NanoKVM: The S stands for Security

0:00 so if you do any sort of work with computers it h lab kind of stuff you know how revolutionary it is to be able to remotely manage a computer with say a virtual keyboard video and mouse solution and lucky you I have reviewed a number of these devices on my channel in the past maybe I'll have some links down below to some of my other reviews and every time I do one of those I get a comment telling me I should take a look at the cype Nano KVM because it's really cheap and believe it or not I thought that too so I went to buy my own a few months ago only to find out that they can't be sold in the US or Russia but buying one is no longer a problem because cped offered to send me three of them to make a review video so today I'm taking a look at the Nano KVM the light

0:45 the regular and the pcie so if that sounds good to you then come along on this adventure quick disclosure ccip did send me these three units for review no money changed hands they won't see the review before you do I did do some homework though and read their GitHub ISS shoes so this is going to be a bit spicy so anyway here's what I got so I got the light the regular and PCI so first off the light it's in a very tiny little package with the tiniest little bubble wrap ever comes with a heat sink very tiny and here is the unit itself so this has wired ethernet I'm pretty sure it's 100 megabit on the other side we have an HDMI and a USB type-c so you plug these two into your victim computer you can

1:31 capture in the HDMI from the device and you can output keyboard and mouse emulation so you can completely remotely control the computer as if you were plugged right into it it's also got a little micro SD card where the operating system is on and that's pretty much it and it's based on this tiny little board here the Luchi RV Nano which is a risk 5 system on chip so I really like Risk 5 and I'm glad to see risk 5 getting more adoption so this is the Nano next up we have the regular sized one so this one should have a few more parts what is this thing KVM B kvma okay this looks like a power control board so it's got a pin out here where it plugs into a power switch reset

2:16 switch power LED hard drive LED and it probably sends that back over USB doesn't look it has a micro controller on it so I'm not sure what type of USB it's doing next up we got the unit itself and I believe this is actually the same as the light if I pull my light back out of the box so they should be the same as the light at least the baseboard but it comes of the box and an extra layer on top with some other buttons and stuff it's also included I've got two USB cables I'm assuming one of them is for this guy and the other is for your Target computer so it's going to plug into the two type c ports here um no HDMI cable but that's fine HDMI is a pretty common standard it's got these guys which are probably for the um this

3:05 header so you're going to find some wires plug them into this header and then match them up with the corresponding pins on your motherboard also got this little thing here which I guess is for pushing the button somehow I don't know what that does but I guess we'll figure that out later so on the side they got a pin out here so HDMI and hid that's the target computer ethernet goes to our Network they have accessory pinouts here which is labeled as art1 ur2 so those are B seral 5 volts in ground and then KVM B is on this type c Port so again it's probably not really USB this is not actually USB peripheral they're just reusing that USB connector which is kind of weird and they have an ox USB which I think is actually a type-c or maybe it's just power I can't tell external additional power supply okay so that

3:51 might just be power input and last up I got the pcie model so this one says Poe and Wi-Fi which is cool they have versions without I guess I didn't even look okay so here we got the card in quite a piece of foam get out of there so here's the card so we've got the nanovm pcie it's got the ethernet again ethernet HDMI tiny tiny little display USB head and Power in so somehow they didn't manage to take power from the PC bus probably because that resets with a computer they're also not acting as a display cuz you got a loop HDMI my back in so they're really just using the PCI form factor just to sit in the machine as a slot it's not actually connecting

4:36 to any of these guys on the finger I don't think and if I look closely I can see that even though the fingers are there there's only one Trace going to them so I bet it's just using that for reset signal and I've even got these internal jumpers that go between this board and the top board which appear to be for actually labeled um 5vt ground 5V DND DP those are USB data and ground so they couldn't even bother with some standoffs here they use cable instead we do have pin headers here that can go to the motherboard so I could use some of these guys to run these connectors over the motherboard for power reset power LED hard drive LED and underneath here there's a built-in Wi-Fi module with Wi-Fi if you don't want to use wired ethernet and

5:21 appear here is the header for the two seral ports your1 and ur2 what kind of accessories do we have with this one h HMI cable tiny little screwdriver Wi-Fi antenna cap that probably went with that cable uh USB a to c a low height bracket if you're into the low height life which also by the way does not fit the Wi-Fi radio antenna so if you're using a half height card slot you won't be able to F the antenna got another USB and some power and reset cables these actually look pretty pretty nice they're actually labeled and everything cool so anyway that's what came in the Box for these three models I'm going to start with the

6:07 lowend the light version we're going to try out the light version and work our way up from there so now I got a test setup this guy here is my Victim computer he's one we're going to try to access remotely so it's just a basic Linux box nothing special I've got the Nano KVM light here this didn't come with any cables I did put the heat thing on that it came with but I took an HDMI cable and a type-c cable from the other models so you'll just have to get your own cables I've also got a tiny little router here that runs a DHCP server so I can take a look at what IP address it's got and connect to it so let's give it ethernet HDMI and um get in there this is really tight the

