hardware hack

Joe Grand recounts being hired to hack a Trezor One hardware wallet and recover $2 million of cryptocurrency. He describes three months of experimentation, voltage glitching, failures and high-stakes attempts with only one chance to get it right.

A 36C3 talk by Bunnie Huang arguing that open source is necessary but not sufficient for trustworthy hardware, because verifying hardware is destructive and so creates a time-of-check/time-of-use gap. It surveys supply chain security and classes of hardware attacks, and presents the Betrusted approach to narrowing that gap.

The Mentor (Loyd Blankenship) reads his 1986 essay "The Conscience of a Hacker" at H2K2 in 2002 and adds his own insight about its backstory.

Tom Murphy (suckerpinch) shows 'reverse emulation', using a Raspberry Pi in an NES cartridge to give an unmodified NES new abilities such as playing SNES games. The video starts in a strange way and gets stranger.

Timothy Roscoe of ETH Zurich delivers the joint USENIX ATC/OSDI 2021 keynote arguing that operating systems must reckon with modern hardware, which is a heterogeneous collection of processors, firmware and coprocessors rather than a simple machine. It shows how much runs below and beside Linux.

A 33c3 talk by marcan on reverse engineering the PS4 hardware to run Linux with 3D acceleration. It covers how the console differs from a PC and includes a story about tunneling PCIe over RS-232.

A 35C3 talk presenting a proof-of-concept SPI bus hardware implant with capabilities like those alleged in the Bloomberg Supermicro story, plus countermeasures for detecting such modchips.

A HOPE X talk giving an in-depth explanation of how elevators work, from their history in hacker culture to using their control systems to bypass building security. It covers features and abilities of elevators that most people never see.

Cliff Click of Azul Systems gives a Google Tech Talk on running Java business applications on a machine with about a thousand cores. He covers hardware and software codesign, including garbage collection hardware and the JIT.

Christopher Domas presents research at DEF CON 26 showing a hidden alternate instruction set and undocumented hardware backdoor in some x86 processors, found on a third-party CPU. He uses it to ask how feasible wider hardware backdoors are.

Christopher Domas's Black Hat talk demonstrates a hardware backdoor in a third-party x86 processor, a hidden core that grants root from userland. He uses it to discuss how feasible broader hardware backdoors might be.

Craig Heffner's Black Hat 2013 talk on exploiting network surveillance cameras, covering how insecure their firmware is. It shows how easily such devices can be compromised.

A PyCon 2012 talk by Kurt Grandis on building an automated water-squirting turret that uses Python and computer vision to detect and drive off squirrels from a bird feeder.

John Sotos, a physician and former Intel chief medical officer, argues at DEF CON 25 that genetic diseases are exploitable vulnerabilities in the genome. He warns that CRISPR and related tools will make malicious genome hacks and targeted bioweapons feasible.

Microsoft's Tony Chen explains how the Xbox One was designed to resist physical attacks, including secure boot, encrypted memory, a security processor and a hypervisor. The goal was to make any hardware attack cost more than the price of many games.

Andrew "bunnie" Huang examines how realistic hardware supply chain attacks are, from rogue insiders to nation states, in the wake of the Bloomberg Businessweek report. He explains how undocumented components could be hidden on boards and how hard they are to spot.

Bill Dally of NVIDIA gives a Hot Chips 2023 keynote on the challenges of building hardware for deep learning. He traces how GPUs have been adapted for machine learning, especially training.

The fail0verflow team (bushing, marcan, sven) present console hacking at 27C3, covering Wii, Xbox 360 and PS3 exploits. They explain how the PS3 was cracked after Sony removed Other OS.

A DEF CON 23 talk by Marc Rogers and Kevin Mahaffey walking through the architecture of the Tesla Model S, what Tesla got right and wrong, and how the interconnected systems can be hacked. It also covers the data the car collects.

