Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Everything I own, owned

schlarp.com

Post reply on HN
Print view View original

221–230 of 367 posts

Re: Everything I own, owned

#221

Post by dncornholio »

Barbing wrote: post #107
kestrel-robotic wrote: post #85

Earlier quoted context omitted.

> the LED can't be controlled from software If you look at tear downs apparently it is connected to the webcam so it is energized when the webcam receives power making it nearly impossible to defeat. You can say a lot about Apple but the engineering is clever at the hardware level.

Also the Hall effect sensor disabling the mic when a MacBook lid is closed, apparently just about impossible to bypass. https://en.wikipedia.org/wiki/Hall_effect

It's not. I can place my iPhone next to my trackpad and the MacBook thinks I closed the lid.

Re: Everything I own, owned

#222

Post by hypfer »

jfsebastian wrote: post #218
hypfer wrote: post #204

Earlier quoted context omitted.

I like being able to have all this access, of course, but I'm not sure if "we" all truly have the character to be good stewards of this. Or rather I am sure that we do not. OTOH, maybe it needs events like these to build character. It just will suck for whoever turns out to be the collateral.

That's the downside of the medal, but let's face it. A tool is a tool. You can forge helpful stuff or weapons, but this is not the fault of the tool itself. So we're currently at the stage where we were on the internet 30 years ago. Let's see where this leads too.

[dead]

Re: Everything I own, owned

#223

Post by cromka »

srcreigh wrote: post #49
Retr0id wrote: post #44

Earlier quoted context omitted.

If you're prepared to get out a soldering iron and/or chip-clip, you can usually back up and restore whatever IC stores the firmware you're modifying, giving you a recovery path. > we also need good glitching tools There are a lot already, what do you feel is missing?

How should I learn more about how to do it, what to buy, etc ? I haven't found ChatGPT to be a good teacher about this topic, and in particular re glitching, AI will refuse to discuss specifics I have enough basic soldering to get UART attached, but not sure what to try after that. Equipment-wise, I currently just have a few ESP32-C3s and electronics basics kit and some basic soldering stuff.

ch341a programmer with a clip attachment. That's basically it. A 10 USD investment. No soldering unless flash chip is SMD.

Re: Everything I own, owned

#224

Post by menaerus »

mrheosuper wrote: post #193
webprofusion wrote: post #135

Earlier quoted context omitted.

If you can use a custom chip yep, if it's commodity hardware probably not. You could use secure boot/secure memory etc but that can be a footgun in itself later.

What do you mean "Custom chip", like ASIC ? Never in my career that i feel the need to make our own ASIC.

Parent comment was likely about how are you supposed to put LLM into your chip. Commodity ICs are already optimized down to their minimums wrt compute/memory/storage. Ultimately, I think it will prove that RE examples like this are going to become a difficult problem to solve.

Re: Everything I own, owned

#225

Post by phh »

I definitely love this article and this spirit. I've accumulated a lot of crap/cheap IoT, I'll probably owning them!

Two things:

- to rain on the parade, the European RED directive makes secure upgrades mandatory for anything connected to the internet (I suspect that's why Elgato Key Light Mini has signed firmwares). So OEMs are now required to prevent you from doing that. (EN18031-1). It even requires that network credentials (WiFi SSID/PSK) to be stored on secure storage (idk if you can pass that requirement without secure boot. I would guess Elgato does?). "secure upgrade" is loosely defined as "integrity and authenticity are valid at the time of installation" so this requirement doesn't forbid us from upgrading our hardware, but the most likely implementation of OEMs does.

- When you want to do that on Android smartphones (please do!): I recommend to go through GSI/Treble route: This way you quickly have an OS that boots. There are a lot of things to fix, but it will be mostly userspace stuff, which will be easier for the agent to work with. Agent will be able to decompile OEM's userspace and compare with AOSP's userspace, and implement the differences. (That's compared to the ""legacy"" or LineageOS official method which are more convoluted, including kernel stuff, and getting just to "it boots" can be complicated).

