Hacking Hardware Bitcoin Wallets: Extracting The Cryptographic Seed From A Trezor

February 4, 2021 by Adam Zeloof 30 Comments

It’s long been common wisdom that one of the safest places to keep your cryptocurrency holdings is in a hardware wallet. These are small, portable devices that encrypt your keys and offer a bit more peace of mind than holding your coins in a soft or web wallet.

But of course, as we know, nothing is totally secure.

And we were reminded of this fact by Kraken Security Labs, when they showed us how they bypassed all of the safeguards in a popular wallet, the Trezor, to dump and decrypt it’s seed.

It’s worth noting that the hack does require physical access to the wallet — albeit only about fifteen minutes worth. And by “physical access” we mean that the hack leaves the device thoroughly mutilated. The Kraken team started by desoldering the heart of the wallet, a STM32 processor. They then dropped it into a socket on an interface board, and got to glitching.

The hack relies on an attack known as voltage glitching. Essentially, at a precisely-timed moment during the device’s boot sequence, the supply voltage is fluctuated. This enables the chip’s factory bootloader, which can read out the contents of it’s onboard flash memory. The memory is read-protected, but can be accessed 256 bytes at a time through a second voltage glitch. Neither of these attacks work 100% of the time, so if the device fails to boot or the memory remains locked, the FPGA performing the attacks simply tries again. After enough iterations, the Kraken team was able to fully dump the chip’s flash memory.

Continue reading “Hacking Hardware Bitcoin Wallets: Extracting The Cryptographic Seed From A Trezor” →

Brilliant Brick Prototyping

February 3, 2021 by Kerry Scharfglass 24 Comments

Have a rusty collection of protoboards wired together that would benefit from mechanical support? Working on putting together a robot and need to attach PCBAs without drilling holes, zipping a cable tie, or globing hot glue? Add some stud holes with [James Munns]’ Brick Mount! This isn’t the first time we’ve seen an interface between everyone’s favorite Nordic building system and circuitboards, but this implementation has the elegance we’ve come to expect from [James]’ software work.

The project repository contains two things: a KiCad library with components for holes in standard patterns and sizes (1×1, 1×2, etc) and a series of protoboards made with those hole components. The protoboards feature a couple common elements; QUIIC connectors for easy chaining between them and holes in the middle or edges for easy mounting on studs. Some are intended to be carriers for Feather-format PCBAs (very convenient!) and others are primarily undifferentiated prototyping space. Of particular note is the “medium” Feather breakout seen to the left, which incorporates clever cutouts to make it easy to wires down under the board so it can be mounted flush against another board.

The thesis here is that getting custom PCBs fabricated is easier and less expensive than ever before. So easy and inexpensive that fabricating customized protoboard to use in one-off projects is cost-efficient enough to be worthwhile. Waste concerns aside this does seem like a great way to level up those temporary projects which find a more permanent home.

The Bus That’s Not A Bus: The Joys Of Hacking PCI Express

February 3, 2021 by Maya Posch 55 Comments

PCI Express (PCIe) has been around since 2003, and in that time it has managed to become the primary data interconnect for not only expansion cards, but also high-speed external devices. What also makes PCIe interesting is that it replaces the widespread use of parallel buses with serial links. Instead of having a bus with a common medium (traces) to which multiple devices connect, PCIe uses a root complex that directly connects to PCIe end points.

This is similar to how Ethernet originally used a bus configuration, with a common backbone (coax cable), but modern Ethernet (starting in the 90s) moved to a point-to-point configuration, assisted by switches to allow for dynamic switching between which points (devices) are connected. PCIe also offers the ability to add switches which allows more than one PCIe end point (a device or part of a device) to share a PCIe link (called a ‘lane’).

This change from a parallel bus to serial links simplifies the topology a lot compared to ISA or PCI where communication time had to be shared with other PCI devices on the bus and only half-duplex operation was possible. The ability to bundle multiple lanes to provide less or more bandwidth to specific ports or devices has meant that there was no need for a specialized graphics card slot, using e.g. an x16 PCIe slot with 16 lanes. It does however mean we’re using serial links that run at many GHz and must be implemented as differential pairs to protect signal integrity.

This all may seem a bit beyond the means of the average hobbyist, but there are still ways to have fun with PCIe hacking even if they do not involve breadboarding 7400-logic chips and debugging with a 100 MHz budget oscilloscope, like with ISA buses.

Continue reading “The Bus That’s Not A Bus: The Joys Of Hacking PCI Express” →

Why Blobs Are Important, And Why You Should Care

January 29, 2021 by Jenny List 53 Comments

We are extraordinarily fortunate to live at a time in which hardware with astounding capabilities can be had for only a few dollars. Systems that would once have taken an expensive pile of chips and discretes along with months of development time to assemble are now integrated onto commodity silicon. Whether it is a Linux-capable system-on-chip or a microcontroller, such peripherals as WiFi, GPUs, Bluetooth, or USB stacks now come as part of the chip, just another software library rather than a ton of extra hardware.

Beware The Blob!

An ESP-01 module — The cheapest of chips still comes with a blob.

