1
00:00:03,930 --> 00:00:05,970
Hardware Hacking Village.

2
00:00:06,390 --> 00:00:11,910
Welcome to Boston's Hacking Underground.

3
00:00:12,110 --> 00:00:15,630
Quite literally we are in my basement.

4
00:00:16,150 --> 00:00:21,710
Socially distant greetings from down here.

5
00:00:21,910 --> 00:00:28,030
Hopefully I managed to secure the location as in there is not going to be any noise and we get a reasonable recording.

6
00:00:29,950 --> 00:00:31,510
And that's it.

7
00:00:31,510 --> 00:00:32,890
Let's get started.

8
00:00:32,890 --> 00:00:36,730
I'm going to take the mask off since you're sufficiently far away.

9
00:00:36,730 --> 00:00:46,810
And while I certainly wanted to wear a fork bomb on a mask for a long time, I cannot go for a full hour doing that.

10
00:00:47,330 --> 00:00:55,010
So we have 45 or odd slides and the demo.

11
00:00:55,010 --> 00:00:57,430
So let's get going.

12
00:00:58,450 --> 00:01:07,510
Now, as a way of introduction, I had the privilege of spending my entire career in free and open source software.

13
00:01:08,330 --> 00:01:13,010
I am the product management director for Red Hat Ceph.

14
00:01:13,070 --> 00:01:18,310
And I was previously Ubuntu server PM at Canonical.

15
00:01:18,310 --> 00:01:23,810
And if you go back a decade, I was the dreaded systems management tsar at SUSE.

16
00:01:23,930 --> 00:01:26,850
The talk has nothing to do with my job.

17
00:01:26,850 --> 00:01:29,570
Well, I guess it is storage after all.

18
00:01:29,830 --> 00:01:31,650
I'm a manager these days.

19
00:01:31,650 --> 00:01:35,730
So as a former embedded developer, this is my definition of fun.

20
00:01:36,930 --> 00:01:43,650
The obligatory disclaimer is that we will most likely break some hardware playing with this.

21
00:01:43,650 --> 00:01:45,870
And it will come out of your pocket.

22
00:01:45,870 --> 00:01:52,930
No liability if you follow our instructions and stub your toe or bring about the end of the world.

23
00:01:53,210 --> 00:01:56,190
Or break your device, which is far more likely.

24
00:01:56,410 --> 00:01:58,210
So you have been warned.

25
00:01:58,270 --> 00:01:59,550
Let's get going.

26
00:01:59,570 --> 00:02:02,090
We have a lot of slides in the demo.

27
00:02:02,090 --> 00:02:03,230
We need to hustle a bit.

28
00:02:04,690 --> 00:02:06,070
Here is the idea.

29
00:02:06,810 --> 00:02:10,050
A processor is found in an SD card.

30
00:02:10,710 --> 00:02:13,510
Hackaday featured somebody's blog.

31
00:02:13,510 --> 00:02:18,670
Pretty much went viral in a word of web process.

32
00:02:18,670 --> 00:02:23,030
Virally blooming once Linux was noticed on the device.

33
00:02:23,030 --> 00:02:25,810
And Hackaday made it famous.

34
00:02:25,810 --> 00:02:27,130
Lots of blogs.

35
00:02:27,130 --> 00:02:28,870
SD card sized.

36
00:02:28,870 --> 00:02:30,870
Almost a raspberry pi.

37
00:02:30,870 --> 00:02:33,190
Can we repurpose the device?

38
00:02:34,650 --> 00:02:40,230
The word of web process really got going once Linux was noticed on the device.

39
00:02:41,250 --> 00:02:44,850
And so I noticed all this was going on.

40
00:02:44,930 --> 00:02:47,030
And I wanted a project for Christmas.

41
00:02:47,030 --> 00:02:51,270
That was five years and a bit more ago.

42
00:02:51,490 --> 00:02:55,330
So you could say that it has taken me for quite a ride.

43
00:02:56,970 --> 00:03:06,410
Let me repeat that as there is always someone who has no idea what I'm talking about.

44
00:03:06,410 --> 00:03:07,850
Here is the concept.

45
00:03:07,850 --> 00:03:09,810
A Wi-Fi enabled SD card.

46
00:03:10,070 --> 00:03:12,310
Automatically downloads your pictures.

47
00:03:12,470 --> 00:03:14,250
Several models exist.

48
00:03:14,450 --> 00:03:17,150
We're after the embedded system in there.

49
00:03:17,150 --> 00:03:18,050
In the card.

50
00:03:18,050 --> 00:03:20,110
The CPU of the card itself.

51
00:03:20,210 --> 00:03:24,650
It's like the Intel Edison they originally promised us, but for real this time.

52
00:03:26,390 --> 00:03:30,770
Copious amounts of Google Translate were used in the making of this talk.

53
00:03:30,770 --> 00:03:32,570
Really international effort.

54
00:03:32,570 --> 00:03:39,050
I saw blogs in French, Japanese, German, Korean, and of course English.

55
00:03:39,050 --> 00:03:41,170
Some Russian too.

56
00:03:41,210 --> 00:03:43,570
And I believe some Spanish.

57
00:03:43,950 --> 00:03:48,210
So copious use of Google Translate and in singularity of course.

58
00:03:48,950 --> 00:03:56,590
We explored the limits of machine translation, but it usually comes across clear enough to work with.

59
00:03:57,730 --> 00:04:03,450
So we're looking at the Trescend Wi-Fi SD line here.

60
00:04:03,450 --> 00:04:08,250
It comes in size from 8 gigabytes to 32 gigabytes.

61
00:04:08,250 --> 00:04:23,930
I prefer them as they are more open, even without hacking, as there are no attempts at platform strategies made by adding any middling cloud services that we do not want by some clever MBA that had a platforms class.

62
00:04:24,190 --> 00:04:29,790
There is no stepping stone service that may make things easier to set up.

63
00:04:29,790 --> 00:04:31,310
And doesn't.

64
00:04:31,410 --> 00:04:35,390
And adds yet another place your pictures are potentially in.

65
00:04:35,450 --> 00:04:42,750
The software on the Trescend card is simple and not perfect, but that is an asset for us as we will see.

66
00:04:43,670 --> 00:04:46,010
So where do we get these cards?

67
00:04:46,010 --> 00:04:47,630
You can go to Amazon.

68
00:04:47,630 --> 00:04:49,150
You could also try eBay.

69
00:04:50,810 --> 00:04:59,610
And they're going to be between $40 and $60 depending on capacity, about the price of Raspberry Pi and up.

70
00:04:59,610 --> 00:05:05,910
There are others like the PQi AirCard that are functionally the same.

71
00:05:06,190 --> 00:05:11,370
The PQi AirCard is interesting because it is actually an adapter card.

72
00:05:11,370 --> 00:05:18,350
You can put any storage you want in microSD format in there, and the adapter actually has the embedded system.

73
00:05:18,830 --> 00:05:23,150
Toshiba makes another one, and there is also the Flu card.

74
00:05:23,710 --> 00:05:26,250
And you can carry binaries through them.

75
00:05:26,410 --> 00:05:35,630
As a matter of fact, when you log into the system, you may notice that there is a command buzz in there.

76
00:05:36,270 --> 00:05:41,010
But there is no piezoelectric transducer here, so what is that for?

77
00:05:42,490 --> 00:05:47,970
But looking at another one of the card designs, that has a piezo.

78
00:05:48,510 --> 00:05:54,190
So you can learn things on one card that applies to another.

