Earlier quoted context omitted.
Was it made in China?
Aren't virtually all SBCs made in China?
I was referring to Board Support Packages
How I discovered a hidden microphone on a Chinese NanoKVM
121–130 of 138 posts
Re: How I discovered a hidden microphone on a Chinese NanoKVM
#122Earlier quoted context omitted.
I can't recall seeing any server that includes KVM-over-IP, but instead they have some shitty remote access controller (e.g. Dell iDRAC) that is buggy as hell and requires a subscription to even get working.
Supermicro boards have it via the IPMI Ethernet port. Doesn't require any sign up.
That sounds good - I thought they required a license key to get working.
(However, IMPI is a security nightmare with backdoors, default passwords and weak encryption)
Re: How I discovered a hidden microphone on a Chinese NanoKVM
#123These days tbh I'm just assuming every device I purchace has a microphone for one of the completely unwanted 'assistants'.
Re: How I discovered a hidden microphone on a Chinese NanoKVM
#124Why is this article trending again?? The NanoKVM is showcase product for the LicheeRV Nano. A built-in microphone is an advertised feature of that board.
I like Matej's work, especially his GSM stuff, but this article is so overblown. A third are known issues and another third are non-issues. The last third was good security work and I genuinely appreciate he did it. Beat me to it by a feew weeks, since my order was stuck in customs while I tried to explain to them what a KVM was...
Re: How I discovered a hidden microphone on a Chinese NanoKVM
#125Earlier quoted context omitted.
They mean the K in KVM could trivially have a keylogger. For the computers attached to that KVM. Audio is for logging for computers not attached to the device in question. Which could be up to and including a whole server room save a couple machines.
What would you be able to get from the noise of loads of servers in a room where no-one is using a keyboard?
The conversations of server goblins ofc. Gotten listen in on the little gnomes inside the racks.
Re: How I discovered a hidden microphone on a Chinese NanoKVM
#126Earlier quoted context omitted.
One really-cool way to solve that problem is to embed a 7-segment LED under each keycap. You walk up to the keypad and the 0-9 digits appear in random order. No one can shoulder-surf, look for wear or IR emission from the buttons, or train on the click sounds. Dell had those on every lab door in the building back in the early 90s. You felt like 007 every time you punched in your access code. I've never seen them anyw…
And now days I can't put in my card's pin without 10 overhead cameras aimed at the register area. All the cameras of which are network-connected, video stored persistently, and high res/fidelity enough to here the little beeps as I press the keys, and to know that I've hit the enter because the screen indicates it immediately. But then Dell cared about its own security, and the grocery store doesn't give a single shi…
Contactless doesn't need a PIN, and indeed if it's looking for one that's a good indication that the card reader is compromised and skimming.
Re: How I discovered a hidden microphone on a Chinese NanoKVM
#127 * Includes a microphone? Look at the datasheet of the devboard they used, dummy.
* Running everything as root? Valid point. That's a inexcusable mistake and has been for ever a sign of laziness and ignorance.
* Not including systemd? Yes please.
* Not including a package manager the author nows? Shows the authors ignorance to assume apt would be found on a small embedded system.Re: How I discovered a hidden microphone on a Chinese NanoKVM
#128> For instance, a security researcher even found an image of a cat embedded in the firmware.
How can the article not include this picture or at least link to it. Internet, today you have disappointed me.
Re: How I discovered a hidden microphone on a Chinese NanoKVM
#129Thanks to everyone for following the discussion on NanoKVM security. I think most of you will know exactly what to make of this article the moment you read the complaint that it 'runs a heavily stripped-down version of Linux that lacks systemd and apt.'
Most of the claims in the article are not real vulnerabilities. Some harmless behaviors were indeed easy to misinterpret if viewed with bias, but we actually changed those behaviors and implementations over 10 months ago. It is surprising to see this article coming out today instead of last year.
As for the onboard mic, it is not 'hidden.' It is a component that has been clearly documented and explained in our Wiki: https://wiki.sipeed.com/hardware/en/kvm/NanoKVM/introduction... We believe open source lets the facts speak for themselves. Thanks to the NanoKVM community for using your technical common sense to help clear this up!
Re: How I discovered a hidden microphone on a Chinese NanoKVM
#130Earlier quoted context omitted.
They mean the K in KVM could trivially have a keylogger. For the computers attached to that KVM. Audio is for logging for computers not attached to the device in question. Which could be up to and including a whole server room save a couple machines.
What would you be able to get from the noise of loads of servers in a room where no-one is using a keyboard?
I think I’m thinking of old school kvms you attach a laptop to instead of VNCing into.