Day: May 3, 2016

I Am Satoshi Nakamoto

May 3, 2016 by 74 Comments

OK, you got me. I’m not. Neither is Dorian Nakamoto, pictured above, and neither is this [Craig White] guy. Or at least, his supposed proof that he is “Satoshi” doesn’t stand up to scrutiny. Indeed, you can re-create it yourself and pretend to be “Satoshi” too.

If you haven’t been following along, “Satoshi Nakamoto” is the person or group of people who invented Bitcoin, and who holds a decent fortune’s worth of the currency. He’s been exceedingly careful at keeping his identity secret. So much so, that upon hearing another “We Found Satoshi” story in the news, we actually laughed at our wife this morning. But then it was picked up by the BBC and is forthcoming in the Economist. Serious journalism.

Well, if you read the BBC piece, they note that “Security expert Dan Kaminsky said the procedure was almost ‘maliciously resistant’ to validation.” Hint: If Dan “DNSSEC” Kaminsky can’t verify a signature, there’s a good chance it’s not the real deal.

The really embarrassing part is that this [Craig White] character claimed to be Satoshi in December 2015. If he actually were Satoshi, who is probably a cryptographic genius, do you think it would take him five months to figure out a cryptographically sound way of proving his identity? Nope.

So here’s how he did it, according to [Patrick McKenzie]’s GitHub, linked above. There is a hashed secret out there that only “Satoshi” knows. Hashes are one-way functions; they produce a number that’s easy to calculate if you know the original data, but devilishly hard to work from the hash backwards to get the data out. This hashed value is public, and part of the blockchain, so we can be pretty sure that it hasn’t been altered.

[Craig] claimed to have some text from Sartre hashed with “Satoshi’s” key, and that this proves his identity. But instead of providing the hash of the Sartre text, [Craig] apparently substituted a hash from the blockchain. When this supposed Sartre hash is validated against the blockchain, of course, it works. In short, he swapped hashes, and people failed to notice.

So I’m not “Satoshi”, and neither is this guy. Who is? The mystery continues. And given how careful “Satoshi” has been so far, it’s likely to remain so for a long while. But one thing’s for sure, when “he” does choose to reveal himself, it won’t be difficult to verify. After all “Satoshi” knows “Satoshi’s” password.

Image via the BBC, of another guy who isn’t “Satoshi”.

(Late Edit: Here’s another really nice writeup, this one by [ErrataRob].)

Reverse Engineering An ATM Card Skimmer

May 3, 2016 by 47 Comments

While vacationing in Bali, [Matt South] walked into a nice, secure, air-conditioned cubicle housing an ATM. Knowing card skimmers are the bane of every traveller, [Matt] did the sensible thing and jiggled the card reader and the guard that hides your PIN when punching it into the numeric keypad. [Matt] found the PIN pad shield came off very easily and was soon the rightful owner of a block of injection molded plastic, a tiny camera, and a few bits of electronics.

The first thing that tipped [Matt] off to the existence of electronics in this brick of plastic was a single switch and a port with four contacts. These four pins could be anything, but guessing it was USB [Matt] eventually had access to a drive filled with 11GB of video taken from inside this PIN pad shield.

An investigation of the videos and the subsequent teardown of the device itself revealed exactly what you would expect. A tiny pinhole camera, probably taken from a ‘spy camera’ device, takes video whenever movement is detected. Oddly, there’s an audio track to these videos, but [Matt] says that makes sense; the scammers can hear the beeps made by the ATM with every keypress and correlate them to each button pressed.

Of course, the black hats behind this skimmer need two things: the card number, and the PIN. This tiny spy cam only gets the PIN, and there wasn’t a device over or in the card slot in the ATM. How did the scammers get the card number, then? Most likely, the thieves are getting the card number by sniffing the ATM’s connection to the outside world. It’s a bit more complex than sticking a magnetic card reader over the ATM’s card slot, but it’s harder to detect.

Atmel Removes Full-Swing Crystal Oscillator

May 3, 2016 by 56 Comments

It is one of our favorite chips, and the brains behind the Arduino UNO and its clones, and it’s getting a tweak (PDF). The ATmega328 and other megaX8-series chips have undergone a subtle design change that probably won’t affect you, but will cause hours of debugging headaches if it does. So here’s your heads-up. The full-swing oscillator driver circuitry is being removed. As always, there’s good news and bad news.

The older ATmega chips had two different crystal drivers, a low-power one that worked for lower speeds, and higher-current version that would make even recalcitrant crystals with fat loading capacitors sing. This “full-swing” crystal driver was good for 16 MHz and up.

The good news about the change is that the low-power crystal driver has been improved to the point that it’ll drive 16 MHz crystals, so you probably don’t need the full-swing driver anymore unless you’re running the chip at 20 MHz (or higher, you naughty little overclocker).

This is tremendously important for Arduinos, for instance, which run a 16 MHz crystal. Can you imagine the public-relations disaster if future Arduinos just stopped working randomly? Unclear is if this is going to ruin building up a perfboard Arduino as shown in the banner image. The full-swing oscillator was so robust that people were getting away with a lot of hacky designs and sub-optimal loading capacitor choices. Will those continue to work? Time will tell.

The bad news is that if you were using the full-swing oscillator to overcome electrical noise in your environment, you’re going to need to resort to an external oscillator instead of a simple crystal. This will increase parts cost, but might be the right thing to do anyway.

Whenever anyone changes your favorite chip, there’s a predictable kerfuffle on the forums. An Atmel representative said they can get you chips with the full-swing driver with a special order code. We’re thinking that they’re not going to let us special order ten chips, though, so we’re going to have to learn to live with the change.

The ATmega328 has already gotten a makeover, and the new version has improved peripheral devices which are certainly welcome. They don’t have the full-swing oscillator onboard, so you can pick some up now and verify if this change is going to be a problem for you or not. We don’t have any of the new chips to test out just yet.

Thanks to [Ido Gendel] for tipping us off to the change in our comment section! If you have any first-hand experience with the new chips, let us know in the comments and send in a tip anytime you trip over something awesome during your Internet travels.