Breaking Smartphone NFC Firmware: The Gory Details

August 23, 2020 by Sven Gregori 2 Comments

Near-field Communication (NFC) has been around a while and is used for example in access control, small data exchange, and of course in mobile payment systems. With such sensitive application areas, security is naturally a crucial element of the protocol, and therefore any lower-level access is usually heavily restricted and guarded.

This hardware is especially well-guarded in phones, and rooting your Android device won’t be of much help here. Well, that was of course only until [Christopher Wade] took a deep look into that subject, which he presented in his NFC firmware hacking talk at for this year’s DEF CON.

But before you cry out “duplicate!” in the comments now, [Jonathan Bennett] has indeed mentioned the talk in a recent This Week In Security article, but [Christopher] has since written up the content of his talk in a blog post that we thought deserves some additional attention.

To recap: [Christopher] took a rooted Samsung S6 and searched for vulnerabilities in the NFC chip’s safe firmware update process, in hopes to run a custom firmware image on it. Obviously, this wouldn’t be worth mentioning twice if he hadn’t succeeded, and he goes at serious length into describing how he got there. Picking a brain like his by reading up on the process he went through — from reverse engineering the firmware to actually exploiting a weakness that let him run his own code — is always fascinating and downright fun. And if you’re someone who prefers the code to do the talking, the exploits are on GitHub.

Naturally, [Christopher] disclosed his findings to Samsung, but the exploited vulnerability — and therefore the ability to reproduce this — has of course been out there for a long time already. Sure, you can use a Proxmark device to attack NFC, or the hardware we saw a few DEF CONs back, but a regular-looking phone will certainly raise a lot less suspicion at the checkout counter, and might open whole new possibilities for penetration testers. But then again, sometimes a regular app will be enough, as we’ve seen in this NFC vending machine hack.

Continue reading “Breaking Smartphone NFC Firmware: The Gory Details” →

Eavesdropping On Satellites For Fun And Profit

August 20, 2020 by Dan Maloney 8 Comments

Geosynchronous satellites, girdling the Earth from their perches 36,000 km above the equator, are remarkably useful devices. Depending on where they’re parked, they command views of perhaps a third of the globe at a time, making them perfect communications relays. But as [James Pavur] points out in his DEF CON Safe Mode talk, “Whispers Among the Stars”, geosynchronous satellite communication links are often far from secure.

[James], a D. Phil. student in Systems Security at Oxford University, relates that his exploits rely on the wide areas covered by the downlink signals from the satellites, coupled with security as an afterthought, if it was even thought of at all by satellite service providers. This lackadaisical approach let him use little more than a regular digital satellite TV dish and a tuner card for a PC — off-the-shelf stuff that you’d really have to try hard to spend more than $300 on — to tap into sensitive information.

While decoding the digital signals from satellites into something parseable can be done with commercial applications, [James] and his colleagues built a custom tool, GSExtract, to pull data from the often noisy signals coming down from on high. The setup returned an amazing bounty of information, like maritime operators relaying the passport information of crew members from ship to shore, point-of-sale terminal information from cruise ships in the Mediterranean, and in-flight entertainment systems in jet airliners. The last example proved particularly alarming, as it revealed an exploitable connection between the systems dedicated to keeping passengers content and those in the cockpit, which clearly should not be the case.

We found [James’] insights on these weaknesses in satellite communications fascinating, and it’s well worth the 45 minutes to watch the video below and perhaps try these exploits, which amount to side-channel attacks, for yourself.

Continue reading “Eavesdropping On Satellites For Fun And Profit” →

HOPE 2020 Delivers Historic Marathon Of Hacking

August 11, 2020 by Tom Nardi 1 Comment

Anyone who’s ever attended a hacker conference knows that the talks and workshops are only part of the reason that people travel from all over the country (and indeed, the world) to be there. The social and extracurricular aspects of these events are just as important as the scheduled content, if not more so. After all, you can always watch the recorded version of any presentation you missed when you get back home; but there’s only a relatively short window for drinking Club-Mate, driving a Segway at unreasonable speeds, and hanging out with other people in the community.

So I don’t mind admitting that I was extremely skeptical when it was announced that the Hackers On Planet Earth (HOPE) conference was going virtual due to the COVID-19 pandemic. Especially since the decision came just a few months before the event was set to kick off in New York. Trying to recreate the experience of a large scale hacker con as an online-only event is hard enough, but doing it on such short notice seemed like a recipe for disaster. Particularly for an event like HOPE that had always crammed the historic Hotel Pennsylvania to the rafters (and sometimes, above) with content and activities.

Which is not to say they didn’t have some interesting ideas. Since so many people were stuck at home anyway, they decided there wasn’t much point limiting HOPE to a single weekend. For 2020, the event would instead run for nine continuous days. Prerecorded talks and interactive workshops would start at 9 AM Eastern and run right up until the wee hours of the morning, often concluding with a live musical performance.

As founder Emmanuel Goldstein described it, the idea was to turn this year’s HOPE into a 24 hour hacker television channel that could beam a diverse array of ideas and opinions into homes all over the planet. Rather than pretending that the classic hacker convention experience could be fully replicated online, they would fully embrace the possibilities offered by the Internet and create something completely different. But could they pull it off?

