>My injected ELF also flushes the page cache
The difference between a padawan and a jedi
Amazing write up and bonus points for the reproducibility of this creativity.
My parents oven gets regular software updates so I didn’t even question whether the cigarette lighter was “smart.”
But good and thorough write-up about how to actually exploit such a glitch.
And you could also use the cigarette lighter for hanging out at the data center back door and wait until the admin comes for a smoke.
Generally the historical perspective on physical access was: "once they have it, game over." TPM and trusted execution environments have shifted this security perspective to "we can trust certain operations inside the enclave even if the user has physical access."
His next steps are most interesting to me -- can you get something (semi-) reliable without soldering stuff? My guess is it's going to be a lot harder. Lots of thought already goes into dealing with electrical interference. On the other hand, maybe? if you flip one random bit of a 64 bit read every time you click your lighter, and your exploit can work with one of say 4 bit flips, then you don't need that many tries on average. At any rate, round 2 of experimentation should be interesting.
You then took that clicker to your local arcade, and clicked one of the corners of the CRT, that would send a shock through the system and add credits to your game. I believe this was because the CRT was grounded on the same ground lines that the mechanism for physically checking a coin had gone through the system.
Suffice to say, they caught onto this over time, and added some form of an alarm into it. But up until then... Those were truly the best times.
"Finally, I'd like to thank JEDEC for paywalling all of the specification documents that were relevant to conducting this research."
really neat hack. using the lighter to create EM interference. better go light up next to my DDR bus and see what happens :)
Without the antenna it would be hard to limit it to a single bit getting flipped. At least that’s what I suspect.
No, you can't. That long lead to couple your ersatz pulse generator defeats all the engineering put into making the computer reliable and quiet in the EMI sense.
Circuit bending is fun stuff, but it's not a remote exploit.
To my understanding some of those early arcade games also had jumpers to control some of the behavior. It could be that a tech set the "free credit on reboot" jumper and forgot to reset it when they were done.
I think they still use these in bars
Those systems are occasionally used in bars in the US, though they've dropped the whole plate and it's usually just arms where the holes are.
To my understanding, at least in the US, they aren't used for deep-cleaning anything. That happens with soap and water in the back still. The upside-down-showers are used to clean out the dregs of someone's glass when they get a refill (you give them a glass, they give it a quick rinse, refill it and hand it back), and as a quick rinse for new glasses to clean up water stains/detergent residue and anything that might have fallen in since they were cleaned (hair, dust, etc).
but I remembered that most of the physical access hacks would not be possible if the disk is encrypted.. which then makes this kind of hack enormously attractive.
The antenna idea can be extended to be a piece of hardware with the interference device built-in (piezo or whatever) which communicates with the external world with any wireless medium and then the attacker can trigger the interference remotely. This, plus a website controlled by the hacker which the victim is scammed to visit can be enough to make it viable.
Only if you have not booted into your system through using a keyfile or a passphrase to decrypt the data, i.e. if your PC is shut down. I have full disk encryption, and when I boot into my system, it uses the keyfile with which it would perform the decryption, and boom, I have my PC ready to be accessed physically.
The "Jungle Jive" version of this would dispense tokens out the opposite side of the machine if the electric ignition of a cigarette lighter was used to lightly shock the metal intake slot. If you clicked it too much too quickly it would go into an alert mode. While this could be accomplished solo, the ideal MVP setup was a team of three: one scout to watch for employees, one to click, and one to collect.
Maybe that unlocks different and exciting hacks, maybe it just melts your machine.
We did it for a couple of years until they figured it out and started to conver the arcade cabinets with transparent plastic.
At the same time they also drilled holes at the back of the machine for ventilation as the rest of the case now was sealed in plastic.
We found out that using a bamboo stick you could press the lever that register when a coin has been paid into the slot.
That made them relocate the holes for the ventilation to the top of the case instead of the back so we couldn't get the lever anymore. Or so they thought. haha
We discovered that by pressing a coin up the return slot — the one where you get your coin back if it isn’t accepted — you could also trigger the lever for coin registration and the free gaming continued.
Eventually they put in sharp screws into that coin return box so you would cut your finges.
After that we got a SEGA. Was great fun :)
War Games used a pull tab from an aluminum can to a similar effect?
(It’s been a while.)
Actually here is a link explaining it: https://www.webstaurantstore.com/article/620/three-compartme...
