Physical Security for Desktop Computers

There’s a truism in the security circles that says physical security is security. It doesn’t matter how many bits you’ve encrypted your password with, which elliptic curve you’ve used in your algorithm, or if you use a fingerprint, retina scan, or face print for a second factor of authentication. If someone has physical access to a device, all these protections are just road bumps in the way of getting your data. Physical access to a machine means all that data is out in the open, and until now there’s nothing you could do to stop it.

This week at Black Hat Europe, Design-Shift introduced ORWL, a computer that provides the physical security to all the data sitting on your computer.

The first line of protection for the data stuffed into the ORWL is unique key fob radio. This electronic key fob is simply a means of authentication for the ORWL – without it, ORWL simply stays in its sleep mode. If the user walks away from the computer, the USB ports are shut down, and the HDMI output is disabled. While this isn’t a revolutionary feature – something like this can be installed on any computer – that’s not the biggest trick ORWL has up its sleeve.

ORWL2The big draw to the ORWL is a ‘honeycomb mesh’ that completely covers every square inch of circuit board. This honeycomb mesh is simply a bit of plastic that screws on to the ORWL PCB and connects dozens of electronic traces embedded in this board to a secure microcontroller. If these traces are broken – either through taking the honeycomb shell off or by breaking it wide open, the digital keys that unlock the computer are erased.

The ORWL specs are what you would expect from a bare-bones desktop computer: Intel Skylake mobile processors, Intel graphics, a choice of 4 or 8GB of RAM, 64 to 512GB SSD. WiFi, two USB C ports, and an HDMI port provide all the connections to the outside world.

While this isn’t a computer for everyone, and it may not even a very large deployment, it is an interesting¬†challenge. Physical security rules over all, and it would be very interesting to see what sort of attack can be performed on the ORWL to extract all the data hidden away behind an electronic mesh. Short of breaking the digital key hidden on a key fob, the best attack might just be desoldering the chips for the SSD and transplanting them into a platform more amenable to reading them.

In any event, ORWL is an interesting device if only for being one of the few desktop computers to tackle the problem of physical security. As with any computer, if you have physical access to a device, you have access to all the data on the device; we just don’t know how to get the data off one of these tiny computers.

Video below.

Continue reading “Physical Security for Desktop Computers”

Tales from the Hackaday “tip line”

surprisingly accurate portrayal of Caleb

Lets just start right off and acknowledge that the word “Hack” is in our site name. We all see it. It is right there, in plain English. However, anyone who spends more than a few nanoseconds looking down below that big name, will quickly see that the kind of hacking we do is more like McGyver and less like Operation Swordfish.

This exceedingly obvious point is missed by many, many people. We get tons of requests coming in for various acts of hackery. They range from nonsense gibberish to flagrant lies. Yeah, sure you forgot your password and the recovery system isn’t working. Oh they stole your website but you can’t prove that you’re the owner? Hrm, you want to be a master hacker and are seeking our guidance on how to steal money?

Join me after the break for a few actual examples.

Continue reading “Tales from the Hackaday “tip line””

Smartphone anti-virus software


With DEFCON and Black Hat going on, a lot of security issues are being made public. This year, cellphones have been a larger target than before. More and more people are carrying complex smartphones that have more ways to go wrong. Even worse, since phones are tied to a billed account, it is possible for malicious software to charge phones discreetly. However, Flexilis promises to keep your phone safe. It’s a free mobile anti-virus that works on most smartphones and PDAs with more clients in the works. It also provides easy backup and recovery options, as well as the ability to wipe the phone if it’s lost. The phone makers really need to fix the probelms, but in the meantime Flexilis can provide a quick response.

[via WSJ Digits]

Defcon 17: Badge details released


Defcon is upon us once again, and that can only mean one thing: new badge designs. Our friends over at Wired posted the picture above along with a description of this year’s new badge. Since our last post, there has been little new information released regarding the components used for the new badge. However, we now know that it utilizes a microphone and a full color LED along with the Freescale mc56f8006, an¬†advanced digital signal processing microcontroller. [Grand], the badge designer, told Wired that while this year’s design is a bit simplified compared to last year’s design, it is not nearly as easy to hack. Just like last year, the functionality of the badge hasn’t been announced yet. We’re hoping for some kind of communicator. Be sure to check out Wired’s article if you want to see the high res pictures.

Black Hat 2009: Parking meter hacking

For day two of Black Hat, we sat in on on [Joe Grand], [Jacob Appelbaum], and [Chris Tarnovsky]’s study of the electronic parking meter industry. They decided to study parking meters because they are available everywhere, but rarely considered from a security perspective.

Continue reading “Black Hat 2009: Parking meter hacking”

Black Hat 2009: Breaking SSL with null characters

Update: The video of [Moxie]’s presentation is now online.

[Moxie Marlinspike] appeared on our radar back in February when he showed sslstrip at Black Hat DC. It was an amazing piece of software that could hijack and rewrite all SSL connections. The differences between a legitimate site and the hijacked ones were very hard to notice. He recently stumbled across something thing that makes the attack even more effective.

Continue reading “Black Hat 2009: Breaking SSL with null characters”

Black Hat 2009: Powerline and optical keysniffing


The 2009 edition of the Black Hat security conference in Las Vegas has just begun. The first interesting talk we saw was [Andrea Barisani] and [Daniele Bianco]’s Sniff Keystrokes With Lasers/Voltmeters. They presented two methods for Tempest style eavesdropping of keyboards.

Continue reading “Black Hat 2009: Powerline and optical keysniffing”