Cody Brocious

Last updated

Cody Brocious
Occupation Software engineer
EmployerOptiv [1] [2]
Known for PyMusique, Alky Project, The Hardware Hacker Manifesto, Onity Lock Hack

Cody Brocious is an American software engineer best known for his work on PyMusique and his demonstration of Onity HT lock system vulnerabilities in 2012. [3] [4] [5]

Contents

Notable projects

PyMusique

Brocious first saw recognition as founder of the PyMusique project, where he worked with Jon Lech Johansen of DeCSS fame. PyMusique allowed Linux users to purchase music from the iTunes music store without the standard FairPlay DRM implementation in place. [6]

Falling Leaf Systems

During his employment with MP3Tunes, Brocious also joined forces with Brian Thomason, then an employee of another Michael Robertson company, Linspire Inc., to form Falling Leaf Systems LLC. [7] [8] Falling Leaf Systems attempted to commercialize the Alky Project, which was started by Brocious to enable Microsoft Windows games to run on other platforms.

Falling Leaf Systems sold access to a membership site dubbed the Sapling Program, whereby users could access a build of Alky allowing them to demo the game Prey on either Linux or Mac OS X. Despite attempts to expand their stack by also supporting applications on disparate platforms, Falling Leaf Systems officially closed its doors in early 2008. [9] [10]

Emokit

In 2010, Brocious reverse-engineered the protocol used by the Emotiv EPOC EEG headset, publishing the AES key used for encrypting the sensor data. [11]

The Hardware Hacker Manifesto

The Hardware Hacker Manifesto was published on 21 September 2010. It gives some insight of the psychology of hardware hackers. Cody Brocious goes into an explanation of why it is important for owners to have the right to utilize hardware the way they wish to use it. [12]

Onity lock systems

At the 2012 Black Hat Briefings, Brocious presented several vulnerabilities about the Onity HT lock system, a lock used by the majority of U.S. hotels. [13] The security hole can be exploited using about US$50 worth of hardware, and it potentially affects millions of hotel rooms. [3] [14] The device was eventually optimized down to the size of a marker, and was eventually used to perform burglaries. [15]

Onity has started rolling out safeguards for the problem in late 2012, [16] which was considered a slow reaction. [17] However, in 2013 it was still reported that some hotels continued to have the vulnerability exploited. [18]

Related Research Articles

In the field of computer security, independent researchers often discover flaws in software that can be abused to cause unintended behaviour; these flaws are called vulnerabilities. The process by which the analysis of these vulnerabilities is shared with third parties is the subject of much debate, and is referred to as the researcher's disclosure policy. Full disclosure is the practice of publishing analysis of software vulnerabilities as early as possible, making the data accessible to everyone without restriction. The primary purpose of widely disseminating information about vulnerabilities is so that potential victims are as knowledgeable as those who attack them.

A computer hacker is any skilled computer expert who uses their technical knowledge to overcome a problem. While "hacker" can refer to any skilled computer programmer, the term has become associated in popular culture with a "security hacker", someone who, with their technical knowledge, uses bugs or exploits to break into computer systems.

Firmware low-level software traditionally held in ROM

In computing, firmware is a specific class of computer software that provides the low-level control for a device's specific hardware. Firmware can either provide a standardized operating environment for more complex device software, or, for less complex devices, act as the device's complete operating system, performing all control, monitoring and data manipulation functions. Typical examples of devices containing firmware are embedded systems, consumer appliances, computers, computer peripherals, and others. Almost all electronic devices beyond the simplest contain some firmware.

Jon Lech Johansen, also known as DVD Jon, is a Norwegian programmer who has worked on reverse engineering data formats. He wrote the DeCSS software, which decodes the Content Scramble System used for DVD licensing enforcement. Johansen is a self-trained software engineer, who quit high school during his first year to spend more time with the DeCSS case. He moved to the United States and worked as a software engineer from October 2005 until November 2006. He then moved to Norway but moved back to the United States in June 2007.

In computer networking, Server Message Block (SMB), one version of which was also known as Common Internet File System, is a network communication protocol for providing shared access to files, printers, and serial ports between nodes on a network. It also provides an authenticated inter-process communication mechanism. Most usage of SMB involves computers running Microsoft Windows, where it was known as "Microsoft Windows Network" before the introduction of Active Directory. Corresponding Windows services are LAN Manager Server for the server component, and LAN Manager Workstation for the client component.

Lock and key Mechanical or electronic fastening device

A lock is a mechanical or electronic fastening device that is released by a physical object, by supplying secret information, or by a combination thereof or only being able to be opened from one side such as a door chain.

In computer security, a vulnerability is a weakness which can be exploited by a threat actor, such as an attacker, to perform unauthorized actions within a computer system. To exploit a vulnerability, an attacker must have at least one applicable tool or technique that can connect to a system weakness. In this frame, vulnerabilities are also known as the attack surface.

SharpMusique was a rewrite in C# of PyMusique, both programs were iTunes Music Store clients, allowing songs to be downloaded from the iTunes Music Store without DRM.

Electronic lock locking device which operates by means of electric current

An electronic lock is a locking device which operates by means of electric current. Electric locks are sometimes stand-alone with an electronic control assembly mounted directly to the lock. Electric locks may be connected to an access control system, the advantages of which include: key control, where keys can be added and removed without re-keying the lock cylinder; fine access control, where time and place are factors; and transaction logging, where activity is recorded. Electronic locks can also be remotely monitored and controlled, both to lock and to unlock.

