In 2007/2008 I built a InfoPanel for my apartment to show me news, the weather and other interesting and fun things. The original InfoPanel was built using a VIA x86 micro ITX board and a 17" touchscreen all fitted in a self made wooden case. The InfoPanel survived until 2012 when I moved to the U.S. It was too old and too big to bring so I dismantled it.
I always missed it and thought about brining it back. For a brief time I used an old Samsung Galaxy Tab 10" but the device was just not right. Starting with a proprietary Samsung USB connecter that didn't allow for nice looking cabling, the device was black and silver so it didn't look too nice on the wall and finally the device was just old and slow. Long story short it only stayed on the wall for a couple of weeks and I just ran a full screened web browser.
The new InfoPanel
Hardware: Android 10" tablet in a white case with a USB connector on the long side.
Software: custom Android app that hides the Android navigation elements and status bar.
I chose a Yellyouth Android 10" tablet, those tablets are damn cheap (just under $100) but also kinda tricky. The good parts: 4GB ram and a fast processor. The tricky parts: The product description says the resolution is 2560x1600 my device reports that resolution in the system infos but the screen reports 1216x800 pixels. The device does not contain any sensors such as a light or proximity sensor (you will see why that matters later). The GSM modem does not support T-Mobile/AT&T SIM cards, I thought this was a joke but I tried a Google Fi data-only SIM (T-mobile) and the device couldn't connect to any network (this is fine since I only use WiFi).
I wrote a small Android application that basically shows a full screen webview. I've added a back and reload button to allow returning to the main page from links I clicked. The application hides all system UI (navigation and status bar). The user can swipe from bottom to top or top to bottom to reveal the back and reload buttons. The buttons auto hide after a short timeout. A really basic Android app!Result
I wanted to conserve power and turn of the screen when I'm not using the InfoPanel. Luckily saving power is a default function of Android (you can just set the inactivity timeout after which the screen will be dimmed and eventually turned off).
The catch: how do I turn the screen back on (without pressing the power button - since that is not super practical!)?
- Motion detection using the camera: several projects exist and I've got it integrated but was not able to get it working while the screen was off (I also didn't want so spent a lot of time on this part)
- Motion detection using the light sensor: I implemented this using a Nexus 7 tablet, a background service monitors the sensor and wakes up the device once it detects a significant change in brightness - sadly the Yellyouth device does not have a light sensor.
- Audio activation: the idea is to monitor the ambient noise and wake up the tablet when there is a loud noise (finger snap or clap), I implemented this using a background task that records audio and discards the content and only monitors the amplitude (there is a built-in method in the SDK to query the amplitude!)
All in all a fun weekend/evening project of a few hours.
I finally had time and a use case to build this idea that I had some years ago. The idea is pretty simple. I wanted to have a USB flash drive that is network connected to allow adding files remotely while the drive is connected to a device such as a SmartTV. Basically this would allow any device that is capable of reading files from USB flash drive to have access to data stored on the network.
For the first version of this project I used a Raspberry Pi Zero W. The PiZW comes with a USB OTG port, Wifi, and runs of a mini SDcard. So we have USB client (to emulate a USB mass storage device), Wifi (for network connectivity), and the SDcard for the actual storage.
The current implementation basically is a small linux system that takes up a tiny part of the SD card, the rest of the SD card is used to emulate the USB flash drive. The linux system automatically connects to my WiFi network. You can transfer files to the SD card via SCP. The trick of the system is that you can soft plug and un-plug the USB drive via SSH. This means you simply run a command to enable or disable the mass storage emulation, this will look like an plug or un-plug event to the device the PiZW is connected to.
I used Buildroot for this project, I created a repository that allows you to build this entire device for yourself. My Buildroot repository contains all the scripts and settings to enable USB OTG and device switching. The repository can be found here: github.com/crmulliner/usbnetstore.
After finishing this project I found the SanDisk Wireless Stick basically a USB flash drive with built-in Wifi. Sadly it turns out you can't switch between WiFi and USB using their app (it comes with a mobile app). This means as long as it detects a USB connection it will not allow Wifi Access. Therefore, the SanDisk device is not sufficient for my use case.
