Hardwarehacking on Colin O'Flynn

Dumping Parallel NAND with Glasgow

Sun, 14 Apr 2024 23:00:05 +0000

I recently got my Glasgow device, which is a rather impressive piece of tech. I followed the Windows installation instructions and it “Just Worked”, including installing the toolchain! On one computer I needed to use Zadig to force the driver to be libusbK, but on another Windows computer it wasn’t needed. In this blog post, I’m going to explore a parallel NAND device that I wanted to dump, and find out how well Glasgow works.

RECON 2023: Adventures of My Oven (Pinocchio) with ChipWhisperer

Fri, 09 Jun 2023 14:40:27 +0000

At RECON2023 I gave a talk about reverse engineering my Samsung Oven. This blog post has slides & links to information, with more to come! You can get a copy of the slides below:

OFLYNN-RECON2023 Download

Oven-Specific Stuff: https://github.com/colinoflynn/samsung-ovens-deconstructed
Python Loader for TMP91 Series: https://github.com/colinoflynn/pytoshload
Resource CD for TLCS900: https://github.com/colinoflynn/Toshiba-TLCS-900-L-Resources

New England Hardware Security Day 2022 Talk

Fri, 01 Apr 2022 11:50:25 +0000

On April 1st, 2022 I gave a “workshop” at New England Hardware Security Day. This blog post is a quick summary of some of the links to recreate my demos from that talk. Here is a copy of the slides if you’d like them:

New-England-Hardware-Security-Day-2022 Download

DFA on Raspberry Pi with PicoEMP

Pi on Pi Violence

This demo is pretty simple - it recreates the classic DFA attack on RSA (I find David’s description great here, or you can see my Hardware Hacking Handbook which includes another derivation of it using a different method).

Apple AirTag Teardown & Test Point Mapping

Sat, 08 May 2021 18:24:32 +0000

What’s inside of Apple’s new AirTag? There was already an iFixIt teardown (which I swear was missing a few items that are there now), but of course was curious to see what sort of protection was enabled. Notably the nRF chip used is likely vulnerable to a known bypass of security as well. With that in mind, I set out to see how we could dump some data from this thing - the good news is you can access a lot of interesting stuff (including the SPI flash) right from the backside, which requires you to simply pop the first plastic cover off. This is super-easy to do without damaging anything. Going further than that is tricky to keep it all intact.

BAM BAM!! On Reliability of EMFI for in-situ Automotive ECU Attacks

Sun, 08 Nov 2020 21:50:11 +0000

This post is a summary of some work on an accepted paper for ESCAR EU 2020. This work was demonstration on certain NXP chips & GM ECUs, but the idea of both the attack & understanding how portable results are is applicable across the entire domain.

NOTE TO CAR TUNERS: I won’t perform this for hire on your ECU, please don’t email me asking this. The cost for me to do this type of work under hire would also be many times the HPTuners fee, and without any of of the actual tuning interface (I’m only attacking the bootloader, I never ever built a reflash tool that would be needed, yet alone the mapping work etc).

Square Terminal Teardown

Mon, 06 Apr 2020 13:30:57 +0000

Part-way through the Square Terminal Teardown

I recently tore down a square terminal (the one with the LCD screen) and wanted to share some of these results. I haven’t photographed everything as was mostly interested in how the secure areas of it are down. You can see an overview in the following video if you want to see how the whole thing fits together.

https://www.youtube.com/watch?v=pB8T5wZJLcM

Teardown of Square Terminal Video

Amazon Echo Dot Gen 3 - Microphone Disable Circuitry

Sat, 18 Jan 2020 17:36:11 +0000

Have you been interested in the Echo Dot device? One feature they mention is that there is a microphone off button. I spent a few hours reverse engineering this, and recorded (in un-edited glory) the process:

https://youtu.be/xH8LnK9hh6w

The resulting schematic is shown below:

The astute reader will note the only pin under direct control allows the disabling of the microphone, it cannot re-enable it. However - there is one more loophole to check.

A Call for Time Travel Resistant Cryptography (TTRC)

Thu, 19 Sep 2019 02:16:08 +0000

At CHES 2019 [rump session], I presented my revolutionary talk on Time Travel Resistant Cryptography (TTRC). This is a hugely important area of research that has been widely ignored in academic work, and it’s time to finally make this right.

