This is part two. Part 1 which discusses why MIPS is more secure, use of external battery packs to circumvent powerline hacking and interdiction and tampering of tablet #1 at http://www.reddit.com/badBIOS/comments/2f2uub/mips_cpu_may_be_more_secure/
HOW TO AIR GAP
Redditors ask me for evidence that I am being hacked. I included the evidence in this tutorial on how to air gap which is why this thread is long.
There is only one online photograph of the motherboard. http://imagizer.imageshack.us/a/img823/1634/m0q4.jpg
. Tablet #1 has two Hynix RAM chips and a WL33 chip next to the Realtek wifi chip. Tablet #2 has two non branded RAM chips, Samsung K9GBG08U0A NAND flash and a messy clear adhesive glob below the webcam.
No disassembly guide. MIPS tablet was easy to open with a guitar pick. Save the small black plastic volume control and power switch that fall off during disassembly. MIPS motherboard is similar to Allwinner A13 motherboard. Photograph of MIPS tablet http://imgur.com/iIAoOKy
MIPS and Allwinner A13 CPU tablets have the same Realtek RTL8188EUS wifi chip. Photo of wifi chip to the upper left of the MIPS ATM7013 CPU. Wifi chip is on top of a teal blue board surrounded by metal rectangular antenna. http://imgur.com/v2SEY9Z
Realtek RTl8188EUS wifi chip is to the right of the ATM7013 CPU in this photo. http://imgur.com/eXSjIZL
Close up photo of speaker. Back of speaker has a magnet. Speaker is next to battery. http://imgur.com/WVIxSfe
Back case has 'mic' imprinted on it. The black circle with a metal ring around it and a red cable is the microphone. http://imgur.com/opfzy8e
To air gap, cut cable to piezoelectric conductive speaker and microphone. Cut off gray antenna that is soldered above wifi chip and goes along microphone and battery and is soldered to removable small green board XRD-RF1. A chip extractor tool and exacto knife won't remove the wifi chip. I had two holes drilled in the black wifi chip in tablet #2.
I purchased a second MIPS tablet from the same Ebay seller. Immediately upon receipt of the package, two holes was drilled in the wifi chip with a 1/8" bit. Like the first tablet, the second tablet would not turn on. The next day, I connected an external battery pack to its micro usb port. A battery icon popped up showing it had 75%. Why hadn't it turned on the day before? I disconnected the USB battery pack and turned on the tablet.
When I stop the charging prematurely to turn on the tablet, the battery indicator shows 100%. I'll use the tablet for a little while and then go to system settings > battery. The battery still is 100%. I turn off the tablet and connect the external battery pack. Battery indicator is significantly less than 100%. Tablet #1 also had false battery readings. I had to repeatedly hold down the power button for it to turn off. Hackers have tampered with the power management of all my devices. http://www.reddit.com/badBIOS/comments/2ap9z5/badbios_requires_charged_battery_and_always_on/
Tablet #2 has a file manager, Adobe Reader, Skype. Like Tablet #1, it is missing AppInstaller. Tablet #2 has Angry Birds and Fruit Ninja whereas tablet #1 did not.
Using file manager, I was able to install the apps that I previously downloaded on a 8 GB SD card using a computer. Settings > manage apps > on SD card listed only four of approximately a dozen f-droid.org apps. The size of the four apps is 0B (zero bytes).
The apps that I had downloaded using a computer were able to access my personal files in ext-sd. The tablet is now a PDA capable of creating, reading and editing plain text files and reading PDF files.
I connected tablet #2 to a different Windows PC. PC didn't detect the tablet nor the SD card inside the tablet because the tablet was off. Connecting the tablet to a PC does not wake up the tablet. I turned on the tablet. Tablet asked if I wanted to "turn on USB storage." I clicked on it. PC was able to open my tablet and SD card. I went to f-droid.org and could download more apps directly to the download folder in my tablet or to th download folder in my SD card.
