Post by: gunug on July 22, 2011, 06:59:57 PM
QUOTE
https://threatpost.com/en_us/blogs/apple-la...e-hacked-072211
The basis of Miller's research, which he plans to present at the Black Hat conference in Las Vegas next month, is the battery that's used in most Apple laptops. The battery, like many others in modern laptops, has a chip on it that contains instructions for how the battery is meant to behave and interact with the operating system and other components. Inspired by Barnaby Jack's ATM hacking talk at last year's conference, Miller was interested in seeing what would happen if he could get access to the chip and start messing with the instruction set and firmware.
"The battery has its own processor and firmware and I wanted to get into the chip and change things and see what problems would arise," said Miller, a principal research consultant at Accuvant.
What he found is that the batteries are shipped from the factory in a state called "sealed mode" and that there's a four-byte password that's required to change that. By analyzing a couple of updates that Apple had sent to fix problems in the batteries in the past, Miller found that password and was able to put the battery into "unsealed mode."
From there, he could make a few small changes to the firmware, but not what he really wanted. So he poked around a bit more and found that a second password was required to move the battery into full access mode, which gave him the ability to make any changes he wished. That password is a default set at the factory and it's not changed on laptops before they're shipped. Once he had that, Miller found he could do a lot of interesting things with the battery.
The basis of Miller's research, which he plans to present at the Black Hat conference in Las Vegas next month, is the battery that's used in most Apple laptops. The battery, like many others in modern laptops, has a chip on it that contains instructions for how the battery is meant to behave and interact with the operating system and other components. Inspired by Barnaby Jack's ATM hacking talk at last year's conference, Miller was interested in seeing what would happen if he could get access to the chip and start messing with the instruction set and firmware.
"The battery has its own processor and firmware and I wanted to get into the chip and change things and see what problems would arise," said Miller, a principal research consultant at Accuvant.
What he found is that the batteries are shipped from the factory in a state called "sealed mode" and that there's a four-byte password that's required to change that. By analyzing a couple of updates that Apple had sent to fix problems in the batteries in the past, Miller found that password and was able to put the battery into "unsealed mode."
From there, he could make a few small changes to the firmware, but not what he really wanted. So he poked around a bit more and found that a second password was required to move the battery into full access mode, which gave him the ability to make any changes he wished. That password is a default set at the factory and it's not changed on laptops before they're shipped. Once he had that, Miller found he could do a lot of interesting things with the battery.
This is probably not impossible to do on other smart batteries in other brands of laptop!
Post by: Xairbusdriver on July 22, 2011, 08:13:28 PM
QUOTE
Miller found he could do a lot of interesting things with the battery.
Such as? Could he make it hum the Star Spangled Banner? Could he make it power his house? Could he use it as a garage door opener? Could he make it do anything useful? I seriously doubt it. 
Too bad he didn't get to see one explode...at a safe distance, of course...just close enough to blow his 'black hat' off...
