Hacking 2000 years from now...

kzt wrote:All those sort of systems are able to be bypassed by an expert who isn't trying to be subtle or sneaky or worried about someone trying to stop them. Until you get the the actual PAL inside the weapon, which would be very damn hard to work on given that it's inside a sealed warhead inside the sealed aerodynamic fairing inside a sealed launch container iniside a sealed steel tube whose door is held closed by many tons of water pressure.

Luckily the crew has the full launch codes, so they don't need to do that if everyone on board agrees it's time for Beijing to die.

I be bold.

Say whaaaat? Tell that to the laughing perpetrators, whoever they are , of the designers of the Stuxnet worm.

https://en.wikipedia.org/wiki/Stuxnet

Exactly what does that have to do with the price of eggs?

You suggest exactly what approach to reprogram a ROM over a unidirectional serial interface?

kzt wrote:Exactly what does that have to do with the price of eggs?

You suggest exactly what approach to reprogram a ROM over a unidirectional serial interface?

That's exactly what was accomplished long ago when the eggs were the tape drives of a TRS-80 and users needed to utilize a more capable third party BIOS. The native ROM was decoded and supplanted by the user. This was accomplished by dumping ROM for analysis then intercepting the interrupt vector that reported to ROM.

It happened again with the Heathkits, iirc, although they were intentionally designed to do so, as an easy way (for the company only) to upgrade BIOS. Except that the little secret got out.

My attempt was to point out that a completely secure system is at the mercy of the designers and the users --regardless of how many tons of steel or water in which it is encased.

I know that was in the dinosaur days of computing, but idiocy in design isn't an age, it's a state of mind.

cthia wrote:

kzt wrote:Exactly what does that have to do with the price of eggs?

You suggest exactly what approach to reprogram a ROM over a unidirectional serial interface?

That's exactly what was accomplished long ago when the eggs were the tape drives of a TRS-80 and users needed to utilize a more capable third party BIOS. The native ROM was decoded and supplanted by the user. This was accomplished by dumping ROM for analysis then intercepting the interrupt vector that reported to ROM.

It happened again with the Heathkits, iirc, although they were intentionally designed to do so, as an easy way (for the company only) to upgrade BIOS. Except that the little secret got out.

My attempt was to point out that a completely secure system is at the mercy of the designers and the users --regardless of how many tons of steel or water in which it is encased.

I know that was in the dinosaur days of computing, but idiocy in design isn't an age, it's a state of mind.

PAL != ROM

And you can't compare a programmable computer to a hardwired system. Sure, there are ways to compromise a hardwired system but it's difficult and you almost always need physical access. And if you have physical access it's already compromised.

Most OTP IC's for secure applications today are programmed at the factory, the circuit themselves doesn't even contain the circuitry for the programming. Some OTP IC's can't even be reprogrammed since the programming physically alters the circuit. They also contain anti-tampering circuitry which bricks the IC if tampering are detected.

To compromise that type of circuitry you need acid to dissolve the packaging (hoping it doesn't damage the chip) and some very very expensive equipment to probe the naked IC. There are some other esoteric methods to compromise chips also by among other things faking signals into them and cooling.

cthia wrote:

kzt wrote:Exactly what does that have to do with the price of eggs?

You suggest exactly what approach to reprogram a ROM over a unidirectional serial interface?

That's exactly what was accomplished long ago when the eggs were the tape drives of a TRS-80 and users needed to utilize a more capable third party BIOS. The native ROM was decoded and supplanted by the user. This was accomplished by dumping ROM for analysis then intercepting the interrupt vector that reported to ROM.

It happened again with the Heathkits, iirc, although they were intentionally designed to do so, as an easy way (for the company only) to upgrade BIOS. Except that the little secret got out.

My attempt was to point out that a completely secure system is at the mercy of the designers and the users --regardless of how many tons of steel or water in which it is encased.

I know that was in the dinosaur days of computing, but idiocy in design isn't an age, it's a state of mind.

Joat42 wrote:PAL != ROM

Of course it doesn't. I think that analogy went right over your head. No time for a dissertation. This'll have to suffice. "Any type of programming can be supplanted. Given intimate knowledge of the system, physical access, location and/or many other factors. Intimate knowledge of the system itself is compromising. Of course, in Hitler's day, he'd've had the designers shot after it was completed, making a bigger mistake.

And you can't compare a programmable computer to a hardwired system. Sure, there are ways to compromise a hardwired system but it's difficult and you almost always need physical access. And if you have physical access it's already compromised.

Exactly! Now you're catching up. The designers and users already do have this access. We compromise the designers and the users. It is essentially what the army of virus engineers do all the time. The difference between a hacker and a Harkness is conception of problem and intimacy of knowledge.