My SanDisk Wireless Stick also stopped charging after a week or so (and thus became a brick). I disassembled it and found that the storage is provided by a SD card. The device is actually made by AirStash and sadly does NOT run Linux and therefore is not easily modifiable.
Below some pictures of this project:
One USB connector for power and one USB connector for the flash drive.
I'm now working on the second version of this project.
It has been a while since I wrote anything on this blog (October 2017 to be specific) and it will be a bit until I start doing blog posts on a regular basis again. This has multiple reasons. First, I'm not doing the mobile security update anymore since I have kinda stopped working in mobile security space. Second, I'm working on super fun things at the moment and therefore don't have time or energy to work on side projects. Some in progress long term projects will be continued. Third, I will likely attend fewer conferences this year since I'm spending time on different aspects of security research.
I will likely blog about random things every now and then.
I wrote an article for the Parallax about the security of third party Android app stores.
PacSec Nov 1-2, Tokyo, Japan. Grandma's old bag, how outdated libraries spoil Android app security by Marc Schoenefeld. When encryption is not enough: Attacking Wearable - Mobile communication over BLE by Kavya Racharla. The Art of Exploiting Unconventional Use- after-free Bugs in Android Kernel by Di Shen.
DeepSec Nov 14-17, Vienna, Austria. Normal Permissions In Android: An Audiovisual Deception by Constantinos Patsakis.
Black Hat Europe 2017 Dec 4-7, London, UK. ATTACKING NEXTGEN ROAMING NETWORKS by Daniel Mende, Hendrik Schmidt. ATTACKS AGAINST GSMA'S M2M REMOTE PROVISIONING by Maxime Meyer. BLUEBORNE - A NEW CLASS OF AIRBORNE ATTACKS THAT CAN REMOTELY COMPROMISE ANY LINUX/IOT DEVICE by Ben Seri, Gregory Vishnepolsky. DIFUZZING ANDROID KERNEL DRIVERS by Aravind Machiry, Chris Salls, Jake Corina, Shuang Hao, Yan Shoshitaishvili. HOW SAMSUNG SECURES YOUR WALLET AND HOW TO BREAK IT by HC MA. INSIDE ANDROID'S SAFETYNET ATTESTATION by Collin Mulliner, John Kozyrakis. JAILBREAKING APPLE WATCH by Max Bazaliy. RO(O)TTEN APPLES: VULNERABILITY HEAVEN IN THE IOS SANDBOX by Adam Donenfeld.
Quick conference review: both 44con and ekoparty were great. Ekoparty was especially awesome since I got to check the last continent off my list. Also the size of ekoparty was way beyond what I was expecting. They managed to have a really good conference that is professionally run while stilling maintaining the vibe of a hacker / underground con <3
Two weeks ago there was a post on Medium about two companies that provide a mobile identification service. That service basically can be used to convert your phone's IP address into real information about the owner of the phone (the contract owner). This is done via APIs that are provided by multiple Mobile Network Operators (such as AT&T). The medium article linked to demo pages of those two service providers (payfone and danal inc) that show not only your phone number but also your operator's name, your name and address.
I played with the two demo sites for a bit (while they were still online - offline now). I'm on Google Fi with a number proted from T-Mobile (pre-paid). Payfone only had my phonenumber and old carrier (T-Mobile) while Danal inc showed no data at all. I never provided any data to T-Mobile since it is not required for a pre-paid card. Google has all the data but likely does not share it with 3rd parties.
Overall this is a service that I really don't want to exist. I don't want an abritary company to be able to identify me while visiting their website from my mobile phone. I hope those companies don't just sell their services to anybody. Read the Medium article again: AT&T consumer choice opt-out doesn't affect this!
iOS 11 the tragedy continues: 11.0 had a bunch of flaws that were annyoing. Now 11.0.3 randomly frezzes my phone for minutes. Also I have some issues with voice call audio not working sometimes. Highly disaspointing!