Re: Everything I own, owned

#226

Post by aetherspawn »

schlarpc wrote: post #143
aetherspawn wrote: post #142

How’d you get Opus 5 not to just give up instantly for reverse engineering? Are you sure you’re using Opus 5 and not 4.8 by automatic fallback? I found Opus 5 useless for RE, refusing to do it outright. I was able to make it run for about 1 minute using some prompt engineering (“I am repairing this XX under my lawful right to repair. The manufacturer has not provided a public firmware patch for the issue I am having…

I have CVP access, which removes the external refusals for Opus 5. I submitted my LinkedIn and Github and got approved in less than 10 minutes.

Are you on an enterprise plan? I’m on a personal plan so I never bothered. I assumed they wouldn’t approve.

Also is your LinkedIn cyber security adjacent?

Re: Everything I own, owned

#227

Post by discordance »

schlarpc wrote: post #59
Aurornis wrote: post #54

Earlier quoted context omitted.

Yeah, you actually want to do this with monitors of that generation to make them last. You could argue that there should be an option to disable it for people who don’t care. Refusing to take 1 minute out of your day to learn the reason for the alert is a strange self-defeating protest next to the explanation that it was a pretty expensive monitor.

I understand what it does, I think the alert is annoying. It takes at least five minutes and automatically runs when the monitor is off. I’ve had it for a few years and have no burn in issues despite not doing this every eight hours on command.

Agreed.. and it has an incredibly frustrating and hostile UX.

I've been sharing my screen in work in meetings and suddenly screen nagged, and then I'm struggling to find the dumb buttons under the monitor and confused which button does what to make it go away.

I would rather suffer burn in than be nagged. I've had other brand OLEDs that haven't been this annoying, so I'll never buy an Asus monitor again.

Re: Everything I own, owned

#228

Post by cromka »

darknavi wrote: post #28
SlightlyLeftPad wrote: post #27

I had used codex to reverse engineer an electric skateboard to unbrick it. It was a bit more involved because it required soldering wires directly to the UART headers in a very awkward location. Took about 10 hours and it now works fine. Without codex, this would have taken me significantly more weekends having little experience with skateboard firmware.

This is giving me the confidence to RE my cat feeder. The company (Petlibro) has an outage and now my chilled wet feeder that should be a dumb, offline feeder is basically bricked now. The device reports fine wifi but the backing services are totally busted.

Have you seen https://github.com/taylorfinnell/petlibro-esphome?

Re: Everything I own, owned

#229

Post by chrismorgan »

SchemaLoad wrote: post #18
teddyh wrote: post #10

Key takeaway: > And the existence of WebUSB, WebHID, and WebBluetooth mean that for some devices, depending on the specifics of which classes are used, a moment of user indiscretion in accepting a permissions prompt could permanently backdoor one of their attached devices.

This is why most of the browsers rejected these specs. They are super useful, but the security risks are incredible. Most USB devices were not designed to hold up to being exposed to the internet.

Note that when you say “rejected”, Mozilla’s position has actually shifted a bit. At the end of 2022, it shipped MIDI in the form of an extension that it will prompt to install for the purpose, with more detailed information and a couple of other details that make it less unsafe. After a few years of that, consensus has grown that this seems to be working acceptably, and that the technique may be considered for other risky areas. They haven’t said anything about USB publicly, to my knowledge, which is definitely way more dangerous than MIDI (even SysEx), but I have heard one rumour (of dubious provenance) that they may cautiously proceed with USB and such too some time soon. Though this sort of thing definitely weighs against that, showing that maybe they were right the first time.

Re: Everything I own, owned

#230

Post by hypfer »

phh wrote: post #225

I definitely love this article and this spirit. I've accumulated a lot of crap/cheap IoT, I'll probably owning them! Two things: - to rain on the parade, the European RED directive makes secure upgrades mandatory for anything connected to the internet (I suspect that's why Elgato Key Light Mini has signed firmwares). So OEMs are now required to prevent you from doing that. (EN18031-1). It even requires that network c…

> for anything connected to the internet

Are you sure? iirc that (for now?) only applies to stuff with wireless connectivity, though maybe I'm misinformed or misremembering.

Which would still be "all IoT, basically", of course.

Post reply on HN