Serafina Brocious Explained

Serafina Brocious
Known For:PyMusique, Alky Project, The Hardware Hacker Manifesto, Onity Lock Hack
Employer:Optiv[1] [2]
Occupation:Software engineer

Serafina Brocious is an American software engineer best known for her work on PyMusique and her demonstration of Onity HT lock system vulnerabilities in 2012.[3] [4]

Notable projects

PyMusique

Brocious first saw recognition as founder of the PyMusique project, where she worked with Jon Lech Johansen of DeCSS fame. PyMusique allowed Linux users to purchase music from the iTunes music store without the standard FairPlay DRM implementation in place.[5]

Falling Leaf Systems

During her employment with MP3Tunes, Brocious also joined forces with Brian Thomason, then an employee of another Michael Robertson company, Linspire Inc., to form Falling Leaf Systems LLC.[6] [7] Falling Leaf Systems attempted to commercialize the Alky Project, which was started by Brocious to enable Microsoft Windows games to run on other platforms.

Falling Leaf Systems sold access to a membership site dubbed the Sapling Program, whereby users could access a build of Alky allowing them to demo the game Prey on either Linux or Mac OS X. Despite attempts to expand their stack by also supporting applications on disparate platforms, Falling Leaf Systems officially closed its doors in early 2008.[8] [9]

Emokit

In 2010, Brocious reverse-engineered the protocol used by the Emotiv EPOC EEG headset, publishing the AES key used for encrypting the sensor data.[10]

The Hardware Hacker Manifesto

The Hardware Hacker Manifesto was published on 21 September 2010. It gives some insight of the psychology of hardware hackers. Serafina Brocious goes into an explanation of why it is important for owners to have the right to utilize hardware the way they wish to use it.[11]

Onity lock systems

At the 2012 Black Hat Briefings, Brocious presented several vulnerabilities about the Onity HT lock system, a lock used by the majority of U.S. hotels.[12] The security hole can be exploited using about worth of hardware, and it potentially affects millions of hotel rooms.[13] [14] The device was eventually optimized down to the size of a marker, and was eventually used to perform burglaries.[15]

Onity started rolling out safeguards for the problem in late 2012,[16] which was considered a slow reaction.[17] However, in 2013 it was still reported that some hotels continued to be vulnerable, likely due to the cost of the security upgrade.[18]

Notes and References

  1. Web site: Holy crap, it's 2013.
  2. Web site: Press Releases. Optiv.
  3. Web site: Hotel-room lock hack tied to ongoing thefts. NBC News. 16 May 2013 .
  4. Web site: Faulty Hotel Locks Demonstrated by ABC News Report. ABC News. United States.
  5. Web site: Forbes interview with Cody Brocious on PyMusique. Arik Hesseldahl. 28 March 2005. Forbes.
  6. Web site: DesktopLinux citing Thomason's role at Linspire . 11 July 2008 . https://web.archive.org/web/20080512061156/http://www.desktoplinux.com/news/NS4485976647.html . 12 May 2008 . dead .
  7. Web site: Falling Leaf Systems announces launch.
  8. Web site: Alky Project merges with Project VAIO.
  9. Web site: Falling Leaf Systems closes shop.
  10. Web site: Interview with Cody Brocious on the Emokit. Friendly. h+ Magazine.
  11. Web site: The Hardware Hacker Manifesto.
  12. http://demoseen.com/bhpaper.html demoseen.com – Inner workings of the Onity HT lock system for hotels
  13. https://www.forbes.com/sites/andygreenberg/2012/07/23/hacker-will-expose-potential-security-flaw-in-more-than-four-million-hotel-room-keycard-locks/ forbes.com – Hacker will expose potential security flaw in more than four million hotel room keycard locks
  14. http://www.extremetech.com/computing/133448-black-hat-hacker-gains-access-to-4-million-hotel-rooms-with-arduino-microcontroller extremetech.com – Black Hat hacker gains access to 4 million hotel rooms with Arduino microcontroller
  15. Web site: Electronic lock picking: Hotel heists allegedly exploited Onity keycard lock hack | Computerworld Blogs. 23 July 2013. https://web.archive.org/web/20130310053555/http://blogs.computerworld.com/security/21404/electronic-lock-picking-hotel-heists-allegedly-exploited-onity-keycard-lock-hack. 10 March 2013. dead.
  16. https://www.engadget.com/2012/12/07/onity-rolling-out-safeguards-against-hotel-keycard-hacks/ Onity rolling out safeguards against hotel keycard hacks, may fix some locks outright
  17. Web site: Fix for hotels' electronic door lock hack slow to roll out. Cyrus. Farivar. 7 December 2012. Ars Technica.
  18. Web site: Hotel Lock Hack Still Being Used in Burglaries, Months After Lock Firm's Fix. Andy. Greenberg. Forbes.