The Benefits of Endpoint Encryption
An unofficial blog post from FTC chief technologist Ashkan Soltani on the virtues of strong end-user device controls.
Entries Tagged "firmware"
Page 2 of 2
Time to Patch Your HP Printers
It’s a serious vulnerability. Note that this is the research that was mistakenly reported as allowing hackers to set your printer on fire.
Here’s a list of all the printers affected.
Hacking Apple Laptop Batteries
Security researcher Charlie Miller, widely known for his work on Mac OS X and Apple’s iOS, has discovered an interesting method that enables him to completely disable the batteries on Apple laptops, making them permanently unusable, and perform a number of other unintended actions. The method, which involves accessing and sending instructions to the chip housed on smart batteries could also be used for more malicious purposes down the road.
[…]
What he found is that the batteries are shipped from the factory in a state called “sealed mode” and that there’s a four-byte password that’s required to change that. By analyzing a couple of updates that Apple had sent to fix problems in the batteries in the past, Miller found that password and was able to put the battery into “unsealed mode.”
From there, he could make a few small changes to the firmware, but not what he really wanted. So he poked around a bit more and found that a second password was required to move the battery into full access mode, which gave him the ability to make any changes he wished. That password is a default set at the factory and it’s not changed on laptops before they’re shipped. Once he had that, Miller found he could do a lot of interesting things with the battery.
“That lets you access it at the same level as the factory can,” he said. “You can read all the firmware, make changes to the code, do whatever you want. And those code changes will survive a reinstall of the OS, so you could imagine writing malware that could hide on the chip on the battery. You’d need a vulnerability in the OS or something that the battery could then attack, though.”
As components get smarter, they also get more vulnerable.
BIOS Protection
NIST has released “BIOS Protection Guidelines.”
EDITED TO ADD (6/12): Good write-up.
Hacking Cars with MP3 Files
Impressive research:
By adding extra code to a digital music file, they were able to turn a song burned to CD into a Trojan horse. When played on the car’s stereo, this song could alter the firmware of the car’s stereo system, giving attackers an entry point to change other components on the car.
Sidebar photo of Bruce Schneier by Joe MacInnis.