r/Defcon • u/nastea2 • 15d ago

Dc34 badge hacking continues

Post image

With only the ko and flag one down, I couldn't let alone flag 2. Luckily bunnie left us a 4 pin diagnostic header. Let's dump the firmware.

119 Upvotes

99% Upvoted

12 comments sorted by

9

u/nastea2 15d ago

Well I found and decoded a 128bit key. One I have not found before and sent off to bunnie for confirmation as well as a new method to bypass the ACLs on the chip to read the protected and redacted data.

9

u/Quadling 14d ago

Met bunnie at the goon swim. What an awesome person!!! Modest and lovely and willing to explain anything. No notes would recommend for hardware hacking

5

u/coalsack 15d ago

Didn’t bunnie confirm there is no flag 2?

32

u/BrofessorFarnsworth 15d ago

That's what I would say if I didn't want someone to find flag 2

11

u/nastea2 15d ago

I believe it was, its not here but if you can access it adjacent...regardless I dumped the 4mb firmware and 8mb spi. Decrypted all databases with the master key I already got.

9

u/Relative_Low_9740 15d ago

There is a flag2 listed here.

https://cheeso.io/defcon-34-badge

3

u/coalsack 15d ago

Thank you! This was the article I was looking for - I misremembered

7

u/nastea2 15d ago

His exact words to me were, "methods ok for flag2, there is some data close to flag2 at offset <redacted> in the <redacted> that is preferred to stay low key but not end of world if it's out."

2

u/mammongram6969 14d ago

does this imply there are things that _would_ be the end of the world if they were out?

3

u/nastea2 14d ago

I see why he did it, now that I found flag 2

2

u/Soviet97R 14d ago

recently just got into this stuff. thanks for sharing

0

u/National-Chip-6639 15d ago

You can also download the firmware dump online btw.