79
00:05:54,930 --> 00:05:59,730
But we're getting a little bit sidetracked here, so let's go back to where we should be.

80
00:05:59,730 --> 00:06:04,290
When the postman arrives, here is what you get.

81
00:06:05,330 --> 00:06:12,570
Inside the package, let's unbox one here, a card and an adapter.

82
00:06:12,610 --> 00:06:15,050
The inevitable legal disclaimer.

83
00:06:15,590 --> 00:06:20,330
I don't think this conference has a legal track, otherwise I would blame the lawyers.

84
00:06:21,130 --> 00:06:26,130
And a microscopic bit of a manual, which is actually not bad.

85
00:06:26,130 --> 00:06:35,310
The adapter is there because you can write to the SD card directly by mounting it on your Mac, for example, or over the radio.

86
00:06:36,010 --> 00:06:45,030
And when you have file systems mounted two places, and you are writing from two places, bad things happen.

87
00:06:45,690 --> 00:06:53,470
The adapter signals to the card to disable the radio, and prevents simultaneous writes from the air and local mount.

88
00:06:53,490 --> 00:06:57,170
Of course, that is exactly what we want to do.

89
00:06:57,170 --> 00:06:59,210
But we think before we do.

90
00:06:59,210 --> 00:07:05,890
We only want to use the radio, so we'll assemble it so it is actually not turned off.

91
00:07:06,750 --> 00:07:09,190
So just what is in there?

92
00:07:11,030 --> 00:07:15,690
This is an SDHC class 10 card.

93
00:07:15,810 --> 00:07:19,930
16 gigabytes in the case of the ones I used.

94
00:07:19,930 --> 00:07:22,450
Half and double the size exists.

95
00:07:22,870 --> 00:07:25,750
This is a full-size SD card.

96
00:07:25,750 --> 00:07:32,090
Pictured is model TS16GWSDHC10.

97
00:07:33,050 --> 00:07:38,370
You will have the slides at the end, so if you want to search for the cards, you'll have all the models.

98
00:07:38,370 --> 00:07:41,110
There is no need to take notes or any of that.

99
00:07:43,330 --> 00:07:47,250
So physically breaking the device voids the warranty.

100
00:07:47,290 --> 00:07:49,910
I bet you did not see that one coming.

101
00:07:52,430 --> 00:07:58,110
Exacto-knifing our way to success, we slice the card in two and find four large chips.

102
00:07:58,430 --> 00:07:59,470
Interesting.

103
00:07:59,670 --> 00:08:02,370
The parts on the left are the case.

104
00:08:02,370 --> 00:08:04,390
Nothing strange there.

105
00:08:05,150 --> 00:08:11,050
It may help guide your dissection if you need to open one, but that's about it.

106
00:08:11,770 --> 00:08:15,230
Incidentally, do you see the yellow tab in the center?

107
00:08:15,390 --> 00:08:18,870
That is the write-protect switch cards have.

108
00:08:18,870 --> 00:08:20,850
Interesting technical detail.

109
00:08:20,850 --> 00:08:25,090
There is nothing on the device reading the state of that toggle.

110
00:08:25,550 --> 00:08:30,670
The reason for this is that SD cards work like floppy drives.

111
00:08:31,770 --> 00:08:38,690
And in floppy drives, if you still remember those devices, write-protect is implemented by the drive.

112
00:08:38,890 --> 00:08:41,870
If the drive sends a write, the card will take it.

113
00:08:44,210 --> 00:08:56,750
If the card doesn't know and doesn't have to, the drive will not send a write if the toggle is in the protect position.

114
00:08:58,590 --> 00:09:02,610
So let's do a bit of overview of the components from the top left.

115
00:09:02,610 --> 00:09:13,470
We have a trace antenna, definitely not a 3 dB antenna and not 100 milliwatts of broadcasting power as the whole card consumes less than that.

116
00:09:14,110 --> 00:09:19,610
So Wi-Fi range will not be as per the Wi-Fi specs maximum.

117
00:09:19,630 --> 00:09:23,630
But that's okay because we're still beating the pants off Bluetooth.

118
00:09:24,270 --> 00:09:26,530
There is no antenna connector.

119
00:09:26,590 --> 00:09:31,240
You could try your hand at adding one if you're a master at soldering.

120
00:09:35,030 --> 00:09:39,790
But assuming you don't, you're not going to get the full Wi-Fi range.

121
00:09:39,810 --> 00:09:41,870
And I'm okay with that.

122
00:09:42,970 --> 00:09:46,670
Then we have the Wi-Fi radio chip.

123
00:09:47,810 --> 00:09:52,450
The SoC with the ARM CPU we are after is underneath it.

124
00:09:53,570 --> 00:09:57,310
16 gigs of flash in the big chip.

125
00:09:58,050 --> 00:10:01,290
And the flash controller is the last thing on the right.

126
00:10:02,270 --> 00:10:08,090
And up top we see the notch where the read-write tab rests that I was mentioning.

127
00:10:08,730 --> 00:10:12,850
And there is no actual board sensing of any kind as I said.

128
00:10:12,850 --> 00:10:16,490
The card is just making room for the tab to fit in that space.

129
00:10:17,870 --> 00:10:19,350
Flip side.

130
00:10:19,590 --> 00:10:29,930
Besides the standard SD leads, some of the smaller pads are TX and RX for a 3.3 volt 38400 baud serial.

131
00:10:30,410 --> 00:10:33,570
Annoyingly, really annoyingly, they are not labeled.

132
00:10:34,330 --> 00:10:40,710
They labeled resistors we don't really give a hoot about instead for who knows what reason.

133
00:10:41,430 --> 00:10:47,110
On the PQI air card, the TX and RX serial pads are labeled.

134
00:10:47,150 --> 00:10:49,550
So bonus points to those guys for that.

135
00:10:50,370 --> 00:10:55,530
If you do wired serial, you get access to a well-configured U-boot console.

136
00:10:56,190 --> 00:11:01,470
U-boot is the bootloader of choice for embedded Linux devices for those of you coming from Windows.

137
00:11:01,470 --> 00:11:03,650
A very handy tool to have.

138
00:11:04,670 --> 00:11:10,170
Better than the kernel that is in here as it has been stripped to the bone.

139
00:11:10,690 --> 00:11:14,790
Incidentally, I have been collecting all these details for a survey article.

140
00:11:15,050 --> 00:11:18,450
If you hack the card and blog the details, let me know.

141
00:11:18,450 --> 00:11:19,630
Send me the link.

142
00:11:20,110 --> 00:11:27,790
And you prefer going... if you prefer going the lazy way, you will get a how-to from me soon.

143
00:11:27,830 --> 00:11:28,330
Hopefully.

144
00:11:28,330 --> 00:11:31,910
I've been saying this for a while, but it's almost done.

145
00:11:34,940 --> 00:11:37,980
What's in there are these four chips.

146
00:11:38,000 --> 00:11:42,340
CPU, Wi-Fi module, flash controller, and storage.

147
00:11:44,040 --> 00:11:51,360
The SoC's 32 megabytes of RAM is the weakest spot of the board but very suitable for embedded use.

148
00:11:51,360 --> 00:11:55,500
Fear not those of you who are used to gigabytes of RAM.

149
00:11:55,500 --> 00:11:58,820
Besides, you have lots of storage.

150
00:11:58,820 --> 00:12:01,060
You could expand this with swap.

151
00:12:01,400 --> 00:12:05,240
If the kernel was built with support for swap.

