After having recently purchased a home, I’ve been working on setting up some level of smart home automation/connectivity. One of the things in my list was the ability to control my air conditioning remotely using my phone, so I can get it running before I get home, have it turn off when I leave, etc. But how? System Overview There are 3 components in my very old Mitsubishi Electric HVAC system:…
My goal for this project was quite specific, leaving many details unexplored (for now). This post aims to be a quick reference for my future self, and to hopefully help anyone else who might be interested in doing something similar. No security is bypassed, no exciting exploits are used, and no dangerous backdoors are found. We will simply connect to the device and determine how it works using…
In this post: Known decapping methodologies Personal safety My experiments Tools and materials Failure: Sand down the packaging Limited success: Nitric acid + acetone bath Failure: Nitric acid + acetone syringe Failure: Nitric acid + acetone syringe + ultrasonic methanol bath Success: Nitric acid + acetone syringe + ultrasonic acetone bath Pointless: Bath the IC in room-temp nitric acid before…
We hosted a Halloween party for some friends last week, and I wanted to integrate my costume (whatever it was) with the house decorations. I only had a handful of evenings available to get everything up and running, so I had to build something just complex enough to entice guests to play with it. Preferably using parts I already had in the lab. Here’s the final product: This post describes the…
Part 1 : Hunting for Debug Ports Part 2 : Scouting the Firmware Part 3 : Following the Data Part 4 : Dumping the Flash Part 5 : Digging Through the Firmware In part 4 we extracted the entire firmware from the router and decompressed it. As I explained then, you can often get most of the firmware directly from the manufacturer’s website: Firmware upgrade binaries often contain partial or entire…
Part 1 : Hunting for Debug Ports Part 2 : Scouting the Firmware Part 3 : Following the Data Part 4 : Dumping the Flash Part 5 : Digging Through the Firmware In Parts 1 to 3 we’ve been gathering data within its context. We could sniff the specific pieces of data we were interested in, or observe the resources used by each process. On the other hand, they had some serious limitations; we didn’t have…
Part 1 : Hunting for Debug Ports Part 2 : Scouting the Firmware Part 3 : Following the Data Part 4 : Dumping the Flash Part 5 : Digging Through the Firmware The best thing about hardware hacking is having full access to very bare metal, and all the electrical signals that make the system work. With ingenuity and access to the right equipment we should be able to obtain any data we want. From…
Part 1 : Hunting for Debug Ports Part 2 : Scouting the Firmware Part 3 : Following the Data Part 4 : Dumping the Flash Part 5 : Digging Through the Firmware In part 1 we found a debug UART port that gave us access to a Linux shell. At this point we’ve got the same access to the router that a developer would use to debug issues, control the system, etc. This first overview of the system is easy to…
Part 1 : Hunting for Debug Ports Part 2 : Scouting the Firmware Part 3 : Following the Data Part 4 : Dumping the Flash Part 5 : Digging Through the Firmware In this series of posts we’re gonna go through the process of Reverse Engineering a router. More specifically, a Huawei HG533. At the earliest stages, this is the most basic kind of reverse engineering. We’re simple looking for a serial port…
Some time ago I recorded a slow motion clip of myself picking a cut-away lock. This kind of lock is used for lock picking practice, as it lets you see the pins and springs that make the lock work. In this clip we can see the racking method. Racking a lock is the Rambo approach to non-destructive lock picking: You jam a racking pick into the lock (half diamond, snowman, saw… Pretty much any pick…
Some time ago, I was testing mbed’s USBMouse and USBKeyboard, and used CookieClicker for the proof of concept. The idea of these libraries is that the microcontroller will tell the computer “Hey, I’m a mouse” or “I’m a keyboard”, and we will program it to send the key presses or movements we want. This can be used for all kinds of reasons, such as security attacks: “Hey, I’m a keyboard. Launch the…
For those of you who don’t know it, “memondo network” is the spanish company behind a bunch of websites for memes, funny gifs, etc. And they have, according to alexa, a quite large amount of traffic (a couple of their sites being in the top 3000 and in the spanish top 200). Well, a couple of days ago I found an XSS vulnerability in their search system with a curious attack vector, so let’s take a…
Using the widget QComboBox in Qt 4.8 is pretty easy, but the documentation can be a little bit confusing the first time you want to use it, so here is a quick example on how to use its basic features: #include <QtGui/QApplication> #include "mainwindow.h" int main ( int argc , char * argv []) { QApplication a ( argc , argv ); MainWindow * w = new MainWindow (); w -> show (); return a . exec (); }…