start	end	text
3930	13850	Hardware Hacking Village. Welcome to Boston's Hacking Underground. Quite literally we are
13850	23550	in my basement. Socially distant greetings from down here. Hopefully I managed to secure the
23550	28030	location as in there is not going to be any noise and we get a reasonable recording.
29950	35990	And that's it. Let's get started. I'm going to take the mask off since you're sufficiently far
35990	42570	away. And while I certainly wanted to wear a fork bomb on a mask for a long time,
43270	55010	I cannot go for a full hour doing that. So we have 45 or odd slides and the demo.
55010	64830	So let's get going. Now, as a way of introduction, I had the privilege of spending my entire career
64830	73010	in free and open source software. I am the product management director for Red Hat Ceph.
73070	80210	And I was previously Ubuntu server PM at Canonical. And if you go back a decade,
80210	86850	I was the dreaded systems management tsar at SUSE. The talk has nothing to do with my job.
86850	92850	Well, I guess it is storage after all. I'm a manager these days. So as a former embedded
92850	101050	developer, this is my definition of fun. The obligatory disclaimer is that we will most
101050	106810	likely break some hardware playing with this. And it will come out of your pocket. No liability if
106810	112930	you follow our instructions and stub your toe or bring about the end of the world.
113210	119550	Or break your device, which is far more likely. So you have been warned. Let's get going.
119570	123230	We have a lot of slides in the demo. We need to hustle a bit.
124690	133510	Here is the idea. A processor is found in an SD card. Hackaday featured somebody's blog.
133510	141890	Pretty much went viral in a word of web process. Virally blooming once Linux was noticed on the
141890	150870	device. And Hackaday made it famous. Lots of blogs. SD card sized. Almost a raspberry pi.
150870	159010	Can we repurpose the device? The word of web process really got going once Linux was noticed
159010	167030	on the device. And so I noticed all this was going on. And I wanted a project for Christmas.
167030	175330	That was five years and a bit more ago. So you could say that it has taken me for quite a ride.
176970	186410	Let me repeat that as there is always someone who has no idea what I'm talking about.
186410	192310	Here is the concept. A Wi-Fi enabled SD card. Automatically downloads your pictures.
192470	198970	Several models exist. We're after the embedded system in there. In the card. The CPU of the
198970	204650	card itself. It's like the Intel Edison they originally promised us, but for real this time.
206390	210770	Copious amounts of Google Translate were used in the making of this talk.
210770	218250	Really international effort. I saw blogs in French, Japanese, German, Korean, and of course
218250	225670	English. Some Russian too. And I believe some Spanish. So copious use of Google Translate
225670	232930	and in singularity of course. We explored the limits of machine translation, but it usually
232930	243450	comes across clear enough to work with. So we're looking at the Trescend Wi-Fi SD line here.
243450	251790	It comes in size from 8 gigabytes to 32 gigabytes. I prefer them as they are more open, even without
251790	257850	hacking, as there are no attempts at platform strategies made by adding any middling cloud
257850	265210	services that we do not want by some clever MBA that had a platforms class. There is no
265210	272250	stepping stone service that may make things easier to set up. And doesn't. And adds yet
272250	277630	another place your pictures are potentially in. The software on the Trescend card is simple
277630	286010	and not perfect, but that is an asset for us as we will see. So where do we get these cards?
286010	289150	You can go to Amazon. You could also try eBay.
290810	297310	And they're going to be between $40 and $60 depending on capacity, about the price of
297310	305910	Raspberry Pi and up. There are others like the PQi AirCard that are functionally the same.
306190	312670	The PQi AirCard is interesting because it is actually an adapter card. You can put any storage
312670	319170	you want in microSD format in there, and the adapter actually has the embedded system. Toshiba
319170	326250	makes another one, and there is also the Flu card. And you can carry binaries through them.
326410	333110	As a matter of fact, when you log into the system, you may notice that there is a command
333110	341010	buzz in there. But there is no piezoelectric transducer here, so what is that for?
342490	351110	But looking at another one of the card designs, that has a piezo. So you can learn things on one
351110	358010	card that applies to another. But we're getting a little bit sidetracked here, so let's go back to
358010	364290	where we should be. When the postman arrives, here is what you get.
365330	375050	Inside the package, let's unbox one here, a card and an adapter. The inevitable legal disclaimer.
375590	380330	I don't think this conference has a legal track, otherwise I would blame the lawyers.
