They found that the machine’s only encryption was a weak XOR cipher they were able to easily break, and that there was no real authentication between the machine’s modules.
This reminds me of many many years ago some guy in a bimmer forum figured out BMW's iDriver music file formats (BR3/BR4/BR5) were simply DRM'd via XOR.[1] I was able to verify it via a simple script. Kudos to the reverse engineering masters!
XOR is rather easy to spot, you just XOR each byte with the bytes N positions downstream, and at the N for which the distribution of bytes changes dramatically, you've found the key's period. Finding the key is also not hard if you suspect that the file is a known format (and thus will have a known structure at some places).
In the world of chip cards, it's not uncommon to think xor is a secure encryption scheme for some reason, historical maybe or more probably cost related, I don't know.
Though I remember even worse when a chip card encryption was found not cost effective enough to be enable and security on this card was limited encoding[1], too bad it was a government issued healthcare card which lead a minister to argue that using ASCII and binary was efficient in securing the data. While the GIE (Economic Interest Group) in charge of the chip tricked the whistleblower to demonstrate the vulnerability and sued him for having done so. Fun Times !
Comments
This reminds me of many many years ago some guy in a bimmer forum figured out BMW's iDriver music file formats (BR3/BR4/BR5) were simply DRM'd via XOR.[1] I was able to verify it via a simple script. Kudos to the reverse engineering masters!
[1]: http://www.e90post.com/forums/showthread.php?t=279294#5
XOR is rather easy to spot, you just XOR each byte with the bytes N positions downstream, and at the N for which the distribution of bytes changes dramatically, you've found the key's period. Finding the key is also not hard if you suspect that the file is a known format (and thus will have a known structure at some places).
In the world of chip cards, it's not uncommon to think xor is a secure encryption scheme for some reason, historical maybe or more probably cost related, I don't know.
Though I remember even worse when a chip card encryption was found not cost effective enough to be enable and security on this card was limited encoding[1], too bad it was a government issued healthcare card which lead a minister to argue that using ASCII and binary was efficient in securing the data. While the GIE (Economic Interest Group) in charge of the chip tricked the whistleblower to demonstrate the vulnerability and sued him for having done so. Fun Times !
[1]: http://bigbrotherawards.eu.org/Jerome-Cretaux-et-Patrick-Gue...
I found it curious that the very person who mentioned it being XOR had only one single post in that forum.
That info was originated from a German bimmer forum, it seems.