1
00:00:00,000 --> 00:00:01,540
I'm just here to destroy.

2
00:00:01,700 --> 00:00:13,980
So, it's definitely a learning curve for me, where I'm just used to breaking the thing down, just to break it down, versus breaking it down to actually get some value out of it and turn it into something cool.

3
00:00:13,980 --> 00:00:18,800
So, yeah, I really appreciate all the support and all the help so far.

4
00:00:18,800 --> 00:00:20,240
It's been a great journey.

5
00:00:21,160 --> 00:00:22,440
Outstanding, outstanding.

6
00:00:22,440 --> 00:00:28,940
So, we're getting close kind of to the start point, just a minute or two out.

7
00:00:29,340 --> 00:00:42,160
Again, for those joining in the actual Zoom webinar, there is a button down there where you can actually post questions.

8
00:00:42,160 --> 00:00:46,360
I encourage you to please do so.

9
00:00:46,360 --> 00:00:51,660
The goal is, is we will try to answer any questions that come up.

10
00:00:51,660 --> 00:00:53,300
If we have the answer.

11
00:00:53,780 --> 00:01:00,740
U-Boot's kind of an amazing topic, and none of us claim to be, know possibly everything out there.

12
00:01:00,740 --> 00:01:05,960
But we'll do our best to be able to give you some good feedback on your questions.

13
00:01:05,960 --> 00:01:10,340
Also, after this is all over, I'll be jumping over to Discord.

14
00:01:10,340 --> 00:01:16,920
I think Garrett will be there also in the IoT Village Discord in the speaker area.

15
00:01:16,920 --> 00:01:29,260
So, if you have any follow-up questions after that, please reach out to Garrett or me or Jonathan, and we'd be more than glad to help you out.

16
00:01:29,260 --> 00:01:31,980
So, we're kind of at the go point.

17
00:01:31,980 --> 00:01:38,140
So, I'm going to turn this all over to Garrett to go ahead and get started.

18
00:01:38,140 --> 00:01:39,700
So, it's all yours, Garrett.

19
00:01:41,040 --> 00:01:43,180
All right, right on.

20
00:01:43,600 --> 00:01:47,820
Well, appreciate everyone taking some time out on Saturday.

21
00:01:47,820 --> 00:01:50,620
I know that normally we're in Vegas right now.

22
00:01:50,620 --> 00:01:54,160
So, it would be no harm and no foul to be taking time out on a Saturday.

23
00:01:54,160 --> 00:02:00,240
But appreciate y'all, you know, taking some time and tuning in today.

24
00:02:00,820 --> 00:02:04,980
So, without further ado, let's get this party started.

25
00:02:04,980 --> 00:02:07,040
So, you should be able to see my screen.

26
00:02:07,740 --> 00:02:14,840
We're looking at the U-Boot DC28 IoT Village is what we're going to be going over today.

27
00:02:17,120 --> 00:02:21,300
So, we got a couple agenda items to go over real quick.

28
00:02:21,300 --> 00:02:22,500
You know, what is U-Boot?

29
00:02:22,520 --> 00:02:24,580
First off, we're going to get that out of the way.

30
00:02:24,720 --> 00:02:32,420
Then we're going to go into pin glitching, a Philips Hue device, and then potentially getting root on that machine.

31
00:02:32,780 --> 00:02:39,800
And then we're going to switch gears a little bit and go over some common problems with Daryl Hyland.

32
00:02:39,940 --> 00:02:44,860
And it's common problems related to U-Boot and how U-Boot can solve them.

33
00:02:44,900 --> 00:02:49,400
Then we're going to be rooting a Luma Wi-Fi access point.

34
00:02:49,400 --> 00:02:54,800
It's like a mesh Wi-Fi device utilizing TFTP.

35
00:02:55,020 --> 00:02:58,160
And then following that, we're getting faded.

36
00:02:58,400 --> 00:03:00,980
So, that's the agenda for the day.

37
00:03:01,660 --> 00:03:05,600
And without further ado, let's get this party rolling.

38
00:03:05,600 --> 00:03:09,620
So, what is U-Boot?

39
00:03:09,620 --> 00:03:13,780
So, U-Boot is basically a universal bootloader.

40
00:03:13,880 --> 00:03:19,940
It's loaded by the system's ROM or read-only memory or BIOS.

41
00:03:19,940 --> 00:03:28,960
And for many one of these supported devices like, you know, SD cards, Flash, you know, using SPI or NAND Flash.

42
00:03:30,040 --> 00:03:35,260
And basically, it runs a command line interface over a serial port.

43
00:03:35,680 --> 00:03:45,020
And, you know, people like us can load and boot a kernel, possibly changing any of the parameters in there, you know, from the default to make it do what we want to do.

44
00:03:45,020 --> 00:03:51,080
Kind of take over and give it our own instructions versus something that comes from the manufacturer.

45
00:03:51,080 --> 00:03:59,120
You're also able to read device information, read and write Flash memory, you know, download files.

46
00:04:00,120 --> 00:04:03,400
There's a lot of different things that you can do with this.

47
00:04:04,220 --> 00:04:20,200
And, you know, basically, you can choose the memory locations of the kernel and other boot information and explicitly, you know, tell it, hey, I want to look at this destination, and I'm going to copy this information.

48
00:04:20,200 --> 00:04:30,360
So, it's really good at extracting data and pulling that out for further analysis, you know, outside of that U-boot connection.

49
00:04:30,680 --> 00:04:32,680
So, it's loaded from Flash memory.

50
00:04:32,680 --> 00:04:35,660
It's often accessible over a serial connection.

51
00:04:35,660 --> 00:04:44,460
And that's what we've used today is we're using a Chakra utilizing UART to connect to these devices.

52
00:04:44,780 --> 00:04:47,540
It also comes with a limited set of commands.

53
00:04:47,540 --> 00:04:52,580
So, several commands that we're going to be going over that come with U-boot.

54
00:04:53,620 --> 00:04:55,800
So, moving on.

55
00:04:57,900 --> 00:05:01,760
So, ping glitch on the Philips Hue.

56
00:05:01,760 --> 00:05:03,520
So, that's what we're going to be doing first.

57
00:05:03,520 --> 00:05:05,040
I'm going to get out of these slides.

58
00:05:06,200 --> 00:05:06,980
Boring, right?

59
00:05:06,980 --> 00:05:07,920
Let's get out of here.

60
00:05:07,920 --> 00:05:12,240
So, we're going to go up to my other screen over here.

61
00:05:12,380 --> 00:05:19,200
And just to show you some of the devices we're working with, we got the I'm looking all around me.

62
00:05:19,200 --> 00:05:20,220
It's right in front of me.

63
00:05:20,920 --> 00:05:22,260
The Philips Hue.

64
00:05:22,680 --> 00:05:24,960
It's basically it's been stripped down.

65
00:05:24,960 --> 00:05:28,820
You know, I can see the underlying form factor here.

66
00:05:28,820 --> 00:05:33,540
But, you know, this thing is to connect your lights in your house.

67
00:05:33,540 --> 00:05:39,920
So, if you wanted to, you know, have a bunch of different colored lights and then control them from your phone, you'd buy one of these devices.

68
00:05:39,920 --> 00:05:43,080
So, you can imagine a lot of people have these in their houses.

69
00:05:43,540 --> 00:05:46,600
I think you can connect up to, like, 50 light bulbs with this thing.

70
00:05:46,880 --> 00:05:52,940
And then we have the Luma, which is looks like a little Wi-Fi access point or something like that.

71
00:05:52,940 --> 00:05:54,520
But it's exactly what it is.

72
00:05:54,520 --> 00:05:56,680
It's a mesh Wi-Fi access point.

73
00:05:56,680 --> 00:05:58,240
It's got Ethernet on board.

74
00:05:58,240 --> 00:05:59,420
It's got a USB.

75
00:06:00,160 --> 00:06:04,580
It's got a bunch of other stuff in there you can't really see because camera's not very clear.

76
00:06:04,580 --> 00:06:08,140
But that's what we're going to be breaking down today.

77
00:06:08,140 --> 00:06:13,420
So, let me get my other situation going on here.

78
00:06:15,800 --> 00:06:18,880
And first off, got to set this up.

79
00:06:18,880 --> 00:06:20,340
So, bear with me here.

80
00:06:21,880 --> 00:06:24,360
And if you already have questions, you know, don't hesitate.

81
00:06:24,360 --> 00:06:28,320
Throw them out there while I get this thing set up here.

82
00:06:32,360 --> 00:06:33,620
Okay, that's in there.

83
00:06:33,620 --> 00:06:34,360
Perfect.

84
00:06:35,000 --> 00:06:37,280
So, just get some wires out of the way.

85
00:06:37,280 --> 00:06:39,320
I should remember that choice from last time.

86
00:06:39,320 --> 00:06:40,260
All good.

87
00:06:40,540 --> 00:06:43,860
So, just to break down what is on this now.

88
00:06:44,220 --> 00:06:52,920
So, we have the UART connection over here to my Shikra using ground over here, receive and transmit over here.

89
00:06:52,920 --> 00:06:57,240
So, we're connected to some headers that are on this motherboard.

90
00:06:57,500 --> 00:07:04,800
Then we have another set of headers over here that's set up for my ground out wire.

91
00:07:04,800 --> 00:07:11,800
So, I have a wire that has a paper clip shoved in the end of it that we may be using to glitch this thing out.

92
00:07:11,800 --> 00:07:14,100
So, that's a little bit about what's on this thing.

93
00:07:14,100 --> 00:07:19,240
You also have the two flash chips that we're going to be looking at.

94
00:07:19,240 --> 00:07:22,880
This one down here and this other rectangular guy right here.

95
00:07:22,880 --> 00:07:28,600
So, those are the two chips that are communicating that we're going to be disrupting.

96
00:07:29,280 --> 00:07:37,080
So, on the left-hand side, I have a terminal called... software called Cool Terminal.

97
00:07:37,640 --> 00:07:38,620
And it's free.

98
00:07:38,620 --> 00:07:39,880
You can download it.

99
00:07:40,100 --> 00:07:44,800
It's pretty versatile on Mac from, you know, the few times that I've been using it here.

100
00:07:44,800 --> 00:07:47,100
And so far, so good.

101
00:07:47,240 --> 00:07:49,700
You can actually see when it's transmitting and receiving.

102
00:07:49,700 --> 00:07:51,080
You can see when it's connected.

103
00:07:51,580 --> 00:07:52,960
A lot of good detail here.

104
00:07:52,960 --> 00:07:57,180
So, I'm going to disconnect and I'm going to clear the data.

105
00:07:57,180 --> 00:07:58,640
And I'm also going to look at these options.

106
00:07:58,640 --> 00:08:04,700
So, there has been some things that we did prior to this call to kind of set this up for success.

107
00:08:04,700 --> 00:08:09,520
So, I did change the port to my USB serial because we are using Ashikra.

108
00:08:09,580 --> 00:08:13,660
I did change the baud rate to 115200.

109
00:08:14,600 --> 00:08:27,400
And I also changed some of the terminal settings so that we can actually interact with this terminal and not pull our hair out because you can't backspace, you can't delete, and things start getting crazy.

110
00:08:27,400 --> 00:08:30,760
You know, if I can't go backwards, then how can we go forwards?

111
00:08:31,100 --> 00:08:34,620
So, a few of the options I just wanted to highlight.

112
00:08:35,600 --> 00:08:40,080
So, now that that's all said and done, let's get some power to this thing.

113
00:08:40,080 --> 00:08:48,960
So, you can't see it, but I have a power strip with my, controlled by my foot over here.

114
00:08:49,020 --> 00:08:52,700
So, let me just get power to this real quick.

115
00:08:54,960 --> 00:08:57,020
Okay, so we got power there.

116
00:08:59,450 --> 00:09:02,190
Got to take my shoe off because I can't do it with my shoe.

117
00:09:02,190 --> 00:09:04,090
I totally forgot I have to use my toe.

118
00:09:04,870 --> 00:09:06,330
So, all good.

119
00:09:06,330 --> 00:09:09,490
We're going to connect to this thing once we get some power on it.

120
00:09:11,790 --> 00:09:13,250
And we're in.

121
00:09:13,350 --> 00:09:16,690
So, this is just the normal boot up of this device.

122
00:09:16,690 --> 00:09:20,850
We're just looking at it from a terminal perspective.

123
00:09:21,550 --> 00:09:30,750
And with this, we can already get some good information, good value, because we all know when things boot up, there's a lot of information that's kind of sprayed out there.

