Can you get root with only a cigarette lighter?

https://www.da.vidbuchanan.co.uk/blog/dram-emfi.html

by 1317 • 2 years ago

681 150 2 years ago

da.vidbuchanan.co.uk

You know when your employee quits how you have to block all their accounts? Now imagine they have access to the server room!

pantulis• 2 years ago

And that's why server rooms should have proper physical security.

appendix-rock• 2 years ago

And why “they’ve got physical access, so all bets are off” isn’t an excuse to stop trying

amelius• 2 years ago

And be wrapped in tinfoil.

0xdeadbeefbabe• 2 years ago

This kind of work can't be done under pressure at least not a PoC.

hinkley2• 2 years ago

I find the idea of being escorted out of the building after giving notice a bit insulting. I’ve been interviewing for weeks, I’ve probably been holding this piece of paper since last night when I printed it out at home.

I’ve had plenty of time to fuck with things before I told you I was leaving. You’re just screwing over my coworkers by taking access to me away with zero notice.

mimentum• 2 years ago

I read this wrong.

CartwheelLinux• 2 years ago

I only want glitches to happen on-demand, not all the time.
My injected ELF also flushes the page cache

The difference between a padawan and a jedi

Amazing write up and bonus points for the reproducibility of this creativity.

jojobas• 2 years ago

Back in the day of analog electronic locks a piezo zap into the lock case would unlock 4 out of 5 apartment building locks, root access IRL.

zephyreon• 2 years ago

My immediate thought was that this was a post about how someone got root access to a cigarette lighter and I was totally ready to believe it.

My parents oven gets regular software updates so I didn’t even question whether the cigarette lighter was “smart.”

onionisafruit2• 2 years ago

From the title I half expected an incendiary version of rubber hose cryptography.

sim7c003• 2 years ago

ooh i want a smart lighter, so i can use my phone in one hand to light the lighter in the other hand :O

medstrom• 2 years ago

Sell pyromaniacs this product, find the lighter two months later in a burned-out building, use it to identify which phone did it, catch perp.

deepspace• 2 years ago

Well, the soldering iron I use most often has modifiable firmware running on a RISC-V SOC. (https://pine64.com/product/pinecil-smart-mini-portable-solde...) Who knew that melting lead could be that complicated. So I would totally believe an article about rooting a lighter.

Lockal• 2 years ago

I thought they are calculating square roots using the shape of flame...

Nevermark• 2 years ago

So ... a lighter with a little solar panel, and a battery, which generates sparks like a tiny taser when the lidar detects a suitably proximate cigarette or cigar. But not a finger or hot dog.

No button pushing. No lighter fluid refilling ... ever. The world waited a long time for this.

And obviously it needs a chip to run the lidar, and generate the simultaneous brilliant LED flash and fade, haptic jolt, and accompanying sound effects.

(Can some demo freak please create this? And make it look like a little revolver? But for finger and hot dog safety, you are going to have to harden the virtual memory controller...)

ano-ther• 2 years ago

Sure, if you solder an antenna to your memory first :-)

But good and thorough write-up about how to actually exploit such a glitch.

And you could also use the cigarette lighter for hanging out at the data center back door and wait until the admin comes for a smoke.

Retr0id2• 2 years ago

This should theoretically work with bit-flips in any bit position between 29 [...] and 12 [...] Therefore, soldering the antenna wire perhaps isn't totally necessary, if you can generate strong enough electromagnetic interference

abound• 2 years ago

Mentioned elsewhere in this thread, but you need not only "strong" but "highly directed" electromagnetic interference. Each of those pins is ~0.5mm, flipping a single bit "wirelessly" is probably impossible, as your inference will cause issues in many more places than just your target.

Maybe that unlocks different and exciting hacks, maybe it just melts your machine.

hardburn• 2 years ago

Down in the "practical use" section, one use case is bypassing copy protection on consoles.

vessenes3• 2 years ago

I like this. Upshot - electrostatic bit flip on memory read or write, which with solder can deterministically get a 'safe' pointer mutated into your own evil pointer.

Generally the historical perspective on physical access was: "once they have it, game over." TPM and trusted execution environments have shifted this security perspective to "we can trust certain operations inside the enclave even if the user has physical access."