Why is this so critical? While Post Quantum Cryptography (PQC) gets NIST contests, and invested companies, nobody is considering TTRC. The general thought-process of PQC is that the existence of sufficiently powerful quantum computers is an open problem with no clear solution. BUT - if someone solves that problem (that is unclear is even physically possible to solve), it’s going to be hell on Earth for crypto implementations. Better safe than sorry.

USB Triggering & Hacking

Mon, 02 Sep 2019 01:50:39 +0000

This blog post covers several topics that I should have made independent posts about… but anyway. Here we are. It’s September and I should have done this months ago.

Trezor / USB Hacking Updates (Black Hat + WOOT)

I had an earlier blog post with details of the Trezor attack. It turns out this is more generic type of attack than I realized, so I extended this work into a WOOT paper as well. Quickly I thought I should update on that…

FICHSA ChipWhisperer Tutorial Requirements

Mon, 06 May 2019 11:31:39 +0000

At the FICHSA Conference (
https://fichsa.sise.bgu.ac.il ) I will be running a short workshop on ChipWhisperer using the ChipWhisperer-Nano.

A direct link to a Google Doc with the most up to date information is available here: https://docs.google.com/document/d/1IgDeGZ6d0FEYJbaF4a-KsBhdIHlMZg04-wQYUSZgnks/edit?usp=sharing

If you want to fully play along, please bring a laptop with the following installed and setup:

VirtualBox 5.x (5.2.28 is latest supported). You CANNOT use VirtualBox 6 due to some unknown incompatibility.
VirtualBox Extension pack for version you installed (direct link to 5.2.28, does not depend on the host OS).

I will be (hopefully) posting a VirtualBox image once one is fully updated.

Glitching Trezor using EMFI Through The Enclosure

Wed, 06 Mar 2019 15:13:45 +0000

As mentioned on the Trezor blog post, their latest security patch fixes a flaw I disclosed to them in Jan 2019. This flaw meant an attacker with physical access to the wallet can find the recovery seed stored in FLASH, and leave no evidence of tampering.

This work was heavily inspired by the wallet.fail disclosure - I’m directly dumping FLASH instead of forcing the flash erase then dumping from SRAM, so the results are the same but with a different path. It also has the same limitations - if you used a password protected recovery seed you can’t dump that.

Embedded World 2019 Conference Talk

Thu, 28 Feb 2019 21:43:50 +0000

At Embedded World I gave a talk on embedded security. There was also an associated paper, and I’m now making those available. I’ve also duplicated the paper contents in this blog post for your ease of access.

Download Slides (PPTX):

Click the above to download PPTX

Download Powerpoint Slides:Download

Download PDF of Paper (reproduced below)Download

ABSTRACT: As interconnected devices proliferate, security of those devices becomes more important. Two critical attacks can bypass many standard security mechanisms. These attacks are broadly known as side-channel attacks & fault injection attacks. This paper will introduce side-channel power analysis and fault injection attacks and their relevance to embedded systems. Examples of attacks are given, along with a short discussion of countermeasures and effectiveness. The use of open-source tools is highlighted, allowing the reader the chance to better understand these attacks with hands-on examples.

More Research, More Fun - I'm now an Assistant Professor

Fri, 01 Jun 2018 14:52:59 +0000

Are you interested in this area of research? If you’ve followed some of my work you know I enjoy a combination of fundamental research & hands-on practical experiences. It led me to co-found NewAE Technology Inc out of my PhD, with the objective of taking some of the research I was doing and pushing it ever further out into the world. I’m going to be continuing that work as C.T.O., but at the same time taking a leap forward in building up a larger research group under an academic affiliation. I’ve joined Dalhousie University as an assistant professor in the electrical & computer engineering department. This is a bit of a unique position as I’m also going to be helping with some of the new innovation work being done in the “IDEA Building”, which means I’ll be mandated (and thus have time) to work with companies interested in cyber-security (emphasizing the sort of cyberphysical work I do, like IoT and automotive). I’ll be shortly looking for students as well - if you are interested in a MASc or PhD in this area, I’d love to hear from you! Get in touch with my Dalhousie email (COFLYNN - AT - DAL.CA), if you don’t hear back sometimes I’m travelling quite a bit so may be slow, so please follow up to make sure I didn’t drop it. Or say hello at a conference - I’ll be at RECON and Black Hat in the next few months. More details & update on this to come, but it’s an exciting chance for me to continue pushing the fundamental research I love, while engaging the local start-up community and helping encourage students that starting a business out of research isn’t such a bad idea.

