So I have a Canon consumer inkjet printer, Japanese model, purchased in Japan. No HTTPS on the web interface, but it speaks Cloud Print with Google, and guess what.pic.twitter.com/77MnG9zeYd
-
-
Replying to @marcan42 @matthew_d_green
Also, WTF is this. I thought the contents were supposed to be *random bytes*?pic.twitter.com/SsTp9NJWce
4 replies 1 retweet 11 likes -
Replying to @marcan42 @matthew_d_green
Huh. Uninitialized buffer? If you have the model number it might be interesting to check out the firmware...
1 reply 0 retweets 0 likes -
Replying to @moyix @matthew_d_green
Pixus MG6730. It updates itself over unencrypted HTTP (of *course*). The firmware seems to be obfuscated with some kind of silly DIY algorithm, though. Typical Japanese. The whole file looks like this. https://mrcn.st/t/mg6730_1.060.bin …pic.twitter.com/vMrLdlKOnq
2 replies 0 retweets 1 like -
Oh gawd it's an S-record file with an XOR pad. Just why. Deobfuscated: https://mrcn.st/t/mg6730_1.060.srec … (two logical chunks: https://mrcn.st/t/mg6730_1.060_part1.srec … https://mrcn.st/t/mg6730_1.060_part2.srec …)
1 reply 0 retweets 4 likes -
Looks like it runs DRYOS, the same OS Canon cameras use, and the same OS the CHDK project has quite ample documentation of. Cool.
1 reply 0 retweets 1 like -
Yeah, I'm pretty sure this is deliberate.
@matthew_d_green, do you have code to compare? Looks like this stands for RSA BSAFE Micro Edition Suite I think?pic.twitter.com/lxZ6eMHI7o
1 reply 0 retweets 2 likes -
Replying to @marcan42 @matthew_d_green
I think this matches what's in the BSAFE-Java library (source: http://dualec.org/DualECTLS.pdf )pic.twitter.com/QtHcu7GK5o
1 reply 1 retweet 1 like -
We never analyzed the MES, and the C BSAFE library we did have (SSLC?) didn’t have watermarking activated. But yes it does match, with a slightly different watermark.
1 reply 0 retweets 0 likes -
The idea, or theory, was that it would make identification of BSAFE sessions that much easier for a passive attacker.
1 reply 0 retweets 1 like
Replying to @matthew_d_green @moyix
So blatant support for the backdoor is what you're saying it is.
9:43 PM - 21 Dec 2017
0 replies
0 retweets
3 likes
Loading seems to be taking a while.
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.