EH-Net

Ethical Hacking Discussions and Related Certifications => Hardware => Topic started by: manoj9372 on September 30, 2010, 11:11:36 AM



Title: How an hardware is actually vulnerable to exploitation?
Post by: manoj9372 on September 30, 2010, 11:11:36 AM
I am just new to these hardware hacking field,
I am just wondering about this field,How actually an hardware is subjected to exploitation?

In software we have incorrect handling of input in the source,so we get some buffer overflows and things,but i don't know what  bug's actually present inside the hardware for exploitation?

Also can a hardware exploit can get us remote code execution?

Need a bit of explanation to make my self-clear...


hope i will get some...


Title: Re: How an hardware is actually vulnerable to exploitation?
Post by: dante on September 30, 2010, 01:49:02 PM
Normally hardware hacking boils down to exploiting firmware, code embedded in chips etc... 
I have not seen messing with the hardware resulting in a vulnerable state until I read about geohot's glitching the memory bus hack... Though geohot's work was significant, in the end it was a heap overflow that opened the iron gates of PS3...

http://ps3wiki.lan.st/index.php/PSJailbreak_Exploit_Reverse_Engineering


Title: Re: How an hardware is actually vulnerable to exploitation?
Post by: tturner on November 23, 2010, 09:08:29 AM
One of my recent faves is the jedi packet trick. Check out the CanSecWest 2010 presentation at http://www.alchemistowl.org/arrigo/Papers/Arrigo-Triulzi-CANSEC10-Project-Maux-III.pdf (http://www.alchemistowl.org/arrigo/Papers/Arrigo-Triulzi-CANSEC10-Project-Maux-III.pdf)


Title: Re: How an hardware is actually vulnerable to exploitation?
Post by: taargus taargus on July 14, 2011, 09:17:37 PM
Ahh... hardware exploitation.  Take a look at Chris Tarnovsky's work.  This guy blows my mind.  Chemistry, precision mechanics, and code.  

http://www.youtube.com/watch?v=tnY7UVyaFiQ (http://www.youtube.com/watch?v=tnY7UVyaFiQ)



PS - Didn't realize I dug up a rather old thread.  Sorry, mods.