124
00:09:30,750 --> 00:09:41,470
And sometimes it's machine communication, sometimes it's detailed information that we can actually use and take back and, you know, learn more about this system.

125
00:09:41,770 --> 00:09:46,050
So, you know, as it boots up, I think it takes about 32 seconds.

126
00:09:46,230 --> 00:09:47,150
So, we're almost there.

127
00:09:47,150 --> 00:09:52,250
This is a seconds timer on the left-hand side, if that wasn't clear.

128
00:09:53,510 --> 00:09:56,730
So, once we get to the login, I think it's...

129
00:09:57,710 --> 00:09:58,590
So, we're here.

130
00:09:58,590 --> 00:10:01,390
So, here's the login prompt.

131
00:10:01,390 --> 00:10:02,530
I don't know the password.

132
00:10:02,550 --> 00:10:06,350
I tried to look it up and I didn't find it.

133
00:10:06,910 --> 00:10:07,750
Let's see.

134
00:10:07,810 --> 00:10:09,870
Roots admin.

135
00:10:10,190 --> 00:10:11,590
Just try one.

136
00:10:12,790 --> 00:10:13,310
All right.

137
00:10:13,310 --> 00:10:15,190
So, it's not working.

138
00:10:15,210 --> 00:10:15,470
Okay.

139
00:10:15,470 --> 00:10:18,470
So, we cannot log in at this stage.

140
00:10:18,750 --> 00:10:21,910
So, let's take it to the motherboard, right?

141
00:10:21,990 --> 00:10:23,850
So, I'm going to clear this out.

142
00:10:25,650 --> 00:10:26,170
Okay.

143
00:10:26,170 --> 00:10:27,290
So, we're going to start fresh.

144
00:10:27,290 --> 00:10:29,270
I'm going to turn the power on this guy.

145
00:10:29,330 --> 00:10:32,510
My trusty index toe.

146
00:10:32,510 --> 00:10:33,770
There it is.

147
00:10:33,770 --> 00:10:35,390
So, I'm going to clear it.

148
00:10:35,930 --> 00:10:38,930
And let me get my wire ready.

149
00:10:39,890 --> 00:10:42,270
Hopefully get this on the first shot here.

150
00:10:42,270 --> 00:10:43,970
So, clear the data.

151
00:10:44,250 --> 00:10:45,510
We're connected.

152
00:10:47,490 --> 00:10:50,070
Power is on.

153
00:10:50,550 --> 00:10:52,790
And that's the pin.

154
00:10:52,910 --> 00:10:54,750
Oh, I'm shaking.

155
00:10:54,870 --> 00:10:55,750
Oh, there it is.

156
00:10:55,750 --> 00:10:56,470
Perfect.

157
00:10:56,470 --> 00:11:00,270
So, we got the command line.

158
00:11:00,750 --> 00:11:02,470
So, if you didn't see it, it was pretty quick.

159
00:11:02,470 --> 00:11:11,930
But there is a pin that I just lightly touched and pressed against this little paper clip thing right in there.

160
00:11:11,930 --> 00:11:15,170
So, if I can keep my hand steady, it's right around there.

161
00:11:15,170 --> 00:11:18,730
So, that is what got us to this point.

162
00:11:18,750 --> 00:11:20,110
And what can we do here?

163
00:11:20,290 --> 00:11:22,190
So, a few things.

164
00:11:22,290 --> 00:11:24,170
We can just ask for help.

165
00:11:24,170 --> 00:11:25,130
I mean, where are we?

166
00:11:25,170 --> 00:11:26,330
Help me.

167
00:11:26,810 --> 00:11:29,390
So, we get a lot of different commands.

168
00:11:30,810 --> 00:11:32,790
You know, there's boot commands.

169
00:11:33,650 --> 00:11:35,050
There's echo commands.

170
00:11:35,050 --> 00:11:37,310
We can echo arguments to the console.

171
00:11:37,310 --> 00:11:42,590
We can loop, infinite loop on an address range.

172
00:11:42,650 --> 00:11:44,190
We can ping.

173
00:11:44,290 --> 00:11:45,790
I think there's a ping option in here.

174
00:11:45,790 --> 00:11:46,630
Yeah, ping.

175
00:11:46,710 --> 00:11:54,630
So, we can even try to connect to other network assets, you know, that may be able to communicate to this device if we want to.

176
00:11:54,930 --> 00:11:58,330
We can print the environment variables.

177
00:11:58,570 --> 00:12:01,830
We can set the environment variables, save the environment variables.

178
00:12:01,830 --> 00:12:03,730
So, we have a lot of options here.

179
00:12:04,090 --> 00:12:07,510
We can even boot, TFTP boot if we wanted to.

180
00:12:07,770 --> 00:12:11,930
So, a lot of different things we can see at this point.

181
00:12:12,230 --> 00:12:17,350
So, we're just going to print the environment variables and see what else is in here.

182
00:12:17,350 --> 00:12:25,950
So, these environment variables are somewhat of the command and control area of this device.

183
00:12:25,950 --> 00:12:30,970
So, what we change in here does affect the entire system and the device.

184
00:12:31,550 --> 00:12:37,290
So, you know, we can see the baud rate there is set to 115200, which is how we're able to communicate.

185
00:12:37,770 --> 00:12:41,410
We see some more flash boot up details with the kernel.

186
00:12:42,090 --> 00:12:46,770
We also see some... what else is in here?

187
00:12:46,770 --> 00:12:51,610
We got some version information, production information.

188
00:12:51,610 --> 00:12:53,090
Oh, we got an IP address.

189
00:12:53,270 --> 00:12:54,930
So, we got some IP information.

190
00:12:54,930 --> 00:12:56,930
We got a server IP information.

191
00:12:57,530 --> 00:12:59,370
A lot of information in here.

192
00:12:59,370 --> 00:13:00,110
Boot delay.

193
00:13:00,110 --> 00:13:01,290
Oh, that looks good.

194
00:13:01,810 --> 00:13:04,030
Oh, some security thing with a hash.

195
00:13:04,030 --> 00:13:05,450
That's probably something.

196
00:13:06,210 --> 00:13:07,050
Let's see.

197
00:13:07,050 --> 00:13:10,290
So, I'm gonna just... so, we don't have to do that ping glitch again.

198
00:13:10,290 --> 00:13:20,210
I'm just gonna set the boot delay right now because I don't know about you, but my head got shaky hands and I don't want to have to do that every single time I reboot this thing.

199
00:13:20,210 --> 00:13:26,790
So, we're gonna set the environment variable for boot delay to five seconds just to make sure that that held.

200
00:13:26,790 --> 00:13:29,930
We're gonna check it again and it's there.

201
00:13:30,550 --> 00:13:32,570
So, we got five seconds on that boot delay.

202
00:13:32,570 --> 00:13:33,790
We have to save it.

203
00:13:33,790 --> 00:13:36,250
Otherwise, it just goes away.

204
00:13:36,250 --> 00:13:37,770
So, we're gonna save this.

205
00:13:39,290 --> 00:13:42,790
And that's all the jibber-jabber of saving that environment.

206
00:13:42,790 --> 00:13:45,410
Let's just print it one more time for safekeeping.

207
00:13:49,220 --> 00:13:50,740
And boot delay is five.

208
00:13:50,740 --> 00:13:51,980
So, we are there.

209
00:13:52,700 --> 00:13:54,680
So, I'm just gonna reset.

210
00:13:55,820 --> 00:14:00,400
Let this thing boot up again, except this time we should see a boot delay.

211
00:14:02,020 --> 00:14:03,480
Ah, there it is.

212
00:14:03,480 --> 00:14:05,960
So, I am going to interrupt.

213
00:14:06,680 --> 00:14:07,960
Rude, right?

214
00:14:08,080 --> 00:14:12,660
So, now that we're back in, what else can we do with this thing?

215
00:14:12,660 --> 00:14:16,200
So, let's take a look around back in those environment variables.

216
00:14:16,200 --> 00:14:23,380
And the one that kind of jumped out to me was the security and this weird hash following it.

217
00:14:24,720 --> 00:14:31,600
1984, maybe there's some type of underlying message in here, but the security is something we can mess with.

218
00:14:31,600 --> 00:14:37,340
So, let's just set the environment of security to nothing.

219
00:14:37,340 --> 00:14:39,760
And nothing can be just two single ticks.

220
00:14:40,300 --> 00:14:40,800
Okay.

221
00:14:41,080 --> 00:14:44,600
So, if I save that or set that, let's check it.

222
00:14:48,600 --> 00:14:50,460
Ah, security equals nothing.

223
00:14:50,460 --> 00:14:51,280
Perfect.

224
00:14:51,320 --> 00:14:55,260
So, we do need to make sure we save this, save environment.

225
00:14:55,540 --> 00:14:57,700
No matter what, you always have to save.

226
00:14:57,700 --> 00:15:01,770
So, make sure that that's a, you know, nailed down.

227
00:15:02,050 --> 00:15:04,190
And we'll just try resetting.

228
00:15:04,250 --> 00:15:05,770
See if that did anything for us.

229
00:15:05,770 --> 00:15:15,610
So, essentially, what the manufacturer did with this is they hard-coded the password into the device.

230
00:15:15,610 --> 00:15:18,130
Not a good idea, in my opinion.

231
00:15:18,730 --> 00:15:21,690
But that's what they did.

232
00:15:21,690 --> 00:15:24,650
And that's why we're able to mess with it right now.

233
00:15:24,930 --> 00:15:29,990
So, we did let it go past the boot delay because we want to see what happens when it actually boots up now.

234
00:15:29,990 --> 00:15:33,130
Because before, we got hit with a login prompt.

235
00:15:33,310 --> 00:15:34,650
And I didn't have the password.

236
00:15:34,650 --> 00:15:37,010
So, we couldn't get anywhere with that.

237
00:15:37,850 --> 00:15:43,490
So, as this thing kind of boots up, same kind of song and dance with the boot up information.

238
00:15:44,430 --> 00:15:48,970
You know, it's writing, it's opening, it's loading, it's doing all these things.

239
00:15:49,370 --> 00:15:56,090
And any of those environments that we've changed may affect, you know, this time right now.

240
00:15:56,310 --> 00:16:01,210
So, if we just wait a few more seconds, the magic of television.

241
00:16:02,050 --> 00:16:03,970
And we are root.

242
00:16:04,010 --> 00:16:11,550
So, just by eliminating that environment variable security, it actually cleared out the password.

243
00:16:11,550 --> 00:16:14,830
And that was actually the password in a hash.

244
00:16:14,830 --> 00:16:18,410
So, removing it gave us root access.

245
00:16:18,590 --> 00:16:19,190
So, right on.

246
00:16:19,190 --> 00:16:22,070
High fives, air fives, you know, because the timing.

247
00:16:22,170 --> 00:16:24,350
But air fives all around.

248
00:16:24,350 --> 00:16:25,550
We got this thing.

249
00:16:25,630 --> 00:16:27,310
So, what can we do now?

250
00:16:27,690 --> 00:16:29,190
Well, lots of things.

251
00:16:29,410 --> 00:16:32,790
We can start looking at the mounted drives.

252
00:16:33,390 --> 00:16:35,750
We can dig into the root file system.

253
00:16:35,750 --> 00:16:37,330
We can look at the kernel.

254
00:16:37,550 --> 00:16:39,570
A bunch of different root drives in here.

255
00:16:39,890 --> 00:16:42,470
The root file system data drive.

256
00:16:42,470 --> 00:16:44,450
Maybe there's some good detail in there.

257
00:16:45,590 --> 00:16:50,070
You know, we're clearly at the helm here.

258
00:16:50,070 --> 00:16:52,670
We clearly have the reins of this device now.

259
00:16:53,590 --> 00:17:00,350
You know, we can look at other information on this thing and see if there's more details that we can pull out of it.

260
00:17:00,350 --> 00:17:01,990
More user details.

261
00:17:01,990 --> 00:17:02,910
Maybe some hashes.

262
00:17:02,910 --> 00:17:03,750
Who knows?

263
00:17:04,310 --> 00:17:07,810
But we are in like Flynn here.

264
00:17:08,730 --> 00:17:14,470
So, any questions on that so far?

265
00:17:15,450 --> 00:17:16,510
Hey, Garrett.

266
00:17:16,510 --> 00:17:19,290
Yeah, looks like we have a couple questions here cropping up.

267
00:17:19,350 --> 00:17:26,010
So, Strikeout looks like he's trying to do possibly some U-boot bypass through glitching on a wise came out door.

