Researchers Revive 2000s ‘Blinkenlights’ Technique to Dump Smartwatch Firmware via Screen Pixels
## Cybersecurity: Smartwatch Firmware Extraction Using Blinkenlights Technique
Cybersecurity: Smartwatch Firmware Extraction Using Blinkenlights Technique
Security researchers have revived a 20-year-old attack technique, known as "Blinkenlights," to extract firmware from a budget smartwatch. This method, originally used to access data from network devices, has been adapted for modern TFT screens.
The researchers acquired a low-cost smartwatch for approximately €12, which featured non-functional health sensors incapable of measuring blood pressure or sleep activity. The device utilized a JieLi AC6958C6 system-on-chip and communicated via Bluetooth Low Energy.
Technical Vulnerability and Exploitation
Upon examination, a dial parser vulnerability was identified, which failed to properly validate offset boundaries. This security flaw facilitated an out-of-bounds read condition, allowing arbitrary memory content to be displayed on the screen.
Efforts to exploit JieLi's over-the-air update function for firmware extraction were unsuccessful, as it only supported uploads. The researchers then focused on the Blinkenlights approach, leveraging a Raspberry Pi Pico to intercept data.
Security researchers have revived a 20-year-old attack technique, known as "Blinkenlights," to extract firmware from a budget smartwatch.
The team constructed a custom hardware setup using a Raspberry Pi Pico, overclocked to 200 MHz, to capture data from the smartwatch's main SoC to the NV3030B screen controller. The screen's 25 MHz clock transmitted pixel data in RGB565 format, necessitating high-speed sampling.
Researchers soldered fine wires to the screen connector and employed the Pico's Programmable Input/Output (PIO) feature for data sampling. The PIO program, designed with two instructions, captured data stored in the Pico's buffer before transmission to a host computer.
Creation of custom dials with manipulated offset values to access memory beyond intended data regions. Automation of dial generation, data collection, and firmware reconstruction through Python scripts. Cost-effective hardware approach using a Raspberry Pi Pico.
The research highlights the continued relevance of outdated attack methods when applied creatively to modern devices. The Raspberry Pi Pico proved to be a practical option compared to expensive logic analyzers for this application.
Based on reporting by Cyber Security News.