381130	386130	And a microscopic bit of a manual, which is actually not bad.
386130	392830	The adapter is there because you can write to the SD card directly by mounting it on your Mac,
392830	400290	for example, or over the radio. And when you have file systems mounted two places,
400290	408350	and you are writing from two places, bad things happen. The adapter signals to the card to disable
408350	415490	the radio, and prevents simultaneous writes from the air and local mount. Of course, that is exactly
415490	421150	what we want to do. But we think before we do. We only want to use the radio,
421150	429190	so we'll assemble it so it is actually not turned off. So just what is in there?
431030	439930	This is an SDHC class 10 card. 16 gigabytes in the case of the ones I used.
439930	452090	Half and double the size exists. This is a full-size SD card. Pictured is model TS16GWSDHC10.
453050	457170	You will have the slides at the end, so if you want to search for the cards,
457170	461110	you'll have all the models. There is no need to take notes or any of that.
463330	469910	So physically breaking the device voids the warranty. I bet you did not see that one coming.
472430	478110	Exacto-knifing our way to success, we slice the card in two and find four large chips.
478430	484390	Interesting. The parts on the left are the case. Nothing strange there.
485150	492670	It may help guide your dissection if you need to open one, but that's about it. Incidentally,
492670	498870	do you see the yellow tab in the center? That is the write-protect switch cards have.
498870	505090	Interesting technical detail. There is nothing on the device reading the state of that toggle.
505550	510670	The reason for this is that SD cards work like floppy drives.
511770	516010	And in floppy drives, if you still remember those devices,
516010	521870	write-protect is implemented by the drive. If the drive sends a write, the card will take it.
524210	535270	If the card doesn't know and doesn't have to, the drive will not send a write if the toggle is in
535270	542610	the protect position. So let's do a bit of overview of the components from the top left.
542610	549810	We have a trace antenna, definitely not a 3 dB antenna and not 100 milliwatts of broadcasting
549810	557730	power as the whole card consumes less than that. So Wi-Fi range will not be as per the
557730	563630	Wi-Fi specs maximum. But that's okay because we're still beating the pants off Bluetooth.
564270	571240	There is no antenna connector. You could try your hand at adding one if you're a master at soldering.
575030	579790	But assuming you don't, you're not going to get the full Wi-Fi range.
579810	586670	And I'm okay with that. Then we have the Wi-Fi radio chip.
587810	592450	The SoC with the ARM CPU we are after is underneath it.
593570	601290	16 gigs of flash in the big chip. And the flash controller is the last thing on the right.
602270	608090	And up top we see the notch where the read-write tab rests that I was mentioning.
608730	612850	And there is no actual board sensing of any kind as I said.
612850	616490	The card is just making room for the tab to fit in that space.
617870	626850	Flip side. Besides the standard SD leads, some of the smaller pads are TX and RX for a 3.3 volt
628030	633570	38400 baud serial. Annoyingly, really annoyingly, they are not labeled.
634330	640710	They labeled resistors we don't really give a hoot about instead for who knows what reason.
641430	649550	On the PQI air card, the TX and RX serial pads are labeled. So bonus points to those guys for that.
650370	655530	If you do wired serial, you get access to a well-configured U-boot console.
656190	660670	U-boot is the bootloader of choice for embedded Linux devices for those of you coming from
660670	669150	Windows. A very handy tool to have. Better than the kernel that is in here as it has been stripped
669150	675650	to the bone. Incidentally, I have been collecting all these details for a survey article. If you
675650	681750	hack the card and blog the details, let me know. Send me the link. And you prefer going... if you
681750	689990	prefer going the lazy way, you will get a how-to from me soon. Hopefully. I've been saying this
689990	700240	for a while, but it's almost done. What's in there are these four chips. CPU, Wi-Fi module,
700240	708400	flash controller, and storage. The SoC's 32 megabytes of RAM is the weakest spot of the board
708880	715500	but very suitable for embedded use. Fear not those of you who are used to gigabytes of RAM.
715500	721060	Besides, you have lots of storage. You could expand this with swap.
