Slashdot Mirror
Hacker Set To Demonstrate 60 Second Brinks Safe Hack At DEFCON
darthcamaro writes: Ok so we know that Chrysler cars will be hacked at Black Hat, Android will be hacked at DEFCON with Stagefright, and now word has come out that a pair of security researchers plan on bringing a Brinks safe onstage at DEFCON to demonstrate how it can be digitally hacked. No this isn't some kind of lockpick, but rather a digital hack, abusing the safe's exposed USB port. And oh yeah, it doesn't hurt that the new safe is running Windows XP either.
Digital safe running XP = = special ops commando running with a muzzle load flint lock.
"A large portion of the attack is about escaping out of the kiosk mode that is put in place on the safe, in order to prevent someone from accessing the backend system,"
And I thought Tom Cruise would be dodging laser beams and planting a sophisticated code cracking super gadget into the USB port.
Ok so I can stop reading at the very first sentence because all we get is scary scare words of scaring... and that's it.
Welcome to capitalism, where you have a lot of choice, nearly none of which is any good.
I also have a toy safe. I don't make a big deal of being able to crack it open.
Surely if this is supposed to be a highly secure box it would be a good idea to have an old fashioned mechanical lock alongside the electronic stuff so if one system fails the other is still in operation? Also what happens in a power cut?
I have been to defcon in the past. What is amusing is all the people there from a variety of three letter agencies. They are usually the ones with nice shoes and/or dressed in dark attire. That is my impression at least though I suppose I could be mistaken. Anyhow, the amusement is in the number of them. I suspect they could send fewer or just get together and send a lot fewer people. In some of the smaller and more detailed talks there would be a bunch of them and they seem to gravitate towards each other.
I wonder about the possibility of an event where the feds were not invited and the venue was invite only sans marketers? They would need some way to vet attendees and some would get in through the cracks. Blackhat Con USA was weird feeling. You are sitting there in a talk and you know you are surrounded by law enforcement. I can only imagine that they are like the pervs that attend gaming conventions these days. (I have not been to a gaming convention in a good many years. I did go and get Dungeons and Dragons in loose-leaf format once but that was oh so many years ago and I am too old for such now.)
"So long and thanks for all the fish."
The good thing about standards is that we have so many of them to choose from.
This fella surely works at Microsoft. He's probably the head of the Wondose 10 team .
Why does a safe need an operating system?
And then why for heavens sake has it to be a desktop operating system? Does it need to run MS Office or what was the design idea here? It's not like there are especially hardened OSses out there for embedded devices. (Not to mention that this means we have a safe that's running on a x86 architecture)
And after having such a terrible design idea, why have it implemented by a moron using an out of date, unsupported, and buggy OS?
bickerdyke
There's something to this kind of news... Why do they even put an operating system on such a specialized device, that is dedicated to only one task? The point of an operating system is to be able to run different programs on the same machine. It's certainly easier to build over one, but is it worth the trouble?
There's nothing like $HOME
Good old USB HID keyboard attack... Net hunter tablet, anyone?
Have I missed something? I keep seeing this type of post.
If I had some stuff I wanted to keep secure, I would buy a safe with a dial combination lock, not an electronic safe (and certainly not one with software sophisticated enough that it needs an actual OS underneath it)
I think they started playing StF like the second Defcon so yeah Elite "Players" will be able to spot the feds not obvious.
Why the fuck does a safe need to run any PC operating system in the first place, and how ignorant would its maker have to be to choose XP..... The world may never now.
We'll have to ask the grandfather of all knowledge . . . . Microsoft sales
It's XP.
Its full of known holes.
It's not supported anymore.
It does lots of things that are unwanted for this process.
It has a huge attack surface as a result.
Brinks could never have certified that secure because they used an OS with known security holes that they could never have audited themselves because its closed to them.
WTF! Who would be so stupid as to do that? Are they a division of Diebold??
Apparently because it's some sort of "drop off" safe.
In the normal operation of the safe, the majority of operations are executed by way of a touch-screen on the safe. Once the money has been inserted into the safe, it is automatically deposited to the retailer's bank, which means that it's the bank's money and a store manager cannot remove cash from the safe. Typically, to remove cash, there is a requirement for both the store manager and a Brink's employee to be present.
That still doesn't explain why people in this sort of industry think you need Microsoft freaking Windows for a simple UI screen. Perhaps they are using Visual Basic? (rolls eyes)
This is 2015, folks, this is the kind of crap you can do with a Raspberry Pi, and if it's long-term support you want, you will still be able to get boards ten years from now, at most needing software changes in the form of a few different kernel drivers.
