Tag

Hardware Security

All articles tagged with #hardware security

technology20 days ago•48 min saved

Raspberry Pi Bootloader Locks RAM Size to Curb Counterfeit Sales

Raspberry Pi Foundation introduced a bootloader update in September 2024 that prevents users from upgrading RAM chips on Pi 4, Pi 5, and Compute Modules to sizes larger than the original specification. While this restricts hardware modification, it is easily bypassed by downgrading the bootloader via USB. The move aims to combat third-party sellers who swap in unverified or harvested RAM chips, which often leads to instability and misleading product listings. Critics argue this limits repairability and user freedom, but proponents note that the restriction primarily targets fraudulent commercial practices rather than genuine repairs, as replacing a failed chip with an identical one remains possible.

via Hackaday|

#bootloader #counterfeit-goods #hardware-security

technology21 days ago•18 min saved

Raspberry Pi Firmware Now Blocks RAM Upgrades to Curb Counterfeit Resales

Raspberry Pi has implemented firmware restrictions that prevent users from upgrading the soldered RAM on their single-board computers, even if the new chips are technically compatible. This move, which began around 2024, locks boards to their original factory memory configurations to prevent third parties from reselling lower-capacity units as higher-spec models. While the company cites anti-fraud measures and hardware validation as reasons, critics argue this violates open hardware principles and right-to-repair norms. Workarounds exist via older firmware versions, but the restriction remains a significant barrier for enthusiasts seeking to modify their hardware.

via Hackaday|

#firmware-restrictions #hardware-security #lpddr-memory

technology2 months ago•5 min saved

Chrome adds hardware-backed session keys to curb account takeovers

Google Chrome is adding device-bound session credentials (DBSCs) that store a private key in hardware (TPM on Windows, Secure Enclave on macOS/iOS) to sign authentication challenges, making stolen session cookies useless for account takeover. Currently limited to a test rollout on Windows and macOS, the feature aims to reduce reliance on shared secrets and work alongside passkeys and 2FA; other Chromium-based browsers may adopt it as the standard progresses via the W3C.

via Ars Technica|

#authentication #chrome #dbsc

technology2 months ago•11 min saved

Defcon Badges Contain a Verifiable Open-Source Security Chip You Can Take Home

Defcon’s 2026 badges embed Baochip-1x, a removable, open-source hardware security token designed for verifiability and transparency; the module doubles as a FIDO-like key, supports QR-code registration, and runs a Rust-based OS with secure boot, TRNG, and resistive RAM; two variants exist (Huang’s open Baochip and a Crossbar/ARM counterpart), with infrared-inspection packaging to verify the silicon; attendees will test and potentially extend its features beyond the conference.

via WIRED|

#defcon #hardware-security #open-source

technology6 months ago•4 min saved

Chrome secures sessions by binding cookies to hardware, thwarting infostealer theft

Google Chrome 146 on Windows adds Device Bound Session Credentials (DBSC), cryptographically linking a user’s session to the device’s hardware (TPM on Windows, Secure Enclave on macOS) so stolen session cookies can’t be exploited. New short-lived cookies require possession of the hardware-bound private key, otherwise they expire quickly. macOS support is planned for a future Chrome release. The DBSC protocol, developed with Microsoft and tested with partners like Okta, aims to reduce cookie theft while preserving privacy, with implementation guidance and W3C specs available for developers.

via BleepingComputer|

#chrome #dbsc #hardware-security

technology2 years ago•6 min saved

Windows Hello Fingerprint Authentication Vulnerability Exposes Laptop Security Risks

Researchers have discovered vulnerabilities in Windows Hello's fingerprint authentication system that allow attackers to bypass the security feature on certain laptops. The vulnerabilities were found in the fingerprint sensors of Dell Inspiron 15, Lenovo ThinkPad T14, and Microsoft Surface Pro 8/X devices. The attacks involve manipulating the communication between the sensor chip and the operating system, allowing attackers to log in as a different user. The researchers recommend device makers to address these design flaws and for users to check for updates or firmware fixes.

via The Register|

#fingerprint-authentication #hardware-security #laptop-security

technology2 years ago•3 min saved

"Parisian Engineers Assist Apple in Strengthening iPhone Security"

Apple's Paris-based engineers are working diligently to break and strengthen iPhone security measures, aiming to protect vulnerable users from threats like Pegasus. The company's efforts extend beyond software, with hardware testing involving lasers and finely tuned sensors to eliminate potential security weaknesses. Apple believes its work is succeeding, but the increasing deployment of technology has led to a digital arms race, with hackers constantly developing new attack methods. Ivan Krstic, Apple's chief of security engineering and architecture, emphasizes the importance of defending users, particularly journalists and activists, against state-grade spyware. Krstic also opposes sideloading, arguing that it limits users' choice and compromises software distribution mechanisms they can trust.

via AppleInsider|

#apple #data-breaches #hardware-security

hardware-security2 years ago•1 min saved

"Reptar CPU Vulnerability: Intel Patches High-Severity Flaw Impacting Multi-Tenant Virtualized Environments"

Intel has released fixes for a high-severity CPU vulnerability called Reptar, affecting desktop, mobile, and server CPUs. The flaw, tracked as CVE-2023-23583, could allow privilege escalation, information disclosure, and denial of service via local access. Exploiting the vulnerability in a multi-tenant virtualized environment could crash the host machine, causing a denial of service to other guest machines. Intel has published updated microcode for all affected processors, and there is no evidence of active attacks using this vulnerability.

via The Hacker News|

#cpu-vulnerability #denial-of-service #hardware-security

technology3 years ago•4 min saved

Google Cloud and Accounts Vulnerable to Multiple Security Bugs

Google Cloud and Intel collaborated on a nine-month audit of Intel's new hardware security product, Trust Domain Extensions (TDX), which revealed 10 confirmed vulnerabilities, including two significant ones. The review and fixes were completed before the production of Intel's fourth-generation Intel Xeon processors, which incorporate TDX. The project is part of Google Cloud's Confidential Computing initiative, and the goal is to help chipmakers find and fix vulnerabilities before they create potential exposure for Google Cloud customers or anyone else. Additionally, Google worked with Intel to open source the TDX firmware, low-level code that coordinates between hardware and software.

via WIRED|

#confidential-computing #google-cloud #hardware-security