How much notification did you give the developers before you disclosed? Did you enforce a timeline?
240 karma · joined August 15, 2016
With the rise in number of new security engineers all competing for few "security research" jobs (security research/hacking is the "I want to be a game developer" of security), you start getting into these convoluted hiring processes. Unlike standard software engineering, there aren't even remotely enough positions to accommodate everyone, so the bar can get absurdly high.
Honestly, if the team is asking CTF questions, they clearly want hires with previous CTF experience and should just do targeted hiring from the top teams at different conferences.
At least send people a free t-shirt if they complete the challenge.
I learned from K&R, but highly recommend Seacord's books if you're looking for how to write secure C and a more modern take on some of the trickier parts of C.
Hence, as the check wasn't working, I never ran into the check. Dat file signatures may very well be in the header or stored somewhere else.
The point of this is that hey, this isn't actually that hard if you're willing to put in the time. If you're moderately talented, you can probably learn it too!
As opposed to the standard exploit write-up/security conference circuit thing, where a lot of the details are kept secret and it seems like the entire point is to make other people think you're cool instead of teaching something. :)
1. I believe Harman had a previous device hacked back around 2014 due to a weak shadow hash. My guess was that they learned their lesson and made the password more complex. An easy way to test would be to diff the latest shadow file in the updated Subaru images (assuming they exist) -- if it changed, you may be right, if not, I'd still wager it is strong enough.
I don't like the idea of a backdoor like that available, but it is what it is.
2. The QNX6 hashing mechanism, to the best of my knowledge, isn't fully understood. Upstream changes to JTR seem to indicate that it has some form of bug in it or isn't fully reverse-engineered. That, along with having to spend presumably a large amount of time learning about contributing to hashcat & gpu programming, made this seem like a potential dead end without massive time investment.
So, is it possible it is crackable? Almost certainly, but I'm one guy doing this and you have to spend your time carefully in these ventures.
Medical system security does not seem very good. When I was operating in the area a while back, one comment I kept seeing was similar to yours. "Yes, the security is bad, but the good these devices do outweighs the bad."
I agree with that, but my follow-up has always been, why can't these devices continue to help patients, but in a secure way? The manufacturers really don't want to spend the money to try and have some form of a security posture?
Rhetorical question. At the end of the day, my pessimistic view is that nothing will happen until some firm finally proves that there has been a high profile attack, there is an ensuing media firestorm, and the regulation process starts happening.
To answer your question: I have no idea. Would be neat if a much cheaper model had the horsepower though.
I purchased them a Netgear R7800 and installed hnyman's LEDE build [1] to enable SQM. Night and day difference in latency response. No more staring at a white screen for 3 seconds per URL click.
The build has been stable for several months. I wouldn't recommend this for non-technical users or anyone not willing to spend time troubleshooting, but it has been a great improvement. I couldn't find any other device capable of doing this without running x86 hardware or something else silly.
A few other people mention it, but yes, this is only going to work on slower connections on current SOHO hardware. I think the R7800 can do software SQM at up to 150mbps or so. Plus, if you have a gigabit symmetric connection, hopefully you aren't having bufferbloat issues.
Just wish a popular manufacturer would release an easy-to-use router with SQM so I could install it for non-technical users and forget. Ubiquiti is somewhat close to that, but I believe their prosumer hardware (USG) is running a slow processor at the moment and doesn't even support SQM without installing custom kernels.
[1] https://forum.lede-project.org/t/build-for-netgear-r7800/316
I expect to see drastically more work into IoT devices once tooling and knowledge sharing gets better. A lot of the articles right now begin and end with binwalk. Great tool but that's just the start.
The only hard part of embedded work is that it's really, really difficult to collaborate with anyone as VR is always filled with incredible drama and the talent pool of individuals willing to work on this (for free) with the prerequisite knowledge is almost non-existent.
Good luck. And thanks for not coming out with another media campaign first and interesting research second.
I'd recommend an older Kindle if you want to get root easier. 5th generation Paperwhite and older models should be cheap and have various exploits.
Probably would recommend a Kobo or something else though. Kindles are awesome pieces of hardware but they do try to keep them secure. Not the best choice for an open platform.
It's a neat project to talk about during interviews. Nothing more.
There's quite a few books on the subject. Hacking: The Art of Exploitation is a decent hello world introduction to the subject. Reading CTF practice problem writeups and then trying easier ones yourself are also good experiences.
For REing, http://crackmes.de is a blast. The entry level challenges should be easy to grasp after reading a few tutorials. Would recommend running everything in a Windows VM. ;)
Good luck!
While this exploit is obviously closed, Kindles can still be jailbroken via a new method. See the mobileread forums.
As the guy who wrote this, I don't use any of the addons. Just did it for fun.