WEBVTT 00:03.930 --> 00:05.970 Hardware Hacking Village. 00:06.390 --> 00:11.910 Welcome to Boston's Hacking Underground. 00:12.110 --> 00:15.630 Quite literally we are in my basement. 00:16.150 --> 00:21.710 Socially distant greetings from down here. 00:21.910 --> 00:28.030 Hopefully I managed to secure the location as in there is not going to be any noise and we get a reasonable recording. 00:29.950 --> 00:31.510 And that's it. 00:31.510 --> 00:32.890 Let's get started. 00:32.890 --> 00:36.730 I'm going to take the mask off since you're sufficiently far away. 00:36.730 --> 00:46.810 And while I certainly wanted to wear a fork bomb on a mask for a long time, I cannot go for a full hour doing that. 00:47.330 --> 00:55.010 So we have 45 or odd slides and the demo. 00:55.010 --> 00:57.430 So let's get going. 00:58.450 --> 01:07.510 Now, as a way of introduction, I had the privilege of spending my entire career in free and open source software. 01:08.330 --> 01:13.010 I am the product management director for Red Hat Ceph. 01:13.070 --> 01:18.310 And I was previously Ubuntu server PM at Canonical. 01:18.310 --> 01:23.810 And if you go back a decade, I was the dreaded systems management tsar at SUSE. 01:23.930 --> 01:26.850 The talk has nothing to do with my job. 01:26.850 --> 01:29.570 Well, I guess it is storage after all. 01:29.830 --> 01:31.650 I'm a manager these days. 01:31.650 --> 01:35.730 So as a former embedded developer, this is my definition of fun. 01:36.930 --> 01:43.650 The obligatory disclaimer is that we will most likely break some hardware playing with this. 01:43.650 --> 01:45.870 And it will come out of your pocket. 01:45.870 --> 01:52.930 No liability if you follow our instructions and stub your toe or bring about the end of the world. 01:53.210 --> 01:56.190 Or break your device, which is far more likely. 01:56.410 --> 01:58.210 So you have been warned. 01:58.270 --> 01:59.550 Let's get going. 01:59.570 --> 02:02.090 We have a lot of slides in the demo. 02:02.090 --> 02:03.230 We need to hustle a bit. 02:04.690 --> 02:06.070 Here is the idea. 02:06.810 --> 02:10.050 A processor is found in an SD card. 02:10.710 --> 02:13.510 Hackaday featured somebody's blog. 02:13.510 --> 02:18.670 Pretty much went viral in a word of web process. 02:18.670 --> 02:23.030 Virally blooming once Linux was noticed on the device. 02:23.030 --> 02:25.810 And Hackaday made it famous. 02:25.810 --> 02:27.130 Lots of blogs. 02:27.130 --> 02:28.870 SD card sized. 02:28.870 --> 02:30.870 Almost a raspberry pi. 02:30.870 --> 02:33.190 Can we repurpose the device? 02:34.650 --> 02:40.230 The word of web process really got going once Linux was noticed on the device. 02:41.250 --> 02:44.850 And so I noticed all this was going on. 02:44.930 --> 02:47.030 And I wanted a project for Christmas. 02:47.030 --> 02:51.270 That was five years and a bit more ago. 02:51.490 --> 02:55.330 So you could say that it has taken me for quite a ride. 02:56.970 --> 03:06.410 Let me repeat that as there is always someone who has no idea what I'm talking about. 03:06.410 --> 03:07.850 Here is the concept. 03:07.850 --> 03:09.810 A Wi-Fi enabled SD card. 03:10.070 --> 03:12.310 Automatically downloads your pictures. 03:12.470 --> 03:14.250 Several models exist. 03:14.450 --> 03:17.150 We're after the embedded system in there. 03:17.150 --> 03:18.050 In the card. 03:18.050 --> 03:20.110 The CPU of the card itself. 03:20.210 --> 03:24.650 It's like the Intel Edison they originally promised us, but for real this time. 03:26.390 --> 03:30.770 Copious amounts of Google Translate were used in the making of this talk. 03:30.770 --> 03:32.570 Really international effort. 03:32.570 --> 03:39.050 I saw blogs in French, Japanese, German, Korean, and of course English. 03:39.050 --> 03:41.170 Some Russian too. 03:41.210 --> 03:43.570 And I believe some Spanish. 03:43.950 --> 03:48.210 So copious use of Google Translate and in singularity of course. 03:48.950 --> 03:56.590 We explored the limits of machine translation, but it usually comes across clear enough to work with. 03:57.730 --> 04:03.450 So we're looking at the Trescend Wi-Fi SD line here. 04:03.450 --> 04:08.250 It comes in size from 8 gigabytes to 32 gigabytes. 04:08.250 --> 04:23.930 I prefer them as they are more open, even without hacking, as there are no attempts at platform strategies made by adding any middling cloud services that we do not want by some clever MBA that had a platforms class. 04:24.190 --> 04:29.790 There is no stepping stone service that may make things easier to set up. 04:29.790 --> 04:31.310 And doesn't. 04:31.410 --> 04:35.390 And adds yet another place your pictures are potentially in. 04:35.450 --> 04:42.750 The software on the Trescend card is simple and not perfect, but that is an asset for us as we will see. 04:43.670 --> 04:46.010 So where do we get these cards? 04:46.010 --> 04:47.630 You can go to Amazon. 04:47.630 --> 04:49.150 You could also try eBay. 04:50.810 --> 04:59.610 And they're going to be between $40 and $60 depending on capacity, about the price of Raspberry Pi and up. 04:59.610 --> 05:05.910 There are others like the PQi AirCard that are functionally the same. 05:06.190 --> 05:11.370 The PQi AirCard is interesting because it is actually an adapter card. 05:11.370 --> 05:18.350 You can put any storage you want in microSD format in there, and the adapter actually has the embedded system. 05:18.830 --> 05:23.150 Toshiba makes another one, and there is also the Flu card. 05:23.710 --> 05:26.250 And you can carry binaries through them. 05:26.410 --> 05:35.630 As a matter of fact, when you log into the system, you may notice that there is a command buzz in there. 05:36.270 --> 05:41.010 But there is no piezoelectric transducer here, so what is that for? 05:42.490 --> 05:47.970 But looking at another one of the card designs, that has a piezo. 05:48.510 --> 05:54.190 So you can learn things on one card that applies to another. 