Black-Hat on Colin O'Flynn

Breaking Electronic Door Locks Like You're on CSI: Cyber - Black Hat 2017 Talk

Wed, 26 Jul 2017 02:00:55 +0000

This year at Black Hat I’m presenting some short work on breaking electronic door locks. This talk focuses on one particular residential door lock. There was a bit of a flaw in the design, where the front panel/keypad can be removed from the outside. Once the keypad is off, you have access to a connector that goes into the rear side of the device. You can then make a cool “brute force” board, which was basically the point of this presentation. Finally you can have something that looks like your movie electronic lock hacking mechanism, completed with 7-segment LED displays: This little device does the following:

Philips Hue - R.E. Whitepaper from Black Hat 2016

Thu, 04 Aug 2016 14:37:33 +0000

At Black Hat 2016 I presented on some reverse engineering of the Philips Hue (also see my other post about getting root on it, which was part of that presentation).

If you were at the talk, you would have also seen mention that you'll want to keep your eyes out for future publications by Eyal Ronen. You can see his website for more research related to the Hue as well, and follow him on twitter @eyalr0. He's been doing some work in parallel that I think will do more than just R.E. the bulbs (as I did), and actually bring some of my `possible' attacks to become real proof-of-concepts.

Black Hat Slides - PIN-Protected HD Enclosure / MB86C311A Research

Thu, 04 Aug 2016 14:30:07 +0000

This is a quick post to link to slides from my Black Hat USA 2016 work. This work stands directly on the work done by Joffrey Czarny & Raphaël Rigo presented at HardWear.io last year (2015). They discovered the issues w.r.t. the stream-mode cipher being used by all manufactures on the MB86C311A, and the fact that secrets are stored on the HD itself. Their work is available at:

They have some newer work coming out which looks to be very interesting, so please keep your eyes out for that. Anyway onto my stuff. The following is a link to my slides: Brute-Forcing Lockdown Harddrive PIN Codes [Slides]

Getting Root on Philips Hue Bridge 2.0

Tue, 12 Jul 2016 16:00:00 +0000

This post will briefly show you how to get a root console on the new Philips Hue Bridges (the square ones). It's rather easy, the only special tools you require are a USB-Serial cable & a torx screwdriver.

There's a video with full details, this post is just the specifics if you don't want a very boring walk-through:

For the serial cable (a standard 3.3V type one, DO NOT use a 5V cable), there is a 6-pin header along the bottom. Pin '1' has a square footprint, and counting from pin 1 the connections are:
```
Pin 1 = GND
Pin 4 = RX In (connect to TX Out of your serial cable)
Pin 5 = TX Out (connect to RX in of your serial cable).
```
The bottom left-corner of the 2-row header is GND. You'll have to short that with a wire to the following test point:
This test-point is shorted to GND with a paper-clip or wire. Click image for full-sized to see in better detail.

To get the system working, check you are getting boot messages. Now, restart the system and after you get a bit of output, short the pin. You might see some output like this:

U-Boot 1.1.4 (Sep 8 2015 - 04:08:21)

bsb002 - Honey Bee 2.0DRAM:
sri
Honey Bee 2.0
ath_ddr_initial_config(195): (16bit) ddr2 init
tap = 0x00000003
Tap (low, high) = (0x8, 0x22)
Tap values = (0x15, 0x15, 0x15, 0x15)
64 MB
Top of RAM usable for U-Boot at: 84000000
Reserving 214k for U-Boot at: 83fc8000
Reserving 192k for malloc() at: 83f98000
Reserving 44 Bytes for Board Info at: 83f97fd4
Reserving 36 Bytes for Global Data at: 83f97fb0
Reserving 128k for boot params() at: 83f77fb0
Stack Pointer at: 83f77f98
Now running in RAM - U-Boot at: 83fc8000
Flash Manuf Id 0xc8, DeviceId0 0x40, DeviceId1 0x13
flash size 0MB, sector count = 8
Flash: 512 kB
*** Warning *** : PCIe WLAN Module not found !!!
In:    serial
Out:   serial
Err:   serial
Net:   ath_gmac_enet_initialize...
Fetching MAC Address from 0x83febe80
Fetching MAC Address from 0x83febe80
ath_gmac_enet_initialize: reset mask:c02200
Scorpion ---->S27 PHY*
S27 reg init
: cfg1 0x800c0000 cfg2 0x7114
eth0: 00:03:7f:11:20:ce
athrs27_phy_setup ATHR_PHY_CONTROL 4 :1000
athrs27_phy_setup ATHR_PHY_SPEC_STAUS 4 :10

Which will then fall back to a prompt:

ath>

Good news! We can now get everything working for you. You can print the existing variables if you wish:

ath> printenv

Set a boot delay such we can enter the menu without the boot hack:
```
setenv bootdelay 3
```
Check it works with
```
printenv bootdelay
```
and confirm you get a line like this:
```
bootdelay=3
```
Finally, save the setting with:
```
saveenv
```
You can now reset the system (use the 'reset' command), and confirm there is a count-down that gives you time to hit "enter" and get this prompt again.

Now let's fix the root password. Before doing this, I suggest you keep a copy of the old value:
```
printenv security
```
This would let you restore things back to default. Then the following will set the root password to 'toor':
```
setenv security '$1$3vGNd7Q3$ISqFeo1VkmQV6nyriUV0V/'
```
You may have to copy this into notepad first to ensure it all fits on one line! The quotes are critical here. Again check it works with printenv, then type saveenv to store things to disk.