721400	730520	If the kernel was built with support for swap. In the SoC, 8 megabytes of NOR flash are used
730520	738380	for system including a stripped down kernel and compressed initramfs. Interesting compromises
738380	745260	were made there. And of course, massive amounts of storage. So you could boot with a small system
745500	752540	loop mount a larger image and shroot into it. If you had loop mount in this kernel,
753020	761180	I start seeing a pattern here. But not all is lost. We can add it. Dimitri Greenberg has documented
761180	766280	how to rebuild the kernel. So we have the instructions and the steps on how to do this
766280	775480	already worked out. Let's look at the CPU. It's a 200 megahertz CPU. Some report 400 megahertz and
775480	788960	they are wrong. They are confused by the 426 bogomips it sports. It's an ARM 926 EJS core.
789640	798540	An ARM 9 processor. This is not a Cortex A9, but an older ARM 9. A low cost CPU.
799040	812040	ARM 5 TEJ architecture with more than 5 billion with the B manufactured to date.
812080	818560	Interesting extensions for Java, but the Giselle runtime requires talking to ARM as it was not
818560	826240	shipped with the system. And anyway, who wants to do Java these days? So interesting core.
826920	834320	The extensions. E stands for DSP, Digital Signal Processing Enhancements,
834320	840080	because this processor used to be used for making feature phones.
840640	849960	J for Java extensions or the Giselle JVM. Java extensions make byte codes directly usable by
849960	857160	the CPU, which is really cool. The CPU instruction BJX branch to Java instruction,
857160	866160	which switches the silicon to Giselle state. The JVM still handles errors. The OS handles the traps.
866160	876580	But between 134 and 149 byte codes of the 203 in the JVM spec are handled in silicon. I don't know
876580	885940	why the variation there. Why not a fixed number? But a large chunk of the byte code is running in
885940	904060	hardware. Now, the original Raspberry Pi is a Broadcom BCM2835 processor. An ARM11 76JZF-S.
905220	913300	This is an ARM6K architecture. It's closer to this processor than it is to a Cortex ARM.
913520	920180	So the idea is that instead of the chip in the Pi, you would use the chip in the card.
920240	928220	With different trade-offs. You get built-in radio, lose all the interfaces. The price stays just about the same.
929320	942660	The radio is a Fortune chip. AFN31GL Wi-Fi controller. It comes with an Atheros AR6003
942660	949900	Wi-Fi core, which was marketed as the smallest Wi-Fi silicon design you could buy at the time.
950400	955940	I don't know if they still have the record, but it was a pretty impressive claim five years ago.
955940	964940	The bit we care about is that it does Wi-Fi B, G, and N with really low power draw.
966220	972400	Do not plan to saturate the Wi-Fi Ethernet link with this device. You won't go much beyond one
972400	979280	megabyte per second. Incidentally, if you feel like going turtles all the way down, there is a CPU to
979280	988420	control the baseband radio. An Extensa MIPS core backed by 256 kilobytes of RAM and 256 kilobytes of
988420	995260	ROM. I didn't go in there. Maybe it could be the next project for one of you.
996180	1003000	Also, this chip does not do Bluetooth, by the way. Not that we care.
1005140	1011520	Then we have 16 gigs of NAND flash. You will not be wanting for storage. That's for sure.
1011520	1015040	That is definitely not the problem the system has.
1016400	1020180	The flash controller is a Silicon Motion 26...
1025000	1032900	I can just read the slide. 2683EN. Thank you, picture. Nothing of interest here except
1032900	1037460	there was a bit of annoyance in the community at the lack of redistributed sources
1038060	1044500	for some system components. Transcend resolved this. It's no longer an issue.
1044500	1050500	But one of the modules is proprietary. The one that supports the flash controller.
1051440	1059700	If you're familiar with IP restrictions for source code of video drivers, that is probably a similar
1059700	1066180	reason. There is some secret sauce that the vendors of flash want to keep to themselves and
1066180	1075480	not share with one another. We don't know what it is. But it's not really a concern for us unless
1075480	1084230	you are an open source legal purist and you want everything in the open out of principle.
1085790	1090550	The sources... I mean the sources for some of the modules are available. The binaries for all three
1090550	1094650	modules are available. So if we recompile the kernel we can just drop the modules back in
1094650	1099670	and go on from there. It's not like we're going to modify our interface to the flash
1100450	1105510	to the flash chip anyway. We're not interested in that.
1107430	1120170	Now, this card clocks between 0.9 and 1.1 watts while idle in my office. It peaks at 1.5
1120170	1127330	with wireless clients connected. This is a 110 volt power supply of course.