His next steps are most interesting to me -- can you get something (semi-) reliable without soldering stuff? My guess is it's going to be a lot harder. Lots of thought already goes into dealing with electrical interference. On the other hand, maybe? if you flip one random bit of a 64 bit read every time you click your lighter, and your exploit can work with one of say 4 bit flips, then you don't need that many tries on average. At any rate, round 2 of experimentation should be interesting.

onionisafruit2• 2 years ago

if you flip one random bit of a 64 bit read every time you click your lighter

Without the antenna it would be hard to limit it to a single bit getting flipped. At least that’s what I suspect.

Retr0id2• 2 years ago

On the flip-side (heh) flipping multiple bits at once should make it possible to bypass ECC

vessenes3• 2 years ago

we need a tinfoil waveguide clearly

wang_li• 2 years ago

If you have physical access to a device that you can solder an antenna you can compromise a TPM or anything else by sticking a custom DIMM in there that you can program from the “back side” so you can replace any part of memory with anything you want anytime you want. You don’t have to randomly flip a bit and hope for the best. You just inject your entire program.

tucnak• 2 years ago

Unless the hardware employs some variant of encrypted RAM, see cool paper by the NSA from a few months back that includes benchmarks in FPGA and silicon https://eprint.iacr.org/2024/1240

vessenes3• 2 years ago

A bit late in reply but dont forget that PUFs are a thing too.

Threat models vary of course. I personally believe my iPhone is safe against back side memory hardware swaps if I have turned it off. I could be wrong though!

intothemild2• 2 years ago

This reminds me of exploits we used to do to arcade cabinets back in Sydney in the 80's and 90s. The school gas heaters used to have what we called "clickers", piezoelectric ignition devices you could remove from the heaters.

You then took that clicker to your local arcade, and clicked one of the corners of the CRT, that would send a shock through the system and add credits to your game. I believe this was because the CRT was grounded on the same ground lines that the mechanism for physically checking a coin had gone through the system.

Suffice to say, they caught onto this over time, and added some form of an alarm into it. But up until then... Those were truly the best times.

chasd00• 2 years ago

This brings back a vague memory of smacking the side of a pinball machine just right and getting a free game. I bet it was the same concept.

intothemild2• 2 years ago

I imagine (with zero research) that the mechanism for adding credit would be the coin goes through a slot, and either itself completed a circuit, or the coin as it travels moves some lever to complete a circuit. So I imagine if you hit the machine just right, you'd also move that lever.

devmor• 2 years ago

You were likely causing the spring-loaded mechanism that detects a coin insertion to make physical contact.

candlemas• 2 years ago

Just like The Fonz.

giancarlostoro2• 2 years ago

Reminds me of an arcade machine a friend would get behind, turn it off and back on, and it would give you a free token. Maybe its designed that way so the employee can test it for free, not sure. But he climbed behind it, and proceeded to play for free.

IWeldMelons2• 2 years ago

Those who lived in USSR remembers soda vending machines (they poured your drink in a glass cup; you were expected to wash it before using by pressing on a cup, which stood upside down on plastic plate with holes, kinda inverted shower head; very unhygienic, I know). Well it had a button behind that let you have a free drink. You could also "upgrade" pure carbonated water (1 kopeyek) to a sweet soft drink (3 kopeyek) by pressing another button. needless to say schoolchildren would abuse the hell out of this "feature".

everforward4• 2 years ago

I believe some of those early arcade games were more electrical engineering than software engineering, so perhaps it was easier to set it up that way?

To my understanding some of those early arcade games also had jumpers to control some of the behavior. It could be that a tech set the "free credit on reboot" jumper and forgot to reset it when they were done.

luismedel• 2 years ago

This trick worked in Telefonica's phone booths in Spain in the 90s too :-)

chrisweekly• 2 years ago

I vaguely remember (sometime in the 80s) sticking a straightened paperclip into a small hole on the face of a payphone to avoid having to drop a dime / quarters, and being able to call anywhere.

zxexz• 2 years ago

I remember when Verizon phone booths in the US started accepting the credit cards, for a while they would accept any 16-digit number with a valid IIN that passed the Luhn check.

astrostl• 2 years ago

This also worked in the USA. By the 1990s most arcades operated on proprietary tokens rather than coin currency. Many had skill-gambling machines that had sliding rows covered in tokens, that you would try to dislodge with your own tokens and keep what was displaced.

The "Jungle Jive" version of this would dispense tokens out the opposite side of the machine if the electric ignition of a cigarette lighter was used to lightly shock the metal intake slot. If you clicked it too much too quickly it would go into an alert mode. While this could be accomplished solo, the ideal MVP setup was a team of three: one scout to watch for employees, one to click, and one to collect.

