Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hacking Transcend WiFi SD Cards

haxit.blogspot.com

Post reply on HN
Print view View original

1–10 of 58 posts

Re: Hacking Transcend WiFi SD Cards

#2

Post by q3k »

My experience with embedded systems allows me to be fairly certain that this bugfest is due to an electronics engineer writing the software for the card. Way too often small R&D teams, especially working on new products, have EE people being assigned to part-time-embedded-programmer roles.

This is especially scary as some of these teams work on internet-facing pieces of hardware - home routers/gateways, etc. One cool weekend project to have is trying to get hold of an image of the firmware of your home router, run binwalk on it, try to extract the filesystem, and count the number of remote exploits you can spot in the CGI perl scripts (like they are, in 99% of the cases) found there. Yet another reason to run OpenWRT ;).

Re: Hacking Transcend WiFi SD Cards

#3

Post by jtchang »

This is awesome. A few years back I originally wrote an open source EyeFi server in Python (http://returnbooleantrue.blogspot.com/2009/04/eye-fi-standal...). I could not actually hack into the card though and get root which is what I really wnated.

These memory cards are super fun and I've been meaning to pick another up to give it another go.

Re: Hacking Transcend WiFi SD Cards

#5

Post by q3k »

jtchang wrote: post #3

This is awesome. A few years back I originally wrote an open source EyeFi server in Python ( http://returnbooleantrue.blogspot.com/2009/04/eye-fi-standal... ). I could not actually hack into the card though and get root which is what I really wnated. These memory cards are super fun and I've been meaning to pick another up to give it another go.

We use your eyefi server at our local hackerspace (hackerspace.pl). I haven't really touched the card myself (the setup was done by a fellow hacker), but I'll probably take a look at it some day, if there is at least some vague promise of RCE hidden somewhere.

Thank you for your great piece of software.

Re: Hacking Transcend WiFi SD Cards

#6

Post by jrockway »

q3k wrote: post #2

My experience with embedded systems allows me to be fairly certain that this bugfest is due to an electronics engineer writing the software for the card. Way too often small R&D teams, especially working on new products, have EE people being assigned to part-time-embedded-programmer roles. This is especially scary as some of these teams work on internet-facing pieces of hardware - home routers/gateways, etc. One cool…

As someone who's written software for all his life, I'll posit that most "software engineers" write code like this. People don't test corner cases; they just shit out code, check that it works in the browser, and ship it. That's why the regexes like /.PNG/ are in there: they work, but they don't prevent the security problems they intend to prevent. If the engineer writing the code had written unit tests that checked various filenames, he would have discovered the bug immediately. If there were code reviews by someone who knew even the tiniest bit of Perl, the `$user_controlled_command > file` bug would be gone. If the programmer had run Perl with taint mode enabled, he would have discovered this bug instantly.

I think it's a mental thing: most people writing code never think "how could this go wrong", since they assume that they don't make mistakes. If you don't have a healthy fear of the code you write, you're not going to test the corner cases or not write complex features.

Ultimately, I'm not complaining, because buggy software is great in the context of devices that try to prevent you from doing something with your own property. I especially encourage people to write their system-level software in C and use lots of strcpy calls. It ensures that I can root my phone even though the carrier doesn't want me to.

Re: Hacking Transcend WiFi SD Cards

#10

Post by voltagex_ »

q3k wrote: post #2

My experience with embedded systems allows me to be fairly certain that this bugfest is due to an electronics engineer writing the software for the card. Way too often small R&D teams, especially working on new products, have EE people being assigned to part-time-embedded-programmer roles. This is especially scary as some of these teams work on internet-facing pieces of hardware - home routers/gateways, etc. One cool…

I can attest to the low quality of router firmware, go grab the source from Billion or Netgear and have a look.

Homework question: What's running on your blu-ray player?

Post reply on HN