Hacking Transcend WiFi SD Cards • Hacker News Board

Re: Hacking Transcend WiFi SD Cards

#11

Post by [deleted] » Sun, Aug 11, 2013, 9:24 PM UTC

q3k wrote: post #2

My experience with embedded systems allows me to be fairly certain that this bugfest is due to an electronics engineer writing the software for the card. Way too often small R&D teams, especially working on new products, have EE people being assigned to part-time-embedded-programmer roles. This is especially scary as some of these teams work on internet-facing pieces of hardware - home routers/gateways, etc. One cool…

[deleted]

Re: Hacking Transcend WiFi SD Cards

#12

Post by bluedino » Sun, Aug 11, 2013, 9:38 PM UTC

brador wrote: post #7

How are these cards powered?

A quick look at the pinout for the cards shows a 3.3v line, so it simply draws power from the host device.

Re: Hacking Transcend WiFi SD Cards

#13

Post by yuhong » Sun, Aug 11, 2013, 9:43 PM UTC

jrockway wrote: post #6

q3k wrote: post #2

My experience with embedded systems allows me to be fairly certain that this bugfest is due to an electronics engineer writing the software for the card. Way too often small R&D teams, especially working on new products, have EE people being assigned to part-time-embedded-programmer roles. This is especially scary as some of these teams work on internet-facing pieces of hardware - home routers/gateways, etc. One cool…

As someone who's written software for all his life, I'll posit that most "software engineers" write code like this. People don't test corner cases; they just shit out code, check that it works in the browser, and ship it. That's why the regexes like /.PNG/ are in there: they work, but they don't prevent the security problems they intend to prevent. If the engineer writing the code had written unit tests that checked…

Ultimately, I'm not complaining, because buggy software is great in the context of devices that try to prevent you from doing something with your own property. I especially encourage people to write their system-level software in C and use lots of strcpy calls. It ensures that I can root my phone even though the carrier doesn't want me to.

Reminds me of claims of deliberate backdoors. Of course, these can often be used for bad things too.

Re: Hacking Transcend WiFi SD Cards

#14

Post by reeses » Sun, Aug 11, 2013, 10:09 PM UTC

q3k wrote: post #2

My experience with embedded systems allows me to be fairly certain that this bugfest is due to an electronics engineer writing the software for the card. Way too often small R&D teams, especially working on new products, have EE people being assigned to part-time-embedded-programmer roles. This is especially scary as some of these teams work on internet-facing pieces of hardware - home routers/gateways, etc. One cool…

There's an old saying I don't hear much these days: never give a software engineer a soldering iron and never give a hardware engineer a compiler.

Re: Hacking Transcend WiFi SD Cards

#15

Post by robinson-wall » Sun, Aug 11, 2013, 10:50 PM UTC

Contrived, sure, but you could use these exploits to upload all files added to the card somewhere, assuming it can find a wireless network to connect to. Maybe even just keep a hidden copy on the part of the FS invisible to the host system if there is enough free space.

"Oh sure I've got an SD card you can borrow..."

Re: Hacking Transcend WiFi SD Cards

#16

Post by minor_nitwit » Sun, Aug 11, 2013, 10:57 PM UTC

Is it possible to stream data to these cards?

Re: Hacking Transcend WiFi SD Cards

#17

Post by seanp2k2 » Sun, Aug 11, 2013, 11:25 PM UTC

I love articles like this. Thanks for posting this; good hacks :)

In the same vein, though I can't find the video for it right now: http://www.khanfu.com/m/plain/29/event/1978 (this was also presented at Defcon 21)

Re: Hacking Transcend WiFi SD Cards

#18

Post by femto » Mon, Aug 12, 2013, 12:39 AM UTC

jrockway wrote: post #6

q3k wrote: post #2

My experience with embedded systems allows me to be fairly certain that this bugfest is due to an electronics engineer writing the software for the card. Way too often small R&D teams, especially working on new products, have EE people being assigned to part-time-embedded-programmer roles. This is especially scary as some of these teams work on internet-facing pieces of hardware - home routers/gateways, etc. One cool…

As someone who's written software for all his life, I'll posit that most "software engineers" write code like this. People don't test corner cases; they just shit out code, check that it works in the browser, and ship it. That's why the regexes like /.PNG/ are in there: they work, but they don't prevent the security problems they intend to prevent. If the engineer writing the code had written unit tests that checked…

Another explanation is that there is no benefit to the manufacturer in writing tighter code. Tighter code means more time spent on testing and review, but probably wouldn't increase sales. From a bottom line point of view, the mantra is get it working and ship it.

Re: Hacking Transcend WiFi SD Cards

#19

Post by Tsagadai » Mon, Aug 12, 2013, 1:08 AM UTC

Thanks for posting. I love articles like this which follow the thought processes of someone trying to hack a device. Keep 'em coming!

Re: Hacking Transcend WiFi SD Cards

#20

Post by ars » Mon, Aug 12, 2013, 1:37 AM UTC

"Perl has a nice feature when opening a file with the open() library call, because it not only opens files, but runs programs if the file path is not a path, but a shell command ending in a pipe."

I thought only PHP did things like that :)

I hope this is disabled in mod_perl? Because if not I need to let someone know they need to audit their code.

PS. I get how useful this is, and it's well documented, but this functionality should be in the ancillary function (i.e. used when needed), not in the default one.