05:54.930 --> 05:59.730 But we're getting a little bit sidetracked here, so let's go back to where we should be. 05:59.730 --> 06:04.290 When the postman arrives, here is what you get. 06:05.330 --> 06:12.570 Inside the package, let's unbox one here, a card and an adapter. 06:12.610 --> 06:15.050 The inevitable legal disclaimer. 06:15.590 --> 06:20.330 I don't think this conference has a legal track, otherwise I would blame the lawyers. 06:21.130 --> 06:26.130 And a microscopic bit of a manual, which is actually not bad. 06:26.130 --> 06:35.310 The adapter is there because you can write to the SD card directly by mounting it on your Mac, for example, or over the radio. 06:36.010 --> 06:45.030 And when you have file systems mounted two places, and you are writing from two places, bad things happen. 06:45.690 --> 06:53.470 The adapter signals to the card to disable the radio, and prevents simultaneous writes from the air and local mount. 06:53.490 --> 06:57.170 Of course, that is exactly what we want to do. 06:57.170 --> 06:59.210 But we think before we do. 06:59.210 --> 07:05.890 We only want to use the radio, so we'll assemble it so it is actually not turned off. 07:06.750 --> 07:09.190 So just what is in there? 07:11.030 --> 07:15.690 This is an SDHC class 10 card. 07:15.810 --> 07:19.930 16 gigabytes in the case of the ones I used. 07:19.930 --> 07:22.450 Half and double the size exists. 07:22.870 --> 07:25.750 This is a full-size SD card. 07:25.750 --> 07:32.090 Pictured is model TS16GWSDHC10. 07:33.050 --> 07:38.370 You will have the slides at the end, so if you want to search for the cards, you'll have all the models. 07:38.370 --> 07:41.110 There is no need to take notes or any of that. 07:43.330 --> 07:47.250 So physically breaking the device voids the warranty. 07:47.290 --> 07:49.910 I bet you did not see that one coming. 07:52.430 --> 07:58.110 Exacto-knifing our way to success, we slice the card in two and find four large chips. 07:58.430 --> 07:59.470 Interesting. 07:59.670 --> 08:02.370 The parts on the left are the case. 08:02.370 --> 08:04.390 Nothing strange there. 08:05.150 --> 08:11.050 It may help guide your dissection if you need to open one, but that's about it. 08:11.770 --> 08:15.230 Incidentally, do you see the yellow tab in the center? 08:15.390 --> 08:18.870 That is the write-protect switch cards have. 08:18.870 --> 08:20.850 Interesting technical detail. 08:20.850 --> 08:25.090 There is nothing on the device reading the state of that toggle. 08:25.550 --> 08:30.670 The reason for this is that SD cards work like floppy drives. 08:31.770 --> 08:38.690 And in floppy drives, if you still remember those devices, write-protect is implemented by the drive. 08:38.890 --> 08:41.870 If the drive sends a write, the card will take it. 08:44.210 --> 08:56.750 If the card doesn't know and doesn't have to, the drive will not send a write if the toggle is in the protect position. 08:58.590 --> 09:02.610 So let's do a bit of overview of the components from the top left. 09:02.610 --> 09:13.470 We have a trace antenna, definitely not a 3 dB antenna and not 100 milliwatts of broadcasting power as the whole card consumes less than that. 09:14.110 --> 09:19.610 So Wi-Fi range will not be as per the Wi-Fi specs maximum. 09:19.630 --> 09:23.630 But that's okay because we're still beating the pants off Bluetooth. 09:24.270 --> 09:26.530 There is no antenna connector. 09:26.590 --> 09:31.240 You could try your hand at adding one if you're a master at soldering. 09:35.030 --> 09:39.790 But assuming you don't, you're not going to get the full Wi-Fi range. 09:39.810 --> 09:41.870 And I'm okay with that. 09:42.970 --> 09:46.670 Then we have the Wi-Fi radio chip. 09:47.810 --> 09:52.450 The SoC with the ARM CPU we are after is underneath it. 09:53.570 --> 09:57.310 16 gigs of flash in the big chip. 09:58.050 --> 10:01.290 And the flash controller is the last thing on the right. 10:02.270 --> 10:08.090 And up top we see the notch where the read-write tab rests that I was mentioning. 10:08.730 --> 10:12.850 And there is no actual board sensing of any kind as I said. 10:12.850 --> 10:16.490 The card is just making room for the tab to fit in that space. 10:17.870 --> 10:19.350 Flip side. 10:19.590 --> 10:29.930 Besides the standard SD leads, some of the smaller pads are TX and RX for a 3.3 volt 38400 baud serial. 10:30.410 --> 10:33.570 Annoyingly, really annoyingly, they are not labeled. 10:34.330 --> 10:40.710 They labeled resistors we don't really give a hoot about instead for who knows what reason. 10:41.430 --> 10:47.110 On the PQI air card, the TX and RX serial pads are labeled. 10:47.150 --> 10:49.550 So bonus points to those guys for that. 10:50.370 --> 10:55.530 If you do wired serial, you get access to a well-configured U-boot console. 10:56.190 --> 11:01.470 U-boot is the bootloader of choice for embedded Linux devices for those of you coming from Windows. 11:01.470 --> 11:03.650 A very handy tool to have. 11:04.670 --> 11:10.170 Better than the kernel that is in here as it has been stripped to the bone. 11:10.690 --> 11:14.790 Incidentally, I have been collecting all these details for a survey article. 11:15.050 --> 11:18.450 If you hack the card and blog the details, let me know. 11:18.450 --> 11:19.630 Send me the link. 11:20.110 --> 11:27.790 And you prefer going... if you prefer going the lazy way, you will get a how-to from me soon. 11:27.830 --> 11:28.330 Hopefully. 11:28.330 --> 11:31.910 I've been saying this for a while, but it's almost done. 11:34.940 --> 11:37.980 What's in there are these four chips. 11:38.000 --> 11:42.340 CPU, Wi-Fi module, flash controller, and storage. 11:44.040 --> 11:51.360 The SoC's 32 megabytes of RAM is the weakest spot of the board but very suitable for embedded use. 11:51.360 --> 11:55.500 Fear not those of you who are used to gigabytes of RAM. 11:55.500 --> 11:58.820 Besides, you have lots of storage. 