Breaking Electronic Door Locks Like You're on CSI: Cyber - Black Hat 2017 Talk

Wed, 26 Jul 2017 02:00:55 +0000

This year at Black Hat I’m presenting some short work on breaking electronic door locks. This talk focuses on one particular residential door lock. There was a bit of a flaw in the design, where the front panel/keypad can be removed from the outside. Once the keypad is off, you have access to a connector that goes into the rear side of the device. You can then make a cool “brute force” board, which was basically the point of this presentation. Finally you can have something that looks like your movie electronic lock hacking mechanism, completed with 7-segment LED displays: This little device does the following:

PhD Thesis Finally Done

Wed, 12 Jul 2017 12:44:47 +0000

If you’ve seen my presentations anytime over the past few years, you’ll know the introduction about “PhD Student at Dalhousie University finishing ‘soon’” has been the claim for the past several years. Finally ‘soon’ actually happened! You can see my complete thesis entitled “A Framework for Embedded Hardware Security Analysis” on the DalSpace website. It’s been a ton of fun doing the PhD, and I’ve had a lot of help over the years which I’ve very grateful for. For the foreseeable future I’ll be continuing to spin up NewAE Technology Inc., and keeping my ChipWhisperer project alive.

Philips Hue, AES-CCM, and more!

Thu, 03 Nov 2016 00:55:25 +0000

This is just a quick blog post to update you on some rather interesting research that will be coming out led by Eyal Ronen. At Black Hat USA 2016 I did some teardown of the Philips Hue system, and described the possibility of a lightbulb worm. Check this landing page which now has a draft PDF of what that became. This draft paper details how you can (1) recover the encryption keys used to encrypt the firmware updates, and thus encrypt/sign your own images, and (2) details a bug specific to a version of a range-checking protocol which allows reflashing of bulbs over longer distances. The end result is this basically solves all the roadblocks I had identified as stopping the lighbulb worm from actually happening [NB: the distance-check bug has been FIXED already in firmware updates which solves this specific spreading vector]. To me the most interesting part is a demonstration of side-channel power analysis being useful for breaking a rather good encrypted bootloader. To be clear the Philips Hue does a great job of implementing a bootloader on an IoT device… it’s one of the better I’ve seen, especially considering we are talking about a lightbulb. But it’s very very difficult to hide from side-channel power analysis and other “hands on” embedded hardware attacks, instead it’s better (but more expensive logistically) to push the solutions to the higher-level architecture. If each bulb had a unique encryption key (maybe derived from the MAC address using an algorithm on a secure server if you don’t want to store all those keys) it would provide an excellent layer of defense. I’m working on making a description of the AES-CCM attack, which will be posted to the wiki page.Q: What does that mean to someone using Hue, is it safe? A: Philips released a OTA update to fix the bug that allows spreading over longer distances (October 3rd update). This is a great example of a fast response by a company who takes this stuff seriously. Basically - if I was choosing a smart light platform, I’d probably use Hue (I have a few of them in my house too). Q: What’s power analysis? **A:**This isn’t a FAQ type answer - but you can see an intro video I made. Basically we use tiny variations in power consumption of a device as it’s running to determine information about secrets held within the device. Q: What if I want more information? **A:**Please contact Eyal for more details, if you want to discuss specific questions, etc. Note the Philips-specific details (such as scripts, keys, etc) will never be released, please don’t ask for them. Q: Does a worm exist? A: NO. It would be extremely reckless to make such a worm, as it would be VERY hard to contain the spread should you have a bunch of Hue devices around you. Instead that research paper demo’d all the pieces, but stopped short of putting them together (we wouldn’t want a criticality accident).

Philips Hue - R.E. Whitepaper from Black Hat 2016

Thu, 04 Aug 2016 14:37:33 +0000

At Black Hat 2016 I presented on some reverse engineering of the Philips Hue (also see my other post about getting root on it, which was part of that presentation).

If you were at the talk, you would have also seen mention that you'll want to keep your eyes out for future publications by Eyal Ronen. You can see his website for more research related to the Hue as well, and follow him on twitter @eyalr0. He's been doing some work in parallel that I think will do more than just R.E. the bulbs (as I did), and actually bring some of my `possible' attacks to become real proof-of-concepts.