Pictures of the month:
Saw a throne of phones in Göteborg. pic.twitter.com/wE6M5e2WPa— Mikko Hypponen (@mikko) October 17, 2017
Today marks the third time one of my iPhones has vibrated itself out of alignment with its wireless charging pad over night. pic.twitter.com/HFchysZ7L9— Matthew Panzarino (@panzer) October 10, 2017
IT TAKES JUST $1,000 TO TRACK SOMEONE'S LOCATION WITH MOBILE ADS
Oppo/Oneplus .ops Firmware decrypter
[WIP] Crappy iOS app analyzer
Down the Rabbit Hole with a BLU Phone Infection
eSIM for Consumer Devices (PDF)
Android Crypto-Ransomware that misuses accessibility services + encrypts data + changes PIN.
iOS jailbreak detection toolkit now available from TraiOfBits
Administering Chromebooks For teams traveling to complex and hostile environments
HackingTeam back for your Androids, now extra insecure!
iOS 11 security updates
Researchers: Uber's iOS App Had Secret Permissions That Allowed It to Copy Your Phone Screen
How To Obtain Real-Time Data from iCloud and Forget About 2FA with Just an Old iTunes Backup. No Passwords Needed
Meet Danny, the Guy Authorities Say Is Selling Encrypted Phones to Organized Crime
Android Reverse Engineering tools Not the Usual Suspects (slides)
Understanding new APK Signature Scheme V2?
Google Play Security Reward Program
source for suhide
Dieser Mann weiss, wie man in Smartphones einbricht (German)
NEW Rainbow Table added: GSM A5/1 table, 1.52 Terabytes in size. Torrent now available
Alarming number of DNS requests made by iOS devices
Bluetooth Hacking Tools Comparison
Unpatched Bugs Rampant on Mobile Devices in Financial Services Firms
Legitimacy: a Memory Research Platform for iOS
Samsung Android Security Bulletin Oct 2017 (a very long list!)
SELinux in Android Oreo or: How I Learned to Stop Worrying and Love Attributes (slides)
Android Security Bulletin - October 2017 (now calling out individual vendors)
Frida All The Things (slides)
Magisk Module to Allow Location Mocking, Screenshots in Any App, and Disabling System Signature Verification
notes on Hacking BLE - list of resources
Blue Pill for Your Phone (slides)
Bill Gates just switched to an Android phone (Windows Phones is dead!)
NFC - Contactless Cards: Brute Forcing Processing Options
Over The Air - Vol. 2, Pt. 1: Exploiting The Wi-Fi Stack on Apple Devices
XNU kernel 4570.1.46 sources
Linux Kernel Self Protection Project (slides)
CLKSCREW: Exposing the perils of security-oblivious energy management (paper)
In a first, Android apps abuse serious 'Dirty Cow' bug to backdoor phones
Label enums for Android JNI to aid in reversing
IDA jni helper
Google Play apps with as many as 2.6m downloads added devices to botnet
Samsung is gonna let you run any Linux distro on a Galaxy
Shim to grab keystore backed data
Android Security Reference (largely private notes of @doriancussen)
Google Play Billing Library 1.0 released
The Stony Path of Android Bug Bounty - Bypassing Certificate Pinning
Hardening the Kernel in Android Oreo
since I always rant about how I don't like biometrics in smartphones some people have asked me to formulate what I actually would like to see to happen in this area.
My dislike for biometrics is that you cannot change your password anymore because your password is your finger, eye (iris), or face. That means you basically show you password to everybody. A good example of this is here: Politician's fingerprint 'cloned from photos' by hacker.
The second part of the problem is that many biometric systems can be easily bypassed, some face recognition systems even with a picture shown on a smartphone screen.
My main issue is that biometric systems can be bypassed by forcing the owner of the device to unlock it. This can be done without leaving evidence, a funny example of this issue: 7-Year-Old Boy Uses Sleeping Dad's Finger To Unlock iPhone. Also see this interesting case: Court rules against man who was forced to fingerprint-unlock his phone.
The main argument I always hear is that people who wouldn't set a password (or use just a simple PIN) are using biometrics and therefore are more secure now with the help of biometrics. The kid from the previous story wasn't stopped by biometrics it was just as good as not having a password.
What would have stopped the kid from unlocking his dad's phone? A simple timeout! Basically what I want to see is a timeout for your biometrics. Once you entered your password you can unlock your phone using biometrics, after a specific amount of time you have to re-enter your password and cannot unlock the device using biometrics. With a timeout of say 30 minutes to one hour you can prevent simple attacks while still being able to use the convenience of biometrics. Apple recently introduced the SOS mode that will also disable biometric authentication until you enter your password. I wish this was taken one step further and let you set a timeout.