11:58.820 --> 12:01.060 You could expand this with swap. 12:01.400 --> 12:05.240 If the kernel was built with support for swap. 12:05.860 --> 12:16.260 In the SoC, 8 megabytes of NOR flash are used for system including a stripped down kernel and compressed initramfs. 12:16.880 --> 12:19.660 Interesting compromises were made there. 12:19.660 --> 12:22.860 And of course, massive amounts of storage. 12:23.380 --> 12:29.680 So you could boot with a small system loop mount a larger image and shroot into it. 12:30.200 --> 12:35.380 If you had loop mount in this kernel, I start seeing a pattern here. 12:35.840 --> 12:37.600 But not all is lost. 12:37.600 --> 12:38.960 We can add it. 12:39.380 --> 12:42.980 Dimitri Greenberg has documented how to rebuild the kernel. 12:43.060 --> 12:47.760 So we have the instructions and the steps on how to do this already worked out. 12:48.120 --> 12:49.920 Let's look at the CPU. 12:49.920 --> 12:52.520 It's a 200 megahertz CPU. 12:52.880 --> 12:56.840 Some report 400 megahertz and they are wrong. 12:56.840 --> 13:01.100 They are confused by the 426 bogomips it sports. 13:01.580 --> 13:08.960 It's an ARM 926 EJS core. 13:09.640 --> 13:12.060 An ARM 9 processor. 13:12.060 --> 13:16.400 This is not a Cortex A9, but an older ARM 9. 13:16.400 --> 13:18.540 A low cost CPU. 13:19.040 --> 13:32.040 ARM 5 TEJ architecture with more than 5 billion with the B manufactured to date. 13:32.080 --> 13:40.220 Interesting extensions for Java, but the Giselle runtime requires talking to ARM as it was not shipped with the system. 13:40.220 --> 13:43.540 And anyway, who wants to do Java these days? 13:43.800 --> 13:46.240 So interesting core. 13:46.920 --> 13:48.520 The extensions. 13:48.520 --> 14:00.080 E stands for DSP, Digital Signal Processing Enhancements, because this processor used to be used for making feature phones. 14:00.640 --> 14:06.240 J for Java extensions or the Giselle JVM. 14:06.260 --> 14:12.560 Java extensions make byte codes directly usable by the CPU, which is really cool. 14:12.780 --> 14:20.960 The CPU instruction BJX branch to Java instruction, which switches the silicon to Giselle state. 14:20.960 --> 14:23.680 The JVM still handles errors. 14:23.680 --> 14:26.160 The OS handles the traps. 14:26.160 --> 14:35.700 But between 134 and 149 byte codes of the 203 in the JVM spec are handled in silicon. 14:35.700 --> 14:39.220 I don't know why the variation there. 14:39.220 --> 14:40.780 Why not a fixed number? 14:40.780 --> 14:47.120 But a large chunk of the byte code is running in hardware. 14:47.600 --> 14:54.360 Now, the original Raspberry Pi is a Broadcom BCM2835 processor. 14:54.780 --> 15:04.060 An ARM11 76JZF-S. 15:05.220 --> 15:09.140 This is an ARM6K architecture. 15:09.140 --> 15:13.300 It's closer to this processor than it is to a Cortex ARM. 15:13.520 --> 15:20.180 So the idea is that instead of the chip in the Pi, you would use the chip in the card. 15:20.240 --> 15:22.300 With different trade-offs. 15:22.300 --> 15:25.620 You get built-in radio, lose all the interfaces. 15:25.700 --> 15:28.220 The price stays just about the same. 15:29.320 --> 15:31.740 The radio is a Fortune chip. 15:34.720 --> 15:38.660 AFN31GL Wi-Fi controller. 15:38.820 --> 15:49.900 It comes with an Atheros AR6003 Wi-Fi core, which was marketed as the smallest Wi-Fi silicon design you could buy at the time. 15:50.400 --> 15:55.940 I don't know if they still have the record, but it was a pretty impressive claim five years ago. 15:55.940 --> 16:04.940 The bit we care about is that it does Wi-Fi B, G, and N with really low power draw. 16:06.220 --> 16:10.540 Do not plan to saturate the Wi-Fi Ethernet link with this device. 16:10.540 --> 16:13.880 You won't go much beyond one megabyte per second. 16:14.520 --> 16:21.460 Incidentally, if you feel like going turtles all the way down, there is a CPU to control the baseband radio. 16:21.520 --> 16:29.680 An Extensa MIPS core backed by 256 kilobytes of RAM and 256 kilobytes of ROM. 16:29.880 --> 16:31.220 I didn't go in there. 16:31.220 --> 16:35.260 Maybe it could be the next project for one of you. 16:36.180 --> 16:41.640 Also, this chip does not do Bluetooth, by the way. 16:41.640 --> 16:43.000 Not that we care. 16:45.140 --> 16:48.680 Then we have 16 gigs of NAND flash. 16:48.860 --> 16:50.660 You will not be wanting for storage. 16:50.660 --> 16:51.520 That's for sure. 16:51.520 --> 16:55.040 That is definitely not the problem the system has. 16:56.400 --> 17:00.180 The flash controller is a Silicon Motion 26... 17:05.000 --> 17:07.540 I can just read the slide. 17:08.840 --> 17:09.940 2683EN. 17:09.940 --> 17:11.120 Thank you, picture. 17:11.360 --> 17:20.480 Nothing of interest here except there was a bit of annoyance in the community at the lack of redistributed sources for some system components. 17:21.540 --> 17:22.860 Transcend resolved this. 17:22.860 --> 17:24.500 It's no longer an issue. 17:24.500 --> 17:27.700 But one of the modules is proprietary. 17:27.700 --> 17:30.500 The one that supports the flash controller. 17:31.440 --> 17:40.280 If you're familiar with IP restrictions for source code of video drivers, that is probably a similar reason. 17:40.280 --> 17:48.420 There is some secret sauce that the vendors of flash want to keep to themselves and not share with one another. 17:49.240 --> 17:51.280 We don't know what it is. 17:51.280 --> 18:04.230 But it's not really a concern for us unless you are an open source legal purist and you want everything in the open out of principle. 18:05.790 --> 18:09.090 The sources... I mean the sources for some of the modules are available. 18:09.090 --> 18:11.470 The binaries for all three modules are available. 18:11.470 --> 18:16.490 So if we recompile the kernel we can just drop the modules back in and go on from there. 18:16.490 --> 18:22.750 It's not like we're going to modify our interface to the flash to the flash chip anyway. 18:23.730 --> 18:25.510 We're not interested in that. 18:27.430 --> 18:37.310 Now, this card clocks between 0.9 and 1.1 watts while idle in my office. 