1127530	1133490	An Apple switched power supply. Efficient but still power conversion is a factor.
1133490	1139850	Presumably higher if you push the CPU to 100% while writing to flash.
1142090	1147210	You could also try to push consumption by simultaneously pegging the CPU and massively
1147210	1153570	writing to flash. I got my numbers by exercising the radio only. I didn't do a full suite of
1153570	1160930	benchmarks at different types of load. This is a relatively lightweight system so I didn't see the
1160930	1169590	need to push the envelope that far. Interestingly, I checked to see if we would get better efficiency
1171430	1179070	through eliminating the power conversion step. And we hardly see a difference.
1179070	1189530	220 milliamps is about 1.1 watts at 5 volts. Same as we measured at 120 for idle.
1189530	1195910	It closely matches the other one. Apple really knows what they're doing.
1195910	1200230	That iPhone switched power supply is really efficient. Good for them.
1202050	1205470	Let's start looking at the software side.
1206890	1216870	I'm going to walk you through what we do to make it work first and how we hack it second
1216870	1222530	so it's not hanging in the void and confusing in as to how we got there.
1222530	1227910	How does this all work? First you set up the app on your phone.
1229270	1236610	Then it gives you access to basic setup and core functionality. Setting up network mode,
1236610	1242610	names, password. Shoot and view here means putting the phone in a monitor mode of sorts
1242610	1247010	where any picture shot by the camera is automatically downloaded
1247710	1252750	and presented on the screen with no intervention. This will be important later.
1254470	1260770	It also offers you to upgrade the firmware. Usually this is a concern as that precious
1260770	1267430	security hole used for routing may disappear. But it's not so in this case. It does not matter
1267430	1273270	what version of the firmware you have, you're going to get around it. So do not worry about it.
1273270	1282290	The latest version is as open as the first. It is both good and bad, I guess. I say it is good.
1282290	1287990	It lets us hack the card. Security issues we bring about are not in the hacking of the binary
1287990	1295210	support package. But we'll get to that later. By default, the system wants to be its own access
1295210	1302930	point. Great, very convenient for development. But not so for photo download. Think of it, you want
1302930	1310310	to switch APs on your handheld device every time to sync pictures. The seamless internet AP client
1310310	1317010	mode is a great strength of this card for ease of use compared to others that make it needlessly
1317010	1323430	more complex by putting their service in the middle. You just choose the mode you want and you get it.
1325350	1330210	So when it is up, it shows here from another machine in the same room.
1330650	1335990	Your SD card has now become its own access point. Okay, what's next?
1337330	1341990	Well, now we can connect to it just like you would anywhere else.
1344030	1354060	And now we can ping it just like any other host. Now let's look at how it works before we get into
1354060	1362740	it. Think about it. The app needs to find where the heck the card is. It is out there on the AP,
1362740	1372620	but at what IP address? The card broadcasts on UDP 55777. I'm here, I'm here, I'm here.
1373300	1381560	Other cards are even more aggressive. They ARP the entire slash 24 subnet, found out where every
1381560	1390320	node is, then send HTTP requests to everyone until it finds the card. Then maybe it stops.
1390320	1396360	Most of the time it does anyway. Don't worry, we can fix this. It's just funny to me.
1396780	1404680	The tools are only needed for initial IP discovery and password setup. If you do not want to use them,
1404680	1414360	the card comes with a default user admin with a password of 1, 2, 3, 4, 5, 6, 7, 8.
1415020	1417660	But that's not the part that will make you laugh.
1419420	1424920	We port scan the card to see what's going on here. Here we see Telnet because I already
1424920	1432400	cracked this one. The HTTP server, the pictures are published there. The app just
1432920	1439860	HTTP gets them. Services are offered as CGI scripts out of the web server. That's how the
1439860	1447440	app commands the card to do things. The additional port 5566 broadcasts new entries in shoot and view
1447440	1454140	mode. If you're connected there, you get a new URL message for every picture. That's how shoot and
1454140	1460900	view works. You get one line with URL of new pictures when they're generated. Very simple
1460900	1468820	architecture. Not bad. A few quirks. It downloads pictures twice. A bit suboptimal that way, but
1468820	1475920	in this way it doesn't have to spend CPU power to generate thumbnails on board. Trades a little
1475920	1484280	of bandwidth for not having to spend CPU and power. It also assumes that you're not downloading
1484280	1490200	multiple pictures at once, which you're not. So simplicity prevails. I'm a fan of that type of
1490200	1499960	design. We can browse the card's HTTP server directly. It's a boa web server. It exposes
1499960	1506920	directory listings. In theory, it should show you only the directory listings of the data.
