Live data from Hacker News

Hacking Transcend WiFi SD Cards

haxit.blogspot.com

41–50 of 58 posts

Re: Hacking Transcend WiFi SD Cards

#41
post #20

"Perl has a nice feature when opening a file with the open() library call, because it not only opens files, but runs programs if the file path is not a path, but a shell command ending in a pipe." I thought only PHP did things like that :) I hope this is disabled in mod_perl? Because if not I need to let someone know they need to audit their code. PS. I get how useful this is, and it's well documented, but this funct…

I believe it's enabled under mod_perl. If that someone was allowing user input to make it to an open, system, or back tick call unfiltered then this is just one thing to worry about. It's as bad or worse than taking unfiltered input and building an SQL query with it. Moreover, this isn't a Perl issue. I can think of ways to do similarly I'll advised things with C#'s process.start or C/C++'s System command.

I don't know what they did, it's not my code, but they are not experienced and I suspect they don't know to watch out for this.

> Moreover, this isn't a Perl issue. I can think of ways to do similarly I'll advised things with C#'s process.start or C/C++'s System command.

Obviously every language has ways to cause this. It's just that open is the default command. This extra functionality should be in a openshell command or something, and the regular open not have it. (And yes I'm aware it's way too late to change it.)

Re: Hacking Transcend WiFi SD Cards

#45
post #29

> After navigating the filesystem and downloading scripts, it is obvious, and not surprising, that this system is using busybox... Does anyone know whether Transcend provides source code [0] upon request? The EULA in the user manual for the product [1] mentions that it might contain "GPL Components", but I could not find any additional details. [0]: http://www.busybox.net/license.html [1]: http://www.transcend-info.c…

There is a >50 MB "GPL download" on the Transcend website. So I guess they are at least partially complying with it.

Re: Hacking Transcend WiFi SD Cards

#46
post #45
post #29

> After navigating the filesystem and downloading scripts, it is obvious, and not surprising, that this system is using busybox... Does anyone know whether Transcend provides source code [0] upon request? The EULA in the user manual for the product [1] mentions that it might contain "GPL Components", but I could not find any additional details. [0]: http://www.busybox.net/license.html [1]: http://www.transcend-info.c…

There is a >50 MB "GPL download" on the Transcend website. So I guess they are at least partially complying with it.

Do you have a link? The only GPL-related download I could find was for their RecoveRX data recovery software: http://www.transcend.de/products/RecoveRXTool/GPL.asp

Re: Hacking Transcend WiFi SD Cards

#47
post #22

Earlier quoted context omitted.

Java. Oh, don't worry, that's like totally secure. [tries to keep straight face, fails utterly]

I really should start blogging - one of my many unfinished projects is a teardown and reverse engineering effort of a Philips BD player. Java isn't even the half of it.

I really do hope you consider writing that blog post. Everyone here, and on several other sites, would love to read the trials and tribulations of hacking something like a BD player. :) Even if its just a quick run down with some pictures and a little story, it would be worth it.

Re: Hacking Transcend WiFi SD Cards

#48
post #9

this was posted to /r/netsec too, the conversation here has more details about the embedded system: http://www.reddit.com/r/netsec/comments/1k4zhz/i_rooted_my_t...

Googling the hardware name from /proc/cpuinfo, "KeyASIC Ka2000 EVM", I found out that this isn't the first person to hack into these half-SD-half-WiFi cards: http://colas.sebastien.free.fr/index.php/category/transcend-... http://blog.toshikatsu.tanimula.net/2013/03/aircard.html http://lemoidului.wordpress.com/2013/02/11/linux-is-everywhe... etc. etc.

I don't read French or Japanese but even the shell outputs are interesting reads.

Post reply on HN