Let's talk about some of the security features of the new @Raspberry_Pi RP2350, because they are 🔥🧵 1.) Glitch Detectors

The RP2350 has 4 embedded glitch detectors, with configurable sensitivity. These will respond to voltage & EM fault-injection attempts, and reset the chip.

In our testing we found that they are quite effective at capturing most glitches.

One of my neighbours seems to have a smart toilet - and it looks like I can connect to it 👀 According to the website I can remote control the bidet functionality 😂

So I was trying to sniff the BitLocker TPM key on an old laptop of mine - it has this great debug port that exposes most of the TPM (Low Pin Count Bus) signals, but it’s missing the clock signal. So I could either hunt for the clock signal on the backside - or build a "clockless" LPC analyzer! And after a bit of coding I built a @saleae LA analyzer that doesn't need a clock signal - and was able to decode the whole TPM communication!

Let’s gooo Off to a good start - let the jankiness begin

Ever wondered what makes a secure element secure?

A part of it is this pattern: This is a (not-so-great😅) die shot of the upper side of an ATECC608A secure element. As you can see, the upper layer looks like it's all metal - but if we zoom in, we get the above pattern

Bought one of those small 7” field monitors for filming…

Turns out it drains its battery with 72mA - while turned off 😐 I’m sure my NP-F550 batteries really like to get discharged to absolute zero 🥲

20 arcade buttons and a Raspberry Pi Pico make for a fun evening project 😀 Total project costs:
- $30 for arcade buttons
- $4 Pico
- $10 Blade receptacles
- Wire + random wooden board I had laying around

Time: Roughly two hours for the build (damn cable crimping). Takes longer if your chordless drill dies in the middle 🥲

Yesss!!! After hours of trying (and bricking 2 AirTags) I managed to break into the microcontroller of the AirTag! 🥳🥳🥳

/cc @colinoflynn @LennertWo Dumped the firmware and some important areas😀(am I missing any other important ones from the nRF52?)

Continuing the tweet-chain of @colinoflynn on AirTag hacking, we will look at the flash contents now!

https://twitter.com/colinoflynn/status/1390486554586587139

Similar to most Apple embedded devices, the AirTags also seem to run RTKit... And this is where it gets interesting: It's a DEBUG build - debug builds have more functionality, and sometimes more logs & co - this is good news!

/cc @naehrdine

My Nintendo Game and Watch arrived a day early! Let’s tear it down and see how it works - and how easy it is to hack it! For opening it up you unfortunately need some Y-style screwdrivers - let’s see what’s underneath!