Hacker News Reader

Comment by uticus | Hacker News Reader

> Now the exploit was rewritten to read memory, and blink out the contents using the LCD backlight. A LEGO construction was built and a webcam would register the binary stream of a few megabytes of memory contents. Slooooow.

It both amazes me and cracks me up how exploits are accomplished. Given enough time and determination...

View on HN

IIRC they used a variation of this a second time on a newer model of iPod. They found a way to trigger the click speaker, wrote a program to dump the ROM via the clicker Morse code style, and left it sitting next to a microphone in a foam lined box for a few days.

You would probably appreciate this clip [0] from the AMC show Halt and Catch Fire where the character reads out the entire firmware from an IBM PC using lights.

[0] https://youtube.com/watch?v=jSZwtrnKxf4

Couldn't even make it through the whole thing it's so cringe.

Checking voltages and they have a sine wave on the oscilloscope lol.

You could just read out the whole rom contents quite easily with whatever computer you had handy.

There was no read back protection or scrambling - You give it an address and read out the bytes

Also IBM put a listing of the BIOS ROM in the PC technical reference manual so none of this was necessary to begin with.

A character in Cryptonomicon did something similar, using the lights to blink out morse code so he could gain information without his captors realizing it.

There’s virtually nothing in that clip that is factual and it’s not internally consistent. There would be no mystery about which chip is the BIOS, it’s not even self consistent with the claim of it being “off the shelf” junk. You could just dump the thing. And even if you couldn’t, 7 segment displays and other niceties were available. The oscilloscope stuff has no basis in reality.

HCF is a fine series with good storytelling, but the technical stuff is all window dressing and should not be examined too closely or confused with the real deal.

I went for some "security training" with a grayhat once for a company I was developing for. He showed me his SQL injection script that exfiltrated the remote DB by using pauses in the SQL query depending on each letter of the table names/col names/etc. He had a script that would just keep firing blind queries through a textarea and recording the delay before the page returned.

Blind SQL injection is what I’ve heard this called, if anyone wants to read more. I used this concept to exfiltrate sensitive material from our database using PgHero’s analyze feature for an in-house incident response workshop once.

Thank you, I never knew if it had a name.

https://owasp.org/www-community/attacks/Blind_SQL_Injection

I'm struggling to understand.

I can understand how a timing attack would reveal enough details to differentiate between data being touched (but not expected to be returned).

But I can't understand how this would cause SQL injection... do you mean it's a way to perform unauthorized queries, or do you mean data-altering statements could also be executed?

Sibling poster knew the name for it:

https://owasp.org/www-community/attacks/Blind_SQL_Injection

It's really cool how they did this and not to diminish it in any way, but this is really a form of bit banging that a lot of devs already understand how to do.

Reply on news.ycombinator.com