18:37.310 --> 18:42.770 It peaks at 1.5 with wireless clients connected. 18:43.310 --> 18:47.330 This is a 110 volt power supply of course. 18:47.530 --> 18:49.790 An Apple switched power supply. 18:49.790 --> 18:53.490 Efficient but still power conversion is a factor. 18:53.490 --> 18:59.850 Presumably higher if you push the CPU to 100% while writing to flash. 19:02.090 --> 19:08.650 You could also try to push consumption by simultaneously pegging the CPU and massively writing to flash. 19:08.690 --> 19:12.050 I got my numbers by exercising the radio only. 19:12.050 --> 19:16.050 I didn't do a full suite of benchmarks at different types of load. 19:16.450 --> 19:23.450 This is a relatively lightweight system so I didn't see the need to push the envelope that far. 19:23.450 --> 19:36.070 Interestingly, I checked to see if we would get better efficiency through eliminating the power conversion step. 19:36.110 --> 19:39.070 And we hardly see a difference. 19:39.070 --> 19:44.490 220 milliamps is about 1.1 watts at 5 volts. 19:44.650 --> 19:49.530 Same as we measured at 120 for idle. 19:49.530 --> 19:53.290 It closely matches the other one. 19:53.290 --> 19:55.910 Apple really knows what they're doing. 19:55.910 --> 19:58.750 That iPhone switched power supply is really efficient. 19:58.750 --> 20:00.230 Good for them. 20:02.050 --> 20:05.470 Let's start looking at the software side. 20:06.890 --> 20:22.530 I'm going to walk you through what we do to make it work first and how we hack it second so it's not hanging in the void and confusing in as to how we got there. 20:22.530 --> 20:24.650 How does this all work? 20:24.650 --> 20:27.910 First you set up the app on your phone. 20:29.270 --> 20:34.750 Then it gives you access to basic setup and core functionality. 20:34.870 --> 20:38.430 Setting up network mode, names, password. 20:39.050 --> 20:50.670 Shoot and view here means putting the phone in a monitor mode of sorts where any picture shot by the camera is automatically downloaded and presented on the screen with no intervention. 20:50.790 --> 20:52.750 This will be important later. 20:54.470 --> 20:57.390 It also offers you to upgrade the firmware. 20:57.490 --> 21:04.350 Usually this is a concern as that precious security hole used for routing may disappear. 21:04.350 --> 21:06.350 But it's not so in this case. 21:06.350 --> 21:11.830 It does not matter what version of the firmware you have, you're going to get around it. 21:11.910 --> 21:13.270 So do not worry about it. 21:13.270 --> 21:15.910 The latest version is as open as the first. 21:16.870 --> 21:20.430 It is both good and bad, I guess. 21:20.710 --> 21:22.290 I say it is good. 21:22.290 --> 21:24.130 It lets us hack the card. 21:24.390 --> 21:29.210 Security issues we bring about are not in the hacking of the binary support package. 21:29.210 --> 21:31.570 But we'll get to that later. 21:32.150 --> 21:36.130 By default, the system wants to be its own access point. 21:36.130 --> 21:39.290 Great, very convenient for development. 21:39.290 --> 21:41.650 But not so for photo download. 21:41.650 --> 21:47.770 Think of it, you want to switch APs on your handheld device every time to sync pictures. 21:48.170 --> 22:00.270 The seamless internet AP client mode is a great strength of this card for ease of use compared to others that make it needlessly more complex by putting their service in the middle. 22:00.270 --> 22:03.430 You just choose the mode you want and you get it. 22:05.350 --> 22:10.210 So when it is up, it shows here from another machine in the same room. 22:10.650 --> 22:13.750 Your SD card has now become its own access point. 22:13.990 --> 22:15.990 Okay, what's next? 22:17.330 --> 22:21.990 Well, now we can connect to it just like you would anywhere else. 22:24.030 --> 22:28.330 And now we can ping it just like any other host. 22:31.000 --> 22:34.620 Now let's look at how it works before we get into it. 22:34.620 --> 22:35.500 Think about it. 22:35.500 --> 22:39.560 The app needs to find where the heck the card is. 22:39.840 --> 22:44.720 It is out there on the AP, but at what IP address? 22:45.180 --> 22:50.920 The card broadcasts on UDP 55777. 22:50.920 --> 22:52.620 I'm here, I'm here, I'm here. 22:53.300 --> 22:56.140 Other cards are even more aggressive. 22:56.760 --> 23:08.280 They ARP the entire slash 24 subnet, found out where every node is, then send HTTP requests to everyone until it finds the card. 23:08.360 --> 23:10.320 Then maybe it stops. 23:10.320 --> 23:12.460 Most of the time it does anyway. 23:12.680 --> 23:14.140 Don't worry, we can fix this. 23:14.140 --> 23:16.360 It's just funny to me. 23:16.780 --> 23:22.480 The tools are only needed for initial IP discovery and password setup. 23:22.480 --> 23:34.360 If you do not want to use them, the card comes with a default user admin with a password of 1, 2, 3, 4, 5, 6, 7, 8. 23:35.020 --> 23:37.660 But that's not the part that will make you laugh. 23:39.420 --> 23:42.440 We port scan the card to see what's going on here. 23:42.740 --> 23:46.320 Here we see Telnet because I already cracked this one. 23:47.600 --> 23:51.380 The HTTP server, the pictures are published there. 23:51.760 --> 23:54.820 The app just HTTP gets them. 23:55.220 --> 23:59.220 Services are offered as CGI scripts out of the web server. 23:59.360 --> 24:02.240 That's how the app commands the card to do things. 24:02.740 --> 24:08.460 The additional port 5566 broadcasts new entries in shoot and view mode. 24:08.500 --> 24:13.040 If you're connected there, you get a new URL message for every picture. 24:13.040 --> 24:15.520 That's how shoot and view works. 24:15.600 --> 24:20.060 You get one line with URL of new pictures when they're generated. 24:20.060 --> 24:21.960 Very simple architecture. 24:21.960 --> 24:23.240 Not bad. 24:23.780 --> 24:24.940 A few quirks. 24:24.940 --> 24:27.040 It downloads pictures twice. 