Talks on Colin O'Flynn

RECON 2023: Adventures of My Oven (Pinocchio) with ChipWhisperer

Fri, 09 Jun 2023 14:40:27 +0000

At RECON2023 I gave a talk about reverse engineering my Samsung Oven. This blog post has slides & links to information, with more to come! You can get a copy of the slides below:

OFLYNN-RECON2023 Download

Oven-Specific Stuff: https://github.com/colinoflynn/samsung-ovens-deconstructed
Python Loader for TMP91 Series: https://github.com/colinoflynn/pytoshload
Resource CD for TLCS900: https://github.com/colinoflynn/Toshiba-TLCS-900-L-Resources

New England Hardware Security Day 2022 Talk

Fri, 01 Apr 2022 11:50:25 +0000

On April 1st, 2022 I gave a “workshop” at New England Hardware Security Day. This blog post is a quick summary of some of the links to recreate my demos from that talk. Here is a copy of the slides if you’d like them:

New-England-Hardware-Security-Day-2022 Download

DFA on Raspberry Pi with PicoEMP

Pi on Pi Violence

This demo is pretty simple - it recreates the classic DFA attack on RSA (I find David’s description great here, or you can see my Hardware Hacking Handbook which includes another derivation of it using a different method).

A Call for Time Travel Resistant Cryptography (TTRC)

Thu, 19 Sep 2019 02:16:08 +0000

At CHES 2019 [rump session], I presented my revolutionary talk on Time Travel Resistant Cryptography (TTRC). This is a hugely important area of research that has been widely ignored in academic work, and it’s time to finally make this right.

Why is this so critical? While Post Quantum Cryptography (PQC) gets NIST contests, and invested companies, nobody is considering TTRC. The general thought-process of PQC is that the existence of sufficiently powerful quantum computers is an open problem with no clear solution. BUT - if someone solves that problem (that is unclear is even physically possible to solve), it’s going to be hell on Earth for crypto implementations. Better safe than sorry.

USB Triggering & Hacking

Mon, 02 Sep 2019 01:50:39 +0000

This blog post covers several topics that I should have made independent posts about… but anyway. Here we are. It’s September and I should have done this months ago.

Trezor / USB Hacking Updates (Black Hat + WOOT)

I had an earlier blog post with details of the Trezor attack. It turns out this is more generic type of attack than I realized, so I extended this work into a WOOT paper as well. Quickly I thought I should update on that…

Embedded World 2019 Conference Talk

Thu, 28 Feb 2019 21:43:50 +0000

At Embedded World I gave a talk on embedded security. There was also an associated paper, and I’m now making those available. I’ve also duplicated the paper contents in this blog post for your ease of access.

Download Slides (PPTX):

Click the above to download PPTX

Download Powerpoint Slides:Download

Download PDF of Paper (reproduced below)Download

ABSTRACT: As interconnected devices proliferate, security of those devices becomes more important. Two critical attacks can bypass many standard security mechanisms. These attacks are broadly known as side-channel attacks & fault injection attacks. This paper will introduce side-channel power analysis and fault injection attacks and their relevance to embedded systems. Examples of attacks are given, along with a short discussion of countermeasures and effectiveness. The use of open-source tools is highlighted, allowing the reader the chance to better understand these attacks with hands-on examples.

Breaking Electronic Door Locks Like You're on CSI: Cyber - Black Hat 2017 Talk

Wed, 26 Jul 2017 02:00:55 +0000

This year at Black Hat I’m presenting some short work on breaking electronic door locks. This talk focuses on one particular residential door lock. There was a bit of a flaw in the design, where the front panel/keypad can be removed from the outside. Once the keypad is off, you have access to a connector that goes into the rear side of the device. You can then make a cool “brute force” board, which was basically the point of this presentation. Finally you can have something that looks like your movie electronic lock hacking mechanism, completed with 7-segment LED displays: This little device does the following:

Black Hat Slides - PIN-Protected HD Enclosure / MB86C311A Research

Thu, 04 Aug 2016 14:30:07 +0000

This is a quick post to link to slides from my Black Hat USA 2016 work. This work stands directly on the work done by Joffrey Czarny & Raphaël Rigo presented at HardWear.io last year (2015). They discovered the issues w.r.t. the stream-mode cipher being used by all manufactures on the MB86C311A, and the fact that secrets are stored on the HD itself. Their work is available at:

They have some newer work coming out which looks to be very interesting, so please keep your eyes out for that. Anyway onto my stuff. The following is a link to my slides: Brute-Forcing Lockdown Harddrive PIN Codes [Slides]

Getting Root on Philips Hue Bridge 2.0

Tue, 12 Jul 2016 16:00:00 +0000

This post will briefly show you how to get a root console on the new Philips Hue Bridges (the square ones). It's rather easy, the only special tools you require are a USB-Serial cable & a torx screwdriver.