1507500	1515560	And simple CGI bin scripts to set configuration. These are in Perl. App simply downloads the files
1515560	1523800	via HTTP and calls CGI scripts to configure the system. And these scripts are way in. That's how
1523800	1533550	the card was broken into. So this story starts with Pablo, who thinks there must be a CPU in
1533550	1539590	these Wi-Fi enabled cards and turns out that he is right. Pablo went out and started poking at the
1539590	1547770	software, looking for security holes. Find several the size of a small barn. Found dot dot slash dot
1547770	1555890	dot slash backpats breaking out of the allowed inspection area. He extracts the source files
1556490	1566690	for the CGI bin, exploits a Perl script, and in he goes. And I went that way myself the first time.
1566690	1579430	But there is a better way. A file called autorun.sh. I think you know where this is going.
1580670	1589190	Write a file to the SD card named autorun.sh. The system will read it and execute it.
1589190	1597130	With root privilege. At boot. So all I have to do is just go, telnet please,
1597130	1604290	and telnet arrives. So much nicer. Now, the security freaks among you will be horrified.
1604290	1609250	But in terms of actually working with the card, this is fabulous. It makes it so nice.
1609490	1615430	There is another aspect to this that is humorously named.
1617490	1623850	I know what you're thinking. But that's not it. It stands for firmware update.
1624290	1633870	It's a clever mechanism. You supply autorun.sh and three files. The kernel, the program bin.
1634330	1640250	The system starts program bin. Turns out this is a copy of the cards you boot with the default
1640250	1647210	script payload. The script loads the new system onto the old and then reboots. It's a nice way
1647210	1653070	to prevent breaking. It also resets all configuration to the defaults, which may be handy if you screwed
1653070	1659030	up. It is a really nice way to revert breaking and also gives you a way back to the defaults.
1659310	1664450	But obviously you can only undo software breaking. You can still break the hardware.
1673770	1680190	It's time to try and do this live. I usually unbox one of these.
1682170	1690890	But in a virtual setting it doesn't really make it very useful. And you have seen the pictures,
1690890	1697890	so you've seen most of what there is to see in an unboxing. I had to find... so let's set it up.
1698650	1704090	I had to find an SD adapter that does not switch off the radio.
1705490	1712290	So I went to my local computer megastore and bought every single adapter in existence,
1712290	1722070	tested them all, returned 9 out of 10. And now we have the right thing.
1729050	1735750	And this thing boots really fast. So much so that if I connected over the serial,
1735750	1741350	it would be up before I can connect to it. You would not see boot messages.
1743090	1747030	It will just be there already.
1749770	1763190	So... and we got the advertisement.
1765370	1774350	And we are connected. We got a connection. Now I was connected to that card recently,
1774350	1782030	so let's just do it this way. And see? It got there way before me.
1784930	1792570	What are we going to see here? Let's start from version text.
1794610	1804210	So the KeyASIC Wi-Fi SD is the ODM design that all these vendors purchase to make their own products.
1807790	1808570	And
1811170	1824050	you can see that it confirms the 802.11n Wi-Fi. The Linux kernel is 263228,
1825140	1833870	one of our most popular Linux kernels ever. This one was in RHEL 6. It was in SUSE Linux Enterprise
1834970	1843090	11 SP1 in a breaking of continuity from 11 kernel rebase.
1843090	1851050	And I believe it was in Ubuntu Server 10.04, although that one wasn't mine,
1851050	1854230	so don't quote me on that, but I'm pretty sure.
1856790	1864570	This is the kind of kernel that you would want to run when you have only 32 megs of RAM, so
1864570	1873990	it's a very, very good choice. It will not be expecting gigs of RAM either in this form or in
1873990	1881890	userland. What else? Well, let's see what's around here.
1890470	1904250	We want to see something else, actually. This is the actual VFAT system of the SD card.
1904250	1909990	And you can see that I plugged it into a Nikon digital camera that left its own fingerprint
1909990	1919390	there and a few files that I've been poking around with. BusyBox is notable here. We could
1919390	1926210	run that BusyBox and have a much more futureful shell environment, but I want to show you here
1926210	1933730	how the card is rather than how we are going to make it. The making part we can defer to a writeup.
