Comments on: Silicon hacking

By: Mike

Mike — Tue, 13 Oct 2009 00:35:44 +0000

All I want to know is how to read/write the laundry card I have. Once I fill it up with like 10$ I want to be able to do a memory dump, and rewrite it everytime i want to do laundry. Why would I have to mess around with acids and stuff ?

By: Steve DiRaddo

Steve DiRaddo — Wed, 16 Jul 2008 03:48:45 +0000

its awesome stuff like this that make me laugh a the proposal of nagra3

theres nothing you can do that we can’t undo

By: chris tarnovsky

chris tarnovsky — Tue, 03 Jun 2008 07:20:17 +0000

Mike, what would you like to do? Using a second needle, I could take over the CPU’s decoding area and make it single step it’s code rendering every address onto the tip of the other needle. Do this 8 times and I have the full dump.

What else…Hrmmm… Study the code and understand how the UART works incase I don’t know ISO7618 but knew where VCC,RST,CLK,IO,GND were but didn’t understand their protocol… It’s clear in the code where a transmit and receive routine is from the software side of things..

As well, let’s say I write a small script and using a single needle, I wait until clock period n in time and change the instruction. Using this method (the preferred by myself), I can introduce a series of glitches into the software contained inside to maybe overwrite the stack, abuse a readout loop, force a bad signature good, and so on.. Anything imaginable is possible. Complete control with a single needle.

Make sure you come to Blackhat/Defcon for more of a hands-on!

By: mike

mike — Mon, 02 Jun 2008 21:54:39 +0000

"O.k., now that we're 'in', what do we do now?" -A hex dump is pretty useless unless you know what is what. I doubt the manufacturer is going to give you the memory map, register's, or anything else for that matter. And, when you tied into the clock/data line, were those not already bonded out?

"You can do anything you want". (skeptical).

By: Chris Tarnovsky

Chris Tarnovsky — Mon, 02 Jun 2008 05:23:52 +0000

Hi everyone!

Always nice to see positive comments. I will try to do more blogging. I've been overwhelmed with the stresses of work (which is a good thing).

fyi- I need to eventually get around to blogging on a few things: the Intel 4004 (nice hires images of a piece of history), some C64 devices, a declassified NSA cryptographic link controller, and a few other things that have come in.

Thanks to those who have contributed. I will find the time!

-Chris

By: anomaly95

anomaly95 — Sun, 01 Jun 2008 13:37:02 +0000

I love reading the stuff on flylogic. but he hasn’t posted much in the last 2 months.

By: edenist

edenist — Sun, 01 Jun 2008 10:18:34 +0000

Hydrofluoric acid…… wow, thats nasty stuff alright!

Very nice technique though! although I think its a bit extreme for a home job.

By: Will

Will — Sun, 01 Jun 2008 08:05:26 +0000

So you can read the information on the smart card?

Could you use this to create false credentials to log into a computer as a local administrator?

This sounds pretty dangerous, if misused. You can disable starting from Optical Drives and USB in order to defeat intrusion by way of live distributions, but it seems that for computers that require Smart Card logon you're pretty much left wide open here.

By: alex mccown

alex mccown — Sun, 01 Jun 2008 07:03:01 +0000

does any one else think that ICs evolved to fast? i mean not to long ago we were using pcbs with tones and tones of can transistors and not to long b4 that we were useing tubes

By: Bp

Bp — Sun, 01 Jun 2008 06:49:40 +0000

sweet