268
00:17:26,010 --> 00:17:30,190
And this individual is asking where did you actually put the paperclip out on the chip?

269
00:17:30,190 --> 00:17:31,610
A data line?

270
00:17:33,990 --> 00:17:34,550
Yes.

271
00:17:34,550 --> 00:17:36,190
So, that is a great question.

272
00:17:36,190 --> 00:17:37,910
It is a data line.

273
00:17:38,070 --> 00:17:47,690
And it's in between these two flash chips on the... I don't know if I can get a better view of this thing.

274
00:17:47,750 --> 00:17:50,810
But that's looking terrible.

275
00:17:51,390 --> 00:17:52,990
So, I can't... I don't have a micro...

276
00:17:54,870 --> 00:17:58,190
I don't have a magnifier to get you a better view of this.

277
00:17:58,190 --> 00:18:04,930
But basically, there is a pin in between the two chips that is sending data.

278
00:18:06,470 --> 00:18:09,130
It's basically this pin right here.

279
00:18:09,130 --> 00:18:11,870
It's a little silver flat pin there.

280
00:18:12,210 --> 00:18:17,850
And if you look close on the motherboard, you can see the tracks going between those chips.

281
00:18:17,850 --> 00:18:21,310
You can kind of see it, but now it's all blurry, of course.

282
00:18:24,840 --> 00:18:28,520
Yeah, to kind of add to that, this is real quick.

283
00:18:29,120 --> 00:18:40,600
Often, one of the best things to do is once you've identified the flash chips that you're going to attempt this on, is to track down the data sheets on those.

284
00:18:40,600 --> 00:18:47,000
And from the data sheets, in this particular case, I traced out the data zero line.

285
00:18:47,680 --> 00:19:03,840
So, between those two chips, this particular glitch is a little easier timing-wise because the smaller chip that's toward the bottom actually has U-boot on it.

286
00:19:03,840 --> 00:19:06,120
The other chip has the kernel on it.

287
00:19:06,120 --> 00:19:15,480
So, the goal is to find the data line for the chip containing a kernel and interrupt that by taking it to ground.

288
00:19:15,860 --> 00:19:35,540
And the attempt there is U-boot's loaded, and before it has a chance to actually load the kernel or call the kernel, you literally take one of those data lines to ground, causing it to fail to read it, as Garrett was talking about and as he showed there.

289
00:19:42,970 --> 00:19:45,910
One other question here, Garrett, that is cropping up.

290
00:19:45,910 --> 00:19:53,530
Individual asks, what type of device are you using to interact with the device here via UART?

291
00:19:53,530 --> 00:19:55,510
Are you using something like a Shikra?

292
00:19:56,970 --> 00:19:58,490
Yeah, let me show you.

293
00:19:58,490 --> 00:20:00,970
I can show you what that is here.

294
00:20:01,930 --> 00:20:05,570
We got one right here to show you.

295
00:20:06,250 --> 00:20:09,570
So, let me kill out this thing real quick.

296
00:20:12,450 --> 00:20:17,710
So, we're going to disconnect and pull this thing right out of my laptop for you.

297
00:20:21,300 --> 00:20:22,720
Hold power.

298
00:20:22,740 --> 00:20:23,240
All right.

299
00:20:23,240 --> 00:20:36,960
So, to give you a better idea of what this thing is, it's basically just a little USB with a chip attached to it with several different header connections on it.

300
00:20:37,300 --> 00:20:44,460
It comes with a data sheet that kind of breaks down what these connectors are, but that's literally all it is.

301
00:20:44,460 --> 00:20:45,740
It has three cables.

302
00:20:45,740 --> 00:20:47,300
I don't know where my camera is.

303
00:20:47,300 --> 00:20:52,520
It's got three cables, one for ground, one for receive and transmit.

304
00:20:52,520 --> 00:20:56,720
So, that's how I'm connected directly to this device.

305
00:20:56,720 --> 00:20:59,720
So, hopefully that helps.

306
00:21:00,340 --> 00:21:05,140
But you can pick these things up off the internet.

307
00:21:05,140 --> 00:21:08,820
I think they're 30 or 40 bucks.

308
00:21:08,820 --> 00:21:12,780
I can't remember how much they cost, but they're doable.

309
00:21:13,740 --> 00:21:19,320
And there's some other devices out there like Pirate.

310
00:21:19,540 --> 00:21:23,520
There's one called, I think, UART Pirate or something like that, or Pirate Bay.

311
00:21:23,520 --> 00:21:29,800
I can't remember what the name of it is, but there's several tools out there that do the same, essentially the same thing.

312
00:21:29,800 --> 00:21:32,100
This is just the one that we use today.

313
00:21:34,600 --> 00:21:35,180
Cool.

314
00:21:35,180 --> 00:21:38,380
That's, I think, the last of the cute questions that we have here.

315
00:21:38,380 --> 00:21:40,040
Bus Pirate, I think, was the word you're looking for.

316
00:21:40,300 --> 00:21:42,200
That's what it was, Bus Pirate.

317
00:21:43,860 --> 00:21:44,960
Oh, man.

318
00:21:45,080 --> 00:21:45,580
Yep.

319
00:21:45,580 --> 00:21:47,240
I knew it was something to do with the pirates.

320
00:21:47,240 --> 00:21:49,980
Pirate would be pretty good too, I like the ring to none.

321
00:21:51,740 --> 00:21:53,040
Right on.

322
00:21:53,080 --> 00:21:53,920
Cool.

323
00:21:54,040 --> 00:22:01,380
Well, let me, if that's all the questions, let me just get back to the slides here and move on.

324
00:22:02,580 --> 00:22:05,700
So, now we're going to switch gears a little bit.

325
00:22:05,700 --> 00:22:14,940
We're going to be going over some common problems with embedded devices and then using U-boot to solve them.

326
00:22:15,500 --> 00:22:20,700
So, I'm going to switch gears and pass it over to my colleague, Darryl Hyland, and take it away from there.

327
00:22:20,700 --> 00:22:22,300
Let me just stop my share.

328
00:22:24,520 --> 00:22:25,700
Thanks, Garrett.

329
00:22:26,040 --> 00:22:29,660
Let me go ahead and share my screen.

330
00:22:31,020 --> 00:22:33,200
Hopefully, everyone can see my screen.

331
00:22:35,560 --> 00:22:40,740
So, kind of get back to the actual hue.

332
00:22:40,740 --> 00:22:50,440
So, I went and configured this hue to kind of exhibit some of the common problem that you will often encounter.

333
00:22:50,440 --> 00:22:57,640
And I know I've hit it two or three times working on IoT gear in the last year or so.

334
00:22:57,640 --> 00:23:01,580
And I know Jonathan has also encountered it.

335
00:23:01,640 --> 00:23:05,960
And again, this here is just a standard hue.

336
00:23:06,020 --> 00:23:11,820
And then this here happens to be a quad UART device.

337
00:23:11,820 --> 00:23:12,820
I kind of like this one.

338
00:23:12,820 --> 00:23:14,280
It's a little different than the Shikra.

339
00:23:14,280 --> 00:23:20,200
This one actually takes four different UARTs and you can switch between three and a half and four volts.

340
00:23:20,200 --> 00:23:21,740
And it's all USB-based.

341
00:23:21,740 --> 00:23:24,300
So, it's kind of sweet.

342
00:23:24,300 --> 00:23:28,500
I like using that if I need multiple UARTs at the same time.

343
00:23:28,800 --> 00:23:31,660
Sometimes... let's go ahead and plug this device in.

344
00:23:31,660 --> 00:23:34,000
Make sure everything's going to come up here.

345
00:23:34,800 --> 00:23:39,620
So, again, often when you're encountering devices, they'll come up.

346
00:23:39,620 --> 00:23:42,180
And if you noticed, it had the boot delay.

347
00:23:42,180 --> 00:23:45,940
I put the boot delay on here just to avoid having the glitch again.

348
00:23:45,980 --> 00:23:53,540
But the ping glitch to force into a U -Boot console is a literally very common method.

349
00:23:53,540 --> 00:23:57,340
But as you see, we hit a point here where it's literally disabled.

350
00:23:57,340 --> 00:23:59,300
We no longer have a console.

351
00:24:00,260 --> 00:24:02,960
And this is not uncommon.

352
00:24:02,960 --> 00:24:15,740
You'll have a device where you're actually able to establish a UART connection on the device and start seeing it boot up.

353
00:24:15,740 --> 00:24:22,780
But then inevitably when it's booted up, there's literally no console whatsoever on that device.

354
00:24:22,780 --> 00:24:24,740
I've had it go up to this point.

355
00:24:24,740 --> 00:24:26,560
You'll see console disabled.

356
00:24:26,560 --> 00:24:31,140
I've seen it come up and not tell me console disabled, just say loading kernel.

357
00:24:31,140 --> 00:24:33,520
And then you see nothing after that.

358
00:24:33,520 --> 00:24:44,380
So, whether you need to use a ping glitch or they've enabled the boot delay or some method you can gain access to it, we're going to go ahead and go through that.

359
00:24:44,380 --> 00:24:49,940
And often, the fix for this is typically very simple.

360
00:24:50,640 --> 00:24:53,160
Let's see if I can catch this here.

361
00:24:53,520 --> 00:24:54,220
Okay.

362
00:24:56,800 --> 00:25:00,740
Actually, which is funny, that did not work for me.

363
00:25:00,740 --> 00:25:04,360
So, we'll see.

364
00:25:05,340 --> 00:25:07,860
This is going to be funny if this doesn't work.

365
00:25:07,860 --> 00:25:12,360
It wouldn't surprise me if Zoom caused the problem.

366
00:25:12,360 --> 00:25:15,440
Because, okay, we're able to get into it.

367
00:25:15,440 --> 00:25:21,240
So, back to those common commands that Garrett had mentioned, like print environment.

368
00:25:21,240 --> 00:25:23,880
So, we're going to come over here and print environment.

369
00:25:23,880 --> 00:25:28,360
And again, there's literally tons of environment variables.

370
00:25:28,380 --> 00:25:32,540
A lot of these environment variables are part of the boot process, like Garrett said.

371
00:25:32,540 --> 00:25:36,440
Some of these actually pass commands to the kernel.

372
00:25:37,260 --> 00:25:40,940
So, the kernel knows what to do as it's loaded up.

373
00:25:41,460 --> 00:25:47,940
And often, where you see alterations that need to be made, the most common one is bootargs.

374
00:25:48,180 --> 00:25:51,060
You'll see bootargs showing the configurations.

375
00:25:51,060 --> 00:25:56,840
But when we come over here, we see bootargs console is actually set normal.

376
00:25:56,840 --> 00:25:58,620
So, maybe it's somewhere else.

377
00:25:58,620 --> 00:26:04,060
But here, we found out they have another environment variable called standard bootargs.

378
00:26:04,060 --> 00:26:08,260
So, apparently, this is what's being called at some point.

379
00:26:08,700 --> 00:26:12,980
Thus, we see the null taking place in here.

380
00:26:13,920 --> 00:26:17,440
Sometimes, this will involve very experimental.

381
00:26:18,060 --> 00:26:25,500
First time, when I was setting this up to identify it, that's when I found out that this bootargs segment doesn't work.

382
00:26:25,500 --> 00:26:28,320
And then you need to do it some other way.

383
00:26:28,320 --> 00:26:31,600
And then turns out it was the standard bootargs.

384
00:26:31,600 --> 00:26:44,580
So, to go ahead and do this, again, like you did, you go, you set the environment, which was standard std bootargs.

385
00:26:46,020 --> 00:26:49,780
Something always to remember also.

386
00:26:51,780 --> 00:26:54,660
In this case, I'm going to rewrite the entire one.

387
00:26:54,660 --> 00:26:56,920
And we're going to set the console here.

388
00:27:04,280 --> 00:27:06,420
And look at our standard bootargs.

389
00:27:06,420 --> 00:27:08,100
Make sure there's not another one.

390
00:27:08,100 --> 00:27:11,880
You would be surprised how many times I've misspelled something.

391
00:27:11,880 --> 00:27:13,180
And it's easy to do.

392
00:27:13,180 --> 00:27:19,760
And what you end up doing is just creating another argument that isn't read by the system or used.

393
00:27:19,980 --> 00:27:21,280
So, then you boot the system.

394
00:27:21,280 --> 00:27:23,100
It goes, well, it didn't fix anything.

395
00:27:23,100 --> 00:27:24,620
What went wrong?

396
00:27:24,800 --> 00:27:27,060
Often, it's just a typo.