6:54 heck is going on they both look like HDM just get in there and power okay lights up when it turns on so that's good now let's connect to it and see what we got so it's on Port three looks like it got the address 192 16888 253 log in I actually don't remember the account admin admin looks like that okay change password okay we got to change the password uh admin okay so we are connected is it working hello hello sir try restar in the Target computer see if that

7:40 helps there we go Cali G new Linux okay well we're logged in seems to work so that's something got an onc screen keboard I can paste okay well seem to be doing its job could upload an image maybe yeah some basic seem to work right so like I said earlier I did my homework and I noticed some people were complaining about it reaching out to servers in other countries so that is why I have this guy connected to an isolated Network here with just the router now the router is providing everything it should need DHCP DNS

8:25 router advertisements that kind of stuff but it doesn't have an internet connection so I wanted to see what it's trying to connect to I got a packet capture for us to look at so right out the gate it does a DHCP discover very normal thing it gets an offer back from the router the router has offered it 192.168 88253 and also gave it some other information like the subnet mask the router address and domain name server so 192.168 88.1 that should be where DNS queries are going so if I filter on that address as the source or destination we see all the traffic two or from the device on ipv4 so it is starting off by joining ssdp and sending out ssdp frames which is pretty normal thing to do it's then sending out mdns frames to advertise

9:11 itself I guess it named itself KVM df2 local it is pinging the Gateway I don't know why it's pinging the Gateway but it is and it gets a reply back and then we get our first interesting thing it's doing a DNS query for an a record and a quad a record for pool. ntp work now for those of you guys that don't know the ntp pool is essentially a global project to maintain time across the Internet it's not sketchy at all thousands of volunteers around the world are running servers in the ntp pool if you're an open source project really anyone you can get your own subdomains they can track your usage statistics but pool.ntp.org is a really really reasonable thing to hard code into a device as like a Time server in this case I didn't request a Time server over

9:57 dhtp most networks probably aren't opting their own time servers anyway so going to the pool makes sense but check out that destination address so it didn't ask my router at 192.168 88.1 it asked 192.168.0.1 which sounds like a default and it also asked 8.8.4.4 which is Google and it also asked 8.8.8.8 which is Google and it asked all three of those guys again for the quad a and it got a response back from the router that says destination unreachable because it can't route to this subnet or this subnet or that that subnet which makes sense and I guess it didn't care cuz it kept going on anyway so next up we come down here and we get this Nat PMP external address request then it secondarily asks for a map UDP request

10:42 so it is asking for UDP Port 41 641 to be mapped to the outside for 2 hours so it's asking to punch a hole through the ipv4 net firewall on this port and in both cases the router apply is Port unreachable because it's not running an at PMP server so after trying to configure its time from the ntp pool it is now trying to punch a hole in your firewall with n PMP n PMP is a fantastic technology for stuff like game consoles or stuff that actually needs to do peer-to-peer devices but I'm not sure why this would need to do it I have an idea that I know from other reasons but let's keep looking so we're going back to the pool this time we're trying one because our queries to zero failed because we're not looking at the right DNS server we're just using Google um so we keep going now we're

11:27 looking for log tailscale that IO um that's probably why we're doing a n PMP request my guess is that they're running a tail scale Damon and it's trying to do n PMP and it's also reaching out to the wrong DNS server to try to log into tail scale I should probably note at this point I haven't even connected to it in a web browser and changed my default password we're only so far like 4 seconds into this thing being booted up in on the network and it's already reaching out to tail scale I didn't configure a tail scale tunnel I know a lot of people like tail scale but that doesn't mean you should enable it out of the box before before you've even like done the first Setup Wizard we keep hammering the pool again and again it's going to the wrong DNS server cuz it's not going to the network gness server so it's not getting anything back what are we going to do next so now we're going to Ping the Gateway I guess because we

12:13 don't like it so we'll try pinging it and try and tail scale again trying ntp again so this goes on for a while until we eventually see something new so at this point I've connected to it so TCP starts popping up so now I've actually gone and started to do my first login so this is like 45 seconds after I plugged into the network here so now at this point I've actually connected to it in web browser now it's going to CDN cp.com over both a and quad a so it's looking for ipv4 IPv6 it's again going to the wrong DNS server um but let's see what this query looks like so we're going for CDN cp.com it tie us for an A and also quad and also ask for an opt record uh I'm not not sure why it would

12:59 want an opt record but it's looking for it and then went out looking for this long address. loal and it didn't find it I'm not actually sure what this is or i' be looking for it but that looks like a uuid and it's going there to that do local and it's definitely coming from this device it's then looking for turn. cloudflare.com st. google.com turn. cloud.com Etc a and quad so this could be tail scale again trying to punch its way out using stun and turn or it could be something CED is doing I don't know but again it gets a bunch of unreachable back because it's going to the wrong DNS server still so up until now this actually hasn't had internet access so it's just doing DNS queries again to the wrong place it's going to Google DNS because they hardcoded Google DNS so now

