Int3.cc: Tools for the Talented

For the last few years on this blog we’ve been publishing more and more about embedded systems. We started with “Disassembling Blackberry Apps” which (to this day) we still get emails about thanking us for the disassembler patches we released.

A few years back as Ridley was getting into “hardware hacking” and attacking embedded systems we released a talk, slides, and video on simple hardware hacking techniques and tools for software security people to get started.

A year or so ago we publicly released the first training on ARM Exploitation which teaches how to write exploits for software running on ARM hardware. This class sold out at CanSecWest 2012, Blackhat 2012, and again this year at Blackhat 2013. We are grateful that people are interested in our work.

This year we’ve gone a bit further and started designing our own hardware to assist us in attacking software on embedded systems and also started writing firmware for a custom circuit board we designed for a consumer products. We call the hardware system we build Osprey. But in developing our own hardware we formed good relationships with designers and factories. We wanted to leverage these relationships to help get some “build it yourself” security hardware projects to the hands of people (like us) that don’t have the time and/or skill to build a tool from scratch.

It’s a simple thing to build simple circuits once you know how. But most of us would like to just buy the hardware tool so we can quickly get to work reversing and coding.

One such tool was the FaceDancer designed by Travis Goodspeed. So we built a site called http://int3.cc where folks could buy assembled Facedancers. Int3 is an experiment but the idea is simple…we assume the initial risk of manufacturing a fully-assembled device, by paying for it. We then distribute the cost across sales to the community. As our costs go down, so do the devices prices. (You can read more about the mission of Int3.cc on the About Page). We manufactured Facedancers with the same factories and designers that helped us build Osprey. Although Osprey isnt currently available, http://int3.cc gave us a place to show it a bit, and let people know what we’ve been up to.

We’ve gotten a bunch of orders of the FaceDancer and have shipped hundreds of these around the world. We wrote a bit about how fascinating it has been to see the turnout (in both sales) and the community response: the software people write for it and the bugs people find with it.

We are happy with the turnout and hope to add new security focused projects to http://int3.cc soon!