24:27.140 --> 24:34.780 A bit suboptimal that way, but in this way it doesn't have to spend CPU power to generate thumbnails on board. 24:34.940 --> 24:42.160 Trades a little of bandwidth for not having to spend CPU and power. 24:42.240 --> 24:47.220 It also assumes that you're not downloading multiple pictures at once, which you're not. 24:47.220 --> 24:48.700 So simplicity prevails. 24:48.700 --> 24:51.180 I'm a fan of that type of design. 24:52.500 --> 24:56.940 We can browse the card's HTTP server directly. 24:56.940 --> 24:59.000 It's a boa web server. 24:59.280 --> 25:01.480 It exposes directory listings. 25:01.480 --> 25:06.920 In theory, it should show you only the directory listings of the data. 25:07.500 --> 25:10.760 And simple CGI bin scripts to set configuration. 25:10.940 --> 25:12.720 These are in Perl. 25:13.160 --> 25:20.220 App simply downloads the files via HTTP and calls CGI scripts to configure the system. 25:20.580 --> 25:23.140 And these scripts are way in. 25:23.140 --> 25:26.060 That's how the card was broken into. 25:28.850 --> 25:37.230 So this story starts with Pablo, who thinks there must be a CPU in these Wi-Fi enabled cards and turns out that he is right. 25:37.490 --> 25:41.990 Pablo went out and started poking at the software, looking for security holes. 25:41.990 --> 25:44.650 Find several the size of a small barn. 25:45.110 --> 25:53.450 Found dot dot slash dot dot slash backpats breaking out of the allowed inspection area. 25:53.590 --> 26:02.930 He extracts the source files for the CGI bin, exploits a Perl script, and in he goes. 26:03.130 --> 26:06.690 And I went that way myself the first time. 26:06.690 --> 26:09.190 But there is a better way. 26:09.410 --> 26:15.630 A file called autorun.sh. 26:16.190 --> 26:19.430 I think you know where this is going. 26:20.670 --> 26:25.550 Write a file to the SD card named autorun.sh. 26:25.610 --> 26:29.190 The system will read it and execute it. 26:29.190 --> 26:31.170 With root privilege. 26:31.190 --> 26:32.930 At boot. 26:33.190 --> 26:38.870 So all I have to do is just go, telnet please, and telnet arrives. 26:38.870 --> 26:40.390 So much nicer. 26:40.470 --> 26:44.290 Now, the security freaks among you will be horrified. 26:44.290 --> 26:47.590 But in terms of actually working with the card, this is fabulous. 26:47.590 --> 26:49.250 It makes it so nice. 26:49.490 --> 26:55.430 There is another aspect to this that is humorously named. 26:57.490 --> 26:59.490 I know what you're thinking. 26:59.630 --> 27:01.110 But that's not it. 27:01.390 --> 27:03.850 It stands for firmware update. 27:04.290 --> 27:06.030 It's a clever mechanism. 27:06.090 --> 27:11.030 You supply autorun.sh and three files. 27:11.030 --> 27:13.870 The kernel, the program bin. 27:14.330 --> 27:17.590 The system starts program bin. 27:17.590 --> 27:21.470 Turns out this is a copy of the cards you boot with the default script payload. 27:22.010 --> 27:26.110 The script loads the new system onto the old and then reboots. 27:26.330 --> 27:28.310 It's a nice way to prevent breaking. 27:28.310 --> 27:33.850 It also resets all configuration to the defaults, which may be handy if you screwed up. 27:34.390 --> 27:39.030 It is a really nice way to revert breaking and also gives you a way back to the defaults. 27:39.310 --> 27:42.410 But obviously you can only undo software breaking. 27:42.630 --> 27:44.450 You can still break the hardware. 27:53.770 --> 27:56.190 It's time to try and do this live. 27:57.590 --> 28:00.190 I usually unbox one of these. 28:02.170 --> 28:07.930 But in a virtual setting it doesn't really make it very useful. 28:07.930 --> 28:13.950 And you have seen the pictures, so you've seen most of what there is to see in an unboxing. 28:14.690 --> 28:17.890 I had to find... so let's set it up. 28:18.650 --> 28:24.090 I had to find an SD adapter that does not switch off the radio. 28:25.490 --> 28:36.070 So I went to my local computer megastore and bought every single adapter in existence, tested them all, returned 9 out of 10. 28:36.670 --> 28:42.070 And now we have the right thing. 28:49.050 --> 28:52.750 And this thing boots really fast. 28:52.750 --> 28:59.430 So much so that if I connected over the serial, it would be up before I can connect to it. 28:59.430 --> 29:01.350 You would not see boot messages. 29:03.090 --> 29:07.030 It will just be there already. 29:09.770 --> 29:10.570 So... 29:20.870 --> 29:23.190 and we got the advertisement. 29:25.370 --> 29:27.790 And we are connected. 29:27.790 --> 29:31.290 We got a connection. 29:31.290 --> 29:37.010 Now I was connected to that card recently, so let's just do it this way. 29:37.670 --> 29:39.390 And see? 29:39.390 --> 29:42.030 It got there way before me. 29:44.930 --> 29:47.110 What are we going to see here? 29:47.570 --> 29:52.570 Let's start from version text. 29:54.610 --> 30:04.210 So the KeyASIC Wi-Fi SD is the ODM design that all these vendors purchase to make their own products. 30:07.790 --> 30:18.950 And you can see that it confirms the 802.11n Wi-Fi. 30:19.090 --> 30:29.110 The Linux kernel is 263228, one of our most popular Linux kernels ever. 30:29.110 --> 30:31.670 This one was in RHEL 6. 30:31.670 --> 30:43.090 It was in SUSE Linux Enterprise 11 SP1 in a breaking of continuity from 11 kernel rebase. 30:43.090 --> 30:54.230 And I believe it was in Ubuntu Server 10.04, although that one wasn't mine, so don't quote me on that, but I'm pretty sure. 30:56.790 --> 31:07.190 This is the kind of kernel that you would want to run when you have only 32 megs of RAM, so it's a very, very good choice. 31:07.390 --> 31:15.690 It will not be expecting gigs of RAM either in this form or in userland. 31:17.090 --> 31:18.890 What else? 31:19.710 --> 31:21.890 Well, let's see what's around here. 31:30.470 --> 31:34.490 We want to see something else, actually. 