Brute-Forcing Lockdown Harddrive Pin Codes
summary
Emulates the front‑panel I2C keypad over the header and toggles the chip reset to bypass the lockout, using an ATMega/Arduino dev board to submit guesses and brute‑force a 4‑digit PIN in ~6 hours (5 digits takes days). Desolders the SPI flash from an MB86C311A‑based board, reprograms it with a Bus Pirate and observes crypto behavior with ChipWhisperer power analysis. Discovers firmware uses a stream cipher plus SHA‑256 validation that can be coerced to load modified firmware, enabling decryption and further extraction of the drive key material.
AI-written summary · about
chapters (9)
- 0:00Start
- 0:57Chip Whisperer
- 3:18Brute Force
- 4:39Capacitive Touch Sensor
- 11:28Understand the Firmware
- 13:40Interrupt Vectors
- 15:25Power Analysis
- 17:45Power Trace
- 19:30Differential Trace
related talks
36mOpen Sesame - Or How Secure Is Your Stuff In Electronic Lockers
45mPoking the S in SD cards
33mBreaking Into Chips By Reading The Datasheet
48mReverse-Engineering the Supra iBox: Exploitation of a Hardened MSP430-Based Device
37mOpen Sesame! The full story behind opening a smart lock
01h 06mBackdoors in Back Doors
01h 03mHack To Discover Weaknesses In A Series Of Smartcards
49mBreaking Through Another Side: Bypassing Firmware Security Boundaries from Embedded Controller