Simple age check for Linux:
Just have the shell ask the user to check the host IP on first boot.
If they type ifconfig they are old enough, if they type ip they deserve to be restricted from their computer 😇
Remote
stacksmashing
@stacksmashing@infosec.exchange
mastodon 4.8.0-alpha.3+glitchI'm an IT security researcher, and sometimes I make videos about that!
Contact: contact@stacksmashing.net
2458 Followers
88 Following
47 Posts
Joined November 08, 2022
YouTube:
My DEF CON talk "Hacking jetskis - from Sea-Don't to Sea-Doo" got accepted 🥳
We'll be having some good fun - such as bypassing the immobilizer using a custom Flipper Zero app, building a custom diagnostic adapter, and some big plot-twists 🛥️
Non-technical teams are now shipping production vulns
Option A: Upgrade iPhone to iOS26 and have to use liquid glass
Option B: Get pwned by DarkSword malware
I don't know which one is worse
This guy doesn’t even use AI for bug hunting 🙄
Boosted by @RustyCrab@clubcyberia.co
Yes VSCode, I obviously want to use the color-picker to edit my address offsets in Arm assembly 😂
No JLC, component placement is not correct 😂
Sometimes it’s nice to go back to basics:
Built firmware that’s just 246 bytes, uses no RAM at all, and runs parasitically from a 1-wire bus at just 0.2 mA.
Yet it emulates a full jetski key!
You can see voltage rising until the chip starts running based on the BOD threshold.
If the datasheet says to use tantalum capacitors - then use tantalum capacitors!
Blue = Ceramics
Yellow = Tantalum
Won today’s bet of “Do I really have no oil pressure, or is the gauge just broken?” 😆
Replying to
9d3e36fc632d77f24c810cb89892dd1959dfb05b output.bin
(Created from multiple dumps, something is messing with the signal)
If you ever lose the keys to your older Sea-Doo Jetski you might find these bytes useful when talking to the ECU😇
95 BC 2F 02 04 A4 75 BE
Things I didn’t see coming: apparently I own a Game Boy signed by a Eurovision contestant?! 😆
LOOK MUM NO COMPUTER - Eins, Zwei, Drei - Official Music Video
Wow, used Yamaha 01V96 are a steal - and 17 motor faders are a lot of fun 😀
Told someone their "vulnerability report" is bs (result of an automatic scanner that has a false positive...)
This was the response 😑
Replying to
For those playing along at home: Preliminary flash pin-out!
13 - SPI Flash CLK
16 - SPI Flash DI / MOSI
18 - SPI Flash DO / MISO
19 - SPI Flash VCC
20 - SPI Flash CS
Fancy, board-house sent me x-rays of my PCBs!
Replying to
Now, the question we've all been wondering: Which microcontroller did they use this time?
It's the NRF52840 - a chip very similar to the one in the first AirTag - and that, at least in earlier revisions, is vulnerable to the same fault-injection attack!
Time to dive in!
Replying to
Numbered the test-pins on the back of the device - let's try to document the signals!
Replying to
The PCB is suuuper sensitive. I ripped off three pads so far... To get to chip-select I had to solder onto the tiny tiny tiny via barrel😵💫
Replying to
Pulled off the flash and soldered on some magnet-wire on all of the pins to get a decent pin-out. This stuff is smol! 🤏
Opposite of solder-pr0n: Messed up the stencil solder application and was hoping for surface tension to fix it for me 🥲
The expired paste probably didn't help either
Replying to
@notbobbytables@infosec.exchange @CanLehmann@mastodon.social deprecated but not forgotten 🤘
My first post on the RaspberryPi Blog 😍
We've extended the RP2350 side-channel hacking challenge to April 30 - and even better: To make attacks for the challenge easier, we decided to disable the random chaffing and some more mitigations!
https://www.raspberrypi.com/news/rp2350-hacking-challenge-2-less-randomisation-more-correlation/
Replying to
But there's at least something to dump - the SPI flash chip seems to be a Winbond W25Q64
Replying to
Not much new on the backside! The accelerometer (black blob on top) seems to still be there, and otherwise just caps.. And a lot of test-points that look quite similar to the ones from the first AirTag (see second picture of the first generation by Colin O'Flynn)
Replying to
My first issue: I couldn't get the battery cover removed! Instead I used an x-acto knife to just cut out the entire battery assembly 😵💫
Impatient? Me? Never!
Replying to
On the other side we have again have a plastic cover - and we can already see the UWB shine through (the silver thing) and a nice antenna connection!
Replying to
Now interestingly this chip variant - CKABD0 - does not appear in the official datasheet.
Package variant: CK (WLCSP)
Function variant: AB - not listed in the datasheet
Hardware revision: D
Production device identifier: 0
Likely that this version has enhanced AP protection 😭
Replying to
@tavisco@bolha.us This one I know from way back - the iPod firmware used to have that in it too!
Replying to
@DF3LX@social.darc.de I haven't measured it yet - but the directional effect is very very noticable. The antenna is just a random cheap one.
I was frustrated with all nRF-based BLE sniffers that I could find only having not-so-great chip-antennas.
Even with a 2.4GHz stub-antenna this one performs sooo much better
Replying to
@G33KatWork@infosec.exchange typing Perl gets you a 20% discount on your next colonoscopy
@drwho@masto.hackers.town Ah if you mean the thing underneath: That's a PCbite set
Replying to
@r3pek@mastodon.r3pek.org @yetzt@social.yetzt.me Only happens in some browers/tabs for me
If the sandbox escape was so advanced then publish the details.
Replying to
(It works on some browsers but not in others)
Replying to
@tavisco@bolha.us @draconigen@packmates.org There's nothing from the old iPod firmwares in there :) I think it's just a nice easter-egg