1934730	1939370	But yeah, very easy to replace the shell by just downloading a BusyBox and executing it.
1943650	1950170	Incidentally, once you have a new BusyBox, you can run the NTP module and
1950870	1957410	not be in 2012 anymore, which is great because then you can do proper secure connectivity,
1957410	1964750	not plain text telnet. And now that your certificates are not coming from the future,
1964750	1971750	crypto will actually work. What do we have on the storage side?
1974090	1983850	So you see the JFFS2 file system that is the 8 megabyte partition that the system boots from.
1983850	1992510	That is the reason why things have been stripped down so much. It is tiny. Now I'm not an embedded
1992510	1998870	developer anymore. In my time, JFFS2 was the most popular file system for embedded Linux devices.
1999030	2005430	This device is about 7 years old in design, so I don't know if that has changed. But
2006030	2013330	it's nice to see familiar things. Let's see what's in
2013330	2029130	in mtd. Oh yeah, you can see the labels. So mtd0 then spi-flash-nor, that's the 8 megabytes.
2030630	2050440	Okay, then we have Perl. 5.14, not bad. Not an ancient single digit version.
2050440	2056520	So that makes this potentially a system that you can develop on out of the box.
2057580	2062480	Let's see what is running on it. We have
2071470	2074380	the Telnet that we started.
2075370	2082750	And we have two of the UDP-SVD processes. These are the ones that do the
2083820	2087600	the broadcasting process that I described earlier.
2088820	2093470	We have the Boa web server that's providing HTTP support.
2094330	2099250	And we have a dynamic DNS advertisement.
2101110	2110190	We have a DHCP server because in access point mode we have to serve out DHCP addresses to clients.
2112210	2116230	The bodyguard process is the one that disables the radio
2116230	2123450	when you plug the card into an SD card slot so that there is no double write.
2126180	2130940	And that's about it. Let's see what do we have here.
2137730	2143510	We already discussed the kernel version. We can see that it was compiled with sorcery
2147290	2153190	on an Ubuntu machine. It's funny what kind of details you leak out.
2156310	2162150	What else? What else? What else? We're gonna skip the message. It's too messy.
2169930	2178610	So we discussed pretty much the CPU extensively already. You see that I got
2179650	2186090	the CPU series right. And yeah, the 421 Bogomips that I was mentioning before.
2186090	2191030	Not 400 megahertz. Just delay cycle is 421.
2194630	2208430	We can also look in here. This is the one that makes me cry. So here we could really use
2208430	2216750	some loop mount and some swap. But we can put them back in. So no crying.
2216750	2224390	One last thing. We can list the network interfaces of an SD card just because it
2224390	2230210	seems so wrong that we can pass up the opportunity to do it. And we discover absolutely nothing,
2230210	2236670	but it's kind of fun to say that you have done it. So why not? Now...
2238490	2252500	Okay. Back to the slides. Now be careful. The system mounts the flash partition under
2254760	2259820	mount SD. And accessing the file system from the card's own Linux,
2259820	2264560	while an external host is doing the same, could easily corrupt the file system.
2264560	2272780	Two live systems writing to the same host. No good. You can easily fix it by rebuilding the
2272780	2277080	file system. But you need to be aware of the problem so that you don't do it in production.
2277100	2283360	Development is just fun and games. But in production, that's not the way to go.
2283360	2293560	So what software do we have to play with here? In version 1.7 firmware,
2293560	2302300	we have a kernel 2.6.32. The modules, the kernel modules are for the SoC,
2302300	2308900	the Atheros 6003 radio, and the SDHC interface, which, as we discussed, is proprietary.
2310760	2318040	Your services that you can have out of the box are basically a very stripped-down busybox that
2318040	2326340	has Telnet, FTP, and DHCP. Busybox is a little bit crippled, but once you replace it, you can set
2326340	2332980	up SSH as soon as you can set up time properly. And this is very easy to do. It's just one
2332980	2340780	execution away. So, easy fix. On the kernel side, the kernel is extremely thin due to the need to
2340780	2347200	fit in the 8 megabyte NOR flash in the SoC. But we can load components from the larger storage
2347200	2353620	once we have a system running. Ideally, loop mount a file in FAT32 to avoid corruption.
