Leica firmware hacked...

[richardman]

As an embedded tools person, and a longtime Leica person (starting with film Leica), I am impressed by this post :-)

https://alexhude.github.io/2019/01/24/hacking-leica-m240.html

[T3sl4co1l]

Hahaha, PWAD, no shit?  That's hilarious.  The only appropriate response is to run DOOM on it:



Tim

[bson]

Nice. He's a bit rough on XOR ciphers though; they're as good as the random sequence.  RC4 for example has a cycle of 2¹⁷⁰⁰ bits, where by comparison there are an estimated 2⁴²⁰ protons in the known universe.  So, no, it will never repeat in actual use.  (The key mixer has 256! pathological states, but these keys are never used.) The ARC4 implementations work quite well and are fast; I've used them a lot.  A nice thing about XOR ciphers is single bit errors remain single bit errors and can be corrected, on the cipher, rather than the plaintext.

[legacy]

typical done because you can, what I really think is - awesome proof of hacking - no doubt about, however, one must really have nothing useful to do for having the time for doing useless things like this.

[Peabody]

Nice. He's a bit rough on XOR ciphers though; they're as good as the random sequence.  RC4 for example has a cycle of 2¹⁷⁰⁰ bits, where by comparison there are an estimated 2⁴²⁰ protons in the known universe.  So, no, it will never repeat in actual use.  (The key mixer has 256! pathological states, but these keys are never used.) The ARC4 implementations work quite well and are fast; I've used them a lot.  A nice thing about XOR ciphers is single bit errors remain single bit errors and can be corrected, on the cipher, rather than the plaintext.

The Wikipedia entry on RC4 says it has multiple vulnerabilities and is considered insecure.  But I wonder if that's really true as a practical matter.  It's interesting that you still view it favorably.  I was looking at a way to encrypt embedded firmware updates, and for something like that, RC4 is easy to implement and doesn't take up much room.  And it seems if you are careful about the implementation, particularly not reusing keys, it should be fine.  What do you think?

[SiliconWizard]

typical done because you can, what I really think is - awesome proof of hacking - no doubt about, however, one must really have nothing useful to do for having the time for doing useless things like this.

Indeed.

[ebastler]

one must really have nothing useful to do for having the time for doing useless things like this.

Well, there are also people who intend to build their own keyboard from scratch. 

[legacy]

Well, there are also people who intend to build their own keyboard from scratch. 

this has a precise purpose: we need to participate in hacking camping.
besides our keyboard will be useful to increase our productivity (and there are other small business reason behind it)

which is the purpose of putting Doom on a camera? ...

[ebastler]

Well, there are also people who intend to build their own keyboard from scratch. 

this has a precise purpose: we need to participate in hacking camping.
besides our keyboard will be useful to increase our productivity (and there are other small business reason behind it)

which is the purpose of putting Doom on a camera? ...

Feel free to conjure up "productivity" reasons or "small business reasons". (Hint: If you hope to turn a buck from it - you won't...) Or admit to yourself that you are planning to do it "because you can", and because you want to show it off to the guys at the hacking camp. 

Which are perfectly fine reasons for doing a project, of course. But they happen to be the same reasons as for the guy who made his camera run Doom. And they don't make you superior (morally or whatever) to him.

[legacy]

"because you can"

we have a couple of purposes that are particularly interesting
- recycling old polycarbonates and metal frames that otherwise would be trashed as garbage
- improving a couple of ideas, turning them into daily useful tools

we hope to sell a couple of kit in order to cover a part of the cost of the manifestation
 
putting Doom on a camera doesn't satisfy any good point, doesn't improve anything, I don't see any point, it's just playing with your dUck, and, worse still, if you publish it on the internet(1) ... well ... considering that all the crypto stuff has been made in order to prevent people from hacking the camera ...  seeing that someone has screwed up protections will make makers so irritated that they will for sure put more crap into the next generation of their products, and this is what I do find irritating.



(1) this kind of news should go in the underground, on e.g. BeTalk, Discord, IRC, and alike ... places not publicly accessible by the common mass, so not cached by Google.  I remember that we were having fun at hacking the PlayStation (we were using them as a cheap render farm) ... until a couple of idiots decided to publish their work on the public internet and this made SONY so angry that they removed the whole Linux support making the next bunch of consoles a crap of protections with no fun at all 

[timelessbeing]

putting Doom on a camera doesn't satisfy any good point, doesn't improve anything, I don't see any point

You're not seeing the bigger picture. I think this kind of work is very relevant. It shows that you can hack your consumer devices to your own needs. It leads to things like Rigol oscilloscope hacks, and improved firmware that adds features, or fixes bugs that manufacturers refuse to.

http://www.pioneerfaq.info/
https://www.rockbox.org/

[Mechatrommer]

typical done because you can, what I really think is - awesome proof of hacking - no doubt about, however, one must really have nothing useful to do for having the time for doing useless things like this.

ditto...