152
00:12:05,860 --> 00:12:16,260
In the SoC, 8 megabytes of NOR flash are used for system including a stripped down kernel and compressed initramfs.

153
00:12:16,880 --> 00:12:19,660
Interesting compromises were made there.

154
00:12:19,660 --> 00:12:22,860
And of course, massive amounts of storage.

155
00:12:23,380 --> 00:12:29,680
So you could boot with a small system loop mount a larger image and shroot into it.

156
00:12:30,200 --> 00:12:35,380
If you had loop mount in this kernel, I start seeing a pattern here.

157
00:12:35,840 --> 00:12:37,600
But not all is lost.

158
00:12:37,600 --> 00:12:38,960
We can add it.

159
00:12:39,380 --> 00:12:42,980
Dimitri Greenberg has documented how to rebuild the kernel.

160
00:12:43,060 --> 00:12:47,760
So we have the instructions and the steps on how to do this already worked out.

161
00:12:48,120 --> 00:12:49,920
Let's look at the CPU.

162
00:12:49,920 --> 00:12:52,520
It's a 200 megahertz CPU.

163
00:12:52,880 --> 00:12:56,840
Some report 400 megahertz and they are wrong.

164
00:12:56,840 --> 00:13:01,100
They are confused by the 426 bogomips it sports.

165
00:13:01,580 --> 00:13:08,960
It's an ARM 926 EJS core.

166
00:13:09,640 --> 00:13:12,060
An ARM 9 processor.

167
00:13:12,060 --> 00:13:16,400
This is not a Cortex A9, but an older ARM 9.

168
00:13:16,400 --> 00:13:18,540
A low cost CPU.

169
00:13:19,040 --> 00:13:32,040
ARM 5 TEJ architecture with more than 5 billion with the B manufactured to date.

170
00:13:32,080 --> 00:13:40,220
Interesting extensions for Java, but the Giselle runtime requires talking to ARM as it was not shipped with the system.

171
00:13:40,220 --> 00:13:43,540
And anyway, who wants to do Java these days?

172
00:13:43,800 --> 00:13:46,240
So interesting core.

173
00:13:46,920 --> 00:13:48,520
The extensions.

174
00:13:48,520 --> 00:14:00,080
E stands for DSP, Digital Signal Processing Enhancements, because this processor used to be used for making feature phones.

175
00:14:00,640 --> 00:14:06,240
J for Java extensions or the Giselle JVM.

176
00:14:06,260 --> 00:14:12,560
Java extensions make byte codes directly usable by the CPU, which is really cool.

177
00:14:12,780 --> 00:14:20,960
The CPU instruction BJX branch to Java instruction, which switches the silicon to Giselle state.

178
00:14:20,960 --> 00:14:23,680
The JVM still handles errors.

179
00:14:23,680 --> 00:14:26,160
The OS handles the traps.

180
00:14:26,160 --> 00:14:35,700
But between 134 and 149 byte codes of the 203 in the JVM spec are handled in silicon.

181
00:14:35,700 --> 00:14:39,220
I don't know why the variation there.

182
00:14:39,220 --> 00:14:40,780
Why not a fixed number?

183
00:14:40,780 --> 00:14:47,120
But a large chunk of the byte code is running in hardware.

184
00:14:47,600 --> 00:14:54,360
Now, the original Raspberry Pi is a Broadcom BCM2835 processor.

185
00:14:54,780 --> 00:15:04,060
An ARM11 76JZF-S.

186
00:15:05,220 --> 00:15:09,140
This is an ARM6K architecture.

187
00:15:09,140 --> 00:15:13,300
It's closer to this processor than it is to a Cortex ARM.

188
00:15:13,520 --> 00:15:20,180
So the idea is that instead of the chip in the Pi, you would use the chip in the card.

189
00:15:20,240 --> 00:15:22,300
With different trade-offs.

190
00:15:22,300 --> 00:15:25,620
You get built-in radio, lose all the interfaces.

191
00:15:25,700 --> 00:15:28,220
The price stays just about the same.

192
00:15:29,320 --> 00:15:31,740
The radio is a Fortune chip.

193
00:15:34,720 --> 00:15:38,660
AFN31GL Wi-Fi controller.

194
00:15:38,820 --> 00:15:49,900
It comes with an Atheros AR6003 Wi-Fi core, which was marketed as the smallest Wi-Fi silicon design you could buy at the time.

195
00:15:50,400 --> 00:15:55,940
I don't know if they still have the record, but it was a pretty impressive claim five years ago.

196
00:15:55,940 --> 00:16:04,940
The bit we care about is that it does Wi-Fi B, G, and N with really low power draw.

197
00:16:06,220 --> 00:16:10,540
Do not plan to saturate the Wi-Fi Ethernet link with this device.

198
00:16:10,540 --> 00:16:13,880
You won't go much beyond one megabyte per second.

199
00:16:14,520 --> 00:16:21,460
Incidentally, if you feel like going turtles all the way down, there is a CPU to control the baseband radio.

200
00:16:21,520 --> 00:16:29,680
An Extensa MIPS core backed by 256 kilobytes of RAM and 256 kilobytes of ROM.

201
00:16:29,880 --> 00:16:31,220
I didn't go in there.

202
00:16:31,220 --> 00:16:35,260
Maybe it could be the next project for one of you.

203
00:16:36,180 --> 00:16:41,640
Also, this chip does not do Bluetooth, by the way.

204
00:16:41,640 --> 00:16:43,000
Not that we care.

205
00:16:45,140 --> 00:16:48,680
Then we have 16 gigs of NAND flash.

206
00:16:48,860 --> 00:16:50,660
You will not be wanting for storage.

207
00:16:50,660 --> 00:16:51,520
That's for sure.

208
00:16:51,520 --> 00:16:55,040
That is definitely not the problem the system has.

209
00:16:56,400 --> 00:17:00,180
The flash controller is a Silicon Motion 26...

210
00:17:05,000 --> 00:17:07,540
I can just read the slide.

211
00:17:08,840 --> 00:17:09,940
2683EN.

212
00:17:09,940 --> 00:17:11,120
Thank you, picture.

213
00:17:11,360 --> 00:17:20,480
Nothing of interest here except there was a bit of annoyance in the community at the lack of redistributed sources for some system components.

214
00:17:21,540 --> 00:17:22,860
Transcend resolved this.

215
00:17:22,860 --> 00:17:24,500
It's no longer an issue.

216
00:17:24,500 --> 00:17:27,700
But one of the modules is proprietary.

217
00:17:27,700 --> 00:17:30,500
The one that supports the flash controller.

218
00:17:31,440 --> 00:17:40,280
If you're familiar with IP restrictions for source code of video drivers, that is probably a similar reason.

219
00:17:40,280 --> 00:17:48,420
There is some secret sauce that the vendors of flash want to keep to themselves and not share with one another.

220
00:17:49,240 --> 00:17:51,280
We don't know what it is.

221
00:17:51,280 --> 00:18:04,230
But it's not really a concern for us unless you are an open source legal purist and you want everything in the open out of principle.

222
00:18:05,790 --> 00:18:09,090
The sources... I mean the sources for some of the modules are available.

223
00:18:09,090 --> 00:18:11,470
The binaries for all three modules are available.

224
00:18:11,470 --> 00:18:16,490
So if we recompile the kernel we can just drop the modules back in and go on from there.

225
00:18:16,490 --> 00:18:22,750
It's not like we're going to modify our interface to the flash to the flash chip anyway.