I'm not comparing the two. I'm huddling them both under the umbrella of being privy to the faults and bugs of the designers, users, human elements and lack of conception.

Most OTP IC's for secure applications today are programmed at the factory, the circuit themselves doesn't even contain the circuitry for the programming. Some OTP IC's can't even be reprogrammed since the programming physically alters the circuit. They also contain anti-tampering circuitry which bricks the IC if tampering are detected.

That level of security was once circumvented in-house, because a systems designer wanted a back door into the process to facilitate... design. That hole was failed to be plugged before production time. The human element strikes... yet... again.

To compromise that type of circuitry you need acid to dissolve the packaging (hoping it doesn't damage the chip) and some very very expensive equipment to probe the naked IC. There are some other esoteric methods to compromise chips also by among other things faking signals into them and cooling.

Many methods limited only by imagination and opportunity availed.

But perhaps. And perhaps more so if a hacker was always looking towards the brute force solution. Of course, some other ingenious and quite resourceful hacker (*who also may somehow have intimate or privileged knowledge) may take advantage of the quantum computer speeds (virtually a Harkness minicomp compared to anything it would be up against) that just hit the market.

A significant order of magnitude of machine cycles of an advancement in tech invalidates any security system. Automagically. Just get me to a port (in Harkness' case) or something.

cthia wrote:..snip..
A significant order of magnitude of machine cycles of an advancement in tech invalidates any security system. Automagically. Just get me to a port (in Harkness' case) or something.

My point was that hacking a closed security system surreptitiously by remote is a futile operation which was what kzt pointed out. Comparing that to stuxnet is irrelevant, even the reference to TRS-80 ROM's or any other computer equipment from the 80's is irrelevant since they only have incidental security with no active design choices behind them in that regard.

And saying that "a significant order of magnitude of machine cycles" can break any system is like saying "magic can break any security". It's a completely open ended statement which in a sense is true but it is also not really relevant in real world applications.

If you are not using physical brute force approaches to break some security measures, the amount of machine cycles needed to break it may take so long that the universe will experience the heath death since it's the speed of the security measure that dictates how fast you can break it - not the speed of the device trying to break it.

Joat42 wrote:

cthia wrote:..snip..
A significant order of magnitude of machine cycles of an advancement in tech invalidates any security system. Automagically. Just get me to a port (in Harkness' case) or something.

My point was that hacking a closed security system surreptitiously by remote is a futile operation which was what kzt pointed out. Comparing that to stuxnet is irrelevant, even the reference to TRS-80 ROM's or any other computer equipment from the 80's is irrelevant since they only have incidental security with no active design choices behind them in that regard.

And saying that "a significant order of magnitude of machine cycles" can break any system is like saying "magic can break any security". It's a completely open ended statement which in a sense is true but it is also not really relevant in real world applications.

If you are not using physical brute force approaches to break some security measures, the amount of machine cycles needed to break it may take so long that the universe will experience the heath death since it's the speed of the security measure that dictates how fast you can break it - not the speed of the device trying to break it.

Boy could I take you to school if the motivation and the time was there — and I wasn't feeling antsy about discussing methods of circumventing security in a forum.


****** *


Now, at the moment Tchaikovsky's going to fry more speakers. How else to spend a free Saturday evening with long time friends when your wife is an ocean away!

Most security systems and technology fail-safes are not designed to stop some one like Horace Harkness who has been described as one of the best hackers and engineers in the series.What really helped his efforts was that PRN tech was designed to be easily maintained by low skilled and trained personal(at least compared to RMN standards).

pnakasone wrote:Most security systems and technology fail-safes are not designed to stop some one like Horace Harkness who has been described as one of the best hackers and engineers in the series.What really helped his efforts was that PRN tech was designed to be easily maintained by low skilled and trained personal(at least compared to RMN standards).

Well, no most are high on flash and buzzwords and cool new features. And cheap to build.

Serious systems are in fact designed to stop experts. That is why DoD communication electronics has the APL instead of just the FIPS certification. As another example, some of the most experienced safecrackers in the world work for UL testing safes. They get the blueprints and lots of time to examine a sample inside and out. Then they lock it and attempt to break in, getting the tools and time the cert the mfg wants says it can resist. That's because the insurance companies that created UL have a lot of interest in keeping crooks out of safes long enough for the police to show up.

cthia wrote:Boy could I take you to school if the motivation and the time was there — and I wasn't feeling antsy about discussing methods of circumventing security in a forum.

Wow, that was a really cogent and information-filled comment that explains that you where right and I was wrong...