Well, there are also people who intend to build their own keyboard from scratch. 

i read the thread. the intention is stated specifically for production. not playing game on expensive camera. the japanese keyboard is too expensive. everybody incl every factories on earth built things from scratch for this particular reason, ie solving problems.

You're not seeing the bigger picture. I think this kind of work is very relevant. It shows that you can hack your consumer devices to your own needs. It leads to things like Rigol oscilloscope hacks, and improved firmware that adds features, or fixes bugs that manufacturers refuse to.
http://www.pioneerfaq.info/
https://www.rockbox.org/

i'm fine with hacking productivity tool to get more productivity. but usually expensive camera comes with everything a user need to get what they should expect from a camera, ie taking good pictures. and taking good pictures is more than just tweaking a FW, its more like 80% mechanicals and optics involved there. if the manufacturer refuse to add games into it, i think thats a fair decision. and opening up a possibility for others to brick their unit for no apparent reason is a bad move, better if the talent is spent on other things imho. if i want game, there are more that i can cope with in Google Play Stores. but if one think he can and have the money then he can carry on, its not ours. ymmv.

[timelessbeing]

but usually expensive camera comes with everything a user need

Simply not true. And this goes for all electronics.

if the manufacturer refuse to add games into it, i think thats a fair decision

I think you also missed the point.

possibility for others to brick their unit

Why assume everybody is stupid? And yes mistakes happen when you make progress. And if I want to brick my unit then it's my decision.

[SiliconWizard]

Hacking has its own merits, but comparing hacking with designing your own tools/products doesn't make much sense IMO, at least in the general case. So I think legacy has a valid point. Even though it may have sounded offensive for some.

Any company making stuff that already exists on the market is in kinda the same position as he is. It's not hacking. Is developing a new car the same as hacking the ECU of an existing car for instance? Not really. To go a bit further, is partly reverse-engineering some product (which quite a few companies do during their development processes) to help you develop your own akin to hacking? It may involve some similar techniques along the way, but it doesn't have much to do with it in the end.

[legacy]

partly reverse-engineering some product

e.g. we are now reverse-engineering a couple of keyboard matrixes in order to make a new controller.
why? because we need to support a new kind of products(2) and we don't have the money, at the moment, to develop our own keyboard from scratch (1)


(1) 3d printing a prototype is OK, but making and finalizing the mechanical part is too expensive (3)
(2) we are also developing a "couple of paranoid keyboards" for those who are so paranoid to believe that someone can spy what they type. This has been described as "key-logged" keyboards (by the same guys behind nmap and alike), so we have now the perfect gift for them since the link between the keyboard and the KVM is completely encrypted. Hope hackers in our camping will smile and laugh for this
(3) the same applies to our metal frames, recycled from Apple's stuff. Buying one only costs 5 USD, building one is 20-50 times more expensive.

[ebastler]

we are now reverse-engineering a couple of keyboard matrixes in order to make a new controller.
why? because we need to support a new kind of products(2) and we don't have the money, at the moment, to develop our own keyboard from scratch (1)

That's a big improvement over the original concept. I like the reality check! 

(2) we are also developing a "couple of paranoid keyboards" for those who are so paranoid to believe that someone can spy what they type. This has been described as "key-logged" keyboards (by the same guys behind nmap and alike), so we have now the perfect gift for them since the link between the keyboard and the KVM is completely encrypted. Hope hackers in our camping will smile and laugh for this

The perfect gift for people who trust you! 

[@rt]

There were plenty of reasons to hack cameras back in the day. I was into Canon years ago.
They included extending the duration a still camera would record video (which was limited presumably so as to not overlap the camcorder market),
Motion detection for taking images at the right times, Custom intervalometers and timers, Support for RAW and/or bitmaps for cameras that only saved JPEG,
and one program simply counted dead pixels to see how good your sensor was.

I’m not sure how many of these are still relevant, but they certainly were in the past.
I did port Space Invaders to Canon S2IS. I missed the first action game. Mine was the second.

[KL27x]

I still remember wanting, so very badly, to be able to reuse the monitor of my first laptop as an AV composite display. (No, I didn't get anywhere).

Even if this was/is an old obsolete camera that you can't buy anymore, this video made me smile. This is the geek/tech equivalent of Colin Furze turning an old beat up BMW into a convertible hot tub and driving around in it just to share it on Youtube.

This video makes me happy that things like this are possible and that people are doing them!