226
00:18:23,730 --> 00:18:25,510
We're not interested in that.

227
00:18:27,430 --> 00:18:37,310
Now, this card clocks between 0.9 and 1.1 watts while idle in my office.

228
00:18:37,310 --> 00:18:42,770
It peaks at 1.5 with wireless clients connected.

229
00:18:43,310 --> 00:18:47,330
This is a 110 volt power supply of course.

230
00:18:47,530 --> 00:18:49,790
An Apple switched power supply.

231
00:18:49,790 --> 00:18:53,490
Efficient but still power conversion is a factor.

232
00:18:53,490 --> 00:18:59,850
Presumably higher if you push the CPU to 100% while writing to flash.

233
00:19:02,090 --> 00:19:08,650
You could also try to push consumption by simultaneously pegging the CPU and massively writing to flash.

234
00:19:08,690 --> 00:19:12,050
I got my numbers by exercising the radio only.

235
00:19:12,050 --> 00:19:16,050
I didn't do a full suite of benchmarks at different types of load.

236
00:19:16,450 --> 00:19:23,450
This is a relatively lightweight system so I didn't see the need to push the envelope that far.

237
00:19:23,450 --> 00:19:36,070
Interestingly, I checked to see if we would get better efficiency through eliminating the power conversion step.

238
00:19:36,110 --> 00:19:39,070
And we hardly see a difference.

239
00:19:39,070 --> 00:19:44,490
220 milliamps is about 1.1 watts at 5 volts.

240
00:19:44,650 --> 00:19:49,530
Same as we measured at 120 for idle.

241
00:19:49,530 --> 00:19:53,290
It closely matches the other one.

242
00:19:53,290 --> 00:19:55,910
Apple really knows what they're doing.

243
00:19:55,910 --> 00:19:58,750
That iPhone switched power supply is really efficient.

244
00:19:58,750 --> 00:20:00,230
Good for them.

245
00:20:02,050 --> 00:20:05,470
Let's start looking at the software side.

246
00:20:06,890 --> 00:20:22,530
I'm going to walk you through what we do to make it work first and how we hack it second so it's not hanging in the void and confusing in as to how we got there.

247
00:20:22,530 --> 00:20:24,650
How does this all work?

248
00:20:24,650 --> 00:20:27,910
First you set up the app on your phone.

249
00:20:29,270 --> 00:20:34,750
Then it gives you access to basic setup and core functionality.

250
00:20:34,870 --> 00:20:38,430
Setting up network mode, names, password.

251
00:20:39,050 --> 00:20:50,670
Shoot and view here means putting the phone in a monitor mode of sorts where any picture shot by the camera is automatically downloaded and presented on the screen with no intervention.

252
00:20:50,790 --> 00:20:52,750
This will be important later.

253
00:20:54,470 --> 00:20:57,390
It also offers you to upgrade the firmware.

254
00:20:57,490 --> 00:21:04,350
Usually this is a concern as that precious security hole used for routing may disappear.

255
00:21:04,350 --> 00:21:06,350
But it's not so in this case.

256
00:21:06,350 --> 00:21:11,830
It does not matter what version of the firmware you have, you're going to get around it.

257
00:21:11,910 --> 00:21:13,270
So do not worry about it.

258
00:21:13,270 --> 00:21:15,910
The latest version is as open as the first.

259
00:21:16,870 --> 00:21:20,430
It is both good and bad, I guess.

260
00:21:20,710 --> 00:21:22,290
I say it is good.

261
00:21:22,290 --> 00:21:24,130
It lets us hack the card.

262
00:21:24,390 --> 00:21:29,210
Security issues we bring about are not in the hacking of the binary support package.

263
00:21:29,210 --> 00:21:31,570
But we'll get to that later.

264
00:21:32,150 --> 00:21:36,130
By default, the system wants to be its own access point.

265
00:21:36,130 --> 00:21:39,290
Great, very convenient for development.

266
00:21:39,290 --> 00:21:41,650
But not so for photo download.

267
00:21:41,650 --> 00:21:47,770
Think of it, you want to switch APs on your handheld device every time to sync pictures.

268
00:21:48,170 --> 00:22:00,270
The seamless internet AP client mode is a great strength of this card for ease of use compared to others that make it needlessly more complex by putting their service in the middle.

269
00:22:00,270 --> 00:22:03,430
You just choose the mode you want and you get it.

270
00:22:05,350 --> 00:22:10,210
So when it is up, it shows here from another machine in the same room.

271
00:22:10,650 --> 00:22:13,750
Your SD card has now become its own access point.

272
00:22:13,990 --> 00:22:15,990
Okay, what's next?

273
00:22:17,330 --> 00:22:21,990
Well, now we can connect to it just like you would anywhere else.

274
00:22:24,030 --> 00:22:28,330
And now we can ping it just like any other host.

275
00:22:31,000 --> 00:22:34,620
Now let's look at how it works before we get into it.

276
00:22:34,620 --> 00:22:35,500
Think about it.

277
00:22:35,500 --> 00:22:39,560
The app needs to find where the heck the card is.

278
00:22:39,840 --> 00:22:44,720
It is out there on the AP, but at what IP address?

279
00:22:45,180 --> 00:22:50,920
The card broadcasts on UDP 55777.

280
00:22:50,920 --> 00:22:52,620
I'm here, I'm here, I'm here.

281
00:22:53,300 --> 00:22:56,140
Other cards are even more aggressive.

282
00:22:56,760 --> 00:23:08,280
They ARP the entire slash 24 subnet, found out where every node is, then send HTTP requests to everyone until it finds the card.

283
00:23:08,360 --> 00:23:10,320
Then maybe it stops.

284
00:23:10,320 --> 00:23:12,460
Most of the time it does anyway.

285
00:23:12,680 --> 00:23:14,140
Don't worry, we can fix this.

286
00:23:14,140 --> 00:23:16,360
It's just funny to me.

287
00:23:16,780 --> 00:23:22,480
The tools are only needed for initial IP discovery and password setup.

288
00:23:22,480 --> 00:23:34,360
If you do not want to use them, the card comes with a default user admin with a password of 1, 2, 3, 4, 5, 6, 7, 8.

289
00:23:35,020 --> 00:23:37,660
But that's not the part that will make you laugh.

290
00:23:39,420 --> 00:23:42,440
We port scan the card to see what's going on here.

291
00:23:42,740 --> 00:23:46,320
Here we see Telnet because I already cracked this one.

292
00:23:47,600 --> 00:23:51,380
The HTTP server, the pictures are published there.

293
00:23:51,760 --> 00:23:54,820
The app just HTTP gets them.

294
00:23:55,220 --> 00:23:59,220
Services are offered as CGI scripts out of the web server.

295
00:23:59,360 --> 00:24:02,240
That's how the app commands the card to do things.

296
00:24:02,740 --> 00:24:08,460
The additional port 5566 broadcasts new entries in shoot and view mode.

297
00:24:08,500 --> 00:24:13,040
If you're connected there, you get a new URL message for every picture.

298
00:24:13,040 --> 00:24:15,520
That's how shoot and view works.

299
00:24:15,600 --> 00:24:20,060
You get one line with URL of new pictures when they're generated.

300
00:24:20,060 --> 00:24:21,960
Very simple architecture.

301
00:24:21,960 --> 00:24:23,240
Not bad.

302
00:24:23,780 --> 00:24:24,940
A few quirks.

303
00:24:24,940 --> 00:24:27,040
It downloads pictures twice.