#naabhaprzrag, #sverubfr-000, #agi-fcbafberq, negvpyr[pynff*=' negvpyr-ary-'] { qvfcynl: abar !vzcbegnag; }
The OS wasn't compromised, and XP embedded is pretty secure ... it doesn't run anything out of the box, so its pretty safe.
You choose Windows because the Win32 API has a couple of metric fucktons of developers available that are JUST as capable as random Linux developer that thinks he's kind shit just because he runs Linux even though his software is just as exploitable on Linux as it is on XP.
How ignorant do you have to be to make such retarded statements? Pretty fucking ignorant I'd say.
Persistent Volume manager for Kubernetes - https://github.com/dwimsey/openshift-pvmanager
FTA: "So the issue isn't so much that there is no acknowledgment that there is a problem; rather, the vendors have been pointing fingers about whose problem it is for over a year, without progress made on the actual resolution."
Finger pointing or not, it's hard to believe that it could take that long to address the issue. Even if they can't get their shit together to fix the fundamental problem, couldn't they at least kludge in a piece of gateway software that would intercept the USB port data and raise the difficulty level of gaining access and exiting kiosk mode? That, plus actual lock-and-key protection of the port, (and maybe a retrofit of a custom connector that would make it even more difficult to make the physical connection), would buy them a lot of time to get through the exercise of deciding who's going to fix the REAL problem.
Speaking of fixing the problem - I know the answer to this, but I have to ask anyway: What happened to the practice of just fixing it because you can, and because it makes you look good, without regard to whose fault the problem was in the first place? They could have had this taken care of inside two weeks - maybe a month at the outside - if they weren't playing juvenile schoolyard politics.
'The Economy' is a giant Ponzi scheme whose most pitiable suckers are the youngest among us and the yet-unborn.
Why does a safe need an operating system?
Because it is computerized and does more than control a lock. When was the last time you saw a computer without any sort of operating system?
And then why for heavens sake has it to be a desktop operating system?
Because that's what most people know how to write software for. Not saying it was a good choice but I understand why they did it.
It's not like there are especially hardened OSses out there for embedded devices.
It's not an embedded device. It runs a pretty much bog standard PC. I've actually worked on some of the hardware in these in my day job a while back on a project. (No I had nothing to do with the design or the implementation of them nor do I have any relationship with Brinks and no the project had nothing to do with hacking them)
And after having such a terrible design idea, why have it implemented by a moron using an out of date, unsupported, and buggy OS?
Because it wasn't out of date or unsupported when they designed the safes. These aren't a brand new design. Again, not saying it was a good choice but it made sense (sort of) at the time.
...the safe's exposed USB port....
Why not just paint a large target on the front of the safe?
They call it a "lock and key". Totally uncrackable over the internet or via USB, and although exploits do exist, for higher quality setups they take considerable time with physical access to the device.
The "IoT" is not our friend, folks - It turns solid, reliable old-school products into yet another vector for malware in your house. And if you think reinstalling Windows sucks, how about having your oven go into self-cleaning mode during your vacation without the safety latch closed? How about having your blender "playfully" get your cat's attention with brief pulses before going full puree? How about overriding your on-demand hot water heater to its "steam clean" setting with you in the shower?
I love toys, including electronics. But the fewer things in my house vulnerable to remote exploits, the better. My toaster should have one dial and one lever and zero computers, period.
Have I missed something? I keep seeing this type of post.
Yeah - don't you watch television? It's the new Reddit recruiting campaign. Sex Conker is the marketing manager.
Get it right Slashdot, this is not hacking, never has been. This is cracking
...why in the world would you need a full-fledged OS just to run a safe? Is there any reason besides stupidity that you wouldn't put an FPGA or something running a simple hard-coded application in there?
This whole thing makes my head spin- I couldn't be any more surprised if I found out that my toaster or can opener was running Win95, or ANY full-fledged OS. Now I wonder what OS my toothbrush is running on. And the napkin holder on my dining room table- what OS does it use?
Just cruising through this digital world at 33 1/3 rpm...
This seems to be a big problem - large companies seem to be completely unaware of how to hire people to do technical work. Instead, some dumb admin who's been doing Windows for ages said, "Hey! Let's use Windows in our new iSafe!", and this is why they have the worst example of problematic code running in something that's supposed to keep belongings safe.
I don't care how many people claim Windows can be made secure. It simply should not be used for anything sensitive.
Why would a safe have a USB port? Doesn't make sense to me.
So if the money belongs to the bank as soon as it's in the safe, does that make any hack into the safe bank robbery?
Why oh why do people still pre-announce what they are going to demonstrate at DEFCON? This lets the spooks, lawyers, and paid goons scare hackers into being silent on their findings. Let it be a surprise.
https://xkcd.com/463/
It's called Plug n' Pay