2354040	2363640	Add swap to work around RAM. Truth to pivot into loop mount. We need a new kernel to do this,
2363640	2369620	and Robert figured out how to unpack the install files. And then Dimitri rebuilt the kernel by
2369620	2378340	looking at KSIMs. Since the .configure file is not exposed in PROC,
2378340	2383320	some people could think it's secrecy, but I think it's, again, saving space.
2384280	2391920	So, how this would work. Would create on the live partition as a single file a system image.
2391920	2398920	Would loop mount this and truth into it. Now, somebody took this to the extreme.
2399620	2405680	Why do people always do this? So, they downloaded an Ubuntu 9.x image.
2405680	2412840	The last version of Ubuntu compatible with ARM5 architecture. Put the image in there on the SD
2412840	2421840	card. Loop mounted. Truthed. Forwarded X. Started Firefox. And then complained that it was slow.
2423400	2428320	Okay. Well, it's not that interesting to run Ubuntu from 10 years ago.
2428320	2434460	But it's pretty cool that one can take it that far. It's nice to see that the bits actually work
2434460	2442860	and can be stretched. But we don't need to do things that crazy. Where there is Perl,
2442860	2450260	there is everything, I like to say. Maybe Perl is not your cup of tea, but it's better than not
2450260	2456980	having it. This is ARM. You can cross compile. You can build on the system. You can use IPackage.
2456980	2462560	You can bring your own language. You can steal packages from another device of the same
2462560	2468160	architecture since there are five billion of them. But if you want to be lazy, Perl is a perfectly
2468160	2475660	viable option. And this is also a reasonably recent Perl. It's not Perl of the ancients
2475660	2484600	like a Perl 5.6. It's 5.14. Big question for embedded devices is how we find them.
2485110	2489580	Where is my device? And we need to make it safe for the internets.
2491210	2500640	You cannot use this device if you cannot tell what IP it's at. So there are three approaches
2501270	2509580	that are common to work this problem. One is a known configuration. Always be at the same address.
2509580	2516360	This is what I just did. When the card is in AP mode, it is always at the same address.
2516480	2527320	11.254. I know where it is. I do not need to find it. Then there is what the card does natively.
2527400	2534840	Broadcast. It advertises where it is. Besides the horror I described earlier, there are proper
2534840	2542020	advertisement protocols like MDNS. Multicast DNS is a perfectly fine way to discover things
2542020	2549220	on the local network. The third one is to announce, which is the device itself,
2549220	2555440	once it has a valid network configuration, sends out an announcement. My favorite is to send out
2555440	2561720	an XMPP announcement, meaning a Jabber protocol announcement. But you can use any protocol you
2561720	2568140	want. And you know this is a unicast announcement, not a broadcast one like the horror I was
2568140	2575000	describing earlier. It is going to a single endpoint and it's a fair game. No messing up
2575000	2580840	of the network. I'm not going to go through all of these. There is an article I wrote for
2580840	2588120	Linux Journal in 2009, I believe. Search for my name and Linux Journal. And there are scripts.
2588120	2595320	They are implementing all of these for this architecture, in fact. You can go and just grab
2595320	2603580	the scripts. They are in the article. You can also do this right. If you're a standards person,
2603580	2610160	like some people rightly are, and in this case doing it right means implementing DNS update
2610900	2619600	as specified in RFC 2136, which I suffered through implementing a few years ago, actually.
2620580	2627720	Contact me by a fixed DNS name. I will update that DNS record when I boot so that it's always
2627720	2633820	correct for my current device location. This is also implemented in my Linux Journal article.
2633820	2640460	You can do it in 15 lines of Perl or less. So Perl may be hard to read sometimes, but it's
2640460	2646780	very, very expressive and it's very nice for this purpose because there are modules to do anything.
2647760	2653200	So let's go back to the security aspect. We were joking about the fact that it was easy to break
2653200	2661280	in, but realistically we have physical access. We have the card and we can do things to it.
2661280	2669930	We can also do it over Wi-Fi. Fine, that is less kosher, but that hardly matters.
2670240	2675130	What matters is that this brings the lost USB key attack to a new level.
2675780	2681080	In a military base, people are trained to shoot on sight when they see a lost USB key.
2681700	2689360	But in an industrial setting, people are more lax. So picture this out of a Tom Clancy book.
2689360	2696520	You need to break into somebody's network, you lose a USB key in their parking lot, and some
2697600	2703680	good Samaritan-fool will take it inside the office and plug it into the wrong machine.