304
00:24:27,140 --> 00:24:34,780
A bit suboptimal that way, but in this way it doesn't have to spend CPU power to generate thumbnails on board.

305
00:24:34,940 --> 00:24:42,160
Trades a little of bandwidth for not having to spend CPU and power.

306
00:24:42,240 --> 00:24:47,220
It also assumes that you're not downloading multiple pictures at once, which you're not.

307
00:24:47,220 --> 00:24:48,700
So simplicity prevails.

308
00:24:48,700 --> 00:24:51,180
I'm a fan of that type of design.

309
00:24:52,500 --> 00:24:56,940
We can browse the card's HTTP server directly.

310
00:24:56,940 --> 00:24:59,000
It's a boa web server.

311
00:24:59,280 --> 00:25:01,480
It exposes directory listings.

312
00:25:01,480 --> 00:25:06,920
In theory, it should show you only the directory listings of the data.

313
00:25:07,500 --> 00:25:10,760
And simple CGI bin scripts to set configuration.

314
00:25:10,940 --> 00:25:12,720
These are in Perl.

315
00:25:13,160 --> 00:25:20,220
App simply downloads the files via HTTP and calls CGI scripts to configure the system.

316
00:25:20,580 --> 00:25:23,140
And these scripts are way in.

317
00:25:23,140 --> 00:25:26,060
That's how the card was broken into.

318
00:25:28,850 --> 00:25:37,230
So this story starts with Pablo, who thinks there must be a CPU in these Wi-Fi enabled cards and turns out that he is right.

319
00:25:37,490 --> 00:25:41,990
Pablo went out and started poking at the software, looking for security holes.

320
00:25:41,990 --> 00:25:44,650
Find several the size of a small barn.

321
00:25:45,110 --> 00:25:53,450
Found dot dot slash dot dot slash backpats breaking out of the allowed inspection area.

322
00:25:53,590 --> 00:26:02,930
He extracts the source files for the CGI bin, exploits a Perl script, and in he goes.

323
00:26:03,130 --> 00:26:06,690
And I went that way myself the first time.

324
00:26:06,690 --> 00:26:09,190
But there is a better way.

325
00:26:09,410 --> 00:26:15,630
A file called autorun.sh.

326
00:26:16,190 --> 00:26:19,430
I think you know where this is going.

327
00:26:20,670 --> 00:26:25,550
Write a file to the SD card named autorun.sh.

328
00:26:25,610 --> 00:26:29,190
The system will read it and execute it.

329
00:26:29,190 --> 00:26:31,170
With root privilege.

330
00:26:31,190 --> 00:26:32,930
At boot.

331
00:26:33,190 --> 00:26:38,870
So all I have to do is just go, telnet please, and telnet arrives.

332
00:26:38,870 --> 00:26:40,390
So much nicer.

333
00:26:40,470 --> 00:26:44,290
Now, the security freaks among you will be horrified.

334
00:26:44,290 --> 00:26:47,590
But in terms of actually working with the card, this is fabulous.

335
00:26:47,590 --> 00:26:49,250
It makes it so nice.

336
00:26:49,490 --> 00:26:55,430
There is another aspect to this that is humorously named.

337
00:26:57,490 --> 00:26:59,490
I know what you're thinking.

338
00:26:59,630 --> 00:27:01,110
But that's not it.

339
00:27:01,390 --> 00:27:03,850
It stands for firmware update.

340
00:27:04,290 --> 00:27:06,030
It's a clever mechanism.

341
00:27:06,090 --> 00:27:11,030
You supply autorun.sh and three files.

342
00:27:11,030 --> 00:27:13,870
The kernel, the program bin.

343
00:27:14,330 --> 00:27:17,590
The system starts program bin.

344
00:27:17,590 --> 00:27:21,470
Turns out this is a copy of the cards you boot with the default script payload.

345
00:27:22,010 --> 00:27:26,110
The script loads the new system onto the old and then reboots.

346
00:27:26,330 --> 00:27:28,310
It's a nice way to prevent breaking.

347
00:27:28,310 --> 00:27:33,850
It also resets all configuration to the defaults, which may be handy if you screwed up.

348
00:27:34,390 --> 00:27:39,030
It is a really nice way to revert breaking and also gives you a way back to the defaults.

349
00:27:39,310 --> 00:27:42,410
But obviously you can only undo software breaking.

350
00:27:42,630 --> 00:27:44,450
You can still break the hardware.

351
00:27:53,770 --> 00:27:56,190
It's time to try and do this live.

352
00:27:57,590 --> 00:28:00,190
I usually unbox one of these.

353
00:28:02,170 --> 00:28:07,930
But in a virtual setting it doesn't really make it very useful.

354
00:28:07,930 --> 00:28:13,950
And you have seen the pictures, so you've seen most of what there is to see in an unboxing.

355
00:28:14,690 --> 00:28:17,890
I had to find... so let's set it up.

356
00:28:18,650 --> 00:28:24,090
I had to find an SD adapter that does not switch off the radio.

357
00:28:25,490 --> 00:28:36,070
So I went to my local computer megastore and bought every single adapter in existence, tested them all, returned 9 out of 10.

358
00:28:36,670 --> 00:28:42,070
And now we have the right thing.

359
00:28:49,050 --> 00:28:52,750
And this thing boots really fast.

360
00:28:52,750 --> 00:28:59,430
So much so that if I connected over the serial, it would be up before I can connect to it.

361
00:28:59,430 --> 00:29:01,350
You would not see boot messages.

362
00:29:03,090 --> 00:29:07,030
It will just be there already.

363
00:29:09,770 --> 00:29:10,570
So...

364
00:29:20,870 --> 00:29:23,190
and we got the advertisement.

365
00:29:25,370 --> 00:29:27,790
And we are connected.

366
00:29:27,790 --> 00:29:31,290
We got a connection.

367
00:29:31,290 --> 00:29:37,010
Now I was connected to that card recently, so let's just do it this way.

368
00:29:37,670 --> 00:29:39,390
And see?

369
00:29:39,390 --> 00:29:42,030
It got there way before me.

370
00:29:44,930 --> 00:29:47,110
What are we going to see here?

371
00:29:47,570 --> 00:29:52,570
Let's start from version text.

372
00:29:54,610 --> 00:30:04,210
So the KeyASIC Wi-Fi SD is the ODM design that all these vendors purchase to make their own products.

373
00:30:07,790 --> 00:30:18,950
And you can see that it confirms the 802.11n Wi-Fi.

374
00:30:19,090 --> 00:30:29,110
The Linux kernel is 263228, one of our most popular Linux kernels ever.

375
00:30:29,110 --> 00:30:31,670
This one was in RHEL 6.

376
00:30:31,670 --> 00:30:43,090
It was in SUSE Linux Enterprise 11 SP1 in a breaking of continuity from 11 kernel rebase.

377
00:30:43,090 --> 00:30:54,230
And I believe it was in Ubuntu Server 10.04, although that one wasn't mine, so don't quote me on that, but I'm pretty sure.

378
00:30:56,790 --> 00:31:07,190
This is the kind of kernel that you would want to run when you have only 32 megs of RAM, so it's a very, very good choice.

379
00:31:07,390 --> 00:31:15,690
It will not be expecting gigs of RAM either in this form or in userland.

380
00:31:17,090 --> 00:31:18,890
What else?

381
00:31:19,710 --> 00:31:21,890
Well, let's see what's around here.