13:45 I'm going to connect this router up to the network so this can route to the internet and do another packet capture so we can see what that traffic actually looks like see if it's boot it back up again if I refresh the page looks like that's a no okay we're loading again come on you can do it hope I don't have to reboot this thing I unplugged power from the Nano KVM and I left my Victim PC running so I hope that it can handle that kind of reset without having to restart um sometimes devices turn off their HDMI when you unplug them but given that I booted it up with HDMI I would think I'd be able to handle that how about if I wiggle the keyboard a bit come back okay we're rebooting the victim let's

14:30 see if it comes back up this time you do not appear to be working I don't know we'll look at the peek app anyway I'll figure out what's wrong so we're going to stop the capture and we're going to download the peap see so again we got a DHCP discover offer request act that's normal so then it goes in again to asking for ntp so we have now set ourselves up with some mbns we've done ntp we again did the external address request and map UTP request for not PMP um we are doing a lot more queries now okay who are we connecting to this time 55. 161 where did that come from

15:17 log. tailscale doio okay so we're actually connecting to tailscale over TLS 1.3 so I can't see the traffic we do ntp again so now we're querying cede and we also we're doing stun at the same time so I must have found the stun Ser run I just didn't notice it actually probably got that from the TLs session um so now it's doing stun to whoever that is so look for 74 for stun and a 141 for turn and this Cloud flare server is let's see what are we looking for for the cloudware server we end up with only V4 overarch CDN web. k.com w. Kunal soul.com that's a fun one and we're looking for

16:03 8.48 85239 so here's where it's connecting to cdnp do that so it's doing that connection here over TCP and that turns into TLS 1.3 looks like that's the reset so it took it like 40 seconds to do this TLS connection here here's the reset at 140 here's the initial connection here so that took a whole 100 seconds a minute and a half to download this file or whatever it's doing at the API so given this is encrypted with TLS I guess my next stop is to either break the encryption or to set up my own server see if it's actually checking certificates um or I could just read the code because it's open source we'll see what it's doing and by the way it still

16:48 doesn't work I don't know why it's uh try unplugging your replugging HDMI I guess maybe we try different resolution so it worked once now that I gave it access to the internet it reached out to the cloud and stopped working what the so to give a bit of context to what's going on let's take a look at the Nano KVM GitHub together so this issue was brought to my attention by some followers it's just called some security issues and it's in the Nano KVM repo and uh I guess some is an understatement he's got 14 security issues here some of which I've already pointed out and some of the devs and other people go through and talk about them I haven't actually tried to compile

17:34 the code myself um there were some other issues here that people had a hard time compiling the code and getting it to run on their own and so it's related but I didn't try compiling it so I'm just taking everything in this issue at face value mostly you you'll see so this he's brought up um if there's no credentials found then it defaults to admin admin and they actually did fix this one so now you have to enter a password your first time next up he said by default SSH is enabled and has a root password of root and they also resolved this so now it inherits the root password from the first time you change the password it also sets the SSH password encrypt secret key is hardcoded that's a sketchy thing we're going to look at later uh csrf protection that's also kind of sketchy off tokens not

18:19 expiring also sketchy not invalidating sessions um also kind of sketchy using sleep functions also not good why is nano KVM sending your device key to sepede this is what I'm going to look at specifically he also had some issues with wire guard I'm assuming this is related to tail scale um Nano G is connecting to the wiki I actually didn't see this one but maybe it is having TCP dump and air crack installed that is very sketchy for an embedded system to have air crack especially TCP dump is useful for debugging I mean so is aircraft but these are not the kind of things you generally leave in production download doesn't check integrity that's also not good API running as root also not good

19:04 and custom DNS servers which again is something I really hate so the conclusion of this GitHub author is that a lot needs to be done in terms of security so these kinds of issues are relatively basic in terms of embedded software design web app development things like that and so a lot of these authentication things and stuff like that are kind of things that should have been taken care of and so to him and to me it feels feels like the web app is very much a minimum viable product and not something that's like actually good so he suggested using Debian instead of whatever the hack they're using now which would probably be a good idea someone else suggested opt-in modules I would like that as well I definitely don't like tail scale starting up and doing its own done and turn stuff on its own and so here is the one that I want

19:50 to take a look at in more detail because it really fits with what I'm good at it says it's very insecure which is obviously true downloading a lib from the internet and then executing it is like terrifyingly bad security especially because they don't check the check sums or anything so this guy responded and he said this is required by the server to generate the downloaded lib makes cam Libo which is locked to only work with this device so I am pretty good at binary reverse engineering so I took a crack at reverse engineering this sketchy lib mix cam lib binary that gets downloaded on every update with the unique serial number of the device let's take a look at what I found so I started by just disassembling the L file so it's l64 little andyan risk 5 we expected that obviously I have two different versions from two different serial numbers and I can just take a look at what the differences are

