Can you get root with only a cigarette lighter? (2024)
da.vidbuchanan.co.uk
da.vidbuchanan.co.uk
- It also works on LPDDR5, LPDDR4
- Yes, it works on ARM platforms (at least, the ones I tried).
- The simplest way to trigger similar faults electronically is via a high-speed mux IC, as described in https://stefan-gloor.ch/ddr5 (chipshouter also works, but is less elegant imho!)
- Yes, you can get webkit addrof/fakeobj primitives like this, although I didn't write an end-to-end exploit.
- You can pwn nintendo switch kernel with an adjusted exploit strategy, but the same adjusted strategy does not work on Switch 2, due to memory encryption (one bitflip corrupts a whole cache line). But other strategies may be possible? (notably, it is possible to block a whole write operation from happening at all - see also https://rdist.root.org/2010/01/27/how-the-ps3-hypervisor-was... )
Edit: Nailed it!
It's not like you can randomly spike stuff and achieve an exploit
No idea who discovered it, but the machine back at my school had an infrared interface for servicing, and you could trigger an interrupt with the flash of the flintstone of a lighter. Because it's just some 90s microcontroller, it would simply reset after failing to receive a valid command and forget what it was doing previously.
All you had to do was order a coke, and right when it drops out, before it subtracts the amount, you flash the lighter in front of the IR port like a magician, say the magic words and bam - free coke!
And the payphones in the city I grew up in didn't operate using ground-start signalling, so the paper clip/safety pin/pull-tab/static trick didn't work there at all.
But an innocuous walkman with a cassette tape that had some red box tones on it, with a bonus of having the rest of the cassette available for music to listen to? That worked great.
I'm old enough to remember payphones being completely ubiquitous (with whole banks of them inside of each entrance for one large department store, usually with one or two more outside), but I'm not old enough to remember the 1950s. :)
I did find one old phone at a state park not too far out that could be tricked by grounding it, but that was in GTE territory instead of the Ohio Bell BOC that I was more familiar with.
Just hold the sysadmins hand over the lighter until they tell you the password.
Never forget the easy way in ... the humans.