397
00:27:27,200 --> 00:27:29,840
You've seen where people have made typos up here.

398
00:27:29,840 --> 00:27:31,080
Here's an example.

399
00:27:31,080 --> 00:27:32,300
Security, security.

400
00:27:32,300 --> 00:27:33,700
That's kind of weird.

401
00:27:33,700 --> 00:27:38,900
So, again, that's probably a typo that took place there.

402
00:27:38,900 --> 00:27:43,120
So, at this point, we'll go ahead and go save environment variables.

403
00:27:44,460 --> 00:27:46,880
Write the environment variables back out.

404
00:27:46,880 --> 00:27:53,460
And then the reset command will cause the CPU to reset on the device from the U-boot console.

405
00:27:54,020 --> 00:27:56,720
So, let's see if this will actually work.

406
00:27:57,600 --> 00:27:59,460
And it's kind of amazing.

407
00:27:59,460 --> 00:28:12,700
Out of the number of times I've done this, more than three quarters of the time when the device did boot up.

408
00:28:14,590 --> 00:28:16,390
Oh, that's interesting.

409
00:28:16,390 --> 00:28:20,730
We seem to have a crash on the system.

410
00:28:21,250 --> 00:28:23,590
We had a kernel panic.

411
00:28:24,790 --> 00:28:26,350
That's interesting.

412
00:28:32,210 --> 00:28:34,430
So, demos do go bad.

413
00:28:34,430 --> 00:28:37,530
So, we will see what we have here.

414
00:28:39,030 --> 00:28:40,870
This doesn't come up.

415
00:28:41,190 --> 00:28:43,190
We're probably just going to move on.

416
00:28:43,810 --> 00:28:48,770
Typically, you make these changes on the system.

417
00:28:49,050 --> 00:28:50,990
Yep, we got another kernel panic.

418
00:28:50,990 --> 00:28:58,490
I'm going to take one more check and see what corrupted.

419
00:29:16,570 --> 00:29:18,290
Yeah, that's correct.

420
00:29:19,750 --> 00:29:23,550
So, we're not going to waste much time on this.

421
00:29:23,570 --> 00:29:25,550
And we're just going to move on.

422
00:29:25,690 --> 00:29:28,490
Typically, there may be something in here.

423
00:29:28,490 --> 00:29:30,330
Sometimes these things go bad.

424
00:29:30,470 --> 00:29:36,310
But normally, just by fixing the console setting, for some reason, my kernel's messed up.

425
00:29:36,310 --> 00:29:37,690
I'm not sure how that happened.

426
00:29:37,690 --> 00:29:41,770
Maybe from constantly rebooting this thing over and over and over.

427
00:29:42,410 --> 00:29:45,890
Maya finally said, hey, I'm not going to play anymore, corrupted something.

428
00:29:46,170 --> 00:30:06,070
But typically, when you go into the uBoot console, and you've broke into it, and you have a device that will not give you a console after boot up, a lot of times you can go in here and alter either boot args or some other reference that's used for the boot arguments that tell the kernel what console,

429
00:30:06,070 --> 00:30:10,690
what bauld rate, all those typical things, and set that, and it'll come up.

430
00:30:10,810 --> 00:30:27,010
Usually, three quarters of the time, when I've encountered this on commercial gear, where they've actually turned the console off trying to hide access, when I do allow it to boot up, it's giving me root access from the very get-go versus giving me a password prompt.

431
00:30:27,070 --> 00:30:29,570
It's giving me root access.

432
00:30:29,570 --> 00:30:41,830
So, again, the best way to do this is check the console settings, make sure they're correct, make sure they haven't turned initialization off.

433
00:30:41,830 --> 00:30:49,250
I've seen this messed with, which would cause weird things in killing consoles and stuff like that.

434
00:30:49,930 --> 00:30:55,050
But typically, nine times out of ten, it's literally going to be the console setting.

435
00:30:55,050 --> 00:31:10,230
If it's not set, often when you identify the processor that may be used in this case, you can do a little Google reference and identify the most common TTY setting for that.

436
00:31:10,230 --> 00:31:19,190
A lot of times it's in the data sheet and stuff like that, to identify how it is naming its primary console TTY.

437
00:31:19,190 --> 00:31:31,270
So, often data sheets, a little Google on the device or the processor in case, to be able to identify that, and that helps you to literally set the console where it actually needs to be.

438
00:31:31,270 --> 00:31:37,330
Unfortunately, that demo failed, even though it's worked 40 times up until today.

439
00:31:37,670 --> 00:31:43,830
And I will stop sharing and turn this over to Garrett, so he can attempt his next demo.

440
00:31:44,310 --> 00:31:47,950
Is there any questions related to this particular failure?

441
00:31:49,870 --> 00:31:50,670
Let's see.

442
00:31:50,670 --> 00:31:55,930
It looks like there's a couple folks that are helping to troubleshoot, and I saw one of the issues too, I think.

443
00:31:56,090 --> 00:31:59,090
I guess it looks like bootargs was double set.

444
00:31:59,450 --> 00:32:02,290
Also, the board equals appeared to be missing.

445
00:32:02,290 --> 00:32:04,670
The bootargs, I think, for sure, might have been one of them.

446
00:32:04,750 --> 00:32:09,490
The board equals might take a little troubleshooting, but that's a couple questions, I guess, that came up.

447
00:32:09,490 --> 00:32:11,030
But another... Oh, yeah, got it right there.

448
00:32:11,030 --> 00:32:11,590
I see it.

449
00:32:11,590 --> 00:32:11,910
Yep.

450
00:32:11,910 --> 00:32:12,190
Yeah.

451
00:32:12,390 --> 00:32:13,770
Good catch, guys.

452
00:32:13,770 --> 00:32:14,330
Yep.

453
00:32:15,290 --> 00:32:20,350
Often when you're cutting and pasting, it's very difficult to do that.

454
00:32:20,350 --> 00:32:23,230
Since I didn't define the board, that obviously called it.

455
00:32:23,230 --> 00:32:25,070
So, good catch out there.

456
00:32:25,070 --> 00:32:25,870
Yeah.

457
00:32:26,270 --> 00:32:32,950
Props to folks on Twitch as well as here in the panel as well that kind of caught that.

458
00:32:32,950 --> 00:32:35,530
But there is a couple questions that did crop up.

459
00:32:35,530 --> 00:32:42,970
One individual asks, how often do you find that IoT devices are actually using U-boot?

460
00:32:42,970 --> 00:32:46,310
Like, would you say about 75%, 50%?

461
00:32:46,890 --> 00:32:55,030
I'd have to say it's still probably a little higher than 50% that I engage devices that U-boot used.

462
00:32:55,370 --> 00:33:02,690
Now, if they're running the latest version of U-boot, this typical pin glitch will not work.

463
00:33:03,010 --> 00:33:17,030
So, what happens is the newer version of U-boot that is out there, if anyone is actually using it, is supposed to, when it can't learn, it can't load the kernel, will actually restart the U-boot process.

464
00:33:17,030 --> 00:33:22,390
So, it'll just go into an infinite loop until it can load the kernel in that case there.

465
00:33:22,390 --> 00:33:25,290
That's how they kind of started to fix this problem.

466
00:33:25,290 --> 00:33:30,370
I assure you there's probably attack methods in that case with that to get around to it.

467
00:33:30,370 --> 00:33:40,970
But the best fix, what we always recommend to most vendors on how do you solve the problem with U-boot being an issue is start using secure boot.

468
00:33:44,650 --> 00:33:51,090
That actually answers the last question that I had here was, what's the best way of overcoming some of these issues?

469
00:33:51,090 --> 00:33:54,130
And it sounds like secure boot's the best method for that.

470
00:34:02,870 --> 00:34:08,570
Yeah, I would say secure boot is the best solution to these issues that we're running through today.

471
00:34:11,610 --> 00:34:16,990
And I think we had another question just popped up here that we can kind of squeeze in before we move on.

472
00:34:16,990 --> 00:34:19,070
Because there's one more demo, is that correct, Garrett?

473
00:34:19,310 --> 00:34:21,410
Yeah, yeah, we still got one more.

474
00:34:21,410 --> 00:34:23,750
But yeah, more questions, the more the merrier.

475
00:34:23,750 --> 00:34:24,270
Okay, yeah.

476
00:34:24,270 --> 00:34:31,570
So, Asher asks, do you know why sometimes the environment variables cannot be modified even with root access to the U-boot console?

477
00:34:31,810 --> 00:34:34,510
This apparently has happened for this individual.

478
00:34:36,870 --> 00:34:48,150
The only thing I can think of off the top of my head is that the manufacturer hard set some of those environment variables to not allow change even at a root level.

479
00:34:48,610 --> 00:35:01,170
Or there's just some underlying permissions that, you know, even though we may feel we're root, there may be some hard coded just permission set there that we just can't get into.

480
00:35:01,170 --> 00:35:03,490
I don't know, maybe someone else has more to speak on that.

481
00:35:03,490 --> 00:35:07,550
But that's just my initial gut feeling.

482
00:35:09,270 --> 00:35:11,830
I'd have to agree with that.

483
00:35:11,830 --> 00:35:14,530
I actually had a device I was playing with the other day.

484
00:35:14,530 --> 00:35:24,490
And there was probably a half dozen arguments in the environment variables that when I changed them and saved them, they never saved nothing.

485
00:35:25,110 --> 00:35:28,290
So, U-boot's a funny beast.

486
00:35:28,430 --> 00:35:31,450
Everybody compiles it differently.

487
00:35:31,470 --> 00:35:38,430
So, the amount of features, functions, capabilities, and how it works is very configurable.

488
00:35:38,430 --> 00:35:41,510
And every vendor will compile it and use it different.

489
00:35:41,750 --> 00:35:49,330
Also, I've seen some where boot args and all of those settings are not even used by the kernel.

490
00:35:49,730 --> 00:35:54,650
That stuff is actually hard coded into some kernel configurations.

491
00:35:54,670 --> 00:36:07,110
So, alterations with boot args don't actually work, which can be problematic too when you're trying to carry out some level of tax.

492
00:36:07,510 --> 00:36:18,510
Based on that, I think what Garrett's going to demo here just shortly will actually open up some other possible opportunities.

493
00:36:19,010 --> 00:36:32,630
If you're able to break in to the U-boot console, some of the stuff he's going to show may be very helpful in gaining a level of access into the system.

494
00:36:36,720 --> 00:36:37,700
Awesome.

495
00:36:37,700 --> 00:36:40,860
Any other questions out there, John?

496
00:36:40,860 --> 00:36:42,560
I think we're kind of on the queue.

497
00:36:42,560 --> 00:36:43,740
I think we're good to go.

498
00:36:43,760 --> 00:36:44,500
All right.

499
00:36:44,500 --> 00:36:45,040
Right on.

500
00:36:45,040 --> 00:36:46,100
Moving on.

501
00:36:46,560 --> 00:36:52,400
So, next, we're going to be going over the Luma.

502
00:36:52,400 --> 00:36:56,760
The Luma is that mesh device that we were looking at.

503
00:36:57,160 --> 00:37:01,380
It's got a little bit more to it on the motherboard itself.

504
00:37:03,180 --> 00:37:04,780
There's just a lot more going on.

505
00:37:04,780 --> 00:37:06,200
It has onboard Ethernet.

506
00:37:06,200 --> 00:37:07,640
It's got a USB port.

507
00:37:07,640 --> 00:37:11,320
It's got several different places to connect wires.

508
00:37:11,320 --> 00:37:12,380
There's some headers.

509
00:37:13,300 --> 00:37:14,660
A lot of stuff going on.

510
00:37:14,660 --> 00:37:18,180
I think it's got a built-in Wi-Fi chip on it, possibly.

511
00:37:18,180 --> 00:37:19,160
I'm not sure.

512
00:37:19,160 --> 00:37:21,620
But a lot of stuff going on there.

513
00:37:21,620 --> 00:37:30,160
So, we're going to boot to root here real quick out of these slides back into the live action.

514
00:37:30,160 --> 00:37:30,660
Here we go.

515
00:37:30,660 --> 00:37:35,960
So, now I got my Luma set up here, broken down, ripped it apart.

516
00:37:36,500 --> 00:37:42,540
I've got my UART connection over here with my ground, my receive, and my transmit.

517
00:37:42,540 --> 00:37:43,480
We're all good.

518
00:37:43,920 --> 00:37:49,400
I have my Ethernet actually plugged in because I'm just going direct line to this thing.

519
00:37:49,620 --> 00:37:53,460
And then I also have a ground wire that you can't really see.

