Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tomu, a tiny ARM microprocessor which fits in your USB port

tomu.im

Post reply on HN
Print view View original

41–50 of 91 posts

Re: Tomu, a tiny ARM microprocessor which fits in your USB port

#41

Post by abc456879 »

ggm wrote: post #6
jacob019 wrote: post #5

also great for espionage

well.. I'd probably disable the flashing LEDs. But, that aside, I too thought "oh cool... a complete ARM system in my USB.. what could possibly go wrong here" But, the other side of this is: this is precisely what every closed-box USB device I plug into my USB potentially IS. This is just the overt "hi I'm an awesome tiny computer" state we're actually living in, all the time TL;DR how do we know we aren't exposed to…

This is exactly what the vast vast majority of the world hasn’t realized. ARM has made almost EVERYTHING a tiny computer, where tiny == early 90s desktop computers or better. I’m frightened and excited for what happens when the world catches up.

Re: Tomu, a tiny ARM microprocessor which fits in your USB port

#42

Post by abc456879 »

tomcam wrote: post #39
abc456879 wrote: post #38

Zzzz... oh sorry just waiting for something in the microcontroller space somewhat innovative

No one is stopping you from doing it, bro. Beats pissing on someone else’s accomplishment.

Insert defensive Hackernews “don’t put something down because it’s posted on hackernews and that it’s on the front page is justification of its merit.” Zzzz

Naw, this is rubbish. And, for what it’s worth, why do you assume I’m a bro?

What’s posted in this article is an accomplishment in so much as doing something is an accomplishment. Hint, it’s not. Congratulations, you did something, pat on the back. Good job!

Re: Tomu, a tiny ARM microprocessor which fits in your USB port

#43

Post by abc456879 »

tomcam wrote: post #39
abc456879 wrote: post #38

Zzzz... oh sorry just waiting for something in the microcontroller space somewhat innovative

No one is stopping you from doing it, bro. Beats pissing on someone else’s accomplishment.

Ah yes, flag me for disagreeing, but using no profanities and challenging the group think of a front page Hackernews post

Re: Tomu, a tiny ARM microprocessor which fits in your USB port

#44

Post by ecesena »

dtornabene wrote: post #3
utopcell wrote: post #2

Neat little device, looks like a Yubikey clone. One could get a similar device by hacking a Logitech unifying receiver, which contains a ..16MHz 8051 clone in it, and a radio to spare.

thats ultimately the intent, to build a Yubikey-like security key, with everything open down through the firmare to the details of the soc

If size doesn't matter, U2F Zero [1] is an open u2f security key. And we're about to unveil the upgrade to fido2...

Edit: added link

[1] https://u2fzero.com

Re: Tomu, a tiny ARM microprocessor which fits in your USB port

#45

Post by ecesena »

askvictor wrote: post #25

Hold on - doesn't having this live permanently in the USB port reduce the security possible with a 2FA device? If the user has to get the key from their pocket and plug it in, it will at least prevent an attacker from accessing the user's account in a remote-desktop scenario. Certainly the requirement to press the button will mitigate this risk to a degree, but might there be exploits that can trigger this button-pre…

I'd say it depends on the security model. I have a yubikey nano permanently in my mac, I use it for example for vpn. Of course, I don't use it to unlock my mac, and I have a pretty long passphrase for that (and an apple watch to make it easier).

For 2fa in my own gmail/facebook, I use external keys, similarly as you're saying. But I could be comfortable using this yubikey, it's just that one is personal, the other is work in this case.

Re: Tomu, a tiny ARM microprocessor which fits in your USB port

#46

Post by gh02t »

qop wrote: post #35
askvictor wrote: post #25

Hold on - doesn't having this live permanently in the USB port reduce the security possible with a 2FA device? If the user has to get the key from their pocket and plug it in, it will at least prevent an attacker from accessing the user's account in a remote-desktop scenario. Certainly the requirement to press the button will mitigate this risk to a degree, but might there be exploits that can trigger this button-pre…

Don't you think they'd have thought that through? I admire your diligent concern, but I thought the same thing for a split second and dismissed it. I can't imagine even a corporate churn machine with the most reckless abandon designing a device like this and missing the most basic obvious attack vector. Well, anyways....

It might be possible if you find a hardware or software bug in the USB interface on the chip, but the Yubikey uses a chip designed specifically for security applications. Those sorts of chips are designed and tested explicitly for security applications are tested for all sorts of attacks and and exploits, both physical and in software. I doubt it's even physically possible to craft a USB packet that is able to interfere with the ADC on the chip enough to look like a touch event, but even if it was it'd be exceedingly difficult due to the nature of how USB signaling works. You don't have much direct control at the electrical level of what actually goes down the wire.

Re: Tomu, a tiny ARM microprocessor which fits in your USB port

#47

Post by TickleSteve »

colemannugent wrote: post #8
dtornabene wrote: post #3

Earlier quoted context omitted.

thats ultimately the intent, to build a Yubikey-like security key, with everything open down through the firmare to the details of the soc

At some point won't you run into IP issues with the ARM SoC? Plus how would you deal with things like power analysis attacks that require modifying hardware to fully mitigate?

ARM IP is bought by the manufacturer of the device, in this case Silicon Labs.

What IP issues can you imagine happening considering ARM SoCs are the most widespread processors in existence with many, many different manufacturers?

Regarding side-channel attacks such as you mention, all processors are subject to this vulnerability to various degrees. Do not expect a project such as this to have any mitigation for that type of attack.

Re: Tomu, a tiny ARM microprocessor which fits in your USB port

#48

Post by ReverseCold »

ateesdalejr wrote: post #24
tlrobinson wrote: post #13

Earlier quoted context omitted.

A Yubikey clone where you have to tap out a passcode (morse code style) might be neat.

I would be concerned about the inherent audio security issues that solution might have...

Require both the physical device and the tap code, mabye.

Re: Tomu, a tiny ARM microprocessor which fits in your USB port

#50

Post by DarkWiiPlayer »

ateesdalejr wrote: post #24
tlrobinson wrote: post #13

Earlier quoted context omitted.

A Yubikey clone where you have to tap out a passcode (morse code style) might be neat.

I would be concerned about the inherent audio security issues that solution might have...

Maybe apply some pressure instead of tapping? Same effect, but with less sound, so you'd need a really good mic, or something crazy like pointing a laser at the device/hand, and if that's the kind of attacks you're facing, you don't go for a device that costs 30$ xD
Post reply on HN