Black Hat Slides - PIN-Protected HD Enclosure / MB86C311A Research

Thu, 04 Aug 2016 14:30:07 +0000

This is a quick post to link to slides from my Black Hat USA 2016 work. This work stands directly on the work done by Joffrey Czarny & Raphaël Rigo presented at HardWear.io last year (2015). They discovered the issues w.r.t. the stream-mode cipher being used by all manufactures on the MB86C311A, and the fact that secrets are stored on the HD itself. Their work is available at:

They have some newer work coming out which looks to be very interesting, so please keep your eyes out for that. Anyway onto my stuff. The following is a link to my slides: Brute-Forcing Lockdown Harddrive PIN Codes [Slides]

Getting Root on Philips Hue Bridge 2.0

Tue, 12 Jul 2016 16:00:00 +0000

This post will briefly show you how to get a root console on the new Philips Hue Bridges (the square ones). It's rather easy, the only special tools you require are a USB-Serial cable & a torx screwdriver.

There's a video with full details, this post is just the specifics if you don't want a very boring walk-through:

For the serial cable (a standard 3.3V type one, DO NOT use a 5V cable), there is a 6-pin header along the bottom. Pin '1' has a square footprint, and counting from pin 1 the connections are:
```
Pin 1 = GND
Pin 4 = RX In (connect to TX Out of your serial cable)
Pin 5 = TX Out (connect to RX in of your serial cable).
```
The bottom left-corner of the 2-row header is GND. You'll have to short that with a wire to the following test point:
This test-point is shorted to GND with a paper-clip or wire. Click image for full-sized to see in better detail.

To get the system working, check you are getting boot messages. Now, restart the system and after you get a bit of output, short the pin. You might see some output like this:

U-Boot 1.1.4 (Sep 8 2015 - 04:08:21)

bsb002 - Honey Bee 2.0DRAM:
sri
Honey Bee 2.0
ath_ddr_initial_config(195): (16bit) ddr2 init
tap = 0x00000003
Tap (low, high) = (0x8, 0x22)
Tap values = (0x15, 0x15, 0x15, 0x15)
64 MB
Top of RAM usable for U-Boot at: 84000000
Reserving 214k for U-Boot at: 83fc8000
Reserving 192k for malloc() at: 83f98000
Reserving 44 Bytes for Board Info at: 83f97fd4
Reserving 36 Bytes for Global Data at: 83f97fb0
Reserving 128k for boot params() at: 83f77fb0
Stack Pointer at: 83f77f98
Now running in RAM - U-Boot at: 83fc8000
Flash Manuf Id 0xc8, DeviceId0 0x40, DeviceId1 0x13
flash size 0MB, sector count = 8
Flash: 512 kB
*** Warning *** : PCIe WLAN Module not found !!!
In:    serial
Out:   serial
Err:   serial
Net:   ath_gmac_enet_initialize...
Fetching MAC Address from 0x83febe80
Fetching MAC Address from 0x83febe80
ath_gmac_enet_initialize: reset mask:c02200
Scorpion ---->S27 PHY*
S27 reg init
: cfg1 0x800c0000 cfg2 0x7114
eth0: 00:03:7f:11:20:ce
athrs27_phy_setup ATHR_PHY_CONTROL 4 :1000
athrs27_phy_setup ATHR_PHY_SPEC_STAUS 4 :10

Which will then fall back to a prompt:

ath>

Good news! We can now get everything working for you. You can print the existing variables if you wish:

ath> printenv

Set a boot delay such we can enter the menu without the boot hack:
```
setenv bootdelay 3
```
Check it works with
```
printenv bootdelay
```
and confirm you get a line like this:
```
bootdelay=3
```
Finally, save the setting with:
```
saveenv
```
You can now reset the system (use the 'reset' command), and confirm there is a count-down that gives you time to hit "enter" and get this prompt again.

Now let's fix the root password. Before doing this, I suggest you keep a copy of the old value:
```
printenv security
```
This would let you restore things back to default. Then the following will set the root password to 'toor':
```
setenv security '$1$3vGNd7Q3$ISqFeo1VkmQV6nyriUV0V/'
```
You may have to copy this into notepad first to ensure it all fits on one line! The quotes are critical here. Again check it works with printenv, then type saveenv to store things to disk.

SECT-2015 Talk Slides

Fri, 18 Sep 2015 08:48:26 +0000

On Friday at 14:15 I’m giving a talk about my open-source power analysis and glitching projected called ChipWhisperer at SEC-T. Here is some useful links if you watched the presentation:

See information about the entire project at www.ChipWhisperer.com too! Video will be posted online at some point too.