520
00:37:53,460 --> 00:37:58,560
But there is a ground wire soldered onto the board over here.

521
00:37:58,560 --> 00:38:04,740
So, the way that I did get into this thing initially was a pin glitch.

522
00:38:05,760 --> 00:38:07,840
And I'm not going to show that today.

523
00:38:07,840 --> 00:38:11,920
But if it's something you want to see, I can demo it later if we have time.

524
00:38:11,920 --> 00:38:20,680
But basically, this particular chip right here is the chip that we are compromising to break into this thing.

525
00:38:20,800 --> 00:38:25,960
And it's actually this pin right here, this data pin right over here, the second one up.

526
00:38:26,200 --> 00:38:27,640
I don't know if you can even see that.

527
00:38:27,640 --> 00:38:32,500
But there's eight pins around that square chip.

528
00:38:32,840 --> 00:38:39,120
And we're going to short the data line or the data pin on that thing.

529
00:38:39,120 --> 00:38:41,040
So, that's how we would have got into this thing.

530
00:38:41,040 --> 00:38:47,160
But since we already did that, the magic of television, we're just going to plug some power into this thing.

531
00:38:47,980 --> 00:38:48,200
Okay.

532
00:38:48,200 --> 00:38:49,620
We got power now.

533
00:38:50,360 --> 00:38:53,360
And a little bit more slack in that line.

534
00:38:54,480 --> 00:38:56,180
The trusty toe.

535
00:38:56,600 --> 00:38:57,900
Come on, toe.

536
00:38:57,900 --> 00:38:59,100
There it is.

537
00:38:59,580 --> 00:39:00,860
And we're connected.

538
00:39:00,920 --> 00:39:02,200
And there it goes.

539
00:39:02,200 --> 00:39:09,900
So, what's funny about Cool Term is you have these receive and transmit lights going on in the bottom.

540
00:39:09,900 --> 00:39:13,200
So, we know that we're getting data in some way somehow.

541
00:39:14,320 --> 00:39:17,940
And again, with the boot up process, a lot of information here.

542
00:39:18,020 --> 00:39:21,020
And obviously, we can all read extremely fast.

543
00:39:21,020 --> 00:39:23,500
That's how we're able to read everything that's going down the screen.

544
00:39:23,900 --> 00:39:25,040
No, probably not.

545
00:39:25,060 --> 00:39:28,600
There's ways to extract this if you wanted to.

546
00:39:28,600 --> 00:39:32,420
Kind of if you recorded this and just played it back slow.

547
00:39:32,580 --> 00:39:35,340
And you could be taking like screenshots as it goes through.

548
00:39:35,340 --> 00:39:40,080
There's plenty of ways to kind of extract everything that's going on here.

549
00:39:41,120 --> 00:39:44,940
This one actually takes a little bit longer to boot up than the Hue.

550
00:39:45,120 --> 00:39:47,880
I think just because it has more functionality to it.

551
00:39:47,880 --> 00:39:55,760
It's not just going to turn your lights blue or green or red or whatever the ambience for the evening happens to be.

552
00:39:55,900 --> 00:39:59,600
This time, it's actually going to provide internet connection.

553
00:39:59,760 --> 00:40:04,300
So, when people come over or you have parties, not so much anymore.

554
00:40:04,300 --> 00:40:08,100
But when we did, you want to have everyone be able to have internet.

555
00:40:08,100 --> 00:40:11,300
We got to be staying up to date on our socials.

556
00:40:11,300 --> 00:40:14,160
We got to be, you know, staying up to date on everything.

557
00:40:14,160 --> 00:40:16,560
So, internet is good.

558
00:40:17,340 --> 00:40:19,760
So, we may not wait for this whole thing to boot up.

559
00:40:19,760 --> 00:40:22,100
I think it takes about a couple minutes.

560
00:40:22,380 --> 00:40:24,160
And my patience is weak.

561
00:40:24,160 --> 00:40:29,460
So, as this thing kind of rounds the bend here, it looks like it's doing stuff with Wi-Fi.

562
00:40:30,080 --> 00:40:33,440
Looks like some connections were going on, some different channels.

563
00:40:34,800 --> 00:40:36,200
Let's just see what happens.

564
00:40:36,200 --> 00:40:37,120
Oh, okay.

565
00:40:37,120 --> 00:40:38,500
So, we got a login prompt.

566
00:40:40,260 --> 00:40:42,040
We can try to log in.

567
00:40:42,060 --> 00:40:43,740
I don't know the password, though.

568
00:40:45,100 --> 00:40:46,780
Let's give it a shot anyway.

569
00:40:47,320 --> 00:40:48,580
Login incorrect.

570
00:40:48,660 --> 00:40:50,580
So, no luck again.

571
00:40:50,580 --> 00:40:54,720
We're 0 for 2 there on trying to just log into these things.

572
00:40:55,460 --> 00:40:57,040
So, what can we do?

573
00:40:57,040 --> 00:40:59,460
We're just going to power cycle this thing.

574
00:41:01,680 --> 00:41:02,240
All right.

575
00:41:02,240 --> 00:41:03,260
So, clear.

576
00:41:03,920 --> 00:41:04,800
Clear.

577
00:41:04,860 --> 00:41:05,380
All right.

578
00:41:05,380 --> 00:41:07,180
Pinky toe in action.

579
00:41:07,880 --> 00:41:08,600
All right.

580
00:41:08,600 --> 00:41:17,600
So, like I said before, the, you know, how the cooking shows do it, they don't cook that whole turkey right in front of you.

581
00:41:17,600 --> 00:41:18,520
That would be crazy.

582
00:41:18,840 --> 00:41:20,900
But they have one already in the oven.

583
00:41:20,900 --> 00:41:32,100
So, that's kind of what happened here is I pin glitched this thing prior to this call so that I did set this boot delay so that I could break out of it and get in there and actually show you some stuff.

584
00:41:32,100 --> 00:41:35,560
So, similar to before, print environment variables.

585
00:41:35,560 --> 00:41:36,780
We can just ask for help, though.

586
00:41:36,780 --> 00:41:41,080
Just see what's different about the Luma versus the Hue.

587
00:41:41,680 --> 00:41:43,840
So, some slight differences.

588
00:41:44,100 --> 00:41:48,660
This one's not as long as far as the list of items that we can do.

589
00:41:49,100 --> 00:41:58,640
So, just kind of piggybacking on that final question before is, you know, U-Boot is configured differently on every device, or essentially it can be.

590
00:41:59,140 --> 00:42:03,160
So, I was even reading up on this company called Emac.

591
00:42:03,160 --> 00:42:07,780
I think they do, Skada devices.

592
00:42:07,820 --> 00:42:14,600
And the way that they configure U-Boot was completely different than another person who configured U-Boot.

593
00:42:14,600 --> 00:42:21,760
Because when I was looking things up on this stuff, I would find several different explanations.

594
00:42:21,760 --> 00:42:22,860
Like, well, wait a minute.

595
00:42:22,920 --> 00:42:24,460
Is this even the same thing?

596
00:42:24,460 --> 00:42:25,400
Like, yeah, it is.

597
00:42:25,400 --> 00:42:29,740
It just can be completely configured, you know, in several different ways.

598
00:42:30,260 --> 00:42:33,020
Or compiled, I guess is the right word to use.

599
00:42:33,020 --> 00:42:46,500
So, if we look at some of these things, what jumps out to me is the boot arguments, the boot IPQ, boot from a flash device, boot from memory, boot from a network connection using TFTP.

600
00:42:48,340 --> 00:42:49,840
Spoiler alert, maybe.

601
00:42:50,140 --> 00:42:55,540
We got ping, so we can actually test ping connections.

602
00:42:55,680 --> 00:42:57,580
Print environment, like we already know.

603
00:42:57,580 --> 00:43:00,420
Save environment, set environment, that's all there.

604
00:43:01,480 --> 00:43:05,820
Print the memory flash information.

605
00:43:06,640 --> 00:43:09,300
There's a TFTP boot command right there.

606
00:43:09,380 --> 00:43:10,780
Oh, and a USB boot.

607
00:43:10,780 --> 00:43:11,840
So, a lot of stuff.

608
00:43:11,840 --> 00:43:16,040
This thing has a USB onboard, so, you know, there's more opportunities here.

609
00:43:17,660 --> 00:43:22,180
So, today, let's get back into the print environment.

610
00:43:22,180 --> 00:43:23,880
Let's take a look back at this.

611
00:43:24,960 --> 00:43:27,340
Today, we already have set the boot delay.

612
00:43:27,340 --> 00:43:28,380
That's already done.

613
00:43:28,380 --> 00:43:29,640
Boot delay is set.

614
00:43:30,500 --> 00:43:34,500
This boot command, though, is set to that boot IPQ.

615
00:43:34,500 --> 00:43:38,740
And if you don't remember, we can just quickly look back at that boot IPQ.

616
00:43:38,740 --> 00:43:40,220
What the heck is that?

617
00:43:41,360 --> 00:43:43,160
So, here it is.

618
00:43:43,160 --> 00:43:44,400
Boot IPQ.

619
00:43:44,400 --> 00:43:46,980
And it's to boot from flash device.

620
00:43:46,980 --> 00:43:50,600
So, that's what it's set out of the box from the manufacturer there.

621
00:43:51,220 --> 00:43:55,740
So, if we get back into those environment variables, what else can we mess with?

622
00:43:56,480 --> 00:43:57,760
Let's see.

623
00:43:57,760 --> 00:43:59,000
So, IP address.

624
00:43:59,000 --> 00:44:01,200
Ah, IP address is important.

625
00:44:01,220 --> 00:44:03,140
And we also have server IP.

626
00:44:04,060 --> 00:44:06,300
So, what can we do with those?

627
00:44:06,300 --> 00:44:13,220
So, basically, this IP address, this Luma device does not have networking configured out of the box.

628
00:44:13,220 --> 00:44:17,980
So, when it turns on, it just has a random IP in there.

629
00:44:18,560 --> 00:44:30,520
And I just set it to an available IP on the network that isn't already being used by the Xbox or the PlayStation or the 10 Raspberry Pis or the N64.

630
00:44:30,520 --> 00:44:30,980
You know what I'm saying?

631
00:44:30,980 --> 00:44:32,680
All these devices out here.

632
00:44:32,780 --> 00:44:34,360
So, I just chose a random IP.

633
00:44:34,360 --> 00:44:36,020
Doesn't really matter.

634
00:44:36,080 --> 00:44:38,380
What does matter is the server IP.

635
00:44:38,380 --> 00:44:44,000
The server IP is going to be the TFTP server.

636
00:44:44,460 --> 00:44:50,900
So, we're gonna be using TFTP to boot this thing or to boot from TFTP.

637
00:44:50,900 --> 00:44:55,500
And that's where this extra server comes into play.

638
00:44:55,500 --> 00:45:03,660
So, I got my just a Ubuntu 16.04, just fresh ISO I just pulled down the other day.

639
00:45:04,120 --> 00:45:08,280
And just found a couple articles online on how to set up a TFTP server.

640
00:45:08,320 --> 00:45:09,680
It's really straightforward.

641
00:45:10,360 --> 00:45:12,900
You know, if I can do it, I'm sure anybody on the call can do it.

642
00:45:12,900 --> 00:45:21,360
Because it's just creating a file, setting the right parameters in that file, and then making sure the service is up and running.

643
00:45:21,360 --> 00:45:28,020
I can't tell you how much pain I was having literally yesterday about trying to get this thing to work.

644
00:45:28,020 --> 00:45:30,420
And literally, I didn't really change much.

645
00:45:30,420 --> 00:45:31,640
And it just started working again.

646
00:45:31,640 --> 00:45:34,860
So, we're gonna see how well today goes.

647
00:45:34,860 --> 00:45:38,320
But anyway, it looks like it's up and running.

648
00:45:38,320 --> 00:45:41,660
We can just see if this is still good to go.

649
00:45:41,660 --> 00:45:43,660
All the passwords, super secret.

650
00:45:44,040 --> 00:45:44,500
All right.

651
00:45:44,500 --> 00:45:47,160
So, we're still running as of 1529.

652
00:45:47,160 --> 00:45:49,140
So, right on schedule there.

653
00:45:49,960 --> 00:45:50,920
Cool.

654
00:45:50,920 --> 00:45:54,420
And if we look at the IP of this device, that might help, right?

655
00:45:54,680 --> 00:45:56,160
I have config.

656
00:45:57,120 --> 00:45:58,080
Let's see.

657
00:45:58,080 --> 00:46:02,440
So, this is 192.168.118.

