Re: Apple keyboard firmware hack demonstrated [RISKS] Risks Digest 25.76

[David Farber <dave () farber net>]

Begin forwarded message:

From: Gary Johnston <johnston () nku edu>
Date: August 17, 2009 2:20:14 AM EDT
To: "dave () farber net" <dave () farber net>
Cc: ip <ip () v2 listbox com>
Subject: Re: [IP] Apple keyboard firmware hack demonstrated [RISKS]  
Risks Digest 25.76

We might say that a hacker would never have direct access to our  
personal keyboard so we are safe. But can you imagine what this could  
do to university labs or library open access computers!?

Gary Johnston
NKU

Sent from Gary's 3GS iPhone

On Aug 16, 2009, at 8:07 PM, David Farber <dave () farber net> wrote:

> Begin forwarded message:
>
>
> Date: Mon, 3 Aug 2009 08:17:54 -0400
> From: Monty Solomon <monty () roscom com>
> Subject: Apple keyboard firmware hack demonstrated
>
> Charlie Demerjian at Defcon 17, 31 Jul 2009: Apple needs to patch it  
> ASAP
>
> Apple keyboards are vulnerable to a hack that puts keyloggers and  
> malware
> directly into the keyboard. This could be a serious problem, and now  
> that
> the presentation and code is out there, the bad guys will surely be
> exploiting it.
>
> The vulnerability was discovered by K. Chen, and he gave a talk on  
> it at
> Blackhat this year. The concept is simple, a modern Apple keyboard  
> has about
> 8K of flash memory, and 256 bytes of working ram. For the  
> intelligent, this
> is more than enough space to have a field day.
>
> K. Chen demonstrated the hack to S|A at Defcon today and it worked  
> quite
> well. You start out by running GDB, and set a breakpoint in Apple's
> HIDFirmwareUpdaterTool. This tool is meant to update the firmware in  
> human
> interface devices, hence the name. The tool is run, a breakpoint  
> set, and
> then you simply cut and paste the new code into the firmware image in
> memory. That's it.
>
> Nothing is encrypted, decrypted, and the process is simple. You then  
> resume
> HIDFirmwareUpdaterTool, and in a few seconds, your keyboard is
> compromised. Formatting the OS won't do you any good, the code is in
> keyboard flash. There are no batteries to pull, no nothing, the  
> keyboard is
> simply compromised. ...
>
> http://www.semiaccurate.com/2009/07/31/apple-keyboard-firmware-hack-demonstrated/
>
> Reversing and Exploiting an Apple Firmware Update
> http://www.blackhat.com/html/bh-usa-09/bh-usa-09-archives.html#Chen
>
>
>
> -------------------------------------------
> Archives: https://www.listbox.com/member/archive/247/=now
> RSS Feed: https://www.listbox.com/member/archive/rss/247/
> Powered by Listbox: http://www.listbox.com




-------------------------------------------
Archives: https://www.listbox.com/member/archive/247/=now
RSS Feed: https://www.listbox.com/member/archive/rss/247/
Powered by Listbox: http://www.listbox.com