20:36 so there some regions here that have different bytes there's actually seven of them and coming down to where they actually are in the disassembled code so here we're in makes NN NN makes cam that's the destructor and these 64 bytes don't appear to be anything useful now obviously it disassembled them as code but they're not actually code they're just data and interpreting that data as code you get a bunch of Errors like this so it takes me to gidra I identified all the memory locations in the binary in gidra and they're all proceeded by a jump and link to the preo function followed by a jump that skips around it so this jump just Scrolls down to where the end of the data is so essentially that means this data is not being executed as code it's just being used as data but it's not referenced anywhere so

21:21 there's no pointers anywhere in the binary that are looking at this address here so the only way we could know what the address is is IF preo function uses the return address where it was called from and since all of the calls appear the same it looks like that's what's happening so jump and Link means we're doing a function call we're storing the return value in our a z.j is an unconditional jump so we come to the pre off function here and we can see that it's referenced from seven places and these all directly correspond to where there is that weird data so here does a j jumping link to the preo function followed by an unconditional jump and 64 bytes of garbage so the pre-o function um it's an indirect call so it's loading the address of off function from a pointer table and jumping to it so off function here we have

22:08 essentially two other functions we're calling get uid and get U ID L and we're taking the return address and aside from actually returning to it with Rett we are using it here as S1 and then we add two to it which ends up being the direct address of the data we were passed so that gets passed as an argument to tuuid get l so here it says unaffected return address plus two it's plus two because we had two bytes up here at the unconditional jump so jump and Link stores the address to return to which would be 142 224 the address of the data is actually 142 226 that's why we have to add two so then these two functions here do some things so I guess I'll go through get uid first so this is again an indirect call we have to find the address in a pointer table and jump to

22:54 it and this one decompiled well so we're going to look at the C code now in the decompiler um so first it has a global variable that's a file descriptor it checks if it's less than one which means it hasn't been initialized yet it's zero and then it opens a file descriptor to devm so it's directly memory mapping memory then it has this custom op code here so in binary it's 8B B7 077 C and I couldn't find what this op code is in Risk 5 so they're either doing an instruction set option that this version of GCC doesn't have or they've done something entirely early custom now it is allowable in Risk 5 to do custom instruction set options normally they

23:42 would be published somewhere I didn't dig through uh cvit Tech's documentation on this but it seems like these are proprietary to cvit um which is the maker of the chip in this thing so I don't like seeing custom instructions that are undocumented usually this leads to a bunch of security vulnerabilities but who knows it's just it's a nightmare so we open so if we haven't already opened it before from the global variable we open that file descriptor we then do some custom magic here which we don't know what it is then we map two regions of memory here I'll give you guys a little more space here so the first one we call region one or I call region one this goes into a global variable the second one we call region two if either of these fail by the way then we um

24:28 close our file which actually we should have done before we actually never closed this file descriptor otherwise so oops so here we dreference this pointer and we flip a single bit so we or it with Ox 800 we're setting a bit in whatever region of memory this is point by 32000 and then we again have some custom op code it's the same one as up here so but it's doing something from the dreference value offset by hex 110 from our our base region which is 305 then we return some data here or so we get from data hex 10c shifted by hex 20 plus from 110 so we're reading in a

25:14 long integer it looks like so that's what actually happens with that return value I don't see it going anywhere here um so unless we needed that return value somewhere before off function then I don't know what happened to it well what's more exciting is T uidl so remember we saved ra into S1 then we added two to it so a z currently has the address of the weird data we can into an indirect call from the pointer table and we end up here this one does not decompile well it's clearly a for Loop so we set I to zero and then we increment I and then we check until I is 8 but it doesn't decompile this custom instruction so again we have a custom op code that's unique to spch I think so 8 b57 C70 again I couldn't find an

26:01 instruction with this op code so I don't know what it does but we take the address at a z we read off by 0o and one so the first two bytes we read them as unsigned bytes and then we add them together then we increment our pointer by eight and then we get six more of them so these addresses all work out to address 0 1 2 3 4 5 6 7 so we read eight bytes as unsigned we add them together and that ends up in A5 as to what happens to A5 it just disappears so this custom instruction has to be doing something with A5 which is the sum of eight bytes and then we do this eight times to get eight copies of this Loop so I actually did some adding up so there's seven locations here there's

26:47 seven columns and then there's eight chunks which get added and I noticed that in all seven cases the last bite is the same so we have 4 D1 3 3d1 4d1 2d1 Etc and also um these guys here if I select this column that makes my serial number so the serial number I tested with was D1 C9 4D A2 1359 c262 and that shows up here D1 C9 4D A2 13 59 C2 62 so we started with seven locations Each of which had 64 bytes of seemingly random data they added those eight chunks of eight bytes up so we lost a bunch of data there because we're adding bytes we ended up with essentially 88 bits of

27:33 Randomness but then it looks like we just take the lower eight bits of those numbers and that gives us 64 bits of data which just happens to exactly match the serial number of the chip so somehow they took the serial number of the chip they expanded it to take 64 bytes and they're generating a custom library that has seven seven locations of these 64 bytes of random data in it and then they're somehow using some custom risk 5 op code that's not documented to authenticate the chip somehow and that seems extremely sketchy to me so anyway this library is obviously not open source you're not going to just go and download this version of the library from anyone and they can't even bundle it in the images which also are not entirely open as well and it's just a a Clos Source nightmare all around as to