382
00:31:30,470 --> 00:31:34,490
We want to see something else, actually.

383
00:31:37,490 --> 00:31:44,250
This is the actual VFAT system of the SD card.

384
00:31:44,250 --> 00:31:56,850
And you can see that I plugged it into a Nikon digital camera that left its own fingerprint there and a few files that I've been poking around with.

385
00:31:57,210 --> 00:31:58,970
BusyBox is notable here.

386
00:31:58,970 --> 00:32:09,410
We could run that BusyBox and have a much more futureful shell environment, but I want to show you here how the card is rather than how we are going to make it.

387
00:32:09,410 --> 00:32:13,730
The making part we can defer to a writeup.

388
00:32:14,730 --> 00:32:19,370
But yeah, very easy to replace the shell by just downloading a BusyBox and executing it.

389
00:32:23,650 --> 00:32:39,890
Incidentally, once you have a new BusyBox, you can run the NTP module and not be in 2012 anymore, which is great because then you can do proper secure connectivity, not plain text telnet.

390
00:32:40,290 --> 00:32:46,490
And now that your certificates are not coming from the future, crypto will actually work.

391
00:32:48,450 --> 00:32:51,750
What do we have on the storage side?

392
00:32:54,090 --> 00:33:03,850
So you see the JFFS2 file system that is the 8 megabyte partition that the system boots from.

393
00:33:03,850 --> 00:33:07,830
That is the reason why things have been stripped down so much.

394
00:33:08,390 --> 00:33:10,090
It is tiny.

395
00:33:10,270 --> 00:33:13,430
Now I'm not an embedded developer anymore.

396
00:33:13,430 --> 00:33:18,870
In my time, JFFS2 was the most popular file system for embedded Linux devices.

397
00:33:19,030 --> 00:33:25,190
This device is about 7 years old in design, so I don't know if that has changed.

398
00:33:25,190 --> 00:33:28,030
But it's nice to see familiar things.

399
00:33:31,730 --> 00:33:38,430
Let's see what's in in mtd.

400
00:33:39,690 --> 00:33:43,090
Oh yeah, you can see the labels.

401
00:33:43,090 --> 00:33:49,130
So mtd0 then spi-flash-nor, that's the 8 megabytes.

402
00:33:50,630 --> 00:33:54,930
Okay, then

403
00:33:59,180 --> 00:34:03,740
we have Perl.

404
00:34:04,060 --> 00:34:06,920
5.14, not bad.

405
00:34:06,960 --> 00:34:10,440
Not an ancient single digit version.

406
00:34:10,440 --> 00:34:16,520
So that makes this potentially a system that you can develop on out of the box.

407
00:34:17,580 --> 00:34:20,420
Let's see what is running on it.

408
00:34:21,020 --> 00:34:22,480
We have

409
00:34:31,470 --> 00:34:34,380
the Telnet that we started.

410
00:34:35,370 --> 00:34:40,230
And we have two of the UDP-SVD processes.

411
00:34:40,230 --> 00:34:47,600
These are the ones that do the the broadcasting process that I described earlier.

412
00:34:48,820 --> 00:34:53,470
We have the Boa web server that's providing HTTP support.

413
00:34:54,330 --> 00:34:59,250
And we have a dynamic DNS advertisement.

414
00:35:01,110 --> 00:35:10,190
We have a DHCP server because in access point mode we have to serve out DHCP addresses to clients.

415
00:35:12,210 --> 00:35:23,450
The bodyguard process is the one that disables the radio when you plug the card into an SD card slot so that there is no double write.

416
00:35:26,180 --> 00:35:28,220
And that's about it.

417
00:35:28,560 --> 00:35:30,940
Let's see what do we have here.

418
00:35:37,730 --> 00:35:40,410
We already discussed the kernel version.

419
00:35:40,610 --> 00:35:43,510
We can see that it was compiled with sorcery

420
00:35:47,290 --> 00:35:49,130
on an Ubuntu machine.

421
00:35:50,190 --> 00:35:53,190
It's funny what kind of details you leak out.

422
00:35:56,310 --> 00:35:57,810
What else?

423
00:35:57,810 --> 00:35:58,190
What else?

424
00:35:58,190 --> 00:35:58,850
What else?

425
00:35:58,890 --> 00:36:00,750
We're gonna skip the message.

426
00:36:00,750 --> 00:36:02,150
It's too messy.

427
00:36:09,930 --> 00:36:17,450
So we discussed pretty much the CPU extensively already.

428
00:36:17,450 --> 00:36:22,170
You see that I got the CPU series right.

429
00:36:22,170 --> 00:36:26,090
And yeah, the 421 Bogomips that I was mentioning before.

430
00:36:26,090 --> 00:36:28,290
Not 400 megahertz.

431
00:36:28,570 --> 00:36:31,030
Just delay cycle is 421.

432
00:36:34,630 --> 00:36:38,050
We can also look in here.

433
00:36:43,050 --> 00:36:45,150
This is the one that makes me cry.

434
00:36:45,150 --> 00:36:52,410
So here we could really use some loop mount and some swap.

435
00:36:52,590 --> 00:36:54,450
But we can put them back in.

436
00:36:54,450 --> 00:36:56,750
So no crying.

437
00:36:56,750 --> 00:36:58,390
One last thing.

438
00:36:58,870 --> 00:37:07,970
We can list the network interfaces of an SD card just because it seems so wrong that we can pass up the opportunity to do it.

439
00:37:08,470 --> 00:37:13,990
And we discover absolutely nothing, but it's kind of fun to say that you have done it.

440
00:37:13,990 --> 00:37:15,170
So why not?

441
00:37:16,150 --> 00:37:16,670
Now...

442
00:37:18,490 --> 00:37:19,730
Okay.

443
00:37:22,910 --> 00:37:24,790
Back to the slides.

444
00:37:27,800 --> 00:37:29,640
Now be careful.

445
00:37:29,980 --> 00:37:36,420
The system mounts the flash partition under mount SD.

446
00:37:36,820 --> 00:37:44,560
And accessing the file system from the card's own Linux, while an external host is doing the same, could easily corrupt the file system.

447
00:37:44,560 --> 00:37:48,520
Two live systems writing to the same host.

448
00:37:48,820 --> 00:37:50,180
No good.

449
00:37:50,660 --> 00:37:53,720
You can easily fix it by rebuilding the file system.

450
00:37:53,720 --> 00:37:57,080
But you need to be aware of the problem so that you don't do it in production.

451
00:37:57,100 --> 00:37:59,740
Development is just fun and games.

452
00:37:59,740 --> 00:38:03,360
But in production, that's not the way to go.

453
00:38:03,360 --> 00:38:06,760
So what software do we have to play with here?

454
00:38:10,140 --> 00:38:17,380
In version 1.7 firmware, we have a kernel 2.6.32.

455
00:38:18,100 --> 00:38:28,900
The modules, the kernel modules are for the SoC, the Atheros 6003 radio, and the SDHC interface, which, as we discussed, is proprietary.

456
00:38:30,760 --> 00:38:41,060
Your services that you can have out of the box are basically a very stripped-down busybox that has Telnet, FTP, and DHCP.

457
00:38:42,880 --> 00:38:50,920
Busybox is a little bit crippled, but once you replace it, you can set up SSH as soon as you can set up time properly.

458
00:38:50,920 --> 00:38:52,480
And this is very easy to do.

459
00:38:52,480 --> 00:38:53,960
It's just one execution away.

460
00:38:53,960 --> 00:38:55,800
So, easy fix.