I remember a year ago or so there was a submission here which detailed how computers work and are build starting at the tiniest part: starting with logic gates, IIRC. Anybody remember what that website was?
In fact, that could be why some of the machines weren't better protected against that stuff in the first place, right?
Mileage obviously varies, but the "beer nerd/snob" bars I've been to simply don't re-use glasses without a full wash. They'd rather just charge a little more to hire more dishwashers and be able to absolutely guarantee that there's no leftover beer/water in your glass when they refill it, and that the glass is refrigerated if that's something they want.
I've always heard the head/foam had more to do with how you pour the beer (more impact/movement = more foam), but it makes sense that temperature affects it as well. There's some kind of official course on how to pour Guinness to get the correct head on it. I don't remember the whole thing, but it was something about holding the glass the correct distance from the tap and tilting it so that the beer "slides" down the side of the glass rather than a direct perpendicular impact with the beer already in the glass (which makes more foam).
Yes, the glass's sides are still full of the disgusting soapwater from the bucket that's now basically 95% other people's drink dregs.
And the technicians "improving" the machines -- maybe they had a good time too, I'm wondering. @TowerTall and friends made their job more interesting / fun?
But I feel like soldering something is no different than just like splicing a telephone cable in half and putting your own headset in the middle…
Except instead of putting a headset, you crudely use a lighter…
If you only care about remote exploits, fine, but don't go scolding others for accomplishing things you can't.
https://www.amazon.com/CYBERPUNK-Outlaws-Hackers-Computer-Fr...
I’ve had plenty of time to fuck with things before I told you I was leaving. You’re just screwing over my coworkers by taking access to me away with zero notice.
So people were using cancelled or empty prepaid visa/mastercards.
Initially they’d just push out blacklists.
Once they really caught on, they did a firmware upgrade to do online verification and it took fooooreeeeveeeeerrrrr to do a credit card purchase.
However, I'm not sure the kind of root you want unless you're into horticulture.
How long would it take someone to acquire these skills?
>>> 0x100_0000
16777216
>>> 0x100_0001
16777217
>>> 0x1000001
16777217
>>> 0x100000_1
16777217This is impressive, and I'm glad people are working to preserve software freedom, but I'd rather just support the alternatives.
Why give them the perceived install base, and profit? Why not get a steam deck or one of the many other handhelds that you have - day 0 as a feature - root access on?
You can still like all that and want to gain full control of the device you own.
The universe's RNG just happened to roll favourably in Sydney in the 90s and the rest is history.
No button pushing. No lighter fluid refilling ... ever. The world waited a long time for this.
And obviously it needs a chip to run the lidar, and generate the simultaneous brilliant LED flash and fade, haptic jolt, and accompanying sound effects.
(Can some demo freak please create this? And make it look like a little revolver? But for finger and hot dog safety, you are going to have to harden the virtual memory controller...)
In this specific situation, there's no common reference level, and so the induced pulse will go both directions. You can think of this as being about the edges of the pulse being the parts that actually cause radio to be transmitted, and there's both a positive-going edge and a negative-going edge on a pulse.
Since the attacker is very unlikely to flip the exact right bits to make ECC match, their exploit is very likely to be detected before it succeeds. halt() is necessary so the attacker cannot have more tries at it.
Obviously you have the downside that real memory errors cause the system to crash.
Also don't see how the article's exploit would be useful pre-decryption.
Nintendo also has the somewhat unique position of being the only one providing high-quality games in a variety of categories. If you want a couch racing game, you're playing nintendo. If you want a 3D platformer, you're playing nintendo. If you want a couch party games, you're playing nintendo. In fact if you want couch co-op at all you're playing nintendo, pretty much everyone else gave it up because you lose money.
Might need duct tape and a chair as well.
From a health perspective, I'd be more worried about the leftover sanitizer in the water in the glass. Bleach is pretty common, and it's honestly a tossup whether I'd rather drink someone else's dregs or bleach. It's probably the dregs, I'll take a stomach flu over melting my stomach lining with chronic low-grade bleach exposure.
There are a number of great studios which happen to have financial ties to a given publisher. If you like these studios you have no choice but to indirectly give money to the publisher in question.
One obvious example for Nintendo is Monolith Software.
Threat models vary of course. I personally believe my iPhone is safe against back side memory hardware swaps if I have turned it off. I could be wrong though!