658
00:46:02,440 --> 00:46:04,600
So, that's where that IP comes into play.

659
00:46:05,260 --> 00:46:05,820
All right.

660
00:46:05,820 --> 00:46:06,540
Cool.

661
00:46:06,880 --> 00:46:09,880
So, jumping back to this now.

662
00:46:10,560 --> 00:46:14,840
So, this boot command is set to this.

663
00:46:14,840 --> 00:46:20,580
We can actually override this particular boot command here.

664
00:46:20,620 --> 00:46:22,580
And these boot arguments.

665
00:46:23,260 --> 00:46:25,940
Sorry, there might be a neighbor calling for their cat.

666
00:46:25,940 --> 00:46:33,900
So, I've actually already gone ahead and wrote out this command just for sake of typoing this thing a million times.

667
00:46:34,280 --> 00:46:36,000
I'm just gonna copy it over.

668
00:46:38,460 --> 00:46:40,920
And if you notice, I didn't show it, actually.

669
00:46:40,920 --> 00:46:51,140
But if I go back to my VM, I have a kernel image over here that has been compiled using open WRT.

670
00:46:51,600 --> 00:46:57,980
So, it's this is the package or the image that we're gonna be calling from my TFTP server.

671
00:46:57,980 --> 00:47:01,220
So, I just dropped it on the desktop here.

672
00:47:01,260 --> 00:47:04,280
I have it in several locations just because I was testing.

673
00:47:04,300 --> 00:47:08,240
So, I think it just needs to be on the root drive, just accessible.

674
00:47:09,260 --> 00:47:12,500
So, good stuff there.

675
00:47:13,180 --> 00:47:17,140
And now that we're back here, I'm just gonna paste this command.

676
00:47:19,670 --> 00:47:20,230
Cool.

677
00:47:20,230 --> 00:47:21,170
Just like that.

678
00:47:21,170 --> 00:47:28,050
So, I'm using TFTP boot, which is one of those help arguments, if you remember.

679
00:47:28,050 --> 00:47:30,730
There was a TFTP boot argument that we could use.

680
00:47:31,230 --> 00:47:34,690
And then I'm telling it, which piece of memory do I want to boot from?

681
00:47:34,690 --> 00:47:37,050
And I want to boot this particular image.

682
00:47:37,450 --> 00:47:41,010
And then boot at this particular address in memory.

683
00:47:41,010 --> 00:47:43,530
So, that's what this command is meant to do.

684
00:47:43,530 --> 00:47:46,310
So, without further ado, let's see how it goes.

685
00:47:46,310 --> 00:47:49,330
Let's just hit the big red button.

686
00:47:50,590 --> 00:47:55,890
And right away, you can see that it's using an Ethernet device, eth0.

687
00:47:56,170 --> 00:47:57,550
So, it is connected.

688
00:47:57,550 --> 00:48:02,690
It's from the server, my TFTP server at 1.18.

689
00:48:02,890 --> 00:48:06,610
And then from our address, .25.

690
00:48:07,130 --> 00:48:10,610
So, looks like we might be in good shape here on the first go around.

691
00:48:10,610 --> 00:48:11,510
How about that?

692
00:48:12,450 --> 00:48:14,710
Looks like it's uncompressing the kernel image.

693
00:48:14,710 --> 00:48:15,450
It's booting it up.

694
00:48:15,450 --> 00:48:18,430
You can see the OpenWrt right here, if you catch it.

695
00:48:19,930 --> 00:48:21,830
And then it's off to the races.

696
00:48:22,090 --> 00:48:29,330
So, as this thing kind of boots up, we'll see if we got any further than that login prompt that we had before.

697
00:48:30,230 --> 00:48:34,850
And if you're not familiar with OpenWrt, it is open source.

698
00:48:35,210 --> 00:48:44,090
And those can also be kind of compiled a little bit differently depending on, you know, what you want to do with it.

699
00:48:44,090 --> 00:48:49,590
So, by the way, the devices, if you wanted to buy these devices, very cheap on eBay.

700
00:48:49,590 --> 00:48:51,490
You can pick them up here.

701
00:48:51,610 --> 00:48:52,970
Very cheap.

702
00:48:52,970 --> 00:48:53,910
Just search eBay.

703
00:48:53,910 --> 00:49:06,910
But this OpenWrt, it's basically just an open source project that you can compile different, you know, different things and connect to different devices.

704
00:49:06,910 --> 00:49:08,630
It's just fully customizable.

705
00:49:09,330 --> 00:49:12,290
So, that's a little bit about what's going on there.

706
00:49:14,370 --> 00:49:15,170
Let's see.

707
00:49:15,170 --> 00:49:21,270
So, as this thing kind of boots up, see if we just hit one of these random buttons over here.

708
00:49:21,790 --> 00:49:22,470
Boom.

709
00:49:22,790 --> 00:49:24,190
So, that did it.

710
00:49:24,190 --> 00:49:28,870
We are in a built-in shell on the Luma device.

711
00:49:29,070 --> 00:49:33,470
So, this technically is not the Luma OS.

712
00:49:33,570 --> 00:49:35,470
So, I want to be clear on that.

713
00:49:35,470 --> 00:49:38,450
We didn't just root the whole Luma device.

714
00:49:38,450 --> 00:49:54,990
What we did is we created a kind of a landing place for kind of like before the OS hits the ground, we created our own OS and said, hey, we want to boot to our OS before you even get to yours.

715
00:49:55,090 --> 00:49:55,670
Okay?

716
00:49:55,670 --> 00:49:57,190
So, that's what this is.

717
00:49:57,490 --> 00:50:01,110
And so, it's not the direct file system on the Luma.

718
00:50:01,130 --> 00:50:08,430
But we can still do things similar to the Hue where we can, you know, dig into the root file system.

719
00:50:08,430 --> 00:50:10,090
We can look at the kernel, the firmware.

720
00:50:10,090 --> 00:50:12,630
There's a lot of things that we can potentially get into.

721
00:50:13,270 --> 00:50:15,650
There's several different techniques to do that.

722
00:50:16,030 --> 00:50:19,710
One of them would be mounting these drives.

723
00:50:19,710 --> 00:50:27,850
So, assuming that we had full permission, then we would just mount these drives and start extracting data from there.

724
00:50:28,190 --> 00:50:34,270
If we don't, you know, in a situation where we don't have access, say like for right now, like we have all zeros here.

725
00:50:34,270 --> 00:50:37,270
So, it's possible that we don't have access to this right now.

726
00:50:37,270 --> 00:50:44,690
So, what we could do is use something like DD to extract the data that way.

727
00:50:44,690 --> 00:50:55,610
It's a command line tool or something like TFTP and just siphon the data to another medium and then perform, you know, additional analysis there.

728
00:50:55,610 --> 00:51:01,250
But as far as from where we are right here, there are some things that we can do.

729
00:51:01,250 --> 00:51:13,910
But it is kind of in this open WRT console now where we'd have to get a little bit creative and kind of use our noggins and find another path to the Luma OS.

730
00:51:13,910 --> 00:51:15,170
But it's possible.

731
00:51:16,510 --> 00:51:20,810
So, that's a little bit about what we got going on on this thing.

732
00:51:20,810 --> 00:51:27,810
We wanted to show, you know, booting to an OS that we compiled on the device itself.

733
00:51:28,590 --> 00:51:32,430
So, that's a little bit about what we got going on here.

734
00:51:33,030 --> 00:51:36,810
Any questions on how we got to this point?

735
00:51:39,650 --> 00:51:40,390
Yep.

736
00:51:40,390 --> 00:51:42,130
A couple questions here.

737
00:51:42,130 --> 00:51:43,230
Let me take a look.

738
00:51:44,230 --> 00:51:49,370
One individual asks, I assume all of these attacks require physical access.

739
00:51:49,370 --> 00:51:53,410
There's no way of performing this attack remotely.

740
00:51:53,410 --> 00:51:54,610
Is that correct?

741
00:51:55,470 --> 00:51:56,030
Yes.

742
00:51:56,030 --> 00:52:05,630
So, unfortunately, if you did want to, you know, start doing some war driving or something or mess with your family members, whatever, it's all ethical, right?

743
00:52:05,830 --> 00:52:09,530
You know, you would have to have physical access to these devices.

744
00:52:09,610 --> 00:52:23,630
I imagine you could get physical access one time and then set up some type of logic bomb or some type of, you know, hook into the device so that if it were online, it could call to us in some way or somehow.

745
00:52:23,710 --> 00:52:27,970
Probably some of the devices that have internet connection more so than not.

746
00:52:27,970 --> 00:52:35,430
But I know that I have the light bulbs from Costco.

747
00:52:35,430 --> 00:52:40,850
I think they're called... oh, man, now I'm drawing a blank on it.

748
00:52:40,850 --> 00:52:43,310
But it's basically the same thing as the Philips Hue.

749
00:52:43,690 --> 00:52:45,590
And it's the Costco version.

750
00:52:45,590 --> 00:52:47,070
I can't remember the name of it now.

751
00:52:47,110 --> 00:52:48,490
It's driving me nuts.

752
00:52:48,490 --> 00:52:54,730
But basically, they were on the internet, and they didn't have very much any security.

753
00:52:55,130 --> 00:52:58,310
And I was just afraid to even mess with it at that point.

754
00:52:58,310 --> 00:53:07,430
I'm like, physical access to this thing.

755
00:53:07,430 --> 00:53:12,270
But, you know, you never know.

756
00:53:12,270 --> 00:53:14,530
So, good question.

757
00:53:16,250 --> 00:53:17,210
All right.

758
00:53:17,210 --> 00:53:19,610
Taking a look at another question here.

759
00:53:20,690 --> 00:53:26,250
As far as... I think this was touched on a little bit earlier as well by Daryl.

760
00:53:26,250 --> 00:53:29,990
But how do you know which pin to take to ground when glitching?

761
00:53:29,990 --> 00:53:33,090
I know earlier we were talking about data zero, data one.

762
00:53:33,090 --> 00:53:42,030
But as far as testing is concerned, how would you know about taking which pin to ground whenever you're performing this type of glitching?

763
00:53:42,670 --> 00:53:44,670
Yeah, that's a good question.

764
00:53:44,870 --> 00:53:51,130
I do have the breakdown of that flash chip on another screen somewhere, somehow.

765
00:53:52,130 --> 00:53:53,130
Bear with me.

766
00:53:53,130 --> 00:53:54,470
Can you still see my screen?

767
00:53:54,470 --> 00:53:56,450
Is it still showing questions?

768
00:53:56,870 --> 00:53:57,590
Yes.

769
00:53:57,590 --> 00:54:02,950
Okay, give me one second and I can get that readout for you.

770
00:54:02,990 --> 00:54:11,970
But basically, it is a data line, and it is the one that we would want to break into.

771
00:54:11,970 --> 00:54:24,150
So, when you look at the data sheets for these devices, you do want to look for the data lines is kind of the idea in finding out where those actually exist.

772
00:54:24,650 --> 00:54:29,710
Let's see if I can't get a good shot of this.

773
00:54:29,710 --> 00:54:31,310
Give me one second.

774
00:54:33,790 --> 00:54:36,030
Okay, got that now.

775
00:54:36,030 --> 00:54:38,770
Let's just minimize some things.

776
00:54:40,890 --> 00:54:41,810
Okay.

777
00:54:42,070 --> 00:54:47,250
So, see if I can't get a better view of this device here.

778
00:54:50,200 --> 00:54:50,880
Okay.

779
00:54:50,880 --> 00:54:53,180
So, you can still see my screen.

780
00:54:53,320 --> 00:54:59,740
What I have on there now is basically the top down view of that exact chip.

781
00:54:59,740 --> 00:55:05,700
So, if I look back to the camera, this is the chip breakdown, this one right here.

782
00:55:05,820 --> 00:55:10,220
I don't know if you can see that, but the one with the little orange paint drop.

783
00:55:11,060 --> 00:55:15,780
So, that's what we're breaking down in this diagram here.

784
00:55:16,100 --> 00:55:17,400
If I can get my pen out.

785
00:55:17,400 --> 00:55:18,240
There we go.

786
00:55:18,240 --> 00:55:22,520
So, the line that we're shorting is this SO line.

787
00:55:24,000 --> 00:55:28,700
This SO line over here, that's the data line.

788
00:55:29,240 --> 00:55:30,980
I can't remember exactly what it stands for.

789
00:55:30,980 --> 00:55:39,360
Maybe Daryl remembers, but that's essentially what we're shorting in this example.

