Potential major security flaw on HP laptop?

http://www.rtl-sdr.com/potential-major-security-flaw-hp-laptop-discovered-rtl-sdr/

by tlrobinson • 13 years ago

64 19 13 years ago

codezero2• 13 years ago

I'd like to see if others are seeing this same behavior on the same model. Maybe he has some weird malware that keeps the microphone live?

mschuster91• 13 years ago

Malware, though, would likely not be able to actively send stuff out via the air.

codezero2• 13 years ago

Agreed, but I'm not convinced that a weak FM signal isn't just some electronic artifact of a crap board crammed in with a bunch of other tiny components that happens to be triggered when the microphone is on.

ealexhudson• 13 years ago

It seems unlikely that the flaw was intentional - there are much better ways of leaking audio that are much more difficult to detect. But it's interesting that the design and the cheap components or whatever have all conspired to leak the audio in FM.

If nothing else, it's a great lesson in how security is just a very difficult subject, and 'secure' an almost nirvana-like state in terms of the impossibility of achievement.

simcop23872• 13 years ago

Yep I'd definitely chalk this down to being unintentional myself. I'd guess that there's leakage from the ADC on the mic which won't likely ever be turned off since clock gating it would be difficult (many of those guys talk on SPI or I2S or some such, which doesn't make that easy) and gating the power could have all kinds of noise issues during power on and off. Why it's that easy to pick up and why around 24mhz i'm not sure myself.

iyulaev2• 13 years ago

My best guess is that your sound is stimulating some capacitor connected to a voltage-controlled clock oscillator in the laptop. The voltage provides by the sound is causing the frequency of the VCO to move around slightly. 24M is a pretty common frequency in electronics for use as a general-purpose digital clock.

ansible• 13 years ago

I concur. If another laptop of the same model doesn't show the problem, that points to a manufacturing defect.

It can be easy to route noise through an area the designer didn't intend with a simple solder blob or a defective power supply bypass capacitor. 24MHz could just be a frequency of a crystal oscillator.

I'd want to know the actual power level of the transmission, but to measure that accurately, you'd want to put the laptop in a shielded chamber.

jonmrodriguez• 13 years ago

Forgive my beginner question:

What makes clock gating of SPI & I2S difficult?

As an example component, here's a SPI mux by Maxim that has 8 separately-controlled SPST switches for <= $3.30 (probably much cheaper at scale). http://www.maximintegrated.com/datasheet/index.mvp/id/1281 So, if you utilize this fully, you could clock-gate 8 separate SPI components for < $0.42 each, right?

Is a mux the wrong way to do it? What's the proper implementation?

legogt• 13 years ago

Typically, a converter is fed (or generates internally) a few clocks at multiples of the base sample rate. Depending on the CODEC the highest clock could be 256baseFS or even 512baseFS. At a common rate of 48kHz (which cleanly divides samples into both 30fps and 8kHz USB uFrames) this ends up at 24.576MHz.

Keeping the clocks running makes it easier to start streaming audio. Otherwise, restarting the clocks means you have to wait for them to settle before pulling the ADC out of reset. After that you have to flush buffers, align samples for phase/latency, and artificially zero the input stream until the rest of the circuitry settles down. Keeping the clocks running means turning the input on or off is only a matter of passing the audio samples or passing zeros.

Also, if the system isn't grounded properly then the analog input could definitely find its way onto the 24.576MHz MClk. In the audio world, digital noise leaking into the audio stream is universally bad while no one usually bats an eye at analog leaking into the digital domain.

It's definitely lazy from a security standpoint but probably not intentional.

warfangle• 13 years ago

My roomate was just issued one of these "laptops." They weigh a ton, the keyboard doesn't work worth a damn, the trackpad is all but useless, and the wifi is flakey -- and it's brand new. Judging from its build quality, it's completely unintentional that this kind of leak was possible.

It's obviously completely intentional that the laptop be put together with less aplomb than a speak 'n spell.

fnordfnordfnord3• 13 years ago

They weigh a ton, the keyboard doesn't work worth a damn, the trackpad is all but useless, and the wifi is flakey

Sounds like every HP consumer product I have ever seen or used, especially laptops.

fnordfnordfnord3• 13 years ago

Unintentional in what sense? As in not a gov't conspiracy? Sure. But cheap, poor quality is by design, unless you think this is the best HP could do.

Now, if only there were some gov't agency that could regulate the emissions standards for electronic devices sold in the US. /sarcasm

tlrobinson• 13 years ago

Relevant slides from a Defcon talk by Melissa Elliott / @0xABAD1DEA: https://docs.google.com/presentation/d/1Z_IRt6R2FL7POeY4J-pY...

cnlwsu• 13 years ago

wow thats a really interesting set of slides.

Nick_C• 13 years ago

That's one of the most engaging presentations I've seen for years. I laughed out loud at slide 38.

Thanks for the link.

bugmen0t• 13 years ago

</conspiracy> This one explains the issue quite well: http://www.reddit.com/r/RTLSDR/comments/1le3if/so_i_discover...

Learn your electronics and don't believe in rumors ;)

Potential major security flaw on HP laptop?

Related Stories