Newest PlayStation Exploit Skips The Disc

April 10, 2021 by Tom Nardi 17 Comments

Last month we brought you word of tonyhax, a clever exploit for the original Sony PlayStation that leveraged a buffer overflow in several of the games from the Tony Hawk Pro Skater series to load arbitrary code from a specially prepared memory card. But now [Bradlin] has taken that idea a step further and developed a software exploit for Sony’s iconic console that doesn’t need to be triggered from a game.

The exploit is considerably more complex this time around, but [Bradlin] does an excellent job of breaking it down for those who want the gritty details. The short version is that missing boundary checks in the PlayStation’s built-in memory card handling routines mean a carefully formatted “block” on the memory card can get the console to execute a small 128 byte payload. That’s not a lot of room to work with, but it ends up being just enough to load up additional code stored elsewhere on the memory card and really kick things off.

Unlike tonyhax, which was designed specifically to allow the user to swap their retail Tony Hawk disc with a game burned to a CD-R, [Bradlin]’s FreePSXBoot is presented as more of a generic loader. As of right now, it doesn’t allow you to actually play burned games, although its inevitable that somebody will connect those last few dots soon.

If you want to check out the progress so far, all you need is wire a PlayStation memory card up to an Arduino, write the provided image to it, and stick it in the slot. [Bradlin] says the exploit doesn’t work 100% of the time (something else that will surely be addressed in future releases), but it shouldn’t take too many attempts before you’re greeted with the flashing screen that proves Sony’s 27 year old console has now truly been bested.

Continue reading “Newest PlayStation Exploit Skips The Disc” →

PlayStation Unlocked With New Software Hack

March 15, 2021 by Tom Nardi 42 Comments

The original PlayStation might be pushing 30 years old now, but that doesn’t mean hackers have given up on chipping away at it. A new exploit released by [Marcos Del Sol Vives] allows users to run copied games on all but the earliest hardware revisions of this classic console, and all you need to trigger it is a copy of Tony Hawk’s Pro Skater 2.

Aptly named tonyhax, this exploit uses a classic buffer overflow found in the “Create Skater” mode in Tony Hawk 2, 3, and 4. When the game sees a custom character saved on the memory card it will automatically load the name field to show it on the screen, but it turns out the developers didn’t think to check the length of the name before loading it. Thanks to this oversight, a long and carefully crafted name can be used to load an executable payload into the console’s memory.

The name contains the memory address of the payload.

That payload could be anything, such as a homebrew game, but in this case [Marcos] went all in and developed a simple tool that unlocks the console’s optical drive so it will play games burned to CD-Rs. Once the tonyhax exploit has been loaded, you simply swap the authentic Tony Hawk disc for whatever burned title you want to play. So far every game tested has worked, even those that span across multiple discs.

[Marcos] is providing not only the save files ready to load on your PlayStation memory card (either through a PC tool, or with the help of a hacked PS2), as well as the complete source code for tonyhax. This opens the door to the exploit being used to load other tools, emulators, and indie games, but as the PlayStation homebrew scene is relatively limited when compared to newer consoles, the demand might be limited.

Compared to the traditional physical modifications used to play copied games on the PlayStation, this new software approach is far more accessible. Expect to see memory cards with this exploit preinstalled hit your favorite import site in the very near future.

Continue reading “PlayStation Unlocked With New Software Hack” →

Hackaday Links: October 18, 2020

October 18, 2020 by Dan Maloney 2 Comments

Remember subliminal advertising? The idea was that a movie theater operator would splice a single frame showing a bucket of hot buttered popcorn into a movie, which moviegoers would see and process on a subconcious level and rush to the concession stand to buy the tub o’ petrochemical-glazed starch they suddenly craved. It may or may not work on humans, but it appears to work on cars with advanced driver assistance, which can be spoofed by “phantom street signs” flashed on electronic billboards. Security researchers at Ben Gurion University stuck an image of a stop sign into a McDonald’s ad displayed on a large LCD screen by the side of the road. That was enough to convince a Tesla Model X to put on the brakes as it passed by the sign. The phantom images were on the screen anywhere from an eighth of a second to a quarter second, so these aren’t exactly subliminal messages, but it’s still an interesting attack that bears looking into. And while we’re skeptical about the whole subliminal advertising thing in the first place, for some reason we really want a bacon cheeseburger right now.

Score one for the good guys in the battle against patent trolls. Mycroft AI, makers of open-source voice assistants, proudly announced their latest victory against what they claim are patent trolls. This appears to be one of those deals where a bunch of investors get together and buy random patents, and then claim that a company that actually built something infringes on their intellectual property. Mycroft got a letter from one such entity and decided to fight it; they’ve won two battles so far against the alleged trolls and it looks pretty good going forward. They’re not pulling their punches, either, since Mycroft is planning to go after the other parties for legal expenses and punitive damages under the State of Missouri’s patent troll legislation. Here’s hoping this sends a message to IP squatters that it may not be worth the effort and that their time and money are better spent actually creating useful things.