790
00:55:43,530 --> 00:55:44,910
Yeah, exactly.

791
00:55:44,910 --> 00:55:46,970
There's also an interesting question that came up.

792
00:55:46,970 --> 00:55:52,610
When glitching, would it be a little safer to use a resistor in lieu of a paper clip?

793
00:55:53,010 --> 00:55:58,750
There's a possibility you could short a 3.3 or 5 volt trace pin and burn a register.

794
00:55:58,750 --> 00:56:00,830
Yeah, there's always a chance.

795
00:56:02,650 --> 00:56:08,610
That's why it's very important to... I'm not against using a resistor.

796
00:56:08,610 --> 00:56:11,230
I mean, there is some value to that.

797
00:56:11,890 --> 00:56:25,510
If you'd have to experiment around, because obviously you want to interrupt the data significantly enough, and a resistor may or may not drop the voltage enough based on the resistor size.

798
00:56:25,770 --> 00:56:34,070
But in reference to doing that, again, like he's showing here, go ahead and get the data sheets, figure out what you're grounding out.

799
00:56:34,070 --> 00:56:37,590
So, literally, you don't like just smoke something.

800
00:56:37,590 --> 00:56:43,250
To randomly go into a device here and go, oh, I think I'll just start grounding stuff out.

801
00:56:43,250 --> 00:56:48,050
It's almost a guarantee that you will brick the device permanently.

802
00:56:48,210 --> 00:56:55,390
Now, I've had on these glitching attacks, probably successful.

803
00:56:55,570 --> 00:57:09,010
Anytime there's two chips used, where U-Boot is on one chip and the kernel file system is on another, I've had a hundred percent success every time in actually doing that.

804
00:57:09,010 --> 00:57:16,390
I've only had a problem on one device, and it was using... I can't remember the chip it was using.

805
00:57:16,390 --> 00:57:21,670
It was very much more high speed, so getting it at the right time was difficult.

806
00:57:21,750 --> 00:57:43,050
We never destroyed the chip, but during the attack, even though I was taking the data line down the ground, I ended up actually causing it to screw the U-Boot up, and it actually damaged the U-Boot so that the chip would not boot up anymore.

807
00:57:43,050 --> 00:57:46,710
It would come up actually giving you an error in the U-Boot.

808
00:57:46,710 --> 00:57:51,330
Now, how it altered part of the data in the U-Boot during this process, I have no clue.

809
00:57:51,330 --> 00:58:05,390
Maybe it did fry register in there or smoke something, but we were able to pull the chip and then successfully pull the entire operating system off and recover it all anyway, so problem solved.

810
00:58:07,730 --> 00:58:24,510
Yeah, and just to speak on that note too, I've definitely broken enough devices just tinkering just like that and not really looking, you know, doing the right diligence of looking at the data sheet, looking at what am I actually messing with.

811
00:58:24,510 --> 00:58:28,030
It was more like, it's how it works in the movies, so it's how it works in real life.

812
00:58:28,030 --> 00:58:31,450
You know, I'm just going to touch a bunch of stuff and now I'm in.

813
00:58:31,450 --> 00:58:39,070
So, I definitely have a bunch of devices that just are paperweights around, scattered around.

814
00:58:41,090 --> 00:58:43,790
Yeah, that's funny, dude.

815
00:58:46,750 --> 00:58:47,690
Good stuff.

816
00:58:47,690 --> 00:59:01,190
So, that is getting into the Luma and being able to boot up, another operating system such as OpenWrt.

817
00:59:03,210 --> 00:59:17,210
So, if those devices aren't readily available to you, like the Philips Hue and the Luma, things like this, or they're the ones that you use in your house and you're not trying to lose internet in your house, totally get that.

818
00:59:17,390 --> 00:59:22,410
But if you have a Pi laying around, you can do the exercise with a Raspberry Pi.

819
00:59:22,750 --> 00:59:35,730
There's several articles over the internet that you can find how to do this, how to set it up, what you can do with it, and it's pretty wide.

820
00:59:36,210 --> 00:59:43,330
So, this is just an example of a Raspberry Pi that we had connected, one of my colleagues set up for me for this demo.

821
00:59:43,330 --> 00:59:46,570
So, then you have Uboot going on on the right-hand side.

822
00:59:46,570 --> 01:00:01,970
It's doing the same kind of song and dance of getting into the flash memory, the kernel, and actually printing the environment variables so that we can tweak them and adjust them and then tell it what we wanted to do.

823
01:00:02,190 --> 01:00:05,930
So, it's just another example of a Raspberry Pi.

824
01:00:07,810 --> 01:00:08,930
Cool.

825
01:00:11,130 --> 01:00:13,510
So, that is all, folks.

826
01:00:13,510 --> 01:00:19,470
I really appreciate everyone who was able to join this session on a Saturday when we're not in Vegas.

827
01:00:19,470 --> 01:00:30,950
I'm assuming we're not in Vegas, but normally hungover at this time of the day and, you know, completely, you know, con funk is in full force.

828
01:00:31,530 --> 01:00:33,570
You know, I don't know what time it is.

829
01:00:33,570 --> 01:00:34,450
I don't know where I am.

830
01:00:34,450 --> 01:00:37,330
That's normally the status of this day for me.

831
01:00:37,330 --> 01:00:42,150
So, it's a little bit different doing this thing virtual.

832
01:00:42,290 --> 01:00:49,790
So, I appreciate everyone who was able to join and all the questions and, you know, really happy to be here.

833
01:00:49,790 --> 01:00:53,390
So, if you have any other questions, throw them out there.

834
01:00:54,330 --> 01:00:56,490
But that's the end of the show.

835
01:00:56,490 --> 01:00:59,470
Yeah, there was one more question I saw come in in the chat.

836
01:00:59,710 --> 01:01:05,630
It said, did you download someone else's build for the Luma or did you do it yourself?

837
01:01:05,810 --> 01:01:16,610
In this particular case, this build was... I actually built this a while back while I was doing some testing on the Luma.

838
01:01:16,610 --> 01:01:21,310
So, I used OpenWrt's program.

839
01:01:21,310 --> 01:01:29,810
This is built off an IPQ40 series processors, which is what the processor is on that particular Luma.

840
01:01:29,810 --> 01:01:35,690
And it's one of the chipsets that's actually supported within the OpenWrt.

841
01:01:35,690 --> 01:01:47,990
Now, in this particular case, the success of this wasn't 100%, as Garrett pointed out, that the root FS was showing nothing there or zero location.

842
01:01:47,990 --> 01:01:52,810
And the reason why that is, is because, remember, this is a two -chip system.

843
01:01:52,870 --> 01:01:59,870
And when you're building an actual firmware package, you have to build out a device tree.

844
01:02:00,410 --> 01:02:13,950
Now, most of all of the data available on OpenWrt was very well available dealing with one-chip environments.

845
01:02:14,410 --> 01:02:25,230
But the device tree for the second chip has not been built into this yet, which potentially made that an issue.

846
01:02:25,350 --> 01:02:43,630
But once you compile it and compile it with the right complete device tree, complete it, then what he showed with PROC MTD, which is the memory technology devices, kind of an abstract layer between the hardware, the physical flash hardware, and the other part,

847
01:02:43,630 --> 01:03:00,790
you can literally from those potentially mount those file systems up, or you can also DD them off by actually calling them directly through dev MTD 0 through 9 or 10, which is one of the methods.

848
01:03:00,790 --> 01:03:18,110
It's really easy once you get some kind of console, which would be the ultimate goal of bringing in a new kernel via TFTP, because you would come in, it would have the device tree, you would see the chips, even though they're not mounted up, you can easily DD all of those images off their file system,

849
01:03:18,110 --> 01:03:33,310
the root file system, and everything from a separate booted kernel like this, giving you the ability to do some offline binwalk and extract the data, hopefully find the root.

850
01:03:33,510 --> 01:03:52,190
Or inevitably, you could even, when you find the root, you could easily in this particular case, DD it off, explode it out, and then alter it, rebuild it, repack it back in, and then DD it back over that partition area, and then reboot the device.

851
01:03:52,190 --> 01:03:55,270
And in that fashion, actually change the root password.

852
01:03:55,430 --> 01:04:03,630
So this particular attack, as he addressed and talked about, will really open up a lot of new avenues to some hardened devices.

853
01:04:03,630 --> 01:04:07,830
But it all comes down to, can you get access to that UBoot console?

854
01:04:09,070 --> 01:04:19,390
And also, the presentation or the demo I ran, and the person pointed out where I missed board, that was correct.

855
01:04:19,390 --> 01:04:27,910
As soon as we jumped off and he moved on, I went ahead, fixed that typo, failed to copy and reboot it, and it came up to the root prompt.

856
01:04:27,910 --> 01:04:29,850
So that worked out pretty good.

857
01:04:29,850 --> 01:04:36,590
So good shout out to that person, was able to visually, quickly capture the idea that I missed that little piece.

858
01:04:36,590 --> 01:04:37,890
So totally cool.

859
01:04:38,910 --> 01:04:39,790
Nice.

860
01:04:40,430 --> 01:04:42,470
Yeah, I just wanted to add on that.

861
01:04:42,530 --> 01:04:56,110
Sometimes on the devices, if you can still see my screen, the prompt, the command prompts on the Luma is actually the name of the chip, the IPQ40.

862
01:04:56,350 --> 01:05:03,950
So sometimes you can get even more details from just the device itself, just telling you like, hey, this is what I am.

863
01:05:03,950 --> 01:05:06,050
Hope this helps, you know.

864
01:05:06,890 --> 01:05:08,370
But yeah, I just wanted to call that out.

865
01:05:08,370 --> 01:05:11,930
I didn't mention it earlier, but IPQ40, like what the heck is that?

866
01:05:11,930 --> 01:05:18,150
It's the name, it's the type of chipset that's on this thing, type of processor.

867
01:05:18,150 --> 01:05:20,550
So cool.

868
01:05:21,570 --> 01:05:24,910
Well, really appreciate everyone, if that's all the questions.

869
01:05:26,510 --> 01:05:32,290
Not sure if there's any more, but we're good to go, right on time.

870
01:05:32,710 --> 01:05:35,850
Yeah, Jonathan, do you see anything else in the Twitch we might have missed?

871
01:05:36,730 --> 01:05:37,790
I'm taking a look here.

872
01:05:37,790 --> 01:05:42,630
I do see that in Zoom, someone asks, it looks like it identified the attached flash as well.

873
01:05:42,630 --> 01:05:47,050
So I guess from the U-Boot output there, it identifies the flash.

874
01:05:47,490 --> 01:05:49,870
Pulling up Twitch, I think from Twitch, we're also good to go.

875
01:05:49,870 --> 01:05:57,590
So the last question, I guess, was there and the question was, it looks like it identified the type of flash.

876
01:05:57,590 --> 01:06:00,330
And that might be kind of equally a statement as it is a question.

877
01:06:00,330 --> 01:06:00,690
It did.

878
01:06:00,690 --> 01:06:05,350
It identified the one of the flash chips.

879
01:06:08,170 --> 01:06:16,270
So could you actually from that booted kernel potentially get to those current chips?

880
01:06:16,270 --> 01:06:18,190
Yeah, it's highly possible.

881
01:06:18,350 --> 01:06:22,290
You may have to do some manipulation.

882
01:06:22,290 --> 01:06:23,910
I haven't tried it yet.

883
01:06:23,910 --> 01:06:32,890
But typically, the easiest way is to build it into the device tree for the kernel that you're building for that processor.

884
01:06:32,890 --> 01:06:34,810
That's the most effective way.

885
01:06:34,810 --> 01:06:53,090
Once that's built in there, it makes it 10 times easier for gaining access and basically altering this data or extracting that data off there versus not necessarily have to figure out how do I access a chip when I don't have a device tree for it.

886
01:06:53,090 --> 01:06:55,050
It's going to be very difficult.

887
01:06:55,050 --> 01:06:56,050
So yeah.

888
01:07:00,870 --> 01:07:09,630
Sorry, I had someone that was playing the Linkin Park at the full capacity of the volume there.

889
01:07:09,630 --> 01:07:11,930
So I apologize as I drove by.

890
01:07:12,010 --> 01:07:17,210
Okay, yeah, you have one person out there says you need to put that cowboy hat on behind you.

891
01:07:17,410 --> 01:07:20,490
So you look like Billy Ray Cyrus.

892
01:07:27,010 --> 01:07:29,870
Oh, y'all are cracking me up.

893
01:07:29,870 --> 01:07:31,110
Oh, man.

