reliable without soldering stuff? My guess is it's going to be a lot harder. Lots of thought already goes into dealing with electrical interference. On the other hand, maybe? if you flip one random bit of a 64 bit read every time you click your lighter, and your exploit can work with one of say 4 bit flips, then you don't need that many tries on average. At any rate, round 2 of experimentation should be interesting.
- onionisafruit 2y ago> if you flip one random bit of a 64 bit read every time you click your lighter Without the antenna it would be hard to limit it to a single bit getting flipped. At least that’s what I suspect.
- Retr0id 2y agoOn the flip-side (heh) flipping multiple bits at once should make it possible to bypass ECC
- Lance_ET_Compte 2y agoYou'd likely take an exception for a multi-bit error and the handler would likely just retry the read. Single-bit errors are often just corrected on the fly by ECC logic as you mention.
- echoangle 2y agoIf you can induce enough correct errors (yes that is contradicting), the ECC won’t be able to detect the error because the modified data is correct again. The ECC schemes I’ve seen used can correct 1 bit and detect 2 bit error, so 3 flips at the right position would be enough to get new data that would be valid again.
- intothemild 2y agoThis reminds me of exploits we used to do to arcade cabinets back in Sydney in the 80's and 90s. The school gas heaters used to have what we called "clickers", piezoelectric ignition devices you could remove from the heaters. You then took that clicker to your local arcade, and clicked one of the corners of the CRT, that would send a shock through the system and add credits to your game. I believe this was because the CRT was grounded on the same ground lines that the mechanism for physically checking a coin had gone through the system. Suffice to say, they caught onto this over time, and added some form of an alarm into it. But up until then... Those were truly the best times.
- chasd00 2y agoThis brings back a vague memory of smacking the side of a pinball machine just right and getting a free game. I bet it was the same concept.
- devmor 2y agoYou were likely causing the spring-loaded mechanism that detects a coin insertion to make physical contact.
- wgrover 2y agoYup - the first few minutes of one of Technology Connections' videos on electromechanical pinball machines shows this mechanism in action: https://www.youtube.com/watch?v=E3p_Cv32tEo https://www.youtube.com/watch?v=E3p_Cv32tEo
- intothemild 2y agoI imagine (with zero research) that the mechanism for adding credit would be the coin goes through a slot, and either itself completed a circuit, or the coin as it travels moves some lever to complete a circuit. So I imagine if you hit the machine just right, you'd also move that lever.
- candlemas 2y agoJust like The Fonz.
- ballenf 2y agoThe inspiration here was getting root on the Switch 2. Getting root in Linux was the POC. The goal was not demonstrating some fundamental security vulnerability that's practically exploitable, but instead for reclaiming actual ownership of one's own hardware without breaking TPM or game ring 0 anti-cheat.
- karlgkk 2y agoI appreciate the sentiment, but I suppose don't understand the point. 20 years ago, when consoles were powerful computers sold at a loss or low margin, it made more sense. Now though, Nintendo sells their consoles at a profit (and the Switch 2) is likely to be the same. This is impressive, and I'm glad people are working to preserve software freedom, but I'd rather just support the alternatives. Why give them the perceived install base, and profit? Why not get a steam deck or one of the many other handhelds that you have - day 0 as a feature - root access on?
- mgaunard 2y agoPeople tend to care about the games, and buy whatever platform those games run on, not the other way around.
- lupusreal 2y agoAd avoidance is a good solution to caring about the games. You can't covet the product if you don't even know it exists. With Nintendo games in particular, it helps that Nintendo is the kind of asshole corporation that copyright strikes third parties showing off their games online. That makes it even easier to not know what their games are.
- consteval 2y agoNintendo doesn't necessarily need advertising, because their franchises are so strong. I think people know there's gonna be a new Mario Party, or new Mario Kart, or new 3D Mario game, and they'll buy them if they like those games. Odds are if you like Mario Party 8 then Superstars will be right up your alley. Nintendo also has the somewhat unique position of being the only one providing high-quality games in a variety of categories. If you want a couch racing game, you're playing nintendo. If you want a 3D platformer, you're playing nintendo. If you want a couch party games, you're playing nintendo. In fact if you want couch co-op at all you're playing nintendo, pretty much everyone else gave it up because you lose money.
- adrian_b 2y ago... "Finally, I'd like to thank JEDEC for paywalling all of the specification documents that were relevant to conducting this research."
