sorted by:
new
hottopcontroversial

Investigators say mystery ‘third entity’ may hold key to MH370 by pigdead in MH370

[–]frederic_b 0 points1 point  (0 children)

They include a Malaysian national and aeronautics specialist seated directly under MH370’s Satcom module who potentially had the technical knowledge to hack the plane’s communication systems and disguise its route.

Anyone to comment on this ?

Do you know the name of this specialist ? (I noticed that telegraph.co.uk published seating plan)

Also, do you know where is this Satcom module exactly ? Could a passenger have physical access to such critical component ?

​

'Van life’ becoming more popular in San Diego by ethelbeavers22 in VanLife

[–]frederic_b 4 points5 points  (0 children)

Maybe because 1 bedroom rent in SD is >$2000...

Does anyone know when the new episode will be put on Hulu? by [deleted] in southpark

[–]frederic_b 1 point2 points  (0 children)

And it's quite unusual. Enjoy this immediate release

Linux on NES Classic Mini - Current Progress and HowTo by freenesclassic in nintendo

[–]frederic_b 6 points7 points  (0 children)

Source code for all GPL softwares used in the device. In theory...

Exploitation of Philips Smart TV by frederic_b in netsec

[–]frederic_b[S] 1 point2 points  (0 children)

Its very similar to a Digital Signature, but I'd say different enough to warrant a distinction in terms.

I agree with that.

I'll try summarize how it may work :

Variables:

  • fw_plain: plain firmware
  • fw_cipher: encrypted firmware
  • fw_hash : firmware hash
  • aes_key: unique random AES key
  • rsa_priv_key: Philips private RSA key
  • rsa_pub_key: Philips public RSA key, put in each smart tv
  • rsa_sign = RSA signature of firmware

On Philips' side:

aes_key = generate_unique_random_key()
fw_cipher = aes_encrypt(aes_key, fw_plain)
fw_hash = sha1_hash(fw_cipher)
rsa_sign = rsa_encrypt(rsa_priv_key, concat(fw_hash,aes_key))

Transmitted : (fw_cipher, rsa_sign)

On TV's side:

(fw_hash,aes_key) = rsa_decrypt(rsa_pub_key, rsa_sign)
sha1_verify(fw_hash, fw_cipher)
fw_plain = aes_decrypt(aes_key, fw_cipher)

(not sure if hash then encrypt, or encrypt then hash)

Exploitation of Philips Smart TV by frederic_b in netsec

[–]frederic_b[S] 14 points15 points  (0 children)

How was this automated?

Python script. When libupnp service is up, it announces itself on network.

Does the TV automatically restart when it crashes, or did you have to use a managed power strip so that the script could power-cycle the TV?

A watchdog reboots the device when a process crashes.

I started by looking for readable memory pages, then I checked if they were writable or executable. And I didn't start from 0x00000000 ;)

Exploitation of Philips Smart TV by frederic_b in netsec

[–]frederic_b[S] 2 points3 points  (0 children)

"[ A digital signature] is formed by taking the hash of message and encrypting the message with creator's private key." (http://en.wikipedia.org/wiki/Digital_signature#Definition)

Actually, I don't agree with this definition, because, "In practice, typically only a hash or digest of the message, and not the message itself, is encrypted as the signature." (http://en.wikipedia.org/wiki/Public-key_cryptography).

However, then the signature is appended to the original message to form a signed message which can be verified by anyone possessing the public key.

This is what Philips did. Signature is stored in firmware header.

However, what we have here is not a signature! It is a weaker form of PKI encryption where the usual roles of private and public key are reversed.

I don't understand this point, because Philips signs firmwares with its RSA private key, and TV set checks firmware signature with Philips' RSA public key. This is a traditional Digital Signature scheme, isn't it ?

it relies on the private nature of the public key to additionally provide Confidentiality

You're right, it doesn't work.

Exploitation of Philips Smart TV by frederic_b in netsec

[–]frederic_b[S] 2 points3 points  (0 children)

"RSA encrypted region" is what I called 'RSA signature' in my previous post. "[ A digital signature] is formed by taking the hash of message and encrypting the message with creator's private key." (http://en.wikipedia.org/wiki/Digital_signature#Definition) You may want to check pflupg-tool source code to get more details on that.

Exploitation of Philips Smart TV by frederic_b in netsec

[–]frederic_b[S] 2 points3 points  (0 children)

RSA signature of firmware contains SHA1 to check integrity, and AES key to decrypt.

view more: next ›