If there is a price to be paid for this convenience, it comes in the form of the blob. A piece of pre-compiled binary software that does the hard work of talking to the hardware and which presents a unified API to the software. Whether you’re talking to the ESP32 WiFi through an Arduino library or booting a Raspberry Pi with a Linux distribution, while your code may be available or even maybe open source, the blob it relies upon to work is closed source and proprietary. This presents a challenge not only to Software Libre enthusiasts in search of a truly open source computer, but also to the rest of us because we are left reliant upon the willingness of the hardware manufacturer to update and patch their blobs.

An open-source advocate would say that the solution is easy, the manufacturers should simply make their blobs open-source. And it’s true, were all blobs open-source then the Software Libre crowd would be happy and their open-source nature would ease the generation of those updates and patches. So why don’t manufacturers release their blobs as open-source? In some cases that may well be due to a closed-source mindset of never releasing anything to the world to protect company intellectual property, but to leave it at that is not a full answer. To fully understand why that is the case it’s worth looking at how our multifunctional chips are made.

Continue reading “Why Blobs Are Important, And Why You Should Care” →

Two-Key Keyboard Build Log Starts Small, But Thinks Big

January 23, 2021 by Donald Papp 3 Comments

Interested in making a custom keyboard, but unsure where to start? Good news, because [Jared]’s build log for an adorable “2% Milk” two-key mini-keyboard covers everything you need to know about making a custom keyboard, including how to add optional RGB lighting. The only difference is that it gets done in a smaller and cheaper package than jumping directly in with a full-size DIY keyboard.

[Jared] is definitely no stranger to custom keyboard work, but when he saw parts for a two-key “2% Milk” keyboard for sale online, he simply couldn’t resist. Luckily for us, he took plenty of photos and his build log makes an excellent tutorial for anyone who wants to get into custom keyboards by starting small.

The hardware elements are clear by looking at photos, but what about the software? For that, [Jared] uses a ~~Teensy~~ Pro Micro clone running QMK, an open source project for driving and configuring custom input devices. QMK drives tiny devices like the 2% Milk just as easily as it does larger ones, so following [Jared]’s build log therefore conveys exactly the same familiarity that would be needed to work on a bigger keyboard, which is part of what makes it such a great project to document.

Interested in going a little deeper down the custom keyboard rabbit hole? You can go entirely DIY, but there’s also no need to roll everything from scratch. It’s possible to buy most of the parts and treat the project like a kit, and Hackaday’s own [Kristina Panos] is here to tell you all about what that was like.

Making Silicone Molds – Big Ones!

January 21, 2021 by Lewin Day 11 Comments

If you’ve got one of something and you want more, duplicating it with a silicone mold can be a great way to go. This is applicable to 3D printing something you need many copies of, and a whole variety of other usecases. [Eric Strebel] prides himself on his abilities in this area, and has put out a guide to producing very large silicone molds in a simple and reliable manner.

The overarching process is simple, but followed properly, it produces great results. [Eric] starts by building a mold box out of wood, coated in shellac to ensure it doesn’t stick to the silicone. The master part is then stuck to the base, surrounded by a lasercut cardboard strip which acts as a seal and key. Once properly degassed silicone is poured in and cured, the second half can be made. The mold is flipped in the mold box, the seal key removed, and release agent applied to the silicone surfaces. With another pour and cure, the mold is ready for casting new parts.

While simple, if the correct equipment isn’t used or steps skipped, you’ll end up with a useless mold full of air bubbles or surface irregularities. It’s useful to see just what it takes to get a mold of such scale (13″ x 19″!) completed without flaws. We’ve featured [Eric]’s work before, such as his fine detail improvements on the Apple Pencil. Video after the break.

Continue reading “Making Silicone Molds – Big Ones!” →

Arduino Wannabe Should Have Used A 555. Oh Wait, It Does.

January 17, 2021 by Dan Maloney 89 Comments

It’s a little known secret that when the Hackaday writers gather in their secret underground bunker to work on our plans for world domination, we often take breaks to play our version of the corporate “Buzzword Bingo”, where paradigms are leveraged and meetings circle back to loop in offline stakeholders, or something like that. Our version, however, is “Comment Line Bingo”, and right in the middle of the card is the seemingly most common comment of all: “You should have used a 555,” or variations thereof.

So it was with vicious glee that we came across the Trollduino V1.0 by the deliciously named [Mild Lee Interested]. It’s the hardware answer to the common complaint, which we’ll grant is often justified. The beautiful part of this is that Trollduino occupies the same footprint as an Arduino Uno and is even pin-compatible with the microcontroller board, or at least sort of. The familiar line of components and connectors sprout from the left edge of the board, and headers for shields line the top and bottom edges too. “Sketches” are implemented in hardware, with jumpers and resistors and capacitors of various values plugged in to achieve all the marvelous configurations the indispensable timer chip can be used for. And extra points for the deliberately provocative use of Comic Sans in the silkscreen.

Hats off to [Lee] for a thoroughly satisfying troll, and a nice look at what the 555 chip can really do. If you want a more serious look at the 555, check out this 555 modeled on a breadboard, or dive into the story of the chip’s development.