- roymurdock 2y ago"It's just one resistor (15 ohms) and one wire, soldered to DQ26. The wire acts like an antenna, picking up any nearby EM interference and dumping it straight onto the data bus." really neat hack. using the lighter to create EM interference. better go light up next to my DDR bus and see what happens :)
- mikewarot 2y ago>Can You Get Root with Only a Cigarette Lighter? No, you can't. That long lead to couple your ersatz pulse generator defeats all the engineering put into making the computer reliable and quiet in the EMI sense. Circuit bending is fun stuff, but it's not a remote exploit.
- jasongill 2y agoWhere in the article does he say this is a remote exploit?
- _joel 2y agoThe old saying of "if you've got physical access, game over", is where this applies.
- RIMR 2y agoThis guy literally got root using a cigarette lighter, and your attempt to debunk it is to suggest that physical exploits don't count? If you only care about remote exploits, fine, but don't go scolding others for accomplishing things you can't.
- mikewarot 2y agoDo it without the precisely connected wire, and then you can say "only a cigarette lighter" as mentioned in the title, otherwise it's click-bait
- Pikamander2 2y agoWhen I saw the title, I was expecting this to be about hacking a modern car with one of those USB-C cigarette lighter devices.
- KolmogorovComp 2y agoJust wanted to say it was an amazing write-up.
- smcl 2y agoI reckon you can get a root with just a cigarette lighter if you hang around outside the right bars in Australia
- Stefan-H 2y agoAnd worst case there is always the rubber hose.
- twelve40 2y ago...or a $5 wrench
- jacobgkau 2y agoI think you misunderstood the Australian slang. That person was not referring to the XKCD concept. They were referring to another meaning of the word "root."
- Stefan-H 2y agoHa! Thanks for the elucidation. My assumptions around the GP did include the assumption of sex, but it was more in a honeypot context rather than as an end in an of itself.
- smcl 2y agoHaha well you were at least thinking along the right lines! Yeah so "root" in Australian slang refers to having sex.
- mensetmanusman 2y agoNext, a balloon and carpet!
- sim7c00 2y agosocks! and kickng device thru the room!
- _joel 2y agoNice trick, now do it with cosmic rays!
- i4k 2y agoThis was very well written and an amazing challenge but my brain is wired to that "hacking common sense" that if you have physical access then it's already over... the first thing that came to my mind was that, if you have physical access, then you can reflash the BIOS, install a driver backdoor, you can boot a live OS and then it's just a matter of tampering /etc/{passwd,shadow,groups, etc} ... but I remembered that most of the physical access hacks would not be possible if the disk is encrypted.. which then makes this kind of hack enormously attractive. The antenna idea can be extended to be a piece of hardware with the interference device built-in (piezo or whatever) which communicates with the external world with any wireless medium and then the attacker can trigger the interference remotely. This, plus a website controlled by the hacker which the victim is scammed to visit can be enough to make it viable.
- 333c 2y agoThe motivation in the introduction is rooting/jailbreaking a handheld game console. I think this is a perfectly plausible situation where you have physical access but still want to obtain "unauthorized" access.
- i4k 2y agoI get it, makes sense
- johnisgood 2y ago> I remembered that most of the physical access hacks would not be possible if the disk is encrypted.. Only if you have not booted into your system through using a keyfile or a passphrase to decrypt the data, i.e. if your PC is shut down. I have full disk encryption, and when I boot into my system, it uses the keyfile with which it would perform the decryption, and boom, I have my PC ready to be accessed physically.
- causal 2y agoWould flashing BIOS post-boot really work though? Also don't see how the article's exploit would be useful pre-decryption.
- m3kw9 2y agoI’m gonna do one with “ Can You Get Root With Only my bare hands?”
- _trampeltier 2y ago2 days ago https://news.ycombinator.com/item?id=41748861 https://news.ycombinator.com/item?id=41748861
- mmsc 2y agoNot only is it a fun exploit, this is also a cool mini-introduction to how caching works for CPUs. I remember a year ago or so there was a submission here which detailed how computers work and are build starting at the tiniest part: starting with logic gates, IIRC. Anybody remember what that website was?
- treflop 2y agoI thought OP was going to do this without soldering anything. But I feel like soldering something is no different than just like splicing a telephone cable in half and putting your own headset in the middle… Except instead of putting a headset, you crudely use a lighter…
- drilbo 2y agoI'm looking forward to your write up on getting root with a headset
- antaviana 2y agoI thought this was about getting the root password by burning the sysadmin with a cigarette lighter (https://xkcd.com/538/ https://xkcd.com/538/)
- sim7c00 2y agofun read. wonder if someone can do it with one of those lemon batteries, u know.. when life gives u lemons... get root!
