Oracle CSO to Customers: Leave the Vulnerabilities to Us

[Mary Ann Davidson], chief security officer of Oracle, is having a bad Tuesday. The internet has been alight these past few hours over a blog post published and quickly taken down from oracle’s servers. (archive) We’re not 100% sure the whole thing isn’t a hack of some sort. Based on [Mary’s] previous writing though, it seems to be legit.

The TL;DR version of Mary’s post is that she’s sick and tired of customers reverse engineering Oracle’s code in an attempt to find security vulnerabilities. Doing so is a clear violation of Oracle’s license agreement. Beyond the message, the tone of the blog says a lot. This is the same sort of policy we’re seeing on the hardware side from companies like John Deere and Sony. Folks like [Cory Doctorow] and the EFF are doing all they can to fight it. We have to say that we do agree with [Mary] on one point: Operators should make sure their systems are locked down with the latest software versions, updates, and patches before doing anything else.

[Mary] states that “Bug bounties are the new boy band”, that they simply don’t make sense from a business standpoint. Only 3% of Oracles vulnerabilities came from security researchers. The rest come from internal company testing. The fact that Oracle doesn’t have a bug bounty program might have something to do with that. [Mary] need not worry. Bug Bounty or not, she’s placed her company squarely in the cross-hairs of plenty of hackers out there – white hat and black alike.

Cory Doctorow Rails Against the Effect of DRM and the DMCA

If you weren’t at [Cory Doctorow’s] DEF CON talk on Friday you missed out. Fighting Back in the War on General Purpose Computing was inspiring, informed, and incomparable. At the very lowest level his point was that it isn’t the devices gathering data about us that is the big problem, it’s the legislation that makes it illegal for us to make them secure. The good news is that all of the DEF CON talks are recorded and published freely. While you wait for that to happen, read on for a recap and to learn how you can help the EFF fix this mess.

Continue reading “Cory Doctorow Rails Against the Effect of DRM and the DMCA”

Ask Hackaday: Fixing Your Tractor Could Land You Behind Bars

It’s 9AM on any given Sunday. You can be found in your usual spot – knee-deep in wires and circuit boards. The neighbor’s barking dog doesn’t grab your attention as you pry the cover off of a cell phone, but the rustling of leaves by the back door does. Seconds later, several heavily armed SWAT officers bust in and storm your garage. You don’t have time to think as they throw your down on the cold, hard concrete floor. You’re gripped by a sharp stinging pain as one of the officers puts his knee in the square of your back. Seconds later, you’re back on your feet being lead to the back of an awaiting police cruiser. You catch the gaze of one of your neighbors and wonder what they might be thinking as your inner voice squeaks: “What did I do wrong?”

The answer to this question would come soon enough. Your crime – hacking your dad’s tractor.

“That’s like saying locking up books will inspire kids to be innovative writers, because they won’t be tempted to copy passages from a Hemingway novel.”

-Kyle Wiens

John Deere is trying to convince the Copyright Office that farmers don’t really own the tractors they buy from them. They argue that the computer code that runs the systems is not for sale, and that purchasers of the hardware are simply receiving “an implied license for the life of the vehicle to operate the vehicle.”

In order to modify or “hack” any type of software, you have to copy it first. Companies don’t like the copying thing, so many put locks in place to prevent this. But because hackers are hackers, we can easily get past their childish attempts to keep code and information out of our hands. So now they want to make it illegal. John Deere is arguing that if it is legal for hackers to copy and modify their software, that it could lead to farmers listening to pirated music while plowing a corn field. No I am not making this up — dig into this 25-page facepalm-fest (PDF) written by John Deere and you’ll be just as outraged.

Trying to keep hackers out using the DMCA act is not new. Many companies argue that locking hackers out helps to spur innovation. When in fact the opposite is true. What about 3D printers, drones, VR headsets…all from us! The Copyright Office, after holding a hearing and reading comments, will make a decision in July on whether John Deere’s argument has any merit.

Let us know what you think about all this. Can hackers and the free market learn to live in harmony? We just want to fix our tractor!

Thanks to [Malachi] for the tip!

Hardware “Security” and a DMCA Takedown Notice

tektronix-autoLast week we published a post about how it was discovered through trial and error that Tektronix application modules are designed with laughable security. We’ll get to that part of it in a minute. We received a DMCA Takedown Notice from Tektronix (which you can read after the break) demanding that we remove the post. We have altered the original post, but we believe our coverage of this story is valid and we don’t agree that the post should be completely removed.

First off, Tektronix sells the modules to unlock the features already present on the Oscilloscope in questions. We’re operating on the moral assumption that using these features without paying their asking price is wrong. If you want the features they’ve developed you should pay for them.

The real story here is that Tektronix designed a woefully weak system for unlocking these modules. Learn from this. If you’re ever designing a hardware key, don’t do it like this!

An EEPROM, a connector, and a plain text string of characters which is already published publicly on their website is all that is necessary to unlock these “crippled” features. Let’s just say that again: apparently every hardware key is the same and just uses a plain-text string found on their website which is not encrypted or obfuscated. If you were selling these keys for $2.99 perhaps this would be adequate, but Tek values these modules at $500 apiece.

If you were designing this system wouldn’t it be worth using an encryption key pair based on the serial number or some other piece of unique information? How do you think this should have been done? Leave your comment below.

Continue reading “Hardware “Security” and a DMCA Takedown Notice”

Petition for DMCA exemptions regarding Rooting/unlocking gadgets

So you’ve been rooting devices eh? If you get caught you’re headed for the big house, the lockup, the pen, the joint, they’ll send you up the river, you better be careful! Seriously though, if you buy a device and circumvent the security features should that in itself be breaking the law? We’re not talking about stealing intellectual property, like playing copied games on a chipped system (yeah, that’s stealing). We mean unlocking a device so that you can use it for what you wish. Be it your own prototyping, or running open-source applications. Unfortunately if the current Digital Millennium Copyright Act exemptions expire it will be a crime.

Thankfully, [Bunnie] is doing something about this. You may remember him as the guy that found most of the ridiculous security holes in the original Xbox, or the brain behind the Chumby. Now’s he’s got an online petition where your voice can be heard. Speak up and let the US politicians know why unlocking a device isn’t a crime.

[via Twitter]

Thingiverse Receives First DMCA Takedown

A landmark in home 3d printing was set when [Dr. Ulrich Schwanitz] sent a DMCA takedown notice to Thingiverse.com on users [artur83] and [chylld’s] takes on his Penrose triangle model. ([chylld’s] take is pictured above) While the takedown itself is highly debatable, we do think it’s cool that home 3d printing has come far enough to begin infringing on the copyrights of objects themselves. Right now media pirating has the front stage, but it’s not hard to look a little further into the crazy sci-fi universe that is our future and see a battle being fought over the rights to physical objects.

[via Thingiverse Blog]

TI-nspire hacked

The regulars at the United T1 forums keep them coming, this time hacking the Texas Instruments Nspire graphing calculator. We enjoy seeing the exploits that unlock the backend of these types of devices. The difference this time is that the hacking continues even though Texas Instruments has shown that it intends to protect the security of their devices using the DMCA. The Nspire thread linked above discusses the DMCA concerns just a bit but it seems obvious to us that running your own code falls under the umbrella of the act. The exploit package hasn’t yet been posted, but if you want it make sure you check back regularly before the take-down order comes in from TI.

[Thanks Iceman]