Hackers Prove They Can ‘Pwn’ the Lives of Those Not Hyperconnected • Hacker News Board

Re: Hackers Prove They Can ‘Pwn’ the Lives of Those Not Hyperconnected

#71

Post by scintill76 » Fri, Oct 16, 2015, 1:32 AM UTC

i336_ wrote: post #33

TazeTSchnitzel wrote: post #30

Earlier quoted context omitted.

For radio-free hardware, what about a Palm Pilot? Only has IrDA.

A couple of them had Bluetooth. The only 68k-based one with builtin Wi-Fi was the AlphaSmart Dana, a writer's keyboard. You're very very unlikely going to want to type a truly secure (= long) password over and over and over, which you'd need to do in a situation where the browser's password manager is turned off, and/or a website disables password caching anyway. The Palm m5xx series could solve this problem: it had…

I had and enjoyed an m515. :) I see there are several for less than $30 on eBay. Maybe that wouldn't last if someone built the software and a bunch of paranoid power-users started buying them. :P The potential to recycle some old hardware is part of what makes this idea interesting to me.

I suppose if you can do full USB, you can probably get data in somehow.

Re: Hackers Prove They Can ‘Pwn’ the Lives of Those Not Hyperconnected

#72

Post by Vendan » Fri, Oct 16, 2015, 2:26 AM UTC

i336_ wrote: post #69

Vendan wrote: post #59

Earlier quoted context omitted.

Just make something like a usb Rubber Ducky with a couple buttons and a screen. Plug it in, scroll to password, hit "type it", and it types it in. Could probably make one for about $40. Arduino Leonardo, LCD Shield, and the leonardo keyboard libraries. Could even have it as a full password generator too.

That actually sounds like a really, really good idea. Although... I just started thinking about the possibility of using a microcontroller that had a tiny bit of internal, non-reprogrammable ROM, so I could implement a secure stage-0 loader... lol

meh, that seems like a protection against physical access, if all else is done correctly, and you are screwed at that point.

In other news, I just placed an order for the parts for my prototype, so I'll be putting that together this weekend. Fun thing: If done correctly, it should work with most android phones, as they do understand usb hid keyboards. As a result, final design may end up with a very small lithium battery to allow it to run when connected to a phone that doesn't offer much power. I'll put a blog somewhere and post an update to https://twitter.com/andy_leap as I work on it.

Re: Hackers Prove They Can ‘Pwn’ the Lives of Those Not Hyperconnected

#73

Post by FussyZeus » Fri, Oct 16, 2015, 3:03 AM UTC

downandout wrote: post #66

FussyZeus wrote: post #65

Earlier quoted context omitted.

As I read it, they got that information from her email, and were I a betting man I'd say probably Yahoo or Gmail. They already had her password; getting it from the website would be trivial. This is all my own assumption of course. The underscore here is that a limited use case person, someone who occasionally posts limited things and doesn't do anything beyond casual ebaying can still be a victim.

Yes, they got it from email, but they didn't get into the email until they were in the house and got the password from a post-it note for the main account, and the daughter had the browser auto-fill it. They wouldn't have had either of these without a willing participant that let them into the house to find the information. It's like saying "I was easily able to rob the bank vault after the manager opened it".

You make it sound like achieving remote access to this machine with two dozen malicious programs on it would be difficult. I highly doubt the machine is as hardened as her Facebook is.

The chain is only as strong as it's weakest link.

Re: Hackers Prove They Can ‘Pwn’ the Lives of Those Not Hyperconnected

#74

Post by Vendan » Fri, Oct 16, 2015, 5:44 AM UTC

i336_ wrote: post #69

Vendan wrote: post #59

Earlier quoted context omitted.

Just make something like a usb Rubber Ducky with a couple buttons and a screen. Plug it in, scroll to password, hit "type it", and it types it in. Could probably make one for about $40. Arduino Leonardo, LCD Shield, and the leonardo keyboard libraries. Could even have it as a full password generator too.

That actually sounds like a really, really good idea. Although... I just started thinking about the possibility of using a microcontroller that had a tiny bit of internal, non-reprogrammable ROM, so I could implement a secure stage-0 loader... lol

how about this, as an alternative to going down the route of secure loaders and such.

The firmware that's written to the chip is padded out to (sizeof(flash)-X) with cryptographicly secure random bytes, where X is the size of a crypto signature block, which you use to sign the firmware. When you plug the thing into a computer without the sd card inserted(I plan on storing the password vault on an sd card, correctly encrypted), it dumps all of the flash via keyboard. Pipe that into a program that verifies the signature, via whatever means, and you can ensure the firmware has not been tampered short of hardware modification in the form of adding more flash memory/eeprom, as to do so would require compressing the existing code/cryptgraphically secure padding, as you would need to dump the original out to pass the verification. If you want to be even more secure, you can even replace the existing signature with your own, therefore ensuring that people can't change the version without access to your private key.