stgl

6 ms·

1.
by stgl 8mo ago
https://stefan-gloor.ch
2.
Patching Pulse Oximeter Firmware(stefan-gloor.ch)
51 points by stgl 10mo ago|7 comments
3.
Patching Pulse Oximeter Firmware(stefan-gloor.ch)
3 points by stgl 10mo ago|0 comments
4.
by stgl 1y ago
Very interesting!
5.
by stgl 1y ago
Thanks! Yep, I feel foolish. I just could not imagine it would be that easy on a locked-down terminal. But I learned for next time :)
6.
by stgl 1y ago
Linux does not handle any secure binaries. It only shares a filesystem where the signed and encrypted secure images are. The loadercode verification is not done in Linux, rather the insecure bootloader will read it from the filesystem load
7.
by stgl 1y ago
The binary that decides whether to boot or go into tamper mode is the "loadercode", which is integrity-protected (I think by a Boot ROM or similar). The secure firmware can be updated, but it is signed as well.
8.
by stgl 1y ago
Yes, 0.1 mm diameter enameled copper wire. Chasing GPL violations sounds like a fun hobby :)
9.
by stgl 1y ago
I had the same idea, but no, I tried with a second, untampered one and I also got a working shell. So it does not seem to be dependent on the tamper state.
10.
by stgl 1y ago
Well, I felt like I first had to get a feeling for what I am working with. Hardware, what SoC, interfaces, flash etc... Otherwise I am too much in the dark. But sure, in hindsight I could've just tapped the debug connector and could ha
11.
by stgl 1y ago
No, it cannot load a separate bootloader. I tried to tamper with the loadercode (the "secure" bootloader), but it wouldn't boot. So I am guessing there is some third party (boot ROM) that verifies it. Also, I think Linux alwa
12.
by stgl 1y ago
I cannot tell for sure. I didn't have time to really look at the Linux applications and what they do exactly. My guess is that most of the sensitive stuff is done on mp1 (reading the card, verifying the pin etc.) and the Linux just act
13.
by stgl 1y ago
No, I don't think so. I think the tamper logic is implemented in hardware and cannot be easily fooled. It seems like both mp1 and mp2 access memory-mapped registers of the tamper subsystem to check its status (and other hardware system
14.
Root shell on a credit card terminal(stefan-gloor.ch)
840 points by stgl 1y ago|251 comments
15.
DOOM on a Business VoIP Telephone(stefan-gloor.ch)
3 points by stgl 2y ago|2 comments
16.
DOOM on a Business VoIP Telephone(stefan-gloor.ch)
2 points by stgl 2y ago|0 comments