HARDW ARE Hacking IOI Federico Lucifredi disclaimer while the - - PowerPoint PPT Presentation

▶
hardw are hacking ioi
SMART_READER_LITE
LIVE PREVIEW

HARDW ARE Hacking IOI Federico Lucifredi disclaimer while the - - PowerPoint PPT Presentation

Sep 01, 2022 704 likes •1.24k views

HARDW ARE Hacking IOI Federico Lucifredi disclaimer while the following w as conscientiousl y resear ched and verified , neither the or ganizers nor the a uthor will accept any liability if y ou render y our device inoperable as a

slide-1
SLIDE 1

HARDW ARE Hacking IOI

Federico Lucifredi

slide-2
SLIDE 2

disclaimer

Federico Lucifredi MMX

while the following w as conscientiousl y resear ched and verified, neither the or ganizers nor the a uthor will accept any liability if y

  • u render y
  • ur device

inoperable as a resul t of these instr uctions. Proceed a t y

  • ur own risk.
slide-3
SLIDE 3
  • riginS

Federico Lucifredi MMX

slide-4
SLIDE 4

OSCON MMIX

Federico Lucifredi MMX

slide-5
SLIDE 5

Federico Lucifredi MMIX

slide-6
SLIDE 6

OSCON MMX

Federico Lucifredi MMX

slide-7
SLIDE 7

Federico Lucifredi MMX

TIME

slide-8
SLIDE 8

Federico Lucifredi MMX

GPS

slide-9
SLIDE 9

Federico Lucifredi MMX

TIME

slide-10
SLIDE 10

Procurement

Federico Lucifredi MMX

slide-11
SLIDE 11

Federico Lucifredi MMX

slide-12
SLIDE 12

The Hardw are

Federico Lucifredi MMX

slide-13
SLIDE 13

Federico Lucifredi MMX

slide-14
SLIDE 14

Federico Lucifredi MMX

slide-15
SLIDE 15

Federico Lucifredi MMX

slide-16
SLIDE 16

Federico Lucifredi MMX

slide-17
SLIDE 17

Federico Lucifredi MMX

...w a terproof

slide-18
SLIDE 18

INSIDE

Federico Lucifredi MMX

SiRF star III e/LP microcontroller ARM7TDMI core @ 50 MHz 1 Mb SRAM, 4 Mb flash Serial (UART), USB

slide-19
SLIDE 19

INSIDE

Federico Lucifredi MMX

slide-20
SLIDE 20

INSIDE

Federico Lucifredi MMX

slide-21
SLIDE 21

First P ackets

Federico Lucifredi MMX

slide-22
SLIDE 22

contact

Federico Lucifredi MMX

1 ms precision - but in the module Plug in. Look at first serial USB:

slide-23
SLIDE 23

P arlez-vous

Federico Lucifredi MMX

NMEA 0183 default on receiver Serial at 4800,N,8,1, None GPS::NMEA on CPAN

slide-24
SLIDE 24

GPSd

Federico Lucifredi MMX

{zypper|yum|apt} install gpsd Serial at 4800,N,8,1, None Start with device in NMEA mode Daemon understands NMEA, others Daemon speaks JSON

slide-25
SLIDE 25

Federico Lucifredi MMX

slide-26
SLIDE 26

P arlez-vous

Federico Lucifredi MMX

JSON (RFC 4627) on TCP 2947 Sample Commands: TPV: time-position-velocity report SKY: satellite constellation data DEVICE/S: receiver(s) data POLL: grab current receiver state ...

slide-27
SLIDE 27

P arlez-vous

Federico Lucifredi MMX

trying it out:

slide-28
SLIDE 28

Process

Federico Lucifredi MMX

where goes our precious time data? latency, delay, jitter all across pipe want to minimize steps not timestamped

slide-29
SLIDE 29

NTPD

Federico Lucifredi MMX

NTP (RFC 1305, 2030 et al) server “strata” complex: algorithms to mitigate network delay jitter steps of adjustment ...

slide-30
SLIDE 30

NTPd

Federico Lucifredi MMX

turns out GPSd speaks NTPd! they chat over shared memory

slide-31
SLIDE 31

ANTENNA

Federico Lucifredi MMX

GPS signal not in your data center! Need to bring antenna to signal

slide-32
SLIDE 32

A TOMIC CLOCK

Federico Lucifredi MMX

slide-33
SLIDE 33

specs

Federico Lucifredi MMX

1.2 GHz ARM core (Kirkwood) 16+16 KB L1 cache, 256 L2 KB 512 MB DDR2/400MHz RAM 512 MB NAND Flash (bootable) 128 b eFuse JTAG, SDIO, USB, Ethernet

slide-34
SLIDE 34

Federico Lucifredi MMX

W a tts

slide-35
SLIDE 35

ACCURACY

Federico Lucifredi MMX

(civilian) GPS limited to 3.4 x 10E-7 sec Time from GPS fixes: 10E-1 to 10E-3 sec Time from GPS fixes+PPS-pulses10E-4 sec In-hardware timestamping 10E-6

slide-36
SLIDE 36

resul ts

Federico Lucifredi MMX

Your very own stratum-1 server “Atomic” clock driven

slide-37
SLIDE 37

Federico Lucifredi MMX

RANDOM

slide-38
SLIDE 38

Federico Lucifredi MMX

RANDOM (totall y)

slide-39
SLIDE 39

Federico Lucifredi MMX

RNG

Lava Lamp (light occlusion) Gain-maxed, lens-covered CCD Low-significance temperature digits Charge developed on a capacitor Thermal noise across a semiconductor Atmospheric noise High-sample of lightbeam on a hourglass Radioactive decay events

slide-40
SLIDE 40

Federico Lucifredi MMX

Geiger tube

Tube filled with low-pressure inert gas Detects ionizing radiation thru it minimum dead time Natural background radiation

slide-41
SLIDE 41

Federico Lucifredi MMX

COUNTER

slide-42
SLIDE 42

Federico Lucifredi MMX

Tube

slide-43
SLIDE 43

Federico Lucifredi MMX

Micro

AVR Atmega 328

slide-44
SLIDE 44

Federico Lucifredi MMX

Algorithm

wait for values time between events if (sample1 to sample2) < (sample2 to sample 3) out 0 else out 1

slide-45
SLIDE 45

Federico Lucifredi MMX

OUTPUT

slide-46
SLIDE 46

Federico Lucifredi MMX

ISSUES

Slightly biased - unclear why Dead time Von Neumann paper Slow, but tireless pipe randomness to those idle VMs Exploits

slide-47
SLIDE 47

Federico Lucifredi MMX

OUTPUT

slide-48
SLIDE 48

Federico Lucifredi MMX

Conclusions

Playing with hardware is fun! It is not hard - you have seen it A lot more HOWTOs out there The time barrier has been lifted Go Play!

slide-49
SLIDE 49

Federico Lucifredi MMX

resour ces

Haveged Lavarand Ferguson, Schneier Practical Cryptography, Ch.9 ;login:, August 2009 (Van Drunen) ;login: October 2008 (Knowles) Sparkfun’s blog (Weiss)

slide-50
SLIDE 50

Questions

Federico Lucifredi MMX

contact e-mail:flucifredi@acm.or g twitter: federico_II

slide-51
SLIDE 51

Federico Lucifredi MMX

(c) 2010 Federico Lucifredi (CC)A ttribution-Noncommer cial- No Deriv a tive Works 3.0