There's a video with full details, this post is just the specifics if you don't want a very boring walk-through:

For the serial cable (a standard 3.3V type one, DO NOT use a 5V cable), there is a 6-pin header along the bottom. Pin '1' has a square footprint, and counting from pin 1 the connections are:
```
Pin 1 = GND
Pin 4 = RX In (connect to TX Out of your serial cable)
Pin 5 = TX Out (connect to RX in of your serial cable).
```
The bottom left-corner of the 2-row header is GND. You'll have to short that with a wire to the following test point:
This test-point is shorted to GND with a paper-clip or wire. Click image for full-sized to see in better detail.

To get the system working, check you are getting boot messages. Now, restart the system and after you get a bit of output, short the pin. You might see some output like this:

U-Boot 1.1.4 (Sep 8 2015 - 04:08:21)

bsb002 - Honey Bee 2.0DRAM:
sri
Honey Bee 2.0
ath_ddr_initial_config(195): (16bit) ddr2 init
tap = 0x00000003
Tap (low, high) = (0x8, 0x22)
Tap values = (0x15, 0x15, 0x15, 0x15)
64 MB
Top of RAM usable for U-Boot at: 84000000
Reserving 214k for U-Boot at: 83fc8000
Reserving 192k for malloc() at: 83f98000
Reserving 44 Bytes for Board Info at: 83f97fd4
Reserving 36 Bytes for Global Data at: 83f97fb0
Reserving 128k for boot params() at: 83f77fb0
Stack Pointer at: 83f77f98
Now running in RAM - U-Boot at: 83fc8000
Flash Manuf Id 0xc8, DeviceId0 0x40, DeviceId1 0x13
flash size 0MB, sector count = 8
Flash: 512 kB
*** Warning *** : PCIe WLAN Module not found !!!
In:    serial
Out:   serial
Err:   serial
Net:   ath_gmac_enet_initialize...
Fetching MAC Address from 0x83febe80
Fetching MAC Address from 0x83febe80
ath_gmac_enet_initialize: reset mask:c02200
Scorpion ---->S27 PHY*
S27 reg init
: cfg1 0x800c0000 cfg2 0x7114
eth0: 00:03:7f:11:20:ce
athrs27_phy_setup ATHR_PHY_CONTROL 4 :1000
athrs27_phy_setup ATHR_PHY_SPEC_STAUS 4 :10

Which will then fall back to a prompt:

ath>

Good news! We can now get everything working for you. You can print the existing variables if you wish:

ath> printenv

Set a boot delay such we can enter the menu without the boot hack:
```
setenv bootdelay 3
```
Check it works with
```
printenv bootdelay
```
and confirm you get a line like this:
```
bootdelay=3
```
Finally, save the setting with:
```
saveenv
```
You can now reset the system (use the 'reset' command), and confirm there is a count-down that gives you time to hit "enter" and get this prompt again.

Now let's fix the root password. Before doing this, I suggest you keep a copy of the old value:
```
printenv security
```
This would let you restore things back to default. Then the following will set the root password to 'toor':
```
setenv security '$1$3vGNd7Q3$ISqFeo1VkmQV6nyriUV0V/'
```
You may have to copy this into notepad first to ensure it all fits on one line! The quotes are critical here. Again check it works with printenv, then type saveenv to store things to disk.

SECT-2015 Talk Slides

Fri, 18 Sep 2015 08:48:26 +0000

On Friday at 14:15 I’m giving a talk about my open-source power analysis and glitching projected called ChipWhisperer at SEC-T. Here is some useful links if you watched the presentation:

See information about the entire project at www.ChipWhisperer.com too! Video will be posted online at some point too.

DEFCON Talk Slides

Thu, 06 Aug 2015 15:05:35 +0000

On Friday at 1PM I’m giving a talk about my ChipWhisperer. Here is some useful links:

See information about the entire project at www.ChipWhisperer.com too!

ESC SV 2015 - USSSSSB: Talking USB From Python

Tue, 09 Jun 2015 01:51:57 +0000

At ESC 2015 SV I gave a talk on using USB From Python, see the talk description here. This blog post is serving as a placeholder to allow me to update links to software used during the live demo.

For SuperCon 2015, there is a Project Page with these details too. You can also ask questions on the project page.

Download Slides

There is two versions of the slides. Use the SuperCon slides, but I left a copy of the ESC ones here in case you wanted the original for some reason.

EELive! (ESC) Conference Slides + Programs

Tue, 01 Apr 2014 18:19:00 +0000

See my presentation at EELive? If so you can download the slides from: http://www.newae.com/files/ThinkFastFPGADesignUsing_OFlynn.pdf And the ISE + Vivado HLS Project from: http://www.newae.com/files/ThinkFast_FPGA_Files.zip. You can also check out additional details at the Programmable Logic in Practice post, which includes videos + examples of other uses of HLS.

AtlSecCon Presentation Slides

Thu, 27 Mar 2014 15:23:00 +0000

Alright - if you want a copy of my slides from the presentation today, check out http://www.newae.com/files/ATLSECConSlides.pdf

Breaking IEEE 802.15.4 Networks: Paper/Presentation

Sat, 12 Feb 2011 12:00:56 +0000

I presented a paper entitled at a conference in Paris, France this past week. Much to my surprise it was selected as the best paper in the security track! I’ve now posted it online, along with the presentation + notes from Paris. See all the information on my Articles page.