News Security Researcher Finds Coldplay Lyrics in Kingston SSD Firmware

Toggle sidebar Toggle sidebar
helper800 said:
Why would anyone need or want padded data in a firmware update?
Click to expand...
They can without any issues is what they are saying. The way data is stored it wouldn't even take up more space, just fill in the edges of blocks that are already taken up. Doesn't hurt it, doesn't help it, just extra space. Like writing in the margins of a sheet of paper. No matter what the whole paper is going to be used to carry your writings...there is just extra space that is being used to transport your words and is filled with nothing so you can add a note and not change a thing.
 
  • Like
Reactions: helper800
Back in the Amiga Days, I looked at a lot of Boot Blocks on Amiga Game Disks. Some had interesting messages. Cussing you out for looking at the boot block etc. (They assumed anyone looking there was a Hacker trying to break the copy protection). I don't mind these things, but it does bring up the possibility of something sneaking through that could be some form of Malware. Looks like they were having some fun.
 
  • Like
Reactions: lorfa and bit_user
If it's pure padding, i's no skin off anyone's nose. It could also be an easy way to make reading through the firmware a bit more difficult - if you pad stuff with zeroes or Lorem Ipsum, it's easy to track... A Coldplay lyrics sheet is far less likely, and should be harder to locate - even harder than random noise.
 
Sluggotg said:
Back in the Amiga Days, I looked at a lot of Boot Blocks on Amiga Game Disks. Some had interesting messages. Cussing you out for looking at the boot block etc. (They assumed anyone looking there was a Hacker trying to break the copy protection). I don't mind these things, but it does bring up the possibility of something sneaking through that could be some form of Malware. Looks like they were having some fun.
Click to expand...
Not to mention the Rock Lobster boards (B52's album name). I still have a couple
 
helper800 said:
Why would anyone need or want padded data in a firmware update?
Click to expand...
If you use the classic firmware update method of flashing the entire memory contents in one go (rather than incremental updating using a self-flashing bootloader and flipover), the file to be flashed will typically match the capacity of the memory space being flashed. If the data you actually need to flash is smaller than the space available, then the remaining space is filled with padding values to make up the difference. e.g. if you have a 1KiB chip to flash, the hex to be flashed will be a 1KiB file even if you are only 'using' 256 bytes of that. The remaining bytes can be all zeroes, or random values, or whatever else you want, as the file will be the same size regardless.
 
  • Like
Reactions: helper800
Just a random employee who cared nothing about copyright and just wanted to do it, because he/she could do it, knowing no one in the uppper chain will look that far/deep into the file (which is really not that far or deep).

At least they picked a nice piece of music and not some Shakira songs or the likes.
 
Well, at least it's a good tune! Could you imagine if they had put "Muskrat Love" in there instead? 😆

What's next, Superman's Song by the Crash Test Dummies?:
Both songs classify as soft rock and they're both kinda sad...
 
helper800 said:
Why would anyone need or want padded data in a firmware update?
Click to expand...
It's possible the firmware update requires a specific payload. Often it's padded with zeroes. I've seen firmware updates that want (say) 4096 characters, exactly. And if there is 4095, it won't update, because it thinks it only got part of the update. Since firmware updates can brick the system, it's not bad system.
 
  • Like
Reactions: helper800
bit_user said:
Well, it's certainly a departure from good ol' Lorem Ipsum.

I'd be mildly concerned about copyright infringement claims, if including something like lyrics to a pop song.
Click to expand...
Why? It's not the song, just lyrics. They own the copyrights to their performance but anyone can cover any song by crediting the original songwriter.
 
Watchful Fox said:
Why? It's not the song, just lyrics. They own the copyrights to their performance but anyone can cover any song by crediting the original songwriter.
Click to expand...
I'm no lawyer, but I'm sure pop song lyrics are always copyrighted, and I'm sure you don't get a pass to cover a song by simply crediting the author. The rights owner might not bother to sue you, but that's up to their discretion.

The only thing that's legally protected (in the USA) is doing an obvious parody or satire. Otherwise, you're running a risk of getting sued.
 
bit_user said:
I'm no lawyer, but I'm sure pop song lyrics are always copyrighted, and I'm sure you don't get a pass to cover a song by simply crediting the author.
Click to expand...
You are correct. However, this particular usage would not be copyright infringement, no more than singing along to the song in the shower would be. A copyright suit has to show harm of some sort, generally a dilution claim, which would hardly apply here. The defense here would be the legal doctrine know as "incidental use". If a TV crew interviews someone in a bar, and a copywritten song is heard playing in the background, that's incidental to the purpose of the interview itself, and not infringment.

Furthermore, the Director of the US Copyright Office has explicitly stated:

"New technologies have made it increasingly apparent that not all reproductions are the same. Some copies are merely incidental to an intended primary use of a work, including where primary uses are licensed, and these incidental copies should not be treated as infringing..."
 
  • Like
Reactions: helper800 and bit_user
USAFRet said:
And a proper code review before release would have caught this bit of idiocy.
Click to expand...
The thought occurred to me that what if this is baked into a unit-test or diagnostic self-test? It's not hard to imagine: someone is writing + reading-back a block of data and decided to use song lyrics from their favorite band, rather than an arbitrary non-repeating bit-sequence.

Wherever it exists, I'm certain modern SSDs have a codebase that's much too large for a top-to-bottom code review. I mean, that's like Nuclear Reactor stuff, or maybe airplane avionics. Where I work, we require 2-person review + signoff for all changes and even that process is more than burdensome enough.
 
bit_user said:
The thought occurred to me that what if this is baked into a unit-test or diagnostic self-test? It's not hard to imagine: someone is writing + reading-back a block of data and decided to use song lyrics from their favorite band, rather than an arbitrary non-repeating bit-sequence.

Wherever it exists, I'm certain modern SSDs have a codebase that's much too large for a top-to-bottom code review. I mean, that's like Nuclear Reactor stuff, or maybe airplane avionics. Where I work, we require 2-person review + signoff for all changes and even that process is more than burdensome enough.
Click to expand...
Right.

But at every step along the way, every intermediate build and test....code review.
Multiple eyes on the thing.

If their procedures are so lax that some asshat can inject this at a late stage, with no oversight....that is also bad.
 
therosses said:
What are the odds that bits randomly appeared to form lyrics to a song?
Click to expand...
Not worth trying to calculate.

Even if the flash were far more error-prone, increasing the rate at which bit errors occur, in order to have structured data emerge, you need some sort of feedback loop to reverse entropy. Otherwise, entropy would increase, not decrease and what you'd get would be even more noisy than whatever initial condition they started with.

It's a generalization that applies across any sort of emergent phenomena, across fields as disparate as genetics, neural networks, and macro economics. Order simply doesn't emerge from chaos, without such a process at work.
 
Last edited:
  • Like
Reactions: helper800
therosses said:
What are the odds that bits randomly appeared to form lyrics to a song?
Click to expand...
This would be a 'not impossible' but so rare to happen in nature that it is not worth considering. Lets say that the amount of bits required to fit this song was 50. The odds of them flipping to the exact sequence required for the song to exist would be 1 in 50! (factorial). This would be 1 in:
30,414,093,201,713,378,043,612,608,166,064,768,844,377,641,568,960,512,000,000,000,000
I believe in US numbering this would be 30 vigintillion, or a number followed by 63 zeros
 
Last edited:
  • Like
Reactions: bit_user
You must log in or register to reply here.

TRENDING THREADS

Latest posts

Moderators online

Share this page

COMPANY
RESOURCES
FOLLOW
Top Bottom