Something WiFi This Way Comes; Wicked Device Unveils Wildfire

November 28, 2013 by Adam Fabio 17 Comments

WildFire-v2

Wicked Device has released the WildFire board to the world. WildFire is a an Arduino compatible processor board with a Texas instruments CC3000. WildFire adds a few interesting features to the typical ‘Duino clone. Instead of the ATMega328 used in the Arduino Uno, the WildFire uses an ATMega1284p, which gives 16K of SRAM and 128K of Flash ROM (as compared to 2K RAM and 32K Flash in an Uno). A micro SD card slot is also on-board for data logging functions.

In the name of full disclosure, we should mention that [Adam] has known [Victor and Ken] over at Wicked Device for a few years now, and got his hands on a pre-release version of the board to play with. As with any non-standard Arduino board, the WildFire does require some modification to the Arduino IDE. This took a bit of time with the pre-release board. Wicked Device has streamlined the process since then. Everything is contained in a zip file on their product page. Once the IDE is up and running, its easy to get the WildFire’s CC3000 connected to your local access point. From there the internet is your playground. For those of you already asking “So, Hack?”, watch this space – Adam is working on a hack using the WildFire board which will show up in a few days.

Update: SD Card Locker Now Supports Password Protect

November 27, 2013 by Adam Fabio 19 Comments

sdlocker2_1

[Karl Lunt] has updated his Secure Digital Card locker to support password based locking. [Karl’s] original design only supported write locking via the TMP_WRITE_PROTECT bit. The new design gives the user an option: TMP_WRITE_PROTECT, or password protection. [Karl] goes into further detail this time around about the bit fields used with CMD42, and how they are set. The passwords in this case are up to 16 bytes. The bytes don’t necessarily have to be printable characters – any binary value can be used. Unfortunately, [Karl’s] locker doesn’t utilize a user interface beyond the buttons, so any password must be “baked in” to the SD Card locker firmware. We would love to see the option of even a basic serial interface for entering a password (most likely in hex).

[Karl] tried his device out with several different cards, and several computers. While not an exhaustive test, he did find that the computers always behaved the same: A locked SD card would not show up. In the case of windows, no beep, no drive, nothing. He goes into the security possibilities of using password locking: Financial data could be stored and physically transferred via SD or microSD, with the password sent separately (say in an email or SMS). Any unenlightened data thief attempting to use the card would think they have a broken device on their hands.

We don’t know how secure the password lock feature is – brute forcing a variable length 16 byte binary password would take some time. It all comes down to how quickly each password attempt takes. Some cursory web searching didn’t bring up any information about successful SD card password cracking. Sounds like a challenge for our readers!

Keep Your SD Cards Data Safe With The SD Locker

November 12, 2013 by Adam Fabio 41 Comments

sdlocker_1

[Karl Lunt] has come up with a simple circuit for protecting data you have stored on SD cards. As is relatively well-known, the little lock switch on the side of most SD cards really doesn’t do anything more than the switch on floppies or the tabs on VHS or cassette decks. It’s up to the reader/writer to check the status of the tab and decide if it should write to the card or not. Not a very safe system. However, it’s not the only write protection system built into SD and SDHC cards. As part of the standard, cards have three protection methods: A TMP_WRITE_PROTECT bit, a PERM_WRITE_PROTECT bit, and a PWD register.

The PERM_WRITE_PROTECT bit permanently write protects the card. The bit can not be reset, so you should be really sure you want to keep the data on the card forever. The PWD register is a password register. The card will not allow any access (read or write) unless a password is provided. The TMP_WRITE_PROTECT bit is a temporary write protect. This is the bit that [Karl] is working with. When TMP_WRITE_PROTECT is set, the card can be read but not written. Note that there is no true protection here, as anyone can modify the bit. However, this should stop grandma from accidentally deleting your wedding pictures.

[Karl’s] device is very simple. A card is inserted into an Altoids tin enclosure. One button locks the card, another unlocks it. Three LEDs return status – power, card locked, and card unlocked. Under the hood, he’s using an Atmel ATmega328 to set and clear the TMP_WRITE_PROTECT bits. Power is provided by two AA batteries, and regulated with a Pololu 3.3v boost regulator. [Karl] has also included a serial port for control and debug information. We think this is a great hack, however one thing we’re not sure of is how or if these features are implemented in all cards. We’re relatively sure the name brand cards stick to the SD/SDHC spec sheet, but what about all the knockoff and no name brands from overseas?

Advanced Transcend WiFi SD Hacking: Custom Kernels, X, And Firefox

September 19, 2013 by Adam Fabio 95 Comments

[Dmitry] read about hacking the Transcend WiFi cards, and decided to give it a try himself. We already covered [Pablo’s] work with the Transcend card. [Dmitry] took a different enough approach to warrant a second look.

Rather than work from the web interface and user scripts down, [Dmitry] decided to start from Transcend’s GPL package and work his way up. Unfortunately, he found that the package was woefully incomplete – putting the card firmly into the “violates GPL” category. Undaunted, [Dmitry] fired off some emails to the support staff and soldiered on.

It turns out the card uses u-boot to expand the kernel and basic file system into a ramdisk. Unfortunately the size is limited to 3MB. The limit is hard-coded into u-boot, the sources of which transcend didn’t include in the GPL package.

[Dmitry] was able to create his own binary image within the 3MB limit and load it on the card. He discovered a few very interesting (and scary) things. The flash file system must be formatted FAT32, or the controller will become very upset. The 16 (or 32)GB of flash is also mounted read/write to TWO operating systems. Linux on the SD card, and whatever host system the card happens to be plugged in to. This is dangerous to say the least. Any write to the flash could cause a collision leading to lost data – or even a completely corrupt file system. Continue reading “Advanced Transcend WiFi SD Hacking: Custom Kernels, X, And Firefox” →