461
00:38:56,420 --> 00:39:04,480
On the kernel side, the kernel is extremely thin due to the need to fit in the 8 megabyte NOR flash in the SoC.

462
00:39:04,580 --> 00:39:09,180
But we can load components from the larger storage once we have a system running.

463
00:39:09,560 --> 00:39:13,620
Ideally, loop mount a file in FAT32 to avoid corruption.

464
00:39:14,040 --> 00:39:16,700
Add swap to work around RAM.

465
00:39:18,100 --> 00:39:21,120
Truth to pivot into loop mount.

466
00:39:21,900 --> 00:39:26,940
We need a new kernel to do this, and Robert figured out how to unpack the install files.

467
00:39:27,280 --> 00:39:32,600
And then Dimitri rebuilt the kernel by looking at KSIMs.

468
00:39:32,660 --> 00:39:43,320
Since the .configure file is not exposed in PROC, some people could think it's secrecy, but I think it's, again, saving space.

469
00:39:44,280 --> 00:39:46,900
So, how this would work.

470
00:39:46,900 --> 00:39:51,920
Would create on the live partition as a single file a system image.

471
00:39:51,920 --> 00:39:55,240
Would loop mount this and truth into it.

472
00:39:56,220 --> 00:39:58,920
Now, somebody took this to the extreme.

473
00:39:59,620 --> 00:40:01,800
Why do people always do this?

474
00:40:02,100 --> 00:40:05,680
So, they downloaded an Ubuntu 9.x image.

475
00:40:05,680 --> 00:40:10,420
The last version of Ubuntu compatible with ARM5 architecture.

476
00:40:10,960 --> 00:40:13,520
Put the image in there on the SD card.

477
00:40:13,520 --> 00:40:14,600
Loop mounted.

478
00:40:14,600 --> 00:40:15,620
Truthed.

479
00:40:15,620 --> 00:40:17,220
Forwarded X.

480
00:40:17,220 --> 00:40:18,960
Started Firefox.

481
00:40:19,180 --> 00:40:21,840
And then complained that it was slow.

482
00:40:23,400 --> 00:40:24,680
Okay.

483
00:40:24,920 --> 00:40:28,320
Well, it's not that interesting to run Ubuntu from 10 years ago.

484
00:40:28,320 --> 00:40:31,700
But it's pretty cool that one can take it that far.

485
00:40:31,920 --> 00:40:35,940
It's nice to see that the bits actually work and can be stretched.

486
00:40:36,840 --> 00:40:40,540
But we don't need to do things that crazy.

487
00:40:41,280 --> 00:40:45,340
Where there is Perl, there is everything, I like to say.

488
00:40:45,740 --> 00:40:51,300
Maybe Perl is not your cup of tea, but it's better than not having it.

489
00:40:51,820 --> 00:40:52,760
This is ARM.

490
00:40:52,760 --> 00:40:54,080
You can cross compile.

491
00:40:54,080 --> 00:40:55,540
You can build on the system.

492
00:40:55,540 --> 00:40:56,980
You can use IPackage.

493
00:40:56,980 --> 00:40:59,120
You can bring your own language.

494
00:40:59,620 --> 00:41:05,060
You can steal packages from another device of the same architecture since there are five billion of them.

495
00:41:05,360 --> 00:41:09,480
But if you want to be lazy, Perl is a perfectly viable option.

496
00:41:09,960 --> 00:41:13,340
And this is also a reasonably recent Perl.

497
00:41:13,340 --> 00:41:16,980
It's not Perl of the ancients like a Perl 5.6.

498
00:41:16,980 --> 00:41:18,320
It's 5.14.

499
00:41:19,960 --> 00:41:24,600
Big question for embedded devices is how we find them.

500
00:41:25,110 --> 00:41:26,740
Where is my device?

501
00:41:26,740 --> 00:41:29,580
And we need to make it safe for the internets.

502
00:41:31,210 --> 00:41:38,380
You cannot use this device if you cannot tell what IP it's at.

503
00:41:38,380 --> 00:41:43,920
So there are three approaches that are common to work this problem.

504
00:41:44,000 --> 00:41:46,820
One is a known configuration.

505
00:41:46,960 --> 00:41:49,580
Always be at the same address.

506
00:41:49,580 --> 00:41:52,160
This is what I just did.

507
00:41:52,400 --> 00:41:56,360
When the card is in AP mode, it is always at the same address.

508
00:41:56,480 --> 00:41:58,200
11.254.

509
00:41:58,200 --> 00:41:59,860
I know where it is.

510
00:41:59,860 --> 00:42:01,840
I do not need to find it.

511
00:42:04,360 --> 00:42:07,320
Then there is what the card does natively.

512
00:42:07,400 --> 00:42:08,440
Broadcast.

513
00:42:08,440 --> 00:42:11,240
It advertises where it is.

514
00:42:11,660 --> 00:42:17,780
Besides the horror I described earlier, there are proper advertisement protocols like MDNS.

515
00:42:17,780 --> 00:42:23,820
Multicast DNS is a perfectly fine way to discover things on the local network.

516
00:42:24,900 --> 00:42:33,500
The third one is to announce, which is the device itself, once it has a valid network configuration, sends out an announcement.

517
00:42:33,620 --> 00:42:39,560
My favorite is to send out an XMPP announcement, meaning a Jabber protocol announcement.

518
00:42:39,560 --> 00:42:42,720
But you can use any protocol you want.

519
00:42:42,920 --> 00:42:49,400
And you know this is a unicast announcement, not a broadcast one like the horror I was describing earlier.

520
00:42:49,400 --> 00:42:53,660
It is going to a single endpoint and it's a fair game.

521
00:42:53,660 --> 00:42:56,140
No messing up of the network.

522
00:42:57,260 --> 00:42:59,520
I'm not going to go through all of these.

523
00:42:59,520 --> 00:43:04,040
There is an article I wrote for Linux Journal in 2009, I believe.

524
00:43:04,460 --> 00:43:07,060
Search for my name and Linux Journal.

525
00:43:07,060 --> 00:43:08,120
And there are scripts.

526
00:43:08,120 --> 00:43:13,940
They are implementing all of these for this architecture, in fact.

527
00:43:13,940 --> 00:43:16,180
You can go and just grab the scripts.

528
00:43:16,180 --> 00:43:17,860
They are in the article.

529
00:43:19,120 --> 00:43:21,640
You can also do this right.

530
00:43:21,720 --> 00:43:39,600
If you're a standards person, like some people rightly are, and in this case doing it right means implementing DNS update as specified in RFC 2136, which I suffered through implementing a few years ago, actually.

531
00:43:40,580 --> 00:43:43,440
Contact me by a fixed DNS name.

532
00:43:43,440 --> 00:43:50,640
I will update that DNS record when I boot so that it's always correct for my current device location.

533
00:43:50,900 --> 00:43:53,820
This is also implemented in my Linux Journal article.

534
00:43:53,820 --> 00:43:57,000
You can do it in 15 lines of Perl or less.

535
00:43:57,000 --> 00:44:06,780
So Perl may be hard to read sometimes, but it's very, very expressive and it's very nice for this purpose because there are modules to do anything.

536
00:44:07,760 --> 00:44:10,320
So let's go back to the security aspect.

537
00:44:10,440 --> 00:44:17,560
We were joking about the fact that it was easy to break in, but realistically we have physical access.

538
00:44:17,620 --> 00:44:21,280
We have the card and we can do things to it.