Good news from Mars — The Mole is finally completely buried! We’ve been following the saga of the HP³, or “Heat Flow and Physical Properties Package” aboard NASA’s Mars InSight lander for quite a while. The self-drilling “Mole”, which is essentially the guts of an impact screwdriver inside a streamlined case, has been having trouble dealing with the Martian regolith, which is simultaneously too soft to offer the friction needed to keep the penetrator in its hole, but also too hard to pierce in places where there is a “duricrust” of chemically amalgamated material below the surface. It took a lot of delicate maneuvers with the lander’s robotic arm to get the Mole back on track, and it’s clearly not out of the woods yet — it needs to get down to three meters depth or so to do the full program of science it was designed for.

If watching Martian soil experiments proceed doesn’t scratch your itch for space science, why not try running your own radio astronomy experiments? Sure, you could build your own radio telescope to do that, but you don’t even have to go that far — just log into PICTOR, the free-to-use radio telescope. It’s a 3.2-m parabolic dish antenna located near Athens, Greece that’s geared toward hydrogen line measurements of the galaxy. You can set up an observation run and have the results mailed back to you for later analysis.

Here’s a fun, quick hack for anyone who hates the constant drone of white noise coming from fans. Build Comics apparently numbers themselves among that crowd, and decided to rig up a switch to turn on their fume extractor only when the soldering iron is removed from its holder. This hack was executed on a classic old Weller soldering station, but could easily be adapted to Hakko or other irons

And finally, if you’ve never listened to a Nobel laureate give a lecture, here’s your chance. Andrea Ghez, co-winner of the 2020 Nobel Prize in physics for her work on supermassive black holes, will be giving the annual Maria Goeppert Mayer lecture at the University of Chicago. She’ll be talking about exactly what she won the Nobel for: “The Monster at the Heart of Our Galaxy”, the supermassive black hole Sagittarius A*. We suspect the talk was booked before the Nobel announcement, so in normal times the room would likely be packed. But one advantage to the age of social distancing is that everything is online, so you can tune into a livestream of the lecture on October 22.

Breaking Smartphone NFC Firmware: The Gory Details

August 23, 2020 by Sven Gregori 2 Comments

Near-field Communication (NFC) has been around a while and is used for example in access control, small data exchange, and of course in mobile payment systems. With such sensitive application areas, security is naturally a crucial element of the protocol, and therefore any lower-level access is usually heavily restricted and guarded.

This hardware is especially well-guarded in phones, and rooting your Android device won’t be of much help here. Well, that was of course only until [Christopher Wade] took a deep look into that subject, which he presented in his NFC firmware hacking talk at for this year’s DEF CON.

But before you cry out “duplicate!” in the comments now, [Jonathan Bennett] has indeed mentioned the talk in a recent This Week In Security article, but [Christopher] has since written up the content of his talk in a blog post that we thought deserves some additional attention.

To recap: [Christopher] took a rooted Samsung S6 and searched for vulnerabilities in the NFC chip’s safe firmware update process, in hopes to run a custom firmware image on it. Obviously, this wouldn’t be worth mentioning twice if he hadn’t succeeded, and he goes at serious length into describing how he got there. Picking a brain like his by reading up on the process he went through — from reverse engineering the firmware to actually exploiting a weakness that let him run his own code — is always fascinating and downright fun. And if you’re someone who prefers the code to do the talking, the exploits are on GitHub.

Naturally, [Christopher] disclosed his findings to Samsung, but the exploited vulnerability — and therefore the ability to reproduce this — has of course been out there for a long time already. Sure, you can use a Proxmark device to attack NFC, or the hardware we saw a few DEF CONs back, but a regular-looking phone will certainly raise a lot less suspicion at the checkout counter, and might open whole new possibilities for penetration testers. But then again, sometimes a regular app will be enough, as we’ve seen in this NFC vending machine hack.

Continue reading “Breaking Smartphone NFC Firmware: The Gory Details” →

Eavesdropping On Satellites For Fun And Profit

August 20, 2020 by Dan Maloney 8 Comments

Geosynchronous satellites, girdling the Earth from their perches 36,000 km above the equator, are remarkably useful devices. Depending on where they’re parked, they command views of perhaps a third of the globe at a time, making them perfect communications relays. But as [James Pavur] points out in his DEF CON Safe Mode talk, “Whispers Among the Stars”, geosynchronous satellite communication links are often far from secure.