28:20 why they did this I can speculate but it's terrifying and you shouldn't accept it so if downloading an unsigned binary off random in place on the internet and running it without any verification was bad enough let's see what else it can do I'm going to loging over SSH now and see what sort of environment we have running on the Nano KVM so right as I logged in I ran PS so I can see what's going on here not a lot of processes running I think I'll have GED I don't actually know what that is Bluetooth I don't think we actually have Bluetooth so I don't know what that's on going on about so we have ntp aah Damon sshd dpd so simple Service delivery protocol and KVM system gy so this would be on

29:06 the uh uart serial tail scale D which again I never configured never asked it to use uh Nan KVM server and then for some reason it sometimes pings my Gateway I don't know why I don't know which process is doing this ping but someone is pinging the Gateway every few seconds how about IP do we do IPv6 let's see so we have loop back 8 Z ipv4 via DHCP and no no IPv6 configured ip6 tunnel at none I don't know where this tunnel is going but uh yeah I don't know what's up with that USB zero looks like it has a static ipv4 that's relatively normal for USB interfaces and tail scale zero which again I never configured and never told

29:52 it to use so nope we don't do IPv6 either CU we can't do networking so looks like we're using busy box if up down which is Etsy network interfaces and Etsy network interfaces is not configure interfaces so who is if it's not busy box that's who it is UD hcpd and that is our config and this is super basic it's handing out Lisas on USB zero that last a heck of a long time so here is the file that runs ethernet Reserve inet 192168 01/24 that's a weird thing to hard code cuz that's probably a whole bunch of people's address so looking for a file called eth No DHCP then it's doing awful shell hackery

30:42 to call Ipa directly to set the static address in bash it sets the name servers to Gateway which would be the static Gateway and 8888 and 11414 114114 so that is part of this guy who is owned by naning Shing Fen information Technologies Inc Zen layer Inc um okay that's an interesting one so this was all if you had a no DHCP configuration otherwise we start up you dhpc otherwise otherwise we set Reserve inet if we don't have an address at all

31:29 so here's instructions on how to do it and then this is in Chinese so I should probably translate that okay that's all the same information that was there in English just in Chinese so as I expected they have hardcode and resolve docon all of these IP addresses so 1 2 1681 844 8888 114114 114114 this guy9 9 who's he he is um owned by 10 cent looks like yeah so he's being originated by 10 cent to a whole bunch of tier ones what about our last one 223 to5 to5 Alibaba yes so it's

32:15 being origin by alib Baba to a number of Chinese networks and then to the tier ones I don't know about you I don't like when devices on the network go out to Google DNS especially because they hardcoded it they can't be bothered to read the network DNS over DHCP and this doesn't even do IPv6 there's no rdnss involved it's just hardcoded like a bunch of random DNS servers they found on the internet this is very very sketchy don't do this and with that I think I've investigated everything that the little light Nano KVM can do so it's time to move on to the bigger ones so I decided up next I'm going to try the pcie version like I mentioned earlier it doesn't actually speak pcie this is more just a mechanical bracket what it does speak is USB HDMI an Ethernet so we got to hook all those things up to our

33:00 Target computer now initially I thought this wire jumper cable was like an incredibly Jank solution then I realized what they're intending you're supposed to unplug this here if you want to plug into the USB header on your motherboard so I guess for some reason they couldn't have a USB hub to have multiple ports so you have to unplug the USB hi Port from the back and you can plug that into the motherboard now this does have a pan out label on it 5V DN DP ground so USB negative USB positive and that means that this pin here my thumb is on becomes the 5vt power so I can plug that in right here and this guy will power up immediately because USB power is always provided so if I sit this guy in the slot see he doesn't even use a PCI X1 he

33:48 just uses a little thing at the beginning of the PCI slot which is I mean clearly he's not doing PCI Data here almost forgot I can use one of these wires to connect to the power button and then I can push it remotely log into the KVM for security please change your password okay okay so I can see my computer it's working another neat trick I got for you guys for the web UI here this thing doesn't use https that's right it didn't even generate a self-signed c it just doesn't believe in security so over here in wire shark I can look up HTTP looks like it called the endpoint API off login again this this is just regular HTTP it's not secure it's doing some Json

34:33 exchange a API stream h64 Etc so what does this login look like so it's HTTP the connection details are JavaScript in JavaScript we have a key called username with a value of admin and a key called password with a value of that so at least it's encrypted I guess right so response it gets back is Json also and it includes an off token here which is this string this is also a JWT by the way so you can see based on the format remember earlier how I said that GitHub issue said there was bad password security let's take a look at the code that actually generated that password so that Cod is here it's called encrypts it uses this super secret key called Nano KVM ccip 2024 and then it just completely raw dogs AES to encrypt the

