log☇︎
94300+ entries in 0.048s
mircea_popescu: http://btcbase.org/log/2018-06-08#1821721 << yup. you realise that as far as the imbeciles are concerned, once we break their laptop "security" it'll have been "terrorism" and "hacking" bla bla. ☝︎
asciilifeform: https://archive.li/ZtbxL << clue re origin of 'h1'. seems like they took a 'metallization mask' fpga, a la early asicminer crapola, and run licensed cortex-m3 core .
mircea_popescu: looks like made by the exact same people, actually.
asciilifeform: reminiscent of old-time gsm carriers and their crippled handsets
deedbot: http://qntra.net/2018/06/security-researcher-continuing-to-receive-new-usg-charges-for-authoring-popular-code/ << Qntra - Security Researcher Continuing To Receive New USG Charges For Authoring Popular Code
asciilifeform: ohnoez, not tivoized properly!11
asciilifeform: how the fuck is this a vuln tho
a111: Logged on 2018-06-08 17:08 phf: http://btcbase.org/log/2018-06-08#1821658 << they could also bring back 701c butterfly keyboard design, but i guess that's too gimicky.
asciilifeform: http://btcbase.org/log/2018-06-08#1821694 << i actually had that box. the mechanism is clever but i suspect that it wears out ( my unit, to be fair, did not last long enuff for the kbd clockwork to wear out, mobo died 1st ) ☝︎
asciilifeform: phf: if you are able to build the usb snake -- lemme know which cr50 turd ver is in your box ☟︎
phf: heh they are also using gentoo for their stuff.. https://chromium.googlesource.com/chromiumos/overlays/chromiumos-overlay/+/master/chromeos-base/chromeos-cr50-scripts/
asciilifeform: https://chromium.googlesource.com/chromiumos/platform/ec/+/master/common/rma_auth.c#254 << the magic moment where answer is checked.
asciilifeform: https://chromium.googlesource.com/chromiumos/platform/ec/+/master/common/rma_auth.c#176 << mechanism, for the curious.
asciilifeform: it's a deedbot-style challenge/response thing
asciilifeform: so throwing in, e.g., old devkey-carryng versions, dunwork.
asciilifeform: ( what can be flashed in : it gotta pass the rsa sig ; plus it gotta match the board id ; plus the version must be above the previous )
asciilifeform: turns out also that this is the only routine that uses ecc crypto
asciilifeform: the vendor's 'we'll unlock' pg (to be fair, mentioned in no docs anywhere, only in the python proggy in the src repo) is only a taunt.
asciilifeform: i was able to flash in the https://gsdview.appspot.com/chromeos-localmirror/distfiles/cr50.r0.0.10.w0.3.4.tbz2 image ; it supports a few moar commands, including 'rma open' returned-to-factory unlocker thing. but result was , unsurprisingly, 'with notes from hitler only' : http://www.loper-os.org/pub/c101pa/c101pa_unlock_nodice.txt ☟︎
phf: oh those are a special category. my iranians also get distressed because i use old hardware.
phf: i used to get comments about ibook in the early 2000s, like old boomer types asking me about y2k or whatever. get the same reaction with x60 now, some guy on amtrak wanted to talk about bitcoin
phf: http://btcbase.org/log/2018-06-08#1821658 << they could also bring back 701c butterfly keyboard design, but i guess that's too gimicky. ☝︎☟︎
mircea_popescu: (ftr, i am not proposing this agreement as some kind of proof.)
asciilifeform: just like we found with the amd fritz
mircea_popescu: anyway ; basically old lizzards hold exact same pov as tmsr, keeping rsa keys and letting the bumbling kiddies play about with the ecc.
asciilifeform: https://chromium.googlesource.com/chromiumos/platform/ec/+/master/chip/g/config_chip.h#139 << implies that google does not actually hold all of the privkeys
asciilifeform: https://chromium.googlesource.com/chromiumos/platform/ec/+/master/chip/g/rdd.c#20 << as i suspected, thing drives the receiving end of the debug snake ( the http://www.loper-os.org/?p=2415 item )
BingoBoingo: Watching this laptop get molested in channel in near real time is a complete joy.