[James], a D. Phil. student in Systems Security at Oxford University, relates that his exploits rely on the wide areas covered by the downlink signals from the satellites, coupled with security as an afterthought, if it was even thought of at all by satellite service providers. This lackadaisical approach let him use little more than a regular digital satellite TV dish and a tuner card for a PC — off-the-shelf stuff that you’d really have to try hard to spend more than $300 on — to tap into sensitive information.

While decoding the digital signals from satellites into something parseable can be done with commercial applications, [James] and his colleagues built a custom tool, GSExtract, to pull data from the often noisy signals coming down from on high. The setup returned an amazing bounty of information, like maritime operators relaying the passport information of crew members from ship to shore, point-of-sale terminal information from cruise ships in the Mediterranean, and in-flight entertainment systems in jet airliners. The last example proved particularly alarming, as it revealed an exploitable connection between the systems dedicated to keeping passengers content and those in the cockpit, which clearly should not be the case.

We found [James’] insights on these weaknesses in satellite communications fascinating, and it’s well worth the 45 minutes to watch the video below and perhaps try these exploits, which amount to side-channel attacks, for yourself.

Continue reading “Eavesdropping On Satellites For Fun And Profit” →

Side-Channel Attack Turns Power Supply Into Speakers

May 11, 2020 by Dan Maloney 12 Comments

If you work in a secure facility, the chances are pretty good that any computer there is going to be stripped to the minimum complement of peripherals. After all, the fewer parts that a computer has, the fewer things that can be turned into air-gap breaching transducers, right? So no printers, no cameras, no microphones, and certainly no speakers.

Unfortunately, deleting such peripherals does you little good when [Mordechai Guri] is able to turn a computer power supply into a speaker that can exfiltrate data from air-gapped machines. In an arXiv paper (PDF link), [Guri] describes a side-channel attack of considerable deviousness and some complexity that he calls POWER-SUPPLaY. It’s a two-pronged attack with both a transmitter and receiver exploit needed to pull it off. The transmitter malware, delivered via standard methods, runs on the air-gapped machine, and controls the workload of the CPU. These changes in power usage result in vibrations in the switch-mode power supply common to most PCs, particularly in the transformers and capacitors. The resulting audio frequency signals are picked up by a malware-infected receiver on a smartphone, presumably carried by someone into the vicinity of the air-gapped machine. The data is picked up by the phone’s microphone, buffered, and exfiltrated to the attacker at a later time.

Yes, it’s complicated, requiring two exploits to install all the pieces, but under the right conditions it could be feasible. And who’s to say that the receiver malware couldn’t be replaced with the old potato chip bag exploit? Either way, we’re glad [Mordechai] and his fellow security researchers are out there finding the weak spots and challenging assumptions of what’s safe and what’s vulnerable.

Continue reading “Side-Channel Attack Turns Power Supply Into Speakers” →

GPU Turned Into Radio Transmitter To Defeat Air-Gapped PC

April 24, 2020 by Dan Maloney 31 Comments

Another week, another exploit against an air-gapped computer. And this time, the attack is particularly clever and pernicious: turning a GPU into a radio transmitter.

The first part of [Mikhail Davidov] and [Baron Oldenburg]’s article is a review of some of the basics of exploring the RF emissions of computers using software-defined radio (SDR) dongles. Most readers can safely skip ahead a bit to section 9, which gets into the process they used to sniff for potentially compromising RF leaks from an air-gapped test computer. After finding a few weak signals in the gigahertz range and dismissing them as attack vectors due to their limited penetration potential, they settled in on the GPU card, a Radeon Pro WX3100, and specifically on the power management features of its ATI chipset.

With a GPU benchmarking program running, they switched the graphics card shader clock between its two lowest power settings, which produced a strong signal on the SDR waterfall at 428 MHz. They were able to receive this signal up to 50 feet (15 meters) away, perhaps to the annoyance of nearby hams as this is plunk in the middle of the 70-cm band. This is theoretically enough to exfiltrate data, but at a painfully low bitrate. So they improved the exploit by forcing the CPU driver to vary the shader clock frequency in one megahertz steps, allowing them to implement higher throughput encoding schemes. You can hear the change in signal caused by different graphics being displayed in the video below; one doesn’t need much imagination to see how malware could leverage this to exfiltrate pretty much anything on the computer.

It’s a fascinating hack, and hats off to [Davidov] and [Oldenburg] for revealing this weakness. We’ll have to throw this on the pile with all the other side-channel attacks [Samy Kamkar] covered in his 2019 Supercon talk.

Continue reading “GPU Turned Into Radio Transmitter To Defeat Air-Gapped PC” →