35:19 data which is just the literal plain text password using the plain text secret key so didn't use a key derivation function either for the key or for the data so they're basically doing this all wrong I'm not sure if any of you guys are familiar with all the cryptographic research that goes into passwords but passwords are a big challenge for cryptography and one of the big reasons is that in cryptography the closer your data is to random the better it is for everyone involved so it's harder to do a large section of attacks like if you know that the string is eight characters long and the rest of it's padded with zeros that makes your search space significantly smaller so you're doing as250 six with an 8 character password for example you know that a whole bunch of the bytes come out as zero so you can try a bunch of decryption Keys knowing that those bytes

36:05 are zero and you've gained information here so in the sense of storing passwords it doesn't matter what the password is once the user enters their password the actual bytes of the password should be gone they should never leave the user's computer because you don't actually care what the password was you just care that you can compare it later so the best practices of managing passwords is to on user's client side take the password and hash it with a password hash function or key derivation function and also salt the password with the username and some Sal that's specific to your application so a hash function takes a block of data and generates a hash that is a fixed number of bits long that represents the data but is not a way that can be converted back so when you take a hash you can

36:51 only go one way you can't go backwards theoretically you could have a hash Collision where two blocks of beta represent the same hash that's just like incredibly unlikely due to probabilities but it's technically possible so why do we add the username and the salt the salt is there so that if somehow all of your passwords were to leak your entire password database was to leak someone couldn't take a hash password and use it on a different website because it's salted specific to your website and the other reason to add the username is so that if two users have the same password they don't have the same password hash so the server side this is very easy the client does all of the hashing gives it to the server the server then adds it to the database compares the database the end what they're doing here instead is they're taking the password plain text and a string that is completely not

37:38 random it's literally a string of letters and using that as the key into AES and you never ever want to use a string of letters as a key you always want to use some key derivation function which is like a password hash function and same for the password you don't need to use AES here you need to use a password hash function so password hash functions I've mentioned them a few times now are essentially a special class of hash functions that take a long time so with hash functions if we were to say use sha one for all of our our passwords sha one um in theory we can solve it backwards which is really hard to do but it's been done a couple times in history which is why cryptographers consider it broken now even though it's still quite secure but what we could do is take a database of 6,000 random passwords change all the zeros into ones

38:24 um all the eyes into ones Etc mutate these passwords into maybe a million guesses and try hashing them each time and sha one doesn't take very long to run so you could probably run a million guesses in a couple minutes on a computer so a password hash function is designed to take the password data that's very definitively not random because some user came up with it and turn it into hash data in a way that takes a lot of computational power and this way Brute Force attacking the passord with the dictionary becomes really hard because it might take you half a second to do each hash obviously those hashes take a long time on the computer that's why modern hash functions like argon 2 and stuff they take a long time but that's for password security obviously CP is doing none of that you're using a in completely the

39:09 wrong way and this is this is really bad so because this password was sent in the clear using a well-known encryption algorithm and a well-known key anyone could decrypt your plain Tech Password just from this unencrypted HTTP transport so I have not succeeded yet in capturing the sketchy binary download I think that's because it already has it on it so on GitHub the latest version of the image file for the SD cards is dated in November 2024 however the latest version of the app is dated only two weeks ago which would be January 2025 so I think what happened is these guys that they sent me were already updated with the latest version of the app now that is logical that makes sense you want to ship products with the latest software version what doesn't make sense is why

39:56 they haven't updated the image file on GitHub for 2 months so I took the image file from GitHub flashed on here we're going to try the light again with the image file so we can capture a software update failed the update runtime Library please try again that's an interesting failure I also like to point out that the light version does not include a pre-installed SD card so if you buy the light version you'll have to be flashing the two or three month old software from GitHub and it will have problems oh my God the password's just Root Root Root that's done so anyway since the default password used to just be root root which is a terrible default password for an SSH root account um I got in I added my CA certificate so we're going to look at the update process finally so he requested a zip file from CDN dp.com and

40:45 he requested latest that zip at I think at a time so this is a ZIP file that should contain some firmware but anyway download lib yeah so here's the function that actually does the downloading of the lib so read device key that must be a file then it's calling Maxi vision. cp.com apiv1 KVM encryption is device key it does a request well at least it's using SSL when it downloads the sketchy lib from the internet it doesn't check the lib itself or anything but it does at least validate the server CA certificate so here's what it downloaded so it downloaded the AL file just directly that's the file I already showed you guys earlier so the GitHub

41:32 users were not lying it does in fact connect to a server in China where it downloads a custom L file that was custom built just for this device by giving it a serial number however it only does that if you didn't buy the SD card from sepede because it seems they already do that for you on image on images they produce so I guess that's better than nothing maybe it uses SSL too so I guess it could be worse it's not like a wide openen HTTP remote could execution you actually have to do a little bit of work and it's still reaching out to tail scale periodically uh even though I again never configured tail scale it just really really wants to tell tail scale everything that's going on in my life again nothing wrong with tail scale here tail scale is doing what it's supposed to be doing but I don't like to use tail scale I have other solutions that I like better and I