31:37.490 --> 31:44.250 This is the actual VFAT system of the SD card. 31:44.250 --> 31:56.850 And you can see that I plugged it into a Nikon digital camera that left its own fingerprint there and a few files that I've been poking around with. 31:57.210 --> 31:58.970 BusyBox is notable here. 31:58.970 --> 32:09.410 We could run that BusyBox and have a much more futureful shell environment, but I want to show you here how the card is rather than how we are going to make it. 32:09.410 --> 32:13.730 The making part we can defer to a writeup. 32:14.730 --> 32:19.370 But yeah, very easy to replace the shell by just downloading a BusyBox and executing it. 32:23.650 --> 32:39.890 Incidentally, once you have a new BusyBox, you can run the NTP module and not be in 2012 anymore, which is great because then you can do proper secure connectivity, not plain text telnet. 32:40.290 --> 32:46.490 And now that your certificates are not coming from the future, crypto will actually work. 32:48.450 --> 32:51.750 What do we have on the storage side? 32:54.090 --> 33:03.850 So you see the JFFS2 file system that is the 8 megabyte partition that the system boots from. 33:03.850 --> 33:07.830 That is the reason why things have been stripped down so much. 33:08.390 --> 33:10.090 It is tiny. 33:10.270 --> 33:13.430 Now I'm not an embedded developer anymore. 33:13.430 --> 33:18.870 In my time, JFFS2 was the most popular file system for embedded Linux devices. 33:19.030 --> 33:25.190 This device is about 7 years old in design, so I don't know if that has changed. 33:25.190 --> 33:28.030 But it's nice to see familiar things. 33:31.730 --> 33:38.430 Let's see what's in in mtd. 33:39.690 --> 33:43.090 Oh yeah, you can see the labels. 33:43.090 --> 33:49.130 So mtd0 then spi-flash-nor, that's the 8 megabytes. 33:50.630 --> 33:54.930 Okay, then 33:59.180 --> 34:03.740 we have Perl. 34:04.060 --> 34:06.920 5.14, not bad. 34:06.960 --> 34:10.440 Not an ancient single digit version. 34:10.440 --> 34:16.520 So that makes this potentially a system that you can develop on out of the box. 34:17.580 --> 34:20.420 Let's see what is running on it. 34:21.020 --> 34:22.480 We have 34:31.470 --> 34:34.380 the Telnet that we started. 34:35.370 --> 34:40.230 And we have two of the UDP-SVD processes. 34:40.230 --> 34:47.600 These are the ones that do the the broadcasting process that I described earlier. 34:48.820 --> 34:53.470 We have the Boa web server that's providing HTTP support. 34:54.330 --> 34:59.250 And we have a dynamic DNS advertisement. 35:01.110 --> 35:10.190 We have a DHCP server because in access point mode we have to serve out DHCP addresses to clients. 35:12.210 --> 35:23.450 The bodyguard process is the one that disables the radio when you plug the card into an SD card slot so that there is no double write. 35:26.180 --> 35:28.220 And that's about it. 35:28.560 --> 35:30.940 Let's see what do we have here. 35:37.730 --> 35:40.410 We already discussed the kernel version. 35:40.610 --> 35:43.510 We can see that it was compiled with sorcery 35:47.290 --> 35:49.130 on an Ubuntu machine. 35:50.190 --> 35:53.190 It's funny what kind of details you leak out. 35:56.310 --> 35:57.810 What else? 35:57.810 --> 35:58.190 What else? 35:58.190 --> 35:58.850 What else? 35:58.890 --> 36:00.750 We're gonna skip the message. 36:00.750 --> 36:02.150 It's too messy. 36:09.930 --> 36:17.450 So we discussed pretty much the CPU extensively already. 36:17.450 --> 36:22.170 You see that I got the CPU series right. 36:22.170 --> 36:26.090 And yeah, the 421 Bogomips that I was mentioning before. 36:26.090 --> 36:28.290 Not 400 megahertz. 36:28.570 --> 36:31.030 Just delay cycle is 421. 36:34.630 --> 36:38.050 We can also look in here. 36:43.050 --> 36:45.150 This is the one that makes me cry. 36:45.150 --> 36:52.410 So here we could really use some loop mount and some swap. 36:52.590 --> 36:54.450 But we can put them back in. 36:54.450 --> 36:56.750 So no crying. 36:56.750 --> 36:58.390 One last thing. 36:58.870 --> 37:07.970 We can list the network interfaces of an SD card just because it seems so wrong that we can pass up the opportunity to do it. 37:08.470 --> 37:13.990 And we discover absolutely nothing, but it's kind of fun to say that you have done it. 37:13.990 --> 37:15.170 So why not? 37:16.150 --> 37:16.670 Now... 37:18.490 --> 37:19.730 Okay. 37:22.910 --> 37:24.790 Back to the slides. 37:27.800 --> 37:29.640 Now be careful. 37:29.980 --> 37:36.420 The system mounts the flash partition under mount SD. 37:36.820 --> 37:44.560 And accessing the file system from the card's own Linux, while an external host is doing the same, could easily corrupt the file system. 37:44.560 --> 37:48.520 Two live systems writing to the same host. 37:48.820 --> 37:50.180 No good. 37:50.660 --> 37:53.720 You can easily fix it by rebuilding the file system. 37:53.720 --> 37:57.080 But you need to be aware of the problem so that you don't do it in production. 37:57.100 --> 37:59.740 Development is just fun and games. 37:59.740 --> 38:03.360 But in production, that's not the way to go. 38:03.360 --> 38:06.760 So what software do we have to play with here? 38:10.140 --> 38:17.380 In version 1.7 firmware, we have a kernel 2.6.32. 38:18.100 --> 38:28.900 The modules, the kernel modules are for the SoC, the Atheros 6003 radio, and the SDHC interface, which, as we discussed, is proprietary. 38:30.760 --> 38:41.060 Your services that you can have out of the box are basically a very stripped-down busybox that has Telnet, FTP, and DHCP. 38:42.880 --> 38:50.920 Busybox is a little bit crippled, but once you replace it, you can set up SSH as soon as you can set up time properly. 38:50.920 --> 38:52.480 And this is very easy to do. 38:52.480 --> 38:53.960 It's just one execution away. 38:53.960 --> 38:55.800 So, easy fix. 38:56.420 --> 39:04.480 On the kernel side, the kernel is extremely thin due to the need to fit in the 8 megabyte NOR flash in the SoC. 39:04.580 --> 39:09.180 But we can load components from the larger storage once we have a system running. 39:09.560 --> 39:13.620 Ideally, loop mount a file in FAT32 to avoid corruption. 