A Ropecon 2019 talk by a lighting designer and a software engineer on how the Odysseus larp spaceship was built, using over ten IT systems, hundreds of lights and dozens of speakers. It covers the lessons learned.

Theo de Raadt presents pledge, a new OpenBSD security mechanism that kills processes which exceed the system calls they declared they need. The talk was given late at night at Hackfest 2015.

Michael Steil's 33c3 talk explains essentially everything about the Game Boy: CPU, video hardware, peripherals, and the tricks used by games and demos. It revives the era of counting clock cycles around hardware limits.

Deviant Ollam's two-hour conference talk explains how elevators work, from the pit and buffers to the car top, controller logic and access-control features. It shows how this knowledge can be used for optimization and for bypassing building security.

Deviant Ollam and Howard Payne give an in-depth DEF CON 22 explanation of how elevators work, from the pit to the penthouse. It covers their control modes and how pen testers use elevators to bypass building security.

Tony Chen of Microsoft explains at BlueHat Seattle 2019 how the Xbox One was designed to resist physical attacks. He covers the security design and hypervisor-based OS architecture that kept the console uncracked for years.

Karsten Nohl and Jakob Lell present BadUSB at Black Hat 2014, showing that USB controller firmware can be reprogrammed to impersonate other device types. They demonstrate system compromise and a self-replicating USB threat that current defenses cannot detect.

The Grugq's Hack In The Box 2012 talk on operational security for hackers, drawing on hacker indictments and counter-intelligence research. It reviews OPSEC goals and methods for avoiding detection and arrest, with case studies of how hackers got caught.

A DEF CON 21 talk by Adam Laurie and Zac Franken on decapping chips, covering how to remove chip packaging and image the die to read out contents such as ROM.

George Hotz gives a SXSW 2019 talk on the idea that we live in a simulation and asks what actions would be available from inside it. He takes a hacker's view of whether it could be escaped.

Cliff Click walks through a small performance example on a modern out-of-order CPU. He covers pipelining, ILP, CISC vs RISC, multicore, and why cache misses and the memory subsystem dominate performance.

Julien Verlaguet of Facebook describes applying static analysis and type inference to a very large PHP codebase, using OCaml. The work led to the Hack language.

Jessie Frazelle's DockerCon SF 2015 talk on running Docker containers for desktop applications, with fun container hacks and images. It shows how far containers can be pushed beyond servers.

An AWS re:Invent 2018 session diving into the Nitro system, a set of hardware offload and security building blocks behind next-generation EC2 instances. It covers the design and architecture and how Nitro enables new instance types.

Tom Scott explains how he built his emoji keyboard, which turned out to be a series of bodged-together tools including AutoHotkey and LuaMacros. He tells stories about the value of quick-and-dirty solutions.

Hamish Coleman describes reverse engineering the keyboard controller in a Thinkpad and reflashing it with custom firmware. He covers how Lenovo secures its firmware, and his ongoing work on the protocol between the BIOS and the vendor flash tool.

Casey Muratori's long talk arguing that modern software has ballooned to tens of millions of lines because of hardware and OS diversity. He proposes a stable ISA for entire system-on-a-chip packages and recalls when games shipped with their own boot disk.

Jason Turner's CppCon 2016 talk builds a simple Commodore 64 game using C++17, showing how constexpr and const let a modern compiler produce tight 6502 code. He walks through assembly output to show abstractions being optimized away.

Tom7 explains how he built a SIGBOVIK 2017 paper made only of printable ASCII bytes that is also a valid DOS executable. He writes a C compiler targeting printable x86 without self-modifying code and solves the puzzles the constraint creates.

Facebook engineers explain why they abandoned the traditional MVC paradigm for a more functional architecture, introducing Flux and React. They use the unread-message-count bug as a case study of the problems of bidirectional data flow at scale.

Kim Nilsson presents his investigation into how Mt. Gox was hacked and mismanaged, tracing the finances and the missing bitcoins. It was given at the 2017 Breaking Bitcoin meetup.