42:18 don't like tail scale reaching out on a device that I never told it to you and opening holes in my firewall just because it's there like and so now that we solve that problem with the sketchy Library download let's look at the sketchy abuse of the USB type-c connector and the USB type a connector both so this little guy lets you connect ATX power to this thing and USBC is a connector that already has far too many things wrong with it so we don't need to add more weird modes to it I really hate when people use a connector that has a well- defined use like USBC better to use something else that's not well defined like I know rj11 that's got all kinds of weird uses so anyway there's three chips here allegedly this can

43:03 do um power power switch uh hard drive LED reset switch so that's four functions two in two out but there's only four wires on a USB so either they're using the Shield or one of those is not actually going to anything and I did read the name off of these three chips here and I found what they are they appear to be this guy photoos so that would be a Optical isolator if I look at my data sheet here come on okay we're not em the download file but anyway it's photo transistor so that's what it is so given that there's only three of them clearly one of these four functions must be missing I'm going to suspect that's hard drive LED so we probably could have just left it out of the pin out but I guess we'll M out and see what goes to what so we're doing

43:51 beep test mode so I'm going to pick a random PIN here it's this pin right here which is labeled what power switch power LED okay so hard drive LED is not included so that means that three of these pins on the USB connector are data and the last one must be ground so let's see using the Shell as the ground which I guess is pretty normal so anyway don't plug this thing into a USB port don't try to use this USB type-c port as a USB type c cuz it's not type- C it's just digital lines pretending to be a USB port and trench code so not good honestly I don't know why they just didn't put some of these headers in here

44:37 like you could have put these headers here and it would have been perfectly fine a normal but but no we got to make use of uh improper USB connectors here almost forgot these guys have a uh last trick there should be some sort of LCD on here there's one on the PCI card too but it's hard to get a a video of it's like they screwed through the peel with their screws so I can't peel the peel Nan KVM so it shows my IP address ipv4 because we don't support IPv6 of course resolution h264 27 frames per second middle quality so I can't actually change anything here I can just look at it but it's still nice to see that we got an IP address and I guess that's better than

45:24 nothing up there too it shows we have e internet we don't have hi in wi of HDMI I can't really plug any of those in right now without turning it back off but uh you get the idea so I guess that little screen might be a slightly redeeming quality for some people so anyway should you buy one of these products I guess I didn't do a great job demonstrating like when you might need to use a KVM I feel like people that watch my channel have seen one of these things before I mean you use this for remotely managing a computer this computer doesn't have ipmi so with one of these three devices I can hook up his HDMI and it USB port and I can control it remotely so I have access to the desktop or terminal or whatever keyboard mouse and it's like complete remote access in a tiny little package so would

46:10 I buy one of these absolutely not now we're going to talk about that in great detail and before you go down in the comment section I don't want you saying anything negative about the country of China you are welcome to talk about all of the problems that sepede has done but I'd like like to make it clear that all that uh they're not the only company doing this for sure this sort of bad iot security is extremely common in the iot industry and we shouldn't let anyone get away with it no matter what country they're from so anyway one of the big selling points is that it's cheap so I click pre-order here you can see it's not available in the US and Russia so I guess I can't buy one anyway but uh yeah fun I go on talau here it says it's 36 Yan which seems too cheap but I can't

46:55 read it to tell what the rest of the page says I'm guessing that's just like an option and not the price of the light version it actually does show up in AliExpress and it will let me buy it uh it says release on February 28th so I guess they can't ship it until then so they must have gotten their FCC certification done but 4972 which is 17% off from $59.90 that's not really a good deal so light version is only 2482 which also does not include an SD card that mine came with so remember that does not contain system image card the case is five bucks that's probably what is 36 yon on Tau the cheapest option so this little guy here the light he's selling for about 30 bucks right now plus shipping from China direct from China it's got 100 Meg ethernet RIS 5

47:42 processor boots off an SD card has an HDMI input that goes into a GPU that does some proprietary Shenanigans to get us our image that's what that Library download is used for is for HDMI input and it has a USB that can emulate a keyboard and mouse so Hardware wise for 20 or 30 bucks I think this piece of Hardware is nice I really like the hardware the light hardware and for the full version I honestly like the hardware too so this is black we have the same boards as light version but we have another board on top that has the display um they screwed over the screws for peeling the peel so I can't peel the peel off but uh you get the idea and aside from absolutely abusing the USB type-c connector in a way that it was never intended for and could potentially damage other devices

48:27 possibly um I think the hardware is fine too I don't think the price is outrageous for what it is I think it's a pretty good price for the HDMI input the the hardware you get how much is the PCI version I don't see the PCI version here how much are you so I have Wi-Fi Poe so 55 bucks so as for the pcie which is the computer over there uh I think it's relatively misleading to say that it is a pcie device it does not actually connect to a PCI Express bus at all it simply sits in the slot where it gets mechanical support and lives inside of your computer so it goes inside the computer I guess but um it's not connecting to the PCI slot if you want something to actually connect to the PCI slot been a review on an azrock rboard that it's