Continue reading “HOPE 2020 Delivers Historic Marathon Of Hacking” →

Hands-On: Internet Of Batteries Quantum Badge Brings Badgelife Add-Ons The Power And Internet They Crave

August 9, 2020 by Mike Szczys 13 Comments

Our friends in the Whiskey Pirates crew sent me the unofficial DEF CON badge they built this year. The Internet of Batteries QUANTUM provides power and connectivity to the all-important add-on badges of DC28. The front of the badge is absolutely gorgeous to the point I don’t really want to solder on my add-on headers and disrupt that aesthetic.

The gold-plated copper makes for a uniformed and reflective contrast to the red solder mask which occupies the majority of the front. Here we see the great attention to detail that [TrueControl] includes in his badges. The white stripe of silk screen separating the two colors is covered by some black detailing tape that looks much better than the white.

The antenna of the ESP32 module poking out the underside of the gold cover end of the badge gets its own rectangle of the holographic sticker material, the same as the sheet of stickers that was included in the box. Both decals are small details that make a huge difference to your eye.

The line of nine RGB LEDs have black bezels which goes along with the black stripe motif and underscores the typography of the badge name. These lights are hosted on a daughter board soldered to the underside of the badge with a slot for the LEDs to pass through. They are addressed in a 2×15 matrix that is scanned on the low side by the PSoC5 that drives the badge. This low-res image shows that daughter board before the lithium cell is placed.

Continue reading “Hands-On: Internet Of Batteries Quantum Badge Brings Badgelife Add-Ons The Power And Internet They Crave” →

Hands-On: AND!XOR Unofficial DC28 Badge Embraces The Acrylic Stackup

August 7, 2020 by Mike Szczys 1 Comment

Still hot from the solder party, a new AND!XOR badge just landed on my desk courtesy of the hacking crew that has been living the #badgelife for the past five years. Originally based on the Futurama character Bender, the design has morphed to the point that it’s no longer recognizable as a descendant of that belligerent robot. Instead we have a skeletal midget whose face is half covered by a gear-themed mask.

Continue reading “Hands-On: AND!XOR Unofficial DC28 Badge Embraces The Acrylic Stackup” →

Hackaday Remoticon: Our 2020 Conference Is Packed With Workshops And We’re Calling For Proposals

August 4, 2020 by Mike Szczys 13 Comments

We’re proud to announce the Hackaday Remoticon, taking place everywhere November 6th – 8th, 2020. It’s a weekend packed with workshops about hardware creation, held virtually for all to enjoy.

Update: Tickets are now available for 2020 Remoticon!

But we can’t do it without you. We need you to host a workshop on that skill, technique, or special know-how that you acquired through hard work over too many hours to count. Send in your workshop proposal now!

What is a Remoticon?

The Hackaday Remoticon achieves something that we just couldn’t do at the Hackaday Superconference: host more workshops that involve more people. Anyone who’s been to Supercon over the past six years can tell you it’s space-limited and, although we do our best to host a handful of workshops each day, those available seats are always in high demand.

We’re sad that we can’t get together in person for Supercon this year, but now we have an opportunity to host more workshops, engaging more live instructors and participants because they will be held virtually. This also means that we can make recordings of them available so that more people can learn from the experience. This is something that we tried way back during the first Supercon with Mike Ossmann’s RF Circuit Design workshop and 140,000 people have watched that video. (By the way, that link is worth clicking just to see Joe Kim’s excellent art.) Continue reading “Hackaday Remoticon: Our 2020 Conference Is Packed With Workshops And We’re Calling For Proposals” →

2020: Everything Is Virtual

August 1, 2020 by Elliot Williams 6 Comments

It’s like the dystopian future arrived out of the blue. From one year to the next we went from holing up in overly air-conditioned hotel ballrooms and actually meeting our fellow meatbags in the flesh, to huddling in our pods and staring at the screens. I’m looking for the taps to hook me in to the Matrix at this point.

But if you haven’t yet received your flying car or your daily Soma ration, you can still take comfort in one thing: all of the hacker conferences are streaming live, as if it were some fantastic cyber-future! In fact, as we type this, someone is telling you how to print your way to free drinks on USAir flights as part of HOPE’s offering, but the talks will continue for the next few days. (Go straight to live stream one.)

If retrocomputing is more your thing, Saturday marks the start of the virtual Vintage Computer Festival West of which Hackaday is a proud sponsor. (Here’s the schedule.)

And next weekend is DEF CON in Safe Mode with Networking. While we can totally imagine how the talks and demo sessions will work, the Villages, informal talks and hack-togethers based on a common theme, will be a real test of distributed conferencing.

OK, I’ll admit it: I really miss getting together with folks and having the truly random conversations that pre-scripted teleconferences just don’t seem to facilitate. Lobbycon suffers in lockdown. But if you’ve never been to any of these events, and you just want a taste of the talks and presentations at least, now’s your chance to get in for free. And if you like what you see, and if the virus lets us, we’ll see you in person next summer!