• Samsung Galaxy Nexus with Ice Cream Sandwich hands-on (video)

    The Galaxy Nexus (formerly referred to as the Nexus Prime) carries on the Nexus torch in spectacular fashion, and we've just spent a few quality moments with one here at the launch event. Design-wise, it's clear that the Nexus S DNA is here, though the rear reminds us most of the Galaxy S II. Those who abhor physical buttons will also be delighted, and while we'd gotten used to the whole Power + Home for a screenshot on the GSII, Power + Volume Down works just fine on this fellow.......

  • Android 4.0 Ice Cream Sandwich now official, tons of enhancements

    PSHax member - Google has taken the stage in Hong Kong to make the next version of Android OS, nicknamed Ice Cream Sandwich, a thing of reality. Better known as Android 4.0, the update offers a massive redesign to the user interface and adds a plethora of new features. Some of the highlights include an NFC-enabled feature called Android Beam, offline search in Gmail, new lock screen features and a fancy unlocking method called "Face Unlock," which uses facial recognition to ensure strangers can't use your phone without permission. Ice Cream Sandwich also includes enhancements in.....

  • Motorola RAZR to get updated to Ice Cream Sandwich in early 2012

    Mutricy mentioned that while the company's new flagship device was designed for Gingerbread, plans have been set to introduce the latest version of Android in the start of 2012, with a more precise date naturally on its way. Given past experience, however, it's probable that the unbranded version of the device will get the refresh ahead of the Droid RAZR on Verizon, so US users may need to exercise a wee bit of patience here. Regardless, it's time for the competition to step up......

  • HTC Rezound render resoundingly revealed- wait next November 10th

    Hark! The first renders of the HTC Rezound have appeared online, thanks to some of the device's cases going up for pre-order. You can see that, like the Sensation XE, the phone has red-glowing soft keys -- a bit of a departure from HTC's traditionally conservative design language. If you recall, the phone formerly called Vigor is said to have a 4.3-inch screen, a dual-core 1.5GHz processor, 1GB RAM, Beats Audio and an 8MP rear camera.....

Previous Next

How a security researcher discovered the Apple battery "hack"

Posted by Mohd Khairun Nasir Saadi On - - 0 comments

A security "noob" mistake has left the batteries in Apple's laptops open to hacking, which could result in a bricked battery or, in a worst case scenario, fire or explosion. This was revealed on Friday after Accuvant Labs security researcher Charlie Miller disclosed that he plans to detail the hack at the annual Black Hat security conference in early August.

We were curious as to how Miller, known for repeated hacks of Apple's Safari Web browser at the annual Pwn2Own hacking competition, stumbled upon this hack in the first place—after all, it is somewhat obscure and doesn't fall into what most people consider to be his typical focus area (browsers). Miller took time to answer our questions about what the hack is and how he found it, as well as what he plans to do when Black Hat rolls around.

The vulnerability

Laptop batteries include microcontrollers which constantly monitor charging voltage, current, and thermal characteristics, among other properties. These microcontrollers are part of a standardized system called the Smart Battery System, designed to improve the safety of Li-Ion and Li-Poly cells used in these batteries.

According to Miller, these controllers can be hacked in a fairly straightforward manner. By reprogramming the microcontroller's firmware, a battery could report a much lower internal voltage or current, causing the charger to overcharge the battery. In Miller's testing, he was only successfully able to turn a series of seven $130 MacBook Pro batteries into expensive bricks, but he told Ars that it may be possible to cause fire or even an explosion.

"Lithium-ion batteries are potentially dangerous, and it's possible that futzing with the parameters could cause the battery to fail at best, or explode at worst," Miller said. "I know there are internal fuses and other safeguards to prevent that from happening, and I never did it myself, but there's certainly potential to get some malware to rewrite the smart battery firmware and cause some catastrophic failure."

As Miller noted, Smart Battery Systems include fuses which can disable cells if they reach dangerous internal voltages. But even these safeguards occasionally fail, resulting in toasted laptops.

Miller also told Ars that the battery firmware hack could be used to create a sort of "permanent" malware infection. Such malware, or a least a portion of it, could be installed in the microcontroller's flash memory. Even if an infected computer's drive were replaced and the operating system re-installed, it's possible that an exploit could allow the malware to be reloaded from a laptop's Smart Battery System firmware.

The discovery

While the threat of un-installable viruses that cause laptop batteries to explode is highly unlikely, the truth is that the vulnerability exists in the first place because of a blunder on Apple's part. While researching potential vulnerabilities in the MacBook Pro's power management system, Miller inadvertently discovered that Apple used default passwords described in publicly available documentation on the Smart Battery System, which allows rewriting the firmware itself.

Miller began by trying to determine if it was possible to manipulate or control the battery charging system. He downloaded a battery firmware update that Apple released a couple years ago, and dug through its code to see how the system communicates with the Smart Battery System. Inside the firmware updater, he found a password and a command to "unseal" the microcontroller, which allowed the firmware updater to change some of the battery's parameters.

This particular updater, according to Miller, merely told the battery to always keep a slightly higher minimum charge in order to keep the battery from becoming unable to hold a charge after being unused for an extended period of time. But searching for the unseal command led Miller to the Smart Battery Charger Specifications. Digging through the documentation, Miller learned that the password Apple used to unseal the microcontroller was the default used in the specifications.

On a whim, Miller tried the default password to switch the microcontroller into "full access mode," sort of like an administrator account on your Mac. "Unlike the unsealed mode, in full access mode, I could change anything: recalibrate the battery, access the controller at a really low level, including getting the firmware or changing it," Miller said.

Miller downloaded the firmware and reverse engineered the microcontroller's machine code, bricking several batteries in the process. Eventually he was able to change the firmware to "always lie, like to say it wasn't fully charged even when it was."

The fact that Apple never bothered to change the default password is disconcerting, especially considering the effort Apple has made to beef up security in Mac OS X Lion. Lion's implementation of address space layout randomization (ASLR) is now "complete," according to Miller, making it nearly impossible to know where the OS has loaded system functions into memory. Furthermore, Safari—Miller's preferred exploit vector—is now divided into two sandboxed processes, one for the GUI and one for rendering Web content.

"That second process is sandboxed; it can't access your files and other stuff," Miller explained. "Even if you have browser exploits, the only way to do anything [useful] is to get out of the sandbox." Miller said that would mean finding a bug in the kernel itself. "That's not impossible... but it's definitely much harder with a sandbox than without.

"It's certainly going to be a lot harder to own a Mac at Pwn2Own next year," Miller admitted.

Miller speculated that Apple assumed that the battery would never be a target for hackers, and so kept the default passwords described in the documentation as a convenience. Unfortunately, that convenience has resulted in a potential headache for Apple laptop users. If other vendors stuck with the default passwords, those machines could be vulnerable as well, though Miller did not verify a successful hack on non-Apple hardware.

Miller handed his research over to Apple a few weeks ago to give the company time to come up with its own workaround before he presents his findings at the Black Hat conference on August 4. Miller has also written a Mac OS X tool that will generate a random password and store it in a battery's firmware—preventing future hacks, but also preventing future firmware updates—which will be released when he gives his talk at Black Hat.



Leave a Reply


GeostigmaShop Hot Items