Recent content on something from nothing
Bitsquatting has fascinated me for a while. Most of the published work looks at it from the outside: researchers register squatting domains or inspect DNS/query data and then study the traffic that shows up. I am more interested in the earlier question: why do these requests end up in the wrong place in the first place? We know it happens. The more interesting question is why. Introduction If the…
Laser engravers are usually built around a pretty static workflow. You prepare the artwork, import the file, preview it, hit start, and let the machine do its thing. BeamInk does the opposite. It turns a drawing tablet into a live drawing controller for an xTool F1. Live engraving with lasers As far as I can tell, I have not come across anyone else building this exact end-to-end setup before. That…
Microphones are everywhere: smartphones, IoT devices, and so forth. Speakers can be used as microphones too. But what is even more ubiquitous than either of those? Piezo buzzers. They are literally everywhere: smoke detectors, thermostats, electric kettles, fridges, washing machines, computers, and the list goes on. This post is about finding out whether piezos can be used as microphones.
Antenna design is one of those witchcrafts you either know how to do, or you just don’t. I wanted to understand: is it possible to trade years of skill for a bunch of high-end GPUs, and brute-force functional antenna designs? Introduction Let’s start by addressing the elephant in the room. I know quite literally nothing about antenna design. I have a VNA and know how to measure the…
Every baseband enabled device ships with two computers, the one you interact with, and the one that quietly interfaces with the network on your behalf. That second one - the baseband - is usually the least visible part of the device and, arguably, one of the most critical. Introduction Over the past few years baseband research has finally started to get some airtime. Work like 5ghoul has shown…
Having played with access card readers for a fair while, I have always wondered why hasn’t anyone come up with a nice portable tool to check whether the readers are running Wiegand or OSDP. It would also be nice to get the used Wiegand framing, and baud rate and security configurations for OSDP. I took it upon myself to create such a tool. Introducing OSDPeek! Introduction Access control…
In Parts 1 and 2 we covered how to set up a private baseband RAN, build a bare-bones fuzzer, and gather all the data needed to triage the crashes it produced. In Part 3 we focus on the missing piece of the puzzle: baseband firmware — why you need to get hold of it and do at least some reverse engineering. At the end of the post we’ll walk through a few real-world examples of crash triage.
We’ll continue where we left off in Part 1 . We now have a functional RAN and a bare-bones baseband fuzzer. In this second instalment I’ll share what I’ve learned over the past years of fuzzing baseband chips in a variety of devices — from mobile phones to IoT gadgets, payment terminals, and ECUs. Initial headbanging It didn’t take long after starting baseband fuzzing to realise I was flying…
Baseband vulnerabilities have been a hot topic for a few years now. New tools, exploits and attacks have been steadily popping up. To make the research on the topic possible, you need a platform to do that on. This series of posts (this, Part 2 , Part 3 ) is attempting to be a bit more than just a tool, cool exploit or a new attack. It is a basic introduction to baseband LTE/5G as technology and…
Like Wu-Tang said: “C.R.E.A.M / Get the money, dolla dolla bill, y’all”. But how are these “dolla dolla bills” actually validated. Can you print your own money? Going again deep on technology literally no one talks about. Banknote validators. Introduction We’ve all seen them, maybe even interfaced with them, sometimes without even acknowledging them. Plastic…
RISC-V is here to stay. With the big boys joining alliance and companies like Renesas pushing out RISC-V based MCUs and SiPs, it is safe to say hardware hackers will start to see more and more RISC-V in devices. Unfortunately, this is not all good news. Things will get considerably more proprietary and custom, even if the ISA is open-source. This post explores my adventures in the RISC-V land and…
The espresso machine modifying scene is very active. The projects range from simple PID mods to full machine rebuilds like the awesome Gaggiuino project. Yet, for whatever reason, Flair lever machines have received very little hacker love from the community. So I took it upon myself to turn something extremely simple into something outrageously complex. This is.. The Frankenflair 58. Introduction…
Firmware encryption is becoming a common feature in modern devices. From a security standpoint, that’s welcome news. However, for anyone reverse engineering or testing device security, dumping firmware is often one of the first tasks — and encryption makes that task extremely challenging, if not impossible. So, why are we seeing more encryption? There are several reasons. New regulations,…