2704220	2706920	I don't think I need to tell this audience this.
2708180	2713120	So what's new here is the Wi-Fi aspect, of course.
2714280	2720080	Although there are a few devices that do this, like HAC-5 has some devices that
2720080	2726310	do exactly this. But in this case, it's in SD card format with a radio in it, which is interesting.
2729060	2733260	Countermeasures are no different from the rogue access point ones.
2733580	2740520	From radio jamming or your network actively nacking connection requests very cleverly
2740520	2747500	for unknown access points in a broadcast range. Or if you have a security
2749380	2757820	policy against lost USB keys by locking down or pouring glue into USB and other ports,
2757820	2763220	you can pour glue into SD ports just fine and prevent people from sticking things into ports
2763220	2769220	they are not supposed to use. Neither approach is new. Sure, the card is not super secured,
2769220	2774320	but remember your security posture needs to be commensurate to your threat assessment.
2774320	2779240	You are not a nuclear reactor. If you were, you need to account for this.
2779440	2784800	But if the question is the security of your Instagram pictures, do people want them that badly?
2787230	2791970	So your mileage may vary. What is on the opportunity side is that this is a low
2791970	2798870	power system with vast amounts of storage and wireless connectivity. And really low power,
2798870	2802490	as in you could power it with a solar panel and put it up a tree.
2803670	2809470	This is the ideal pirate box data exchange. A pirate box being the term of art for anonymous
2809470	2815110	data exchange, where people drop and retrieve files over Wi-Fi anonymously. I don't think it's
2815110	2822130	as popular as it used to be once as a concept. This is in practice a spy's dead drop,
2822130	2828270	if you want to use the Intel community's comparison, if you want to continue that
2828270	2836070	line of thought. Less ominously, you can make a solar-powered geocache. But seriously,
2836410	2842750	you can now realistically put a server in your wallet or even make a server throwaway
2843750	2849490	or a Beowulf cluster in a shoebox, although I would recommend you do not do that.
2850070	2855170	You could put it in the SD slot of your car radio, if you have one of those old ones,
2855170	2860450	and make it download music whenever you park at home. There is one limitation.
2861070	2867790	SD cards are supposed to have SPI interfaces, and that would be awesome, because SPI means
2868830	2876830	Arduino. But sadly, this is not viable with this card. That won't work. Somebody tried
2877610	2884410	the integrated system. It was bigger than the card itself. I mean, the support for SPI to
2884410	2890150	access Arduino was bigger than the card itself. Not practical. But this is nonetheless a very
2890150	2896050	interesting platform to experiment with. Cross-compiling is an option, but you can
2896050	2901610	take the lazy way out and prototype with Perl. I solved the discovery problem for you. You have
2901610	2907910	all the scripts. And this is a very low cost. Same cost as the original Raspberry Pi. So you
2907910	2914370	have to decide if you want to trade RAM for very low power and small format, or the other way around.
2914470	2920910	And it's a fair question. It's a very niche hacking platform. Trascend has been very nice
2920910	2927690	to the community. Sorry, it's a very nice hacking platform. Trascend has been very nice to the
2927690	2935790	community. We broke this years ago and they haven't complained. They haven't sued anybody.
2935850	2941890	They haven't shut us out or done anything untoward. We get hardware to play with. They sell more
2941890	2949530	hardware. It's great for everyone. The mechanism we used is part of the SDK, but the SDK is not
2949530	2955630	public. So we had to discover it the hard way. We need a better distro image than the crap you
2955630	2961130	have seen. I've worked on too many Linux distributions to stand for that. But that is
2961130	2965650	relatively easy to do and there are some tools out there that are workable already.
2967630	2971890	I think we can do better, but it's adequate to at least experiment.
2973410	2977830	So if you come up with new ideas on how to use it, please send them to me.
2977830	2983810	Here is my contact info. You can find me on Twitter or send me email. Or you can find me
2983810	2991590	in the Discord channel and ask me questions there. Remember that speakers are Pavlovian devices,
2991590	2997070	so if you like the talk, please let us know. Rate the talk, send us comments, submit feedback,
2997070	3004330	all of those things as you see fit. If you do something with it, let us know what you did so
3004330	3011170	we can spread the news. Slides will be available and I'm available for questions if you have any.
3011170	3016310	Thank you and stay safe. Happy hacking!