49:13 really hard to get that actually does connect to pcie and ulated video card but this doesn't do that so you still have to have these outside jumper cables that look Jank AF and the whole point of having it inside the machine is to have it not Jank but uh we end up with that anyway it does take USB and power from the internal USB header which is A+ I guess uh I think it supports remote power on it has the buttons for it I actually didn't test it because I didn't want to shut down this computer because it's doing important things um but other than that it seems like the PCA version works fine it has Wi-Fi as an option it stores your password in plain text on the SD card which I guess is there not really a lot of other options it had but uh it does so so that's fun so there's

49:58 nothing wrong with the PCI occur to me I just find it misleading when companies put devices in the PCI slot that are not using PCI Express and call them PCI devices this does not show up in any way to the Target computer over PCI it's not emulating a graphics card which I think is what a lot of people expect it to do when it plugs into the pcie bus it's not somehow communicating with the computer just be aware that so despite me liking the hardware it's nice it's compact it has all the features that you'd want for for a tiny little KVM um the software is a disaster so the software did work this particular one the one that got stuck not working after an update never did work again but when I reimage the card it works again now so something goofy

50:44 happened when it tried to automatically update itself and it broke itself I don't know what happened I didn't debug it I just reimaged it if that were to happen to this one I would have to unscrew it to take it apart to get to the SD card which would be a pain not hard but a pain and if I want to reimage it the image available in GitHub is currently about 3 months old and the software is currently only 2 weeks old so that means they're shipping an image that is not released that's not inherently a problem except they're claiming this is open source and so if they're not releasing their new build images as they build them they're just um I don't know updating them internally or something then they're not really releasing all of the open source commitments that they think they are and I think that the reason that they're using the word open for this is so they can get other people to do their their development work so I mean this is kind

51:31 of a big problem in the open source Community if a company comes and they make an open source product and they're actually committed to open source then other people should be able to work on it use it in other ways and like so with um py KVM for example that's a project that was truly open source and so the pvm developer sold hats that connected to a Raspberry Pi and you could use them as a KVM and he made the software too and now there's a whole ecosystem of different companies that are making that different Hardware that works for that case but at the same time you get a lot of development effort from different people that are all contributing to the project and making it better and this is not using py KVM they've home brewed their own thing which is fine as a product there's nothing wrong with that except they did a bad job at it um but I

52:16 think that by making it open source they're hoping to get people to help them fix their big firmware problems so like if you follow their GitHub there's all kinds of issues submitted about this big security issues there's the thre that I followed and it seems like the software was just kind of thrown together as a bare minimum functionality with like no thought to security or any of any data things like that so I really don't like the software on these little guys I also really do not like that they're using a library that has to be compiled for a specific chip to get this HDMI input and I'm not sure if that's a limitation of the fact that they're using a library that does neural network processing like AI computer vision and that's just a side effect of those functions being in the same Library um allegedly you can compile an open source

53:02 version of that library that doesn't have those neural nut functions in it and it will work for this use case but the fact that they went through all this effort to build a web server that compiles the image for this specific unit means that they didn't see that that was a problem and that's a problem to me so I think I know why we ended up here so basically this is a post from Hacker News um and someone here is basically saying why the hell didn't they use P KVM why are they doing something special they just have a basic s so it has jpeg codic why don't you just use video Linux 2 VL 2 and one of the developers says that'd be great and we want to use py KVM but the BSB doesn't support V4 L2 so we have to build the software from

53:47 scratch and so I guess they're going down this Rabbit Hole of developing their own KVM solution because they couldn't choose a chip that already had Linux support and instead of adding Linux support for the chip they're just using the vendor API and so this commenter here says this just seems like you should have waited for Linux to Upstream personally I don't see why anyone would want to waste time with some random vet's media API because basically video for Linux is the way to go so anyway enough ranting about this thing I've been talking about it for like an hour now so if you want to buy one I have links down below to tbal if you buy them on Ali Express you might not get them because they are currently still banned in the US which I've been told is due to FCC Emi and EMC compliance electromagnetic compatibility it's a pretty basic thing to sell a

54:34 product with EMC compliance I understand they have to do testing and they might still be in a prototyping phase or whatever but um you got to have a a certified you have to have a compliant product to sell in the US basically what happened so they either already got certification in the EU or they get around it by shipping direct from China which is how a lot of things on AliExpress get shipped by the way they are not FCC complying or not C complying EU and they get shipped anyway so so anyway um yeah that's the N KVM uh if you want to chat with me more about the Nano KVM about risk 5 or gidra or any of these tools that I use Discord server got in the link below if you like the work I do and want to support me personally again I did not pay for these units CP sent them to me I did actually

55:20 tried to go out and buy my own unit a couple months ago and I couldn't because they're banned in the US so um I guess I had to get them by them sending them to me but uh yeah if you want to support the work I do I have a Kofi link down below for that it's kind of like a patreon except it's only a one time thing so I appreciate that and as always I'll see you guys on the next adventure