TowerTall2• 2 years ago

We did the exact same thing early 80's except that we used the clicker found in disposal lighters.

We did it for a couple of years until they figured it out and started to conver the arcade cabinets with transparent plastic.

At the same time they also drilled holes at the back of the machine for ventilation as the rest of the case now was sealed in plastic.

We found out that using a bamboo stick you could press the lever that register when a coin has been paid into the slot.

That made them relocate the holes for the ventilation to the top of the case instead of the back so we couldn't get the lever anymore. Or so they thought. haha

We discovered that by pressing a coin up the return slot — the one where you get your coin back if it isn’t accepted — you could also trigger the lever for coin registration and the free gaming continued.

Eventually they put in sharp screws into that coin return box so you would cut your finges.

After that we got a SEGA. Was great fun :)

jacobgkau3• 2 years ago

At what point does the arcade just kick you out? I can't imagine them seeing you continuously tamper with their equipment to circumvent paying and think, "the best way to handle this is to keep modifying our machines."

throaway89• 2 years ago

I always wondered why arcade cabinets were covered in plastic. Till now i thought it was for spills or something.

roymurdock2• 2 years ago

super cool

j0hnyl• 2 years ago

I remember reading about this in this book, about the hacker named Pengo who was known for adding credits to arcade games in the same manner.

https://www.amazon.com/CYBERPUNK-Outlaws-Hackers-Computer-Fr...

beeflet• 2 years ago

how did you stumble across this one?

beAbU• 2 years ago

Children in a large group that's unsupervised is about as close to infinite monkeys on infinite typewriters as you can get. If you present them with a challenge that has some tangible reward at the other end (free games), you are guaranteed a solution at some point.

The universe's RNG just happened to roll favourably in Sydney in the 90s and the rest is history.

ballenf• 2 years ago

The inspiration here was getting root on the Switch 2. Getting root in Linux was the POC. The goal was not demonstrating some fundamental security vulnerability that's practically exploitable, but instead for reclaiming actual ownership of one's own hardware without breaking TPM or game ring 0 anti-cheat.

karlgkk• 2 years ago

I appreciate the sentiment, but I suppose don't understand the point. 20 years ago, when consoles were powerful computers sold at a loss or low margin, it made more sense. Now though, Nintendo sells their consoles at a profit (and the Switch 2) is likely to be the same.

This is impressive, and I'm glad people are working to preserve software freedom, but I'd rather just support the alternatives.

Why give them the perceived install base, and profit? Why not get a steam deck or one of the many other handhelds that you have - day 0 as a feature - root access on?

mgaunard3• 2 years ago

People tend to care about the games, and buy whatever platform those games run on, not the other way around.

xandrius• 2 years ago

Exclusive games, support the types of games they make, the services/events they provide, etc.

You can still like all that and want to gain full control of the device you own.

adrian_b• 2 years ago

...

"Finally, I'd like to thank JEDEC for paywalling all of the specification documents that were relevant to conducting this research."

roymurdock2• 2 years ago

"It's just one resistor (15 ohms) and one wire, soldered to DQ26. The wire acts like an antenna, picking up any nearby EM interference and dumping it straight onto the data bus."

really neat hack. using the lighter to create EM interference. better go light up next to my DDR bus and see what happens :)

mikewarot2• 2 years ago

Can You Get Root with Only a Cigarette Lighter?

No, you can't. That long lead to couple your ersatz pulse generator defeats all the engineering put into making the computer reliable and quiet in the EMI sense.

Circuit bending is fun stuff, but it's not a remote exploit.

jasongill• 2 years ago

Where in the article does he say this is a remote exploit?

_joel2• 2 years ago

The old saying of "if you've got physical access, game over", is where this applies.

RIMR• 2 years ago

This guy literally got root using a cigarette lighter, and your attempt to debunk it is to suggest that physical exploits don't count?

If you only care about remote exploits, fine, but don't go scolding others for accomplishing things you can't.

mikewarot2• 2 years ago

Do it without the precisely connected wire, and then you can say "only a cigarette lighter" as mentioned in the title, otherwise it's click-bait

Pikamander2• 2 years ago

When I saw the title, I was expecting this to be about hacking a modern car with one of those USB-C cigarette lighter devices.