asciilifeform: more interestingly, https://chromium.googlesource.com/chromiumos/platform/ec/+/master/chip/g/loader/verify.c << there ~is~ an rsa key embedded, apparently one variant for fw update
asciilifeform: https://chromium.googlesource.com/chromiumos/platform/ec/+/master/chip/g/ << support crapola for the chip, apparently.
asciilifeform: this is useful because there is not, apparently, any means for getting a locked h1 to disgorge its fw
asciilifeform: in other noose, i found the vendor binary for my particular box's cr50 (all ver strings match) : https://gsdview.appspot.com/chromeos-localmirror/distfiles/cr50.r0.0.10.w0.3.0.tbz2
asciilifeform: far upstack, re the 'cr50' thread -- asciilifeform woke up today and realized that we can simply cut #wp track on spi rom ( naturally after filling it with e.g. uboot )
mircea_popescu: in the immortal words of brick pollitt, "that will come too."
asciilifeform: with, of course, the grim end of the line, being the glass pseudokbd
asciilifeform: recent boxen feel just about like banging fingers on table
mircea_popescu: yeah, we've not even got to the extra annoying extra short travel distance.
asciilifeform: hell, i'd buy a lappy with a spring kbd. but can only dream of this.
mircea_popescu: keyboard is the size it is. laptop builds around that, the size of the keyboard is not an open engineering problem.
mircea_popescu: good for you but my hands are made for slapping bitches in place. 450mm plox ty.
asciilifeform: i did most of the early trb on that thing
asciilifeform: ( massive tank of a box, 32G, 8core thing, multiple drive slots, kg power brick, etc . but still sad and shallow, vs x60, not even speaking of troo desktop, kbd )
mircea_popescu: asciilifeform, really ? which is this one ?
mircea_popescu: "but mp, who are you to define humanity" shut it. i said, shut it.
mircea_popescu: why the fuck they imagine ~this~ is engineering problem to solve is anyone's guess. but the laptop kbds they produce are reminiscent of lens-shaped dildos. WHY WOULD YOU
mircea_popescu: cuz they insist on making them unwide.
asciilifeform: yea there is not and afaik has never been such a thing as a truly pleasant laptop kbd
mircea_popescu: kbd... well... yeah. though i loathe laptop kbds equally anyway. nonstandard shape
asciilifeform: kinda costly for throwaway
mircea_popescu: i honestly dunno what diff it makes for what's intended as a cheap throwaway anyway
asciilifeform: and better kbd than $3k crapple ( tho similar to decade ago crapple )
asciilifeform: all aluminum ( but the hinge cover, where antenna lives )
asciilifeform: the physical chassis is the very solidly rubbish part
mircea_popescu: so "it's utter rubbish" / "i suspect the os dyi may be sprinkling of holy water, but never checked this. let me know if you establish one way or the other" ?
mircea_popescu: yes, but you still had some sort of thought process.
mircea_popescu: this what ? keep track of why you rejected $item ?!
asciilifeform: i sat down to do this some yrs ago, then decided that life is too short
mircea_popescu: well, don't encourage the "ima make really strong damning statements without my notes" stuff either.
asciilifeform: spyked: reusing parts from existing lappy is possible, tho tricky, you would have to reverse engineer the kbd matrix, buy its weirdo connector somewhere , make kbd scan controller, etc.
asciilifeform: i was actually in line to buy the box myself, for something like a year, turn finally came but by that time i got to see the photos / reviews
asciilifeform: spyked: i could be wrong re the blobs, but iirc there is no fully open loader for a53
spyked: asciilifeform, could please expand re. "blobulent arm"? it's allwinner a53 afaik? I have no comments re. all other points other than: judging from what I hear, only alternative seems "bake own case/kbd/other parts or reuse ones from x60/whatever".
asciilifeform: don't encourage the 'i can peddle liquishit parts that would've been spat on in china street markets decade ago , if i stamp Open on the box!' hucksters.