539
00:44:21,280 --> 00:44:24,740
We can also do it over Wi-Fi.

540
00:44:24,740 --> 00:44:29,930
Fine, that is less kosher, but that hardly matters.

541
00:44:30,240 --> 00:44:35,130
What matters is that this brings the lost USB key attack to a new level.

542
00:44:35,780 --> 00:44:41,080
In a military base, people are trained to shoot on sight when they see a lost USB key.

543
00:44:41,700 --> 00:44:45,080
But in an industrial setting, people are more lax.

544
00:44:45,080 --> 00:44:49,360
So picture this out of a Tom Clancy book.

545
00:44:49,360 --> 00:45:03,680
You need to break into somebody's network, you lose a USB key in their parking lot, and some good Samaritan-fool will take it inside the office and plug it into the wrong machine.

546
00:45:04,220 --> 00:45:06,920
I don't think I need to tell this audience this.

547
00:45:08,180 --> 00:45:13,120
So what's new here is the Wi-Fi aspect, of course.

548
00:45:14,280 --> 00:45:21,340
Although there are a few devices that do this, like HAC-5 has some devices that do exactly this.

549
00:45:21,340 --> 00:45:26,310
But in this case, it's in SD card format with a radio in it, which is interesting.

550
00:45:29,060 --> 00:45:33,260
Countermeasures are no different from the rogue access point ones.

551
00:45:33,580 --> 00:45:45,560
From radio jamming or your network actively nacking connection requests very cleverly for unknown access points in a broadcast range.

552
00:45:45,860 --> 00:46:04,880
Or if you have a security policy against lost USB keys by locking down or pouring glue into USB and other ports, you can pour glue into SD ports just fine and prevent people from sticking things into ports they are not supposed to use.

553
00:46:05,160 --> 00:46:07,060
Neither approach is new.

554
00:46:07,300 --> 00:46:14,320
Sure, the card is not super secured, but remember your security posture needs to be commensurate to your threat assessment.

555
00:46:14,320 --> 00:46:16,420
You are not a nuclear reactor.

556
00:46:16,420 --> 00:46:19,240
If you were, you need to account for this.

557
00:46:19,440 --> 00:46:24,800
But if the question is the security of your Instagram pictures, do people want them that badly?

558
00:46:27,230 --> 00:46:29,510
So your mileage may vary.

559
00:46:29,510 --> 00:46:36,010
What is on the opportunity side is that this is a low power system with vast amounts of storage and wireless connectivity.

560
00:46:36,390 --> 00:46:42,490
And really low power, as in you could power it with a solar panel and put it up a tree.

561
00:46:43,670 --> 00:46:46,610
This is the ideal pirate box data exchange.

562
00:46:46,610 --> 00:46:54,430
A pirate box being the term of art for anonymous data exchange, where people drop and retrieve files over Wi-Fi anonymously.

563
00:46:54,430 --> 00:46:59,150
I don't think it's as popular as it used to be once as a concept.

564
00:46:59,390 --> 00:47:09,450
This is in practice a spy's dead drop, if you want to use the Intel community's comparison, if you want to continue that line of thought.

565
00:47:10,210 --> 00:47:14,870
Less ominously, you can make a solar-powered geocache.

566
00:47:14,870 --> 00:47:29,490
But seriously, you can now realistically put a server in your wallet or even make a server throwaway or a Beowulf cluster in a shoebox, although I would recommend you do not do that.

567
00:47:30,070 --> 00:47:38,250
You could put it in the SD slot of your car radio, if you have one of those old ones, and make it download music whenever you park at home.

568
00:47:38,590 --> 00:47:40,450
There is one limitation.

569
00:47:41,070 --> 00:47:49,870
SD cards are supposed to have SPI interfaces, and that would be awesome, because SPI means Arduino.

570
00:47:50,390 --> 00:47:54,790
But sadly, this is not viable with this card.

571
00:47:54,790 --> 00:47:55,970
That won't work.

572
00:47:55,970 --> 00:47:59,730
Somebody tried the integrated system.

573
00:47:59,990 --> 00:48:01,810
It was bigger than the card itself.

574
00:48:01,810 --> 00:48:06,490
I mean, the support for SPI to access Arduino was bigger than the card itself.

575
00:48:06,490 --> 00:48:08,190
Not practical.

576
00:48:08,630 --> 00:48:12,450
But this is nonetheless a very interesting platform to experiment with.

577
00:48:12,670 --> 00:48:18,610
Cross-compiling is an option, but you can take the lazy way out and prototype with Perl.

578
00:48:18,910 --> 00:48:21,250
I solved the discovery problem for you.

579
00:48:21,250 --> 00:48:22,690
You have all the scripts.

580
00:48:23,290 --> 00:48:24,970
And this is a very low cost.

581
00:48:24,970 --> 00:48:27,410
Same cost as the original Raspberry Pi.

582
00:48:27,490 --> 00:48:34,370
So you have to decide if you want to trade RAM for very low power and small format, or the other way around.

583
00:48:34,470 --> 00:48:36,130
And it's a fair question.

584
00:48:37,590 --> 00:48:39,710
It's a very niche hacking platform.

585
00:48:39,710 --> 00:48:41,890
Trascend has been very nice to the community.

586
00:48:41,890 --> 00:48:45,430
Sorry, it's a very nice hacking platform.

587
00:48:45,470 --> 00:48:48,490
Trascend has been very nice to the community.

588
00:48:48,530 --> 00:48:53,730
We broke this years ago and they haven't complained.

589
00:48:54,050 --> 00:48:55,790
They haven't sued anybody.

590
00:48:55,850 --> 00:48:59,450
They haven't shut us out or done anything untoward.

591
00:48:59,450 --> 00:49:01,230
We get hardware to play with.

592
00:49:01,230 --> 00:49:02,630
They sell more hardware.

593
00:49:02,630 --> 00:49:04,290
It's great for everyone.

594
00:49:04,450 --> 00:49:09,970
The mechanism we used is part of the SDK, but the SDK is not public.

595
00:49:09,970 --> 00:49:12,710
So we had to discover it the hard way.

596
00:49:12,950 --> 00:49:16,390
We need a better distro image than the crap you have seen.

597
00:49:16,510 --> 00:49:20,090
I've worked on too many Linux distributions to stand for that.

598
00:49:20,450 --> 00:49:25,650
But that is relatively easy to do and there are some tools out there that are workable already.

599
00:49:27,630 --> 00:49:31,890
I think we can do better, but it's adequate to at least experiment.

600
00:49:33,410 --> 00:49:37,830
So if you come up with new ideas on how to use it, please send them to me.

601
00:49:37,830 --> 00:49:39,130
Here is my contact info.

602
00:49:39,130 --> 00:49:41,910
You can find me on Twitter or send me email.

603
00:49:42,450 --> 00:49:47,830
Or you can find me in the Discord channel and ask me questions there.

604
00:49:48,210 --> 00:49:54,730
Remember that speakers are Pavlovian devices, so if you like the talk, please let us know.

605
00:49:54,730 --> 00:50:00,050
Rate the talk, send us comments, submit feedback, all of those things as you see fit.

606
00:50:00,430 --> 00:50:05,730
If you do something with it, let us know what you did so we can spread the news.

607
00:50:05,950 --> 00:50:11,170
Slides will be available and I'm available for questions if you have any.

608
00:50:11,170 --> 00:50:15,210
Thank you and stay safe.

609
00:50:15,410 --> 00:50:16,310
Happy hacking!