39:14.040 --> 39:16.700 Add swap to work around RAM. 39:18.100 --> 39:21.120 Truth to pivot into loop mount. 39:21.900 --> 39:26.940 We need a new kernel to do this, and Robert figured out how to unpack the install files. 39:27.280 --> 39:32.600 And then Dimitri rebuilt the kernel by looking at KSIMs. 39:32.660 --> 39:43.320 Since the .configure file is not exposed in PROC, some people could think it's secrecy, but I think it's, again, saving space. 39:44.280 --> 39:46.900 So, how this would work. 39:46.900 --> 39:51.920 Would create on the live partition as a single file a system image. 39:51.920 --> 39:55.240 Would loop mount this and truth into it. 39:56.220 --> 39:58.920 Now, somebody took this to the extreme. 39:59.620 --> 40:01.800 Why do people always do this? 40:02.100 --> 40:05.680 So, they downloaded an Ubuntu 9.x image. 40:05.680 --> 40:10.420 The last version of Ubuntu compatible with ARM5 architecture. 40:10.960 --> 40:13.520 Put the image in there on the SD card. 40:13.520 --> 40:14.600 Loop mounted. 40:14.600 --> 40:15.620 Truthed. 40:15.620 --> 40:17.220 Forwarded X. 40:17.220 --> 40:18.960 Started Firefox. 40:19.180 --> 40:21.840 And then complained that it was slow. 40:23.400 --> 40:24.680 Okay. 40:24.920 --> 40:28.320 Well, it's not that interesting to run Ubuntu from 10 years ago. 40:28.320 --> 40:31.700 But it's pretty cool that one can take it that far. 40:31.920 --> 40:35.940 It's nice to see that the bits actually work and can be stretched. 40:36.840 --> 40:40.540 But we don't need to do things that crazy. 40:41.280 --> 40:45.340 Where there is Perl, there is everything, I like to say. 40:45.740 --> 40:51.300 Maybe Perl is not your cup of tea, but it's better than not having it. 40:51.820 --> 40:52.760 This is ARM. 40:52.760 --> 40:54.080 You can cross compile. 40:54.080 --> 40:55.540 You can build on the system. 40:55.540 --> 40:56.980 You can use IPackage. 40:56.980 --> 40:59.120 You can bring your own language. 40:59.620 --> 41:05.060 You can steal packages from another device of the same architecture since there are five billion of them. 41:05.360 --> 41:09.480 But if you want to be lazy, Perl is a perfectly viable option. 41:09.960 --> 41:13.340 And this is also a reasonably recent Perl. 41:13.340 --> 41:16.980 It's not Perl of the ancients like a Perl 5.6. 41:16.980 --> 41:18.320 It's 5.14. 41:19.960 --> 41:24.600 Big question for embedded devices is how we find them. 41:25.110 --> 41:26.740 Where is my device? 41:26.740 --> 41:29.580 And we need to make it safe for the internets. 41:31.210 --> 41:38.380 You cannot use this device if you cannot tell what IP it's at. 41:38.380 --> 41:43.920 So there are three approaches that are common to work this problem. 41:44.000 --> 41:46.820 One is a known configuration. 41:46.960 --> 41:49.580 Always be at the same address. 41:49.580 --> 41:52.160 This is what I just did. 41:52.400 --> 41:56.360 When the card is in AP mode, it is always at the same address. 41:56.480 --> 41:58.200 11.254. 41:58.200 --> 41:59.860 I know where it is. 41:59.860 --> 42:01.840 I do not need to find it. 42:04.360 --> 42:07.320 Then there is what the card does natively. 42:07.400 --> 42:08.440 Broadcast. 42:08.440 --> 42:11.240 It advertises where it is. 42:11.660 --> 42:17.780 Besides the horror I described earlier, there are proper advertisement protocols like MDNS. 42:17.780 --> 42:23.820 Multicast DNS is a perfectly fine way to discover things on the local network. 42:24.900 --> 42:33.500 The third one is to announce, which is the device itself, once it has a valid network configuration, sends out an announcement. 42:33.620 --> 42:39.560 My favorite is to send out an XMPP announcement, meaning a Jabber protocol announcement. 42:39.560 --> 42:42.720 But you can use any protocol you want. 42:42.920 --> 42:49.400 And you know this is a unicast announcement, not a broadcast one like the horror I was describing earlier. 42:49.400 --> 42:53.660 It is going to a single endpoint and it's a fair game. 42:53.660 --> 42:56.140 No messing up of the network. 42:57.260 --> 42:59.520 I'm not going to go through all of these. 42:59.520 --> 43:04.040 There is an article I wrote for Linux Journal in 2009, I believe. 43:04.460 --> 43:07.060 Search for my name and Linux Journal. 43:07.060 --> 43:08.120 And there are scripts. 43:08.120 --> 43:13.940 They are implementing all of these for this architecture, in fact. 43:13.940 --> 43:16.180 You can go and just grab the scripts. 43:16.180 --> 43:17.860 They are in the article. 43:19.120 --> 43:21.640 You can also do this right. 43:21.720 --> 43:39.600 If you're a standards person, like some people rightly are, and in this case doing it right means implementing DNS update as specified in RFC 2136, which I suffered through implementing a few years ago, actually. 43:40.580 --> 43:43.440 Contact me by a fixed DNS name. 43:43.440 --> 43:50.640 I will update that DNS record when I boot so that it's always correct for my current device location. 43:50.900 --> 43:53.820 This is also implemented in my Linux Journal article. 43:53.820 --> 43:57.000 You can do it in 15 lines of Perl or less. 43:57.000 --> 44:06.780 So Perl may be hard to read sometimes, but it's very, very expressive and it's very nice for this purpose because there are modules to do anything. 44:07.760 --> 44:10.320 So let's go back to the security aspect. 44:10.440 --> 44:17.560 We were joking about the fact that it was easy to break in, but realistically we have physical access. 44:17.620 --> 44:21.280 We have the card and we can do things to it. 44:21.280 --> 44:24.740 We can also do it over Wi-Fi. 44:24.740 --> 44:29.930 Fine, that is less kosher, but that hardly matters. 44:30.240 --> 44:35.130 What matters is that this brings the lost USB key attack to a new level. 