Cryptographic Capabilities of the Barbie Typewriter
They’re not much, but they do exist.
Entries Tagged "hardware"
Page 6 of 18
USB Kill Stick
It costs less than $60.
For just a few bucks, you can pick up a USB stick that destroys almost anything that it’s plugged into. Laptops, PCs, televisions, photo booths—you name it.
Once a proof-of-concept, the pocket-sized USB stick now fits in any security tester’s repertoire of tools and hacks, says the Hong Kong-based company that developed it. It works like this: when the USB Kill stick is plugged in, it rapidly charges its capacitors from the USB power supply, and then discharges—all in the matter of seconds.
On unprotected equipment, the device’s makers say it will “instantly and permanently disable unprotected hardware”.
You might be forgiven for thinking, “Well, why exactly?” The lesson here is simple enough. If a device has an exposed USB port—such as a copy machine or even an airline entertainment system—it can be used and abused, not just by a hacker or malicious actor, but also electrical attacks.
Slashdot thread.
Practical TEMPEST Attack
Four researchers have demonstrated a TEMPEST attack against a laptop, recovering its keys by listening to its electrical emanations. The cost for the attack hardware was about $3,000.
News article:
To test the hack, the researchers first sent the target a specific ciphertext—in other words, an encrypted message.
“During the decryption of the chosen ciphertext, we measure the EM leakage of the target laptop, focusing on a narrow frequency band,” the paper reads. The signal is then processed, and “a clean trace is produced which reveals information about the operands used in the elliptic curve cryptography,” it continues, which in turn “is used in order to reveal the secret key.”
The equipment used included an antenna, amplifiers, a software-defined radio, and a laptop. This process was being carried out through a 15cm thick wall, reinforced with metal studs, according to the paper.
The researchers obtained the secret key after observing 66 decryption processes, each lasting around 0.05 seconds. “This yields a total measurement time of about 3.3 sec,” the paper reads. It’s important to note that when the researchers say that the secret key was obtained in “seconds,” that’s the total measurement time, and not necessarily how long it would take for the attack to actually be carried out. A real world attacker would still need to factor in other things, such as the target reliably decrypting the sent ciphertext, because observing that process is naturally required for the attack to be successful.
For half a century this has been a nation-state-level espionage technique. The cost is continually falling.
Police Dog Sniffs for Hard Drives
This weird story describes a “porn dog” that is trained to find hidden hard drives. It’s used in child porn investigations.
I suppose it’s reasonable that computer disks have a particular chemical smell, but I wonder what it is.
EDITED TO ADD (1/13): More info.
Hacking Fitbit
This is impressive:
“An attacker sends an infected packet to a fitness tracker nearby at bluetooth distance then the rest of the attack occurs by itself, without any special need for the attacker being near,” Apvrille says.
“[When] the victim wishes to synchronise his or her fitness data with FitBit servers to update their profile … the fitness tracker responds to the query, but in addition to the standard message, the response is tainted with the infected code.
“From there, it can deliver a specific malicious payload on the laptop, that is, start a backdoor, or have the machine crash [and] can propagate the infection to other trackers (Fitbits).”
That’s attacker to Fitbit to computer.
Hacking Attack Causes Physical Damage at German Steel Mill
This sort of thing is still very rare, but I fear it will become more common:
…hackers had struck an unnamed steel mill in Germany. They did so by manipulating and disrupting control systems to such a degree that a blast furnace could not be properly shut down, resulting in “massive”—though unspecified—damage.
FDA Guidance on Medical Device Cybersecurity
The Food and Drug Administration has released guidelines regarding the security of medical devices.
I admit that I have not read it.
Hacking a Video Poker Machine
Kevin Poulsen has written an interesting story about two people who successfully exploited a bug in a popular video poker machine.
Safeplug Security Analysis
Good security analysis of Safeplug, which is basically Tor in a box. Short answer: not yet.
Wi-Fi Jammer
A device called Cyborg Unplugged can be configured to prevent any Wi-Fi connection:
Oliver notes on the product’s website that its so-called “All Out Mode”—which prevents surveillance devices from connecting to any Wi-Fi network in the area—is likely illegal, and he advises against its use. Nevertheless, we can imagine activists slipping these little devices into public areas and wreaking a bit of havoc.
Sidebar photo of Bruce Schneier by Joe MacInnis.