KolmogorovComp• 2 years ago

Just wanted to say it was an amazing write-up.

smcl2• 2 years ago

I reckon you can get a root with just a cigarette lighter if you hang around outside the right bars in Australia

Stefan-H2• 2 years ago

And worst case there is always the rubber hose.

twelve40• 2 years ago

...or a $5 wrench

jacobgkau3• 2 years ago

I think you misunderstood the Australian slang. That person was not referring to the XKCD concept. They were referring to another meaning of the word "root."

mensetmanusman• 2 years ago

Next, a balloon and carpet!

sim7c003• 2 years ago

socks! and kickng device thru the room!

_joel2• 2 years ago

Nice trick, now do it with cosmic rays!

i4k4• 2 years ago

This was very well written and an amazing challenge but my brain is wired to that "hacking common sense" that if you have physical access then it's already over... the first thing that came to my mind was that, if you have physical access, then you can reflash the BIOS, install a driver backdoor, you can boot a live OS and then it's just a matter of tampering /etc/{passwd,shadow,groups, etc} ...

but I remembered that most of the physical access hacks would not be possible if the disk is encrypted.. which then makes this kind of hack enormously attractive.

The antenna idea can be extended to be a piece of hardware with the interference device built-in (piezo or whatever) which communicates with the external world with any wireless medium and then the attacker can trigger the interference remotely. This, plus a website controlled by the hacker which the victim is scammed to visit can be enough to make it viable.

333c• 2 years ago

The motivation in the introduction is rooting/jailbreaking a handheld game console. I think this is a perfectly plausible situation where you have physical access but still want to obtain "unauthorized" access.

i4k4• 2 years ago

I get it, makes sense

johnisgood• 2 years ago

I remembered that most of the physical access hacks would not be possible if the disk is encrypted..

Only if you have not booted into your system through using a keyfile or a passphrase to decrypt the data, i.e. if your PC is shut down. I have full disk encryption, and when I boot into my system, it uses the keyfile with which it would perform the decryption, and boom, I have my PC ready to be accessed physically.

causal• 2 years ago

Would flashing BIOS post-boot really work though?

Also don't see how the article's exploit would be useful pre-decryption.

ruslan2• 2 years ago

AFAIC, reflashing BIOS won't give you anything, you need to sign it first with proper private key which is checked by the CPU hardware before execution begins. This EMI trick fools CPU itself and I cannot see how it can be fixed, unless new paging algorithm is invented.

themoonisachees• 2 years ago

This specifically is trivially defeated by ECC, though it wouldn't be that much harder to instead flip 3 bits and ECC would be unable to help. ECC has very poor penetration outside the server world though, so we're still safe. For now.

i4k4• 2 years ago

It depends on the target hardware.

- https://github.com/binarly-io/SupplyChainAttacks/tree/main/M...

- https://github.com/binarly-io/SupplyChainAttacks/tree/main/L...

- https://github.com/binarly-io/SupplyChainAttacks/tree/main/P...

m3kw9• 2 years ago

I’m gonna do one with “ Can You Get Root With Only my bare hands?”

_trampeltier• 2 years ago

2 days ago

https://news.ycombinator.com/item?id=41748861

mmsc2• 2 years ago

Not only is it a fun exploit, this is also a cool mini-introduction to how caching works for CPUs.

I remember a year ago or so there was a submission here which detailed how computers work and are build starting at the tiniest part: starting with logic gates, IIRC. Anybody remember what that website was?

pvitz• 2 years ago

Do you mean nand2tetris? https://www.nand2tetris.org/course

mmsc2• 2 years ago

Hmm, no but similar. This was about full-scale personal computers.

drclegg• 2 years ago

The one by Ben Eater?

treflop• 2 years ago

I thought OP was going to do this without soldering anything.

But I feel like soldering something is no different than just like splicing a telephone cable in half and putting your own headset in the middle…

Except instead of putting a headset, you crudely use a lighter…

drilbo• 2 years ago

I'm looking forward to your write up on getting root with a headset

antaviana• 2 years ago

I thought this was about getting the root password by burning the sysadmin with a cigarette lighter (https://xkcd.com/538/)

sim7c003• 2 years ago

fun read. wonder if someone can do it with one of those lemon batteries, u know.. when life gives u lemons... get root!

pantalaimon• 2 years ago

Three men on a boat.

With four cigarettes, but no lighter.

How are they going to smoke?

i4k4• 2 years ago

they throw 1 cigarette overboard :-)

hinkley2• 2 years ago

That’s worse than the elephant joke.