Free60 is the successor to the Xbox Linux Project that aims to put Linux, BSD, or Darwin on the Microsoft Xbox 360 using a software or hardware based "hack". The Xbox 360 uses hardware encryption and will not run unsigned code out of the box.

Tor Sørnes was a Norwegian author, politician, engineer and the designer and inventor of the VingCard, the first recodable keycard lock and the magnetic stripe keycard lock.

Physical access is a term in computer security that refers to the ability of people to physically gain access to a computer system. According to Gregory White, "Given physical access to an office, the knowledgeable attacker will quickly be able to find the information needed to gain access to the organization's computer systems and network."

Marc Weber Tobias is an American security researcher, focusing on locks and locksmithing. With his associate Tobias Bluzmanis from Caracas (Venezuela) an expert in covert methods of entry wrote the book "Open in Thirty Seconds" published in 2008, and "Locks, Safes, and Security: An International Police Reference".

A hardware restriction is content protection enforced by electronic components. The hardware restriction scheme may complement a digital rights management system implemented in software. Some examples of hardware restriction information appliances are video game consoles, smartphones, tablet computers, Macintosh computers and personal computers that implement secure boot.

Rooting (Android) Modification of Android devices

Rooting is the process of allowing users of smartphones, tablets and other devices running the Android mobile operating system to attain privileged control over various Android subsystems. As Android uses the Linux kernel, rooting an Android device gives similar access to administrative (superuser) permissions as on Linux or any other Unix-like operating system such as FreeBSD or macOS.

A DMA attack is a type of side channel attack in computer security, in which an attacker can penetrate a computer or other device, by exploiting the presence of high-speed expansion ports that permit direct memory access (DMA).

JASBUG is a security bug disclosed in February 2015 and affecting core components of the Microsoft Windows Operating System. The vulnerability dated back to 2000 and affected all supported editions of Windows Server 2003, Windows Vista, Windows Server 2008, Windows 7, Windows Server 2008 R2, Windows 8, Windows Server 2012, Windows RT, Windows 8.1, Windows Server 2012 R2, and Windows RT 8.1.

Custom firmware, also known as aftermarket firmware, is an unofficial new or modified version of firmware created by third parties on devices such as video game consoles and various embedded device types to provide new features or to unlock hidden functionality. In the video game console community, the term is often written as custom firmware or simply CFW, referring to an altered version of the original system software inside a video game console such as the PlayStation Portable, PlayStation 3, PlayStation Vita and Nintendo 3DS.

The Zealot Campaign is a cryptocurrency mining malware collected from a series of stolen National Security Agency (NSA) exploits, released by the Shadow Brokers group on both Windows and Linux machines to mine cryptocurrency, specifically Monero. Discovered in December 2017, these exploits appeared in the Zealot suite include EternalBlue, EternalSynergy, and Apache Struts Jakarta Multipart Parser attack exploit, or CVE-2017-5638. The other notable exploit within the Zealot vulnerabilities includes vulnerability CVE-2017-9822, known as DotNetNuke (DNN) which exploits a content management system so that the user can install a Monero miner software. An estimated USD $8,500 of Monero having been mined on a single targeted computer. The campaign was discovered and studied extensively by F5 Networks in December 2017.

Microarchitectural Data Sampling CPU vulnerabilities

The Microarchitectural Data Sampling (MDS) vulnerabilities are a set of weaknesses in Intel x86 microprocessors that use hyper-threading, and leak data across protection boundaries that are architecturally supposed to be secure. The attacks exploiting the vulnerabilities have been labeled Fallout, RIDL, ZombieLoad., and ZombieLoad 2.

References

  1. ↑ "Holy crap, it's 2013".
  2. ↑ "Press Releases". Optiv.
  3. 1 2 forbes.com – Hacker will expose potential security flaw in more than four million hotel room keycard locks, 2012-07-23
  4. ↑ "Hotel-room lock hack tied to ongoing thefts". NBC News.
  5. ↑ "Faulty Hotel Locks Demonstrated by ABC News Report". ABC News.
  6. ↑ Arik Hesseldahl (28 March 2005). "Forbes interview with Cody Brocious on PyMusique". Forbes.
  7. ↑ "DesktopLinux citing Thomason's role at Linspire". Archived from the original on 12 May 2008. Retrieved 11 July 2008.
  8. ↑ "Falling Leaf Systems announces launch".
  9. ↑ "Alky Project merges with Project VAIO".
  10. ↑ "Falling Leaf Systems closes shop".
  11. ↑ Friendly. "Interview with Cody Brocious on the Emokit". h+ Magazine.
  12. ↑ "The Hardware Hacker Manifesto".
  13. ↑ demoseen.com – Inner workings of the Onity HT lock system for hotels, 2012-07-25
  14. ↑ extremetech.com – Black Hat hacker gains access to 4 million hotel rooms with Arduino microcontroller, 2012-07-25
  15. ↑ "Electronic lock picking: Hotel heists allegedly exploited Onity keycard lock hack | Computerworld Blogs".
  16. ↑ Onity rolling out safeguards against hotel keycard hacks, may fix some locks outright
  17. ↑ Farivar, Cyrus (7 December 2012). "Fix for hotels' electronic door lock hack slow to roll out". Ars Technica.
  18. ↑ Greenberg, Andy. "Hotel Lock Hack Still Being Used In Burglaries, Months After Lock Firm's Fix". Forbes.
This page is based on this Wikipedia article
Text is available under the CC BY-SA 4.0 license; additional terms may apply.
Images, videos and audio are available under their respective licenses.