- pantalaimon 2y agoThree men on a boat. With four cigarettes, but no lighter. How are they going to smoke?
- _ache_ 2y agoI followed him on mastodon, the article is cool too. On Mastodon, there is a video of the root access where one can see the screen. https://mastodon.xyz/@retr0id@retr0.id/113252910481164528 https://mastodon.xyz/@retr0id@retr0.id/113252910481164528
- rcakebread 2y agoJust burned my sysadmin with a lighter. The root passwrod is "OWWhAThtefuck'.
- sfc32 2y agoI read it as "Can you get A root with only a cigarette lighter?"
- oluckyman 2y agoDepends how desperate for a smoke the other person is.
- einpoklum 2y agoI can get root with only a spoon! However, I'm not sure the kind of root you want unless you're into horticulture.
- echoangle 2y agoCan someone explain why the EMI would cause a Bitflip and not always a high read? Why would a pulse invert the signal that’s read? Don’t the voltages effectively get added?
- amenghra 2y agoIt depends on how the analog signal is encoded. In some protocols, a 1 is encoded as high-then-low and 0 is encoded as low-then-high.
- echoangle 2y agoAh good point, I was assuming simple TTL where signal level is the bit that’s transferred, RAM is probably using something more complex
- missinglugnut 2y agoYou need to think of EMI as having a magnitude and a direction. Half the time you are adding a negative voltage.
- echoangle 2y agoSince he’s using a Piezo lighter, shouldn’t it be just a single DC pulse like discharging a capacitor?
- missinglugnut 2y agoI was confused on the lighter type so I deleted that part of my response. I think you're correct but I can't say for sure.
- james_a_craig 2y agoEven your example of discharging a capacitor can end up with a pulse both directions, caused by the inductance of the wires. In this specific situation, there's no common reference level, and so the induced pulse will go both directions. You can think of this as being about the edges of the pulse being the parts that actually cause radio to be transmitted, and there's both a positive-going edge and a negative-going edge on a pulse.
- tinix 2y agoreminds me of using a modified milty zerostat to use the spark gap to induce emp for glitching.
- sizzle 2y agoThis is the kind of content I come to HN for, thanks OP. Really mind blowing how talented some folks are. How long would it take someone to acquire these skills?
- metadat 2y agoWhat is the purpose of the "_" in "0x100_0000"? AFAICT, it doesn't change anything. >>> 0x100_0000 16777216 >>> 0x100_0001 16777217 >>> 0x1000001 16777217 >>> 0x100000_1 16777217
- sweeter 2y agoThis is so awesome! I just love this stuff, I hope that I can be at this level one day. Also I love how we're side-eyeing the switch 2 lmaooo thats bold considering Yuzu, Ryujinx and the 100+ YT creators Nintendo has either taken down or copyright struck this past week.
- King-Aaron 2y agoReading this as an Australian, it interprets differently. Yes, depending on your negotiation skills you can get a root with only a cigarette lighter.
- worthless-trash 2y agoOh, look at mr(s) attractive here..
- thomasfromcdnjs 2y agoThanks for the laugh - Fellow aussie
- lihaciudaniel 2y agoI wish i could root my redmi note 8 pro like this
- londons_explore 2y agoIf you wanted to defend a system from this, a big chunk of defence would be to choose a system with ECC, and then to halt() the whole system when an ECC error occurs. Since the attacker is very unlikely to flip the exact right bits to make ECC match, their exploit is very likely to be detected before it succeeds. halt() is necessary so the attacker cannot have more tries at it. Obviously you have the downside that real memory errors cause the system to crash.
- londons_explore 2y agoWould things like AMD's "Secure encrypted virtualization" protect against this? Is the data XORed with a key (therefore letting bitflips propogate) or is the data actually encrypted (meaning a bitflip in the input leads to a totally different address)
- otteromkram 2y agoCranky comment: Putting your code comments in line with the code is less readable than putting the comment on the preceding line. Most people get what you're going to talk about from the context.
- deleted 2y ago[deleted]
- AStonesThrow 2y agocsh% Got a light? No match. csh% sudo got a light? No match. csh% man 5 betteridge
- rbanffy 2y agoBefore reading the article, my approach would be so much darker… a bit of gasoline and a lighter can do wonders for the memory of a person who “forgot” a password. Might need duct tape and a chair as well.
- williamty689 2y ago[dead]
- burjui 2y agoApply the flame to the sysadmin's hand and get root access. I mean, it's a cool demo, but if you can solder crap to the hardware, might as well do anything that physical access provides normally. Like, you can just install the payload without the exploit.