44:35.780 --> 44:41.080 In a military base, people are trained to shoot on sight when they see a lost USB key. 44:41.700 --> 44:45.080 But in an industrial setting, people are more lax. 44:45.080 --> 44:49.360 So picture this out of a Tom Clancy book. 44:49.360 --> 45:03.680 You need to break into somebody's network, you lose a USB key in their parking lot, and some good Samaritan-fool will take it inside the office and plug it into the wrong machine. 45:04.220 --> 45:06.920 I don't think I need to tell this audience this. 45:08.180 --> 45:13.120 So what's new here is the Wi-Fi aspect, of course. 45:14.280 --> 45:21.340 Although there are a few devices that do this, like HAC-5 has some devices that do exactly this. 45:21.340 --> 45:26.310 But in this case, it's in SD card format with a radio in it, which is interesting. 45:29.060 --> 45:33.260 Countermeasures are no different from the rogue access point ones. 45:33.580 --> 45:45.560 From radio jamming or your network actively nacking connection requests very cleverly for unknown access points in a broadcast range. 45:45.860 --> 46:04.880 Or if you have a security policy against lost USB keys by locking down or pouring glue into USB and other ports, you can pour glue into SD ports just fine and prevent people from sticking things into ports they are not supposed to use. 46:05.160 --> 46:07.060 Neither approach is new. 46:07.300 --> 46:14.320 Sure, the card is not super secured, but remember your security posture needs to be commensurate to your threat assessment. 46:14.320 --> 46:16.420 You are not a nuclear reactor. 46:16.420 --> 46:19.240 If you were, you need to account for this. 46:19.440 --> 46:24.800 But if the question is the security of your Instagram pictures, do people want them that badly? 46:27.230 --> 46:29.510 So your mileage may vary. 46:29.510 --> 46:36.010 What is on the opportunity side is that this is a low power system with vast amounts of storage and wireless connectivity. 46:36.390 --> 46:42.490 And really low power, as in you could power it with a solar panel and put it up a tree. 46:43.670 --> 46:46.610 This is the ideal pirate box data exchange. 46:46.610 --> 46:54.430 A pirate box being the term of art for anonymous data exchange, where people drop and retrieve files over Wi-Fi anonymously. 46:54.430 --> 46:59.150 I don't think it's as popular as it used to be once as a concept. 46:59.390 --> 47:09.450 This is in practice a spy's dead drop, if you want to use the Intel community's comparison, if you want to continue that line of thought. 47:10.210 --> 47:14.870 Less ominously, you can make a solar-powered geocache. 47:14.870 --> 47:29.490 But seriously, you can now realistically put a server in your wallet or even make a server throwaway or a Beowulf cluster in a shoebox, although I would recommend you do not do that. 47:30.070 --> 47:38.250 You could put it in the SD slot of your car radio, if you have one of those old ones, and make it download music whenever you park at home. 47:38.590 --> 47:40.450 There is one limitation. 47:41.070 --> 47:49.870 SD cards are supposed to have SPI interfaces, and that would be awesome, because SPI means Arduino. 47:50.390 --> 47:54.790 But sadly, this is not viable with this card. 47:54.790 --> 47:55.970 That won't work. 47:55.970 --> 47:59.730 Somebody tried the integrated system. 47:59.990 --> 48:01.810 It was bigger than the card itself. 48:01.810 --> 48:06.490 I mean, the support for SPI to access Arduino was bigger than the card itself. 48:06.490 --> 48:08.190 Not practical. 48:08.630 --> 48:12.450 But this is nonetheless a very interesting platform to experiment with. 48:12.670 --> 48:18.610 Cross-compiling is an option, but you can take the lazy way out and prototype with Perl. 48:18.910 --> 48:21.250 I solved the discovery problem for you. 48:21.250 --> 48:22.690 You have all the scripts. 48:23.290 --> 48:24.970 And this is a very low cost. 48:24.970 --> 48:27.410 Same cost as the original Raspberry Pi. 48:27.490 --> 48:34.370 So you have to decide if you want to trade RAM for very low power and small format, or the other way around. 48:34.470 --> 48:36.130 And it's a fair question. 48:37.590 --> 48:39.710 It's a very niche hacking platform. 48:39.710 --> 48:41.890 Trascend has been very nice to the community. 48:41.890 --> 48:45.430 Sorry, it's a very nice hacking platform. 48:45.470 --> 48:48.490 Trascend has been very nice to the community. 48:48.530 --> 48:53.730 We broke this years ago and they haven't complained. 48:54.050 --> 48:55.790 They haven't sued anybody. 48:55.850 --> 48:59.450 They haven't shut us out or done anything untoward. 48:59.450 --> 49:01.230 We get hardware to play with. 49:01.230 --> 49:02.630 They sell more hardware. 49:02.630 --> 49:04.290 It's great for everyone. 49:04.450 --> 49:09.970 The mechanism we used is part of the SDK, but the SDK is not public. 49:09.970 --> 49:12.710 So we had to discover it the hard way. 49:12.950 --> 49:16.390 We need a better distro image than the crap you have seen. 49:16.510 --> 49:20.090 I've worked on too many Linux distributions to stand for that. 49:20.450 --> 49:25.650 But that is relatively easy to do and there are some tools out there that are workable already. 49:27.630 --> 49:31.890 I think we can do better, but it's adequate to at least experiment. 49:33.410 --> 49:37.830 So if you come up with new ideas on how to use it, please send them to me. 49:37.830 --> 49:39.130 Here is my contact info. 49:39.130 --> 49:41.910 You can find me on Twitter or send me email. 49:42.450 --> 49:47.830 Or you can find me in the Discord channel and ask me questions there. 49:48.210 --> 49:54.730 Remember that speakers are Pavlovian devices, so if you like the talk, please let us know. 49:54.730 --> 50:00.050 Rate the talk, send us comments, submit feedback, all of those things as you see fit. 50:00.430 --> 50:05.730 If you do something with it, let us know what you did so we can spread the news. 50:05.950 --> 50:11.170 Slides will be available and I'm available for questions if you have any. 50:11.170 --> 50:15.210 Thank you and stay safe. 50:15.410 --> 50:16.310 Happy hacking!