Top all-time · #941
Trammell Hudson
Personal blog · trmm.nethardwaresecurity
Trammell Hudson's personal blog at trmm.net covers hardware and security. Since 2014, 73 different Hacker News readers have linked it 108 times, most often “Modchips of the State”. No feed was found, so read it on the site itself.
Collection of my projects and hacks.
Most-linked posts?
- Modchips of the State5 people · 5 mentions · first linked 2019-01-08
- Thunderstrike – Apple EFI firmware vulnerability4 people · 4 mentions · first linked 2015-01-01
- Hacking Your Dishwasher4 people · 4 mentions · first linked 2022-10-09
- Apple EFI Firmware Security Vulnerabilities4 people · 4 mentions · first linked 2014-12-27
- AVR RFID3 people · 4 mentions · first linked 2018-01-02
- Heads secure boot3 people · 3 mentions · first linked 2016-12-27
- Yubico with new 4096-bit keys and gpg-agent for ssh authentication3 people · 3 mentions · first linked 2015-07-02
- Sleep Attack: Intel Bootguard Vulnerability Waking from S33 people · 3 mentions · first linked 2020-11-10
- /Mac-SE_video2 people · 5 mentions · first linked 2016-12-18
- /2 people · 2 mentions · first linked 2017-04-16
What Hacker News says?
Ah - brings back memories of the old teletype I first used that had an actual mechanical bell that rang if it got that. Similar to https://trmm.net/Model_ASR33_Teletype
Comment linking /Model_ASR33_Teletype
on “Show HN: Bel”Submitted Thunderstrike – Apple EFI firmware vulnerability as a story · 392 points
HN discussion> That said I don't like contributing to the business model of paying for privacy - seems broken. I fully agree. But to be fair, in a other comment someone linked to a website [0] explaining that the app could be used without connection to internet. So in this case perhaps Bosch didn't have as much of a malicious intent as originally thought. Quote from the link: However, [..], the BSH "HomeConnect" appliances have…
Comment linking /homeconnect/
on “I won't connect my dishwasher to your cloud”Submitted PDP-11 Booting as a story · 221 points
HN discussionI will high-jack this top-rated comment to link to a comment further below. https://news.ycombinator.com/item?id=43469297 This comment has a link to [0], explaining, in plain text: However, perhaps inline with the German attitudes towards privacy, the BSH "HomeConnect" appliances have a no-cloud mode built into their app without any hacks required to disconnect them from the internet. They do require a one-time conn…
Comment linking /homeconnect/
on “I won't connect my dishwasher to your cloud”Submitted SPI Flash as a story · 194 points
HN discussionSeems like this Home Connect stuff does support local only/no cloud mode[0]. I recently discovered my parent's kitchen hardware is all Bosch with Home Connect and was afraid I had to run it through their cloud. But there seems to be some decent effort done in getting it to work with Home Assistant[1]. [0] https://trmm.net/homeconnect/ [1] https://github.com/hcpy2-0/hcpy
Comment linking /homeconnect/
on “I won't connect my dishwasher to your cloud”Submitted Thunderstrike 2: Mac firmware worm details as a story · 155 points
HN discussionFirmware passwords can be bypassed by a local user with a Thunderbolt Option ROM. The 10.10.2 fix for Thunderstrike left that hole open during normal boots: https://trmm.net/Thunderstrike_FAQ#Is_Thunderstrike_fixed_in...
Comment linking /Thunderstrike_FAQ
on “Hidden backdoor API to root privileges in Apple OS X”Submitted Apple EFI Firmware Security Vulnerabilities as a story · 150 points
HN discussionIf the USB device from the article is doing anything along the lines of BadUSB or EFI compromise, then re-imaging your server won't accomplish much. https://trmm.net/EFI
Comment linking /EFI
on ““Warning: Do Not use my mirrors/services until I have reviewed the situation””Submitted Yubico with new 4096-bit keys and gpg-agent for ssh authentication as a story · 107 points
HN discussionTrammell Hudson in 2009 reverse engineered the firmware of the Canon EOS 5D Mark II because he was frustrated with some of the limitations in the camera's firmware when making short films. That little hack turned into Magic Lantern. On his website [1] you'll find a screenshot [2] of his first success: adding three extra vanity letters to the firmware version number. He states: "Re-writing strings is a good easy tech…
Comment linking /Taking_things_apart
on “Magic Lantern”Submitted Modchips of the State as a story · 101 points
HN discussionStarted by Trammell Hudson of Thunderstrike fame (and many other interesting projects), see https://trmm.net
Comment linking /
on “Magic Lantern”Submitted MDT9100 as a story · 98 points
HN discussionCheck out trmml's thunderstrike for an example of a working hardware worm. Its not exactly what you are outlining, but close enough for me to think 'yeah, does not need a nation-state level actor to do'. It would be a different exploit chain for HDMI, and I am no expert in either HDMI or thunderbolt to make a claim that its possible, but I've been surprised with the amount of complexity HDMI offers. https://trmm.net…
Comment linking /Thunderstrike/
on “HDMI Firewall”Submitted PDP-11 Booting as a story · 96 points
HN discussionThat's very similar to what people are doing with the BeagleBone black...there's a pair of PRUs in the AM3XXX processor that have direct access to memory. So, you do the hard work on the ARM, but let the PRU push pixels (or other data) that needs to be real time, jitter free, etc. This guy is driving the CRT on an old mac with it...very cool: https://trmm.net/Mac-SE_video
Comment linking /Mac-SE_video
on “Wolfenstein 3D – Gameboy cartridge with co-processor”Submitted Vector Games 32c3 as a story · 78 points
HN discussionNope. That's dangerous, TPM keys can be sniffed on the bus: https://trmm.net/tpm-sniffing/
Comment linking /tpm-sniffing/
on “How to programmatically find out if computer is on”Submitted Systems software research is still irrelevant as a story · 61 points
HN discussionIt's about expected levels of risk and the level of risk you're willing to accept. e.g. Risk of Apple deploying a malicious binary: low [0] Risk of J Random Dev deploying a malicious binary: higher, after they plug in a Thunderbolt adapter they found laying around at 32C3 [1]. So you might be willing to accept the risk of using a closed source OS, but an app doing interesting low level (?) things to the OS? Maybe no…
Comment linking /Thunderstrike_2
on “A statement from f.lux about Apple's recent announcement”Submitted Hacking Your Dishwasher as a story · 42 points
HN discussion> My dream is to intercept the write-enable lines on the flash chips holding these firmwares so I can lock out updates. And schedule a daily reboot for any memory-resident-only crap. There was an open hardware project for SD card emulation, where the emulator could reject writes, https://github.com/racklet/meeting-notes/blob/main/community... OSS emulation for SPI flash, https://trmm.net/Spispy/ Some USB drives (Kan…
Comment linking /Spispy/
on “The Pumpkin Eclipse”Submitted The Joy of Taking Things Apart as a story · 19 points
HN discussionTrammel Hudson's vector display and oscilloscope tagged articles are worth a look as well: https://trmm.net/Category:Vector_display Also the hostile treatment he got from the MAME developers is kind of amusing: https://github.com/mamedev/mame/pull/483
Comment linking /Category:Vector_display
on “Quake on an oscilloscope (2014)”Submitted Linux as a UEFI bootloader and kexecing windows (2022) as a story · 12 points
HN discussionCheck out this project! https://trmm.net/Ikea/ Apparently, the firmware on some IKEA smart home devices can be easily flashed.
Comment linking /Ikea/
on “Our fridge just emailed us to say we opened its door too many times”Submitted Spispy: Open-Source Flash Emulation as a story · 7 points
HN discussion