_ache_• 2 years ago

I followed him on mastodon, the article is cool too. On Mastodon, there is a video of the root access where one can see the screen.

https://mastodon.xyz/@retr0id@retr0.id/113252910481164528

rcakebread• 2 years ago

Just burned my sysadmin with a lighter. The root passwrod is "OWWhAThtefuck'.

sfc32• 2 years ago

I read it as "Can you get A root with only a cigarette lighter?"

oluckyman• 2 years ago

Depends how desperate for a smoke the other person is.

einpoklum• 2 years ago

I can get root with only a spoon!

However, I'm not sure the kind of root you want unless you're into horticulture.

echoangle4• 2 years ago

Can someone explain why the EMI would cause a Bitflip and not always a high read? Why would a pulse invert the signal that’s read? Don’t the voltages effectively get added?

amenghra• 2 years ago

It depends on how the analog signal is encoded. In some protocols, a 1 is encoded as high-then-low and 0 is encoded as low-then-high.

echoangle4• 2 years ago

Ah good point, I was assuming simple TTL where signal level is the bit that’s transferred, RAM is probably using something more complex

missinglugnut2• 2 years ago

You need to think of EMI as having a magnitude and a direction. Half the time you are adding a negative voltage.

echoangle4• 2 years ago

Since he’s using a Piezo lighter, shouldn’t it be just a single DC pulse like discharging a capacitor?

james_a_craig2• 2 years ago

Sign matters as well as magnitude. The pulse created will have both a positive and negative part - waveform sort of like --^v-- and so you can get either direction bit flip. It's not equivalent to connecting a battery to the pin; EMI's more like AC in that it goes both directions.

tinix• 2 years ago

reminds me of using a modified milty zerostat to use the spark gap to induce emp for glitching.

sizzle• 2 years ago

This is the kind of content I come to HN for, thanks OP. Really mind blowing how talented some folks are.

How long would it take someone to acquire these skills?

metadat• 2 years ago

What is the purpose of the "_" in "0x100_0000"? AFAICT, it doesn't change anything.

  >>> 0x100_0000
  16777216
  >>> 0x100_0001
  16777217
  >>> 0x1000001
  16777217
  >>> 0x100000_1
  16777217

a57721• 2 years ago

It visually separates digits in numeric literals.

grotorea• 2 years ago

Compare for readability: 0x0100000100001000 vs 0x0100_0001_0000_1000

sweeter• 2 years ago

This is so awesome! I just love this stuff, I hope that I can be at this level one day. Also I love how we're side-eyeing the switch 2 lmaooo thats bold considering Yuzu, Ryujinx and the 100+ YT creators Nintendo has either taken down or copyright struck this past week.

King-Aaron• 2 years ago

Reading this as an Australian, it interprets differently. Yes, depending on your negotiation skills you can get a root with only a cigarette lighter.

worthless-trash• 2 years ago

Oh, look at mr(s) attractive here..

thomasfromcdnjs• 2 years ago

Thanks for the laugh - Fellow aussie

lihaciudaniel• 2 years ago

I wish i could root my redmi note 8 pro like this

londons_explore2• 2 years ago

If you wanted to defend a system from this, a big chunk of defence would be to choose a system with ECC, and then to halt() the whole system when an ECC error occurs.

Since the attacker is very unlikely to flip the exact right bits to make ECC match, their exploit is very likely to be detected before it succeeds. halt() is necessary so the attacker cannot have more tries at it.

Obviously you have the downside that real memory errors cause the system to crash.

londons_explore2• 2 years ago

Would things like AMD's "Secure encrypted virtualization" protect against this? Is the data XORed with a key (therefore letting bitflips propogate) or is the data actually encrypted (meaning a bitflip in the input leads to a totally different address)

otteromkram• 2 years ago

Cranky comment: Putting your code comments in line with the code is less readable than putting the comment on the preceding line. Most people get what you're going to talk about from the context.

AStonesThrow• 2 years ago

  csh% Got a light?
  No match.
  csh% sudo got a light?
  No match.
  csh% man 5 betteridge

rbanffy• 2 years ago

Before reading the article, my approach would be so much darker… a bit of gasoline and a lighter can do wonders for the memory of a person who “forgot” a password.

Might need duct tape and a chair as well.

burjui• 2 years ago

Apply the flame to the sysadmin's hand and get root access. I mean, it's a cool demo, but if you can solder crap to the hardware, might as well do anything that physical access provides normally. Like, you can just install the payload without the exploit.

Can you get root with only a cigarette lighter?

Related Stories