I personally see biometrics on a smartphone as a pure convenience feature and treat it as a weak security feature. I only use it for ApplePay.
I think it is pretty bad to get people used to biometric authentication, Apple may get it right but other companies wont. Normal users can't determine this easily. Also how much did the additional hardware components cost to implement fingerprint authentication or face recognition. FaceID doesn't use a normal camera so there are definitely additional costs that you as the user have to pay for this convenience feature.
Face recognition in consumer products also gets people to accept this as an normal everyday thing and thus helps the argument for face recognition being used in surveillance.
Chaos Computer Clubs breaks iris recognition system of the Samsung Galaxy S8 in May 2017
Chaos Computer Club breaks Apple TouchID iPhone 5s in 2013
ekoparty Sep 27-29, Buenos Aires. Blue Pill for your phone by Oleksandr Bazhaniuk. Unbox Your Phone - Exploring and Breaking Samsung's TrustZone Sandboxes by Daniel Komaromy. Inside Android's SafetyNet Attestation: Attack and Defense by Collin Mulliner. How to cook Cisco: Exploit Development for Cisco IOS by George Nosenko. Bypass Android Hack by Marcelo Romero.Some comments on BlueBorne: I've been involved with Bluetooth security since like forever (not active in the last 10+ years). The early Bluetooth vulnerabilities were mostly logic bugs and issues such as missing authentication. Bluetooth devices could not be set to hidden and would always show up when scanning for devices. Stuff like that. BlueBorne is different as it is a remote exploitable memory corruption vulnerability in Linux, Android, and Windows. This is quite a novelty since we haven't seen a bug that is more ore less the same on two platforms. Even more interesting is that this bug is pre-authentication and gives you kernel privileges (code exec in the kernel).
Virus Bulletin 4-6 Oct, Madrid Span. Last-minute paper: Publishing our malware stats by Jason Woloz (Google) [This is about Android Malware]. Android reverse engineering tools: not the usual suspects by Axelle Apvrille.
In theory this set of vulnerabilities can be bad, bad. In practice the issue is much less of an issue. Exploit mitigations and built variances help mitigating the risk. Devices are not always visible therefore the attacker cannot easily find your device and attack it.
Also see: Hackers Could Silently Hack Your Cellphone And Computers Over Bluetooth.
FaceID: I think it is a really horrible idea! Do not put biometric systems in to consumer products ever! I will not buy products with mandatory biometrics so far iOS allows me to turn it off and use a passphrase - thats why I even consider buying iOS devices. I hate this change -- biometrics are bad.
Huh, here I was looking to get a phone similar to Walmarts in-store model... And eBay just has their actual in-store model... Perfect! pic.twitter.com/sq4pUtCBe3— Tim Strazzere (@timstrazz) September 17, 2017
https://t.co/zqdwIa27IR— sp (@LambdaCube) August 28, 2017
"Certified devices are also required to ship without pre-installed malware"
A good requirement IMHO. 😛
I agree ^^^
SELinux in Android Oreo or: How I Learned to Stop Worrying and Love Attributes (presentation)
Kernel Driver mmap Handler Exploitation (paper)
BabelView: Evaluating the Impact of Code Injection Attacks in Mobile Webviews (paper)
AndroidXRef now with Android O/8
Now the native-shim loader can create VM's for ART based Android devices by rednaga
Good thread about the Android Key Store API
IDA AArch64 processor extender extension: Adding support for ARMv8.1 opcodes
INJECTING MISSING METHODS AT RUNTIME
Oppo/Oneplus .ops Firmware decrypter
Android Hardware-backed Keystore (docs)
Samsung to Launch Mobile Security Rewards Program, Welcoming Security Research Community
Android 8.0 includes the following security-related changes
WHAT'S NEW IN KNOX 2.9?
ANDROID O AND DEX 38: DALVIK OPCODES FOR DYNAMIC INVOCATION
The public release of shadow v2 jemalloc exploitation tool with support for Android (both ARM32 and ARM64)
Making it safer to get apps on Android O
Dig Deep into FlexiSpy for Android
Tool for leaking and bypassing Android malware detection system
iOS 8.4.1 32 bit jailbreak