asciilifeform: blobulent slow arm, non-ips lcd, shitplastic case, toystore keyboard
spyked: re. nsa laptop thread: olimex ppl (huh, it seems I keep mentioning these folks) have a "diy laptop kit" whose specs are very similar to the c101pa (for comparison: http://archive.is/4cp8W vs. https://www.olimex.com/Products/DIY-Laptop/KITS/TERES-A64-WHITE/open-source-hardware , the latter doesn't seem to archive for some reason). it's a candidate for my (by now long) hw-to-buy list, the "open sores diy" aspect is otoh the biggest
mircea_popescu: meanwhile at the beach, https://78.media.tumblr.com/d8b02d8788229d446afa7d98ff438d22/tumblr_oxei6oXluN1ubezpxo1_1280.jpg
mircea_popescu: "NEW YORK, June 05, 2018 (GLOBE NEWSWIRE) -- The Nasdaq Stock Market announced today that it will delist the common stock of Long Blockchain Corp. Long Blockchain Corp.’s stock was suspended on April 12, 2018 and has not traded on Nasdaq since that time. "
mircea_popescu: in other holy shit... google returns my own stored image if you try and find the "porch monkey" thing. jesus f. the web is pointless.
asciilifeform: i used to work with a roughly similar fella, so yes, agree
mircea_popescu: contrary to your respective inclinations, you two'd actually make a great team. very bias-mismatched.
asciilifeform: and the contents do seem to correspond, at least partially, to the published src. so there's definitely something to work against.
asciilifeform: ( which is less painful than if nothing could be shat into it to begin with )
mircea_popescu: honestly, i don't expect either elegance or smoothness come out of the haphazard antidesign style of google et all.
asciilifeform: if can find , e.g., overflow, then can have whatever payload waiting there to be jumped into.
asciilifeform: potentially we find a hole in this process.
asciilifeform: so far i did find how to disable #wp signal on the h1 ( it tracks the battery-triggered #wp ). the way updater works, it permits flashing in any old turd, and it goes in a temp slot, which only on next boot gets ecc-sigchecked
mircea_popescu: honesrtly i'd still rather get this than "go to store buy intel chip"
asciilifeform: this is currently best picture i have ( wish i had the schem... )
asciilifeform: iirc the audio dac sits on i2c also
asciilifeform: this is to count only the onboard (i.e. excluding usb)
asciilifeform: there seem to be 4 onboard busses in the thing; ram ( just cpu and dram ) ; pci ( occupied by 80211 chip , you prolly could safely pull it out, even sits on conveniently protruding bit of pcb ) ; spi ( connects to : cpu; boot rom; ec ; 'h1' ) ; i2c ( connects to cpu ; 'h1' ; voltage regs ) .
mircea_popescu: no but these are arms. i thought this is what arm mostly is, bridge-wise.
asciilifeform: ( given as x86 cpu does not know how to speak spi/lpc/etc )
mircea_popescu: this is the common design, neh ?
asciilifeform: ( i.e. 'h1' does not sit , as far as i can tell, between cpu and bootrom , but rather sits on the bus )
mircea_popescu: in more general terms, if you had to dismantle every organisation the moment it had a mole in it... there'd be no organisations ever.
asciilifeform: fwiw the boot rom reads from linux's ordinary spi driver, in userland
mircea_popescu: so then you know it's been flashed.
asciilifeform: aa in that sense yes
mircea_popescu: i dunno, have the boot flash a pink pixel, put a number on screen, whatever. replacement boot sequence won't know to do it, will it.
mircea_popescu: anyway, can also prep a boot rom that has a canary.
mircea_popescu: something like that.
asciilifeform: i'ma carry on with curing the bootloader then. and when 'h1' pops, it pops, we get clean box
mircea_popescu: so in a sense it's up to you. if you've lost the love of labour because of the cp50 issue, i guess it dies. but if not, i do not see it's a waste of time. make it boot cleanly, try see what happens if you remove the item, try see what happens if you fuzz the item, maybe more stuff occurs -- this is a productive line of research.
asciilifeform: i suspect the thing exists mainly to 1) help 'law enforce' folx pry passwords from unwilling patient's box 2) persistence nest for assorted usgologies installed via pwned userland
mircea_popescu: yes, but it seems to me it's basically a local rootkit. so it's not such an overwhelming concern for the contemplated usecase -- give iphone girly machine.
asciilifeform: but i've not found a remote trigger for it. (dun mean there isn't one)
asciilifeform: mircea_popescu: it can rewrite the boot rom, is what i know for certain so far
mircea_popescu: asciilifeform, do you suspect the core can actually talk to the netbridge ?
asciilifeform: upstack, before i start to fall asleep -- what do we wanna do in re the c101 ? march on with curing the 'ordinary' boot rom, and then sit on the thing pending a successful break of the cr50 booby ? shelf whole thing ? which'll it be