894
01:07:31,110 --> 01:07:32,210
I appreciate y'all.

895
01:07:32,210 --> 01:07:33,670
Yeah, let's see what we got.

896
01:07:33,950 --> 01:07:35,290
Here we go.

897
01:07:35,550 --> 01:07:36,650
Hats on.

898
01:07:37,410 --> 01:07:39,330
We have to take this off.

899
01:07:40,670 --> 01:07:42,050
But there we go.

900
01:07:42,050 --> 01:07:43,910
We're locked and loaded now.

901
01:07:45,570 --> 01:07:46,930
Pretty great.

902
01:07:47,090 --> 01:07:50,030
This is how you find the real bones.

903
01:07:53,970 --> 01:07:55,070
Nice.

904
01:07:56,730 --> 01:08:02,330
I mean, the people in the audience, unless the presenters need to leave, we still have time.

905
01:08:03,270 --> 01:08:07,030
There's no rush to close out quite yet.

906
01:08:07,890 --> 01:08:11,610
There's 30 minutes before next talk comes on.

907
01:08:11,610 --> 01:08:19,030
So we still have just a little bit of time probably we could do another five minutes if the presenters are still available.

908
01:08:19,550 --> 01:08:23,530
Hey, let me go ahead and let me go ahead and boot my failure.

909
01:08:25,710 --> 01:08:27,770
So let's switch over to that.

910
01:08:30,450 --> 01:08:32,950
So let me go ahead and share my screen.

911
01:08:32,950 --> 01:08:34,170
Let's get that going.

912
01:08:37,290 --> 01:08:40,170
Okay, hopefully everyone can see everything fine now.

913
01:08:40,830 --> 01:08:42,370
So let's go ahead and power this.

914
01:08:42,370 --> 01:08:43,830
Watch this thing fail again.

915
01:08:44,770 --> 01:08:49,890
I should know when to walk away to a demo failure.

916
01:08:50,070 --> 01:08:52,770
So let's go ahead and stop here real quick.

917
01:08:52,770 --> 01:08:55,010
Let's go print environment.

918
01:08:55,010 --> 01:08:57,250
So we can see what I altered.

919
01:08:57,250 --> 01:09:00,170
So I altered standard boot.

920
01:09:00,430 --> 01:09:05,570
When I copied it over, I missed this word right here, board equals.

921
01:09:05,570 --> 01:09:08,970
So it ended up specifying this board.

922
01:09:08,970 --> 01:09:18,690
And what's kind of strange is often when you do boot args, and I've mistyped things before, I'd never had it cause a kernel panic like that before.

923
01:09:18,690 --> 01:09:19,810
So it's kind of interesting.

924
01:09:19,810 --> 01:09:24,450
I've had it just skip over that functionality or whatever.

925
01:09:24,450 --> 01:09:25,750
So that was kind of interesting.

926
01:09:26,210 --> 01:09:42,250
So the change I did this originally said null, we're able to identify with a little legwork watching the system normally boot up, looking at some of that stuff, identify the type of TTY and replace the console null out of there.

927
01:09:42,250 --> 01:09:42,350
So

928
01:10:02,630 --> 01:10:14,290
it's common to see these options also on devices that are outside of the U-boot where it says press F key, enter into failsafe mode.

929
01:10:14,290 --> 01:10:20,330
Sometimes these will put you into a single user mode when the vendor's crazy enough to leave them available.

930
01:10:20,330 --> 01:10:27,870
Something to think about from when you're watching a boot option, it's not part of the U-boot stuff, but it can be very helpful.

931
01:10:27,870 --> 01:10:31,170
It will put you in a very locked down system.

932
01:10:31,170 --> 01:10:36,650
There won't be network, there won't be device drivers, there won't be nothing on there.

933
01:10:36,750 --> 01:10:38,590
So inherently, there you go.

934
01:10:38,590 --> 01:10:41,870
So instantly you're able to get past that.

935
01:10:41,870 --> 01:10:57,770
And like I said, this is kind of a common issue that you can run into a number of times where they've just basically said, turn the console off before you boot kernel or turn the console off when kernel, before kernel runs.

936
01:10:57,790 --> 01:11:00,690
And because of that, you don't get a console.

937
01:11:00,690 --> 01:11:11,630
If you can gain access to U-boot, probably eight out of 10 times, you can change those settings to be able to gain access to a console.

938
01:11:11,630 --> 01:11:17,870
Now, whether you'll have full root access after boot is to be found or figured out.

939
01:11:17,870 --> 01:11:31,190
But believe it or not, I think over the last so many years, I've encountered three or four devices that had it set up to go ahead and halt the console so you can have it.

940
01:11:31,190 --> 01:11:39,250
And when I changed the argument so the console was enabled, at least half the time, I had a full root console at that point.

941
01:11:39,550 --> 01:11:46,570
And these settings here that I mentioned, the press one, two, just select the debug mode.

942
01:11:46,870 --> 01:11:48,550
Never had much luck with those.

943
01:11:48,550 --> 01:11:50,950
Sometimes they do things, sometimes they don't.

944
01:11:50,950 --> 01:11:54,610
But the F key, if you ever see that, takes you to failsafe mode.

945
01:11:54,610 --> 01:12:04,050
This will give you root level access, but it's amazing how complicated with root level access and no ability to move data on or out of the device.

946
01:12:04,050 --> 01:12:10,770
It's doable, but it becomes very problematic because often you actually have to build the device nodes.

947
01:12:10,770 --> 01:12:16,770
And if they harden the device and turn certain programs off and remove them, it becomes more difficult.

948
01:12:17,070 --> 01:12:24,250
From the Luma, just out of curiosity from the Luma, this had this and I was working to try to get data off of it.

949
01:12:24,250 --> 01:12:45,190
In a way I originally did it was go into the F mode and actually build, manually build all the device, not totally manually, but very close to manually reconstruct the device nodes, naming them all the correct pieces and parts to build a USB.

950
01:12:45,210 --> 01:12:48,250
And then from there was able to move the data off to the USB.

951
01:12:48,310 --> 01:12:50,250
Just some stuff to think about.

952
01:12:52,370 --> 01:12:54,170
A small question just came up, Daryl.

953
01:12:54,170 --> 01:12:57,710
I know you had mentioned this yesterday during your building the IoT lab.

954
01:12:57,710 --> 01:13:00,910
What is your FTDI device you're using for that one?

955
01:13:00,910 --> 01:13:02,310
Its name escapes me.

956
01:13:02,310 --> 01:13:03,770
Someone was asking on Twitch.

957
01:13:03,950 --> 01:13:06,250
Oh, gosh, this one I have right here.

958
01:13:06,590 --> 01:13:12,270
Yeah, it was that cool one that could do like more than just it had like it supported like SPI and others in addition to UART.

959
01:13:18,140 --> 01:13:19,880
Yeah, that's the one.

960
01:13:20,400 --> 01:13:22,240
Let's power this off.

961
01:13:22,320 --> 01:13:25,420
Let's see if this has this name, has a name on it.

962
01:13:25,420 --> 01:13:27,640
I don't know if this even has a name.

963
01:13:27,640 --> 01:13:31,400
It's very generic and I do not even have the box for it anymore.

964
01:13:31,400 --> 01:13:33,660
I bought this off Amazon.

965
01:13:33,720 --> 01:13:44,280
All I did was search for multi UART connector or multi port UART connector and this came up.

966
01:13:44,280 --> 01:13:49,280
If I remember the price of this was like twenty seven dollars.

967
01:13:50,800 --> 01:13:55,500
But to to the life of me, I do not know the name.

968
01:13:55,500 --> 01:14:03,520
This is a generic build device coming out of China and it works pretty good.

969
01:14:03,520 --> 01:14:05,540
So cool.

970
01:14:05,540 --> 01:14:11,100
But sadly, I do not know what its name is or who makes it.

971
01:14:11,100 --> 01:14:11,820
Gotcha.

972
01:14:11,860 --> 01:14:13,600
Another question cropped up.

973
01:14:13,800 --> 01:14:24,420
Is there a URL or GitHub of some type where one could get ROMs to access a processor or access to a processor to play around with and do this type of stuff?

974
01:14:26,420 --> 01:14:43,580
I think they're asking, is there, I guess, any like I guess I think I think what's being asked with it is are there maybe like a list of devices that that could be purchased in order to do things such as U-Boot exploitation?

975
01:14:44,560 --> 01:14:58,340
I would actually literally exactly what Garrett said, go to go on to eBay and look at buying some of the devices on eBay.

976
01:14:58,780 --> 01:15:00,160
I think would be bright.

977
01:15:00,160 --> 01:15:01,480
You get the Lumos.

978
01:15:01,580 --> 01:15:06,640
You can get the you can go ahead and get the Hughes out there.

979
01:15:06,640 --> 01:15:09,940
He actually had a screen where he was showing some that were available.

980
01:15:10,020 --> 01:15:11,880
They're not expensive.

981
01:15:11,980 --> 01:15:13,780
I'm not sure how this would work.

982
01:15:13,780 --> 01:15:19,820
This is a product that that I was playing around with just recently, and it's like 19 or 20 bucks.

983
01:15:19,820 --> 01:15:24,880
And basically, it has OpenWRT running on it right now.

984
01:15:24,880 --> 01:15:26,960
It has serial connections.

985
01:15:27,020 --> 01:15:34,820
There's a flash chip so you can practice pulling the chip off if you want reading it or using SPI chip reading techniques.

986
01:15:35,040 --> 01:15:40,520
You can probably trace out versus some of these headers or connectors.

987
01:15:40,520 --> 01:15:47,440
You may be able to trace out the actual JTAGs on this for the chip.

988
01:15:47,440 --> 01:15:49,240
It has Ethernet.

989
01:15:49,240 --> 01:15:50,640
It has Wi-Fi.

990
01:15:50,640 --> 01:15:52,320
It has USB.

991
01:15:52,460 --> 01:15:55,220
And literally, it's like 20 bucks.

992
01:15:55,320 --> 01:16:01,240
So this would be an easy, cheap device to possibly play with.

993
01:16:01,240 --> 01:16:01,880
And that's

994
01:16:05,840 --> 01:16:08,900
Vixby 300 wireless travel router.

995
01:16:09,100 --> 01:16:11,580
I would try playing around with that.

996
01:16:11,580 --> 01:16:20,300
But I have to admit, this was kind of footsy when it came to the actual U-boot arguments.

997
01:16:20,300 --> 01:16:24,140
I had a couple arguments that didn't work, and I couldn't alter and stuff like that.

998
01:16:24,260 --> 01:16:25,620
Here's another device.

999
01:16:25,620 --> 01:16:27,600
I think it's the exact same product.

1000
01:16:27,600 --> 01:16:29,220
They're just white-labeled different.

1001
01:16:29,660 --> 01:16:35,640
GL-iNet and Mini Smart Router also has all the same functions and features on it.

1002
01:16:35,640 --> 01:16:39,840
I'm not sure if the Mango is still on the market.

1003
01:16:39,840 --> 01:16:41,960
May be able to buy one used.

1004
01:16:45,080 --> 01:16:58,880
But a lot of these cheap devices are out there, and it gives you a chance to experiment with UART and JTAG and SPI chips and sometimes NAND chips and flash chips.

1005
01:16:58,880 --> 01:17:02,920
I mean, the list goes on and on and on, and they're often cheap.

1006
01:17:04,420 --> 01:17:13,100
Like I said, Luma I like a lot because it has all of those same features, and you can get them for 20-30 bucks used.

1007
01:17:13,420 --> 01:17:14,940
It has the USB.

1008
01:17:14,940 --> 01:17:16,360
It has the Ethernet.

1009
01:17:16,360 --> 01:17:18,920
It has UART connectivity.

1010
01:17:19,000 --> 01:17:22,440
It has NAND flash chips on the device.

1011
01:17:22,440 --> 01:17:28,680
It has SOIC8 SPI flash memory chips on the device.

1012
01:17:28,680 --> 01:17:34,160
So it's a perfect platform for hacking, attacking, experimenting.

1013
01:17:34,160 --> 01:17:37,940
The pin glitch works on it also as an example.

1014
01:17:42,610 --> 01:17:43,610
Awesome.

1015
01:17:43,810 --> 01:17:45,450
I was just catching up in the chat.

1016
01:17:45,450 --> 01:17:49,350
It was a F-E-I-T, however you pronounce that.

1017
01:17:49,350 --> 01:17:58,770
It was a fight bulb that I had from Costco that I just decided to put and leave in the drawer because just didn't feel very secure about it.