OI file manager from f-droid.org showed skewed file stampdates of 12/31/1969 for ext-sd, udisk, proc directory and exe files and root files in proc directory. Skewed filestamp dates is a symptom of a BIOS rootkit. http://www.reddit.com/badBIOS/comments/2927mbadbios_alters_timestamps_and_clock/
The problems with tablets #1 and #2 are due to their being hacked. After air gapping and using an external battery pack, tablet #2 is still being hacked. The third day, I cut the webcam's ribbon cable. I turned on the tablet. Date and time were skewed to 12/31/2010 even though in system settings > Date & time > I had unticked 'automatic date & time' and 'automatic time zone.' The real time clock (RTC) should have kept time.
My 8 GB SD card had been unmounted. System settings > storage > Removable SD card was grayed. I could not remount my card. Thereby, my apps no longer have access to my personal files (plain text files, PDFs, JPGs, etc) on my SD card.) aLogcat reported:
I/MountService( 882): gVS.subpart./mnt/uhost state=removed D/OpenGLRenderer (1071): Flushing caches (mode 0) D/WifiService ( 882): ACTION_BATTERY_CHANGED pluggedType: 0
The large black wifi chip had been drilled. There should not be WifiService.
I removed my 8 GB SD card from tablet #2, performed a factory reset and reinserted the SD card. Tablet cannot mount SD card. I inserted the SD card into a Windows PC. PC could not detect the SD card. Inserted the card into my Palm Treo 705p phone. Phone detected card but could not open it. Hackers bricked another SD card. I had not recently backed up all of my files to my flashdrive. Thus, hackers deleted unrecoverable personal files from my SD card.
I connected the tablet and my Flashblu write protected flashdrive to the PC. 4 GB internal storage was not large enough to copy all my personal files. Hackers tampered with file permissions. They changed the internal storage to read only. My f-droid apps and personal files are now read only. I cannot move or delete them. I cannot create new plain text files or edit files. I cannot use my tablet as a PDA.
The first factory reset could not wipe my f-droid.org apps and personal files from the internal storage but was able to remove the file permissions the hackers created. The second factory reset wiped my apps and personal files. I attached my flashdrive to the OTG cable that came with the tablet. Copying my files was much slower than using a computer. I have read and write file permissions. However, some of my plain text files that were copied from my flashdrives have zero bytes. Hackers have emptied my files before. Some of the my plain text files were changed to empty folders. Sneaky ways of deleting files. This is more evidence of being hacked.
There is a small gold rectangular chip with lettering H403B and a tiny black square chip between the Realtek RTL8188EUS wifi chip and wifi antenna. All three chips are on a green square board. http://imgur.com/eXSjIZL
The manufacturer wouldn't have been situated them there if they don't use the antenna.
Searching for Realtek RTL8188EUS images brought up images of the square green board. The gold chip and tiny black chip are components of the wifi. The wifi is not just the large black chip with Realtek lettering. http://images.zakupka.com/i/firms/27/24/24722/wifi-modul-realtek-rtl8188eus_d159ec11f48a5a3_300x300.jpg
I drilled the gold chip and tiny black chip out. After rebooting, the tablet was slow. After a second reboot, the tablet returned to normal speed.
After drilling out the gold and black chips, aLogcat logs:
D/EthernetEnabler( 1415 ): EthernetEnabler construct
I/EthernetManager( 1415 ) Init Ethernet Manager, service: [email protected]
D/WifiEnable( 1415): setSwitch
D/EthernetEnabler( 1415 ): setSwitch called!
D/EthernetManager( 1415): state: 2
The RTC (real time clock) continues to be skewed over night. Date goes back to 12/31/2010. Time is behind.
The battery indicator is still inaccurate. Initially, notice was given before battery was deleted. Now there is no notice. I attempted to install BatteryBat Pro to set up notifications (alarms). I copied BatteryBat Pro from my flashdrive to internal storage. Hackers deleted it.
However, copying my files from my flashdrive is still being tampered. Tablet won't mount flashblu flashdrive when the write protection switch is on. I have to switch it off, mount and then switch it back on. Flashdrive's light flashes continually even when it is not being used by me.
Not all of my files are being copied. The files that are copied, some have empty folders and files.
After copying, flashdrive's light continues to flash indicating it is still busy. With other computers, I could not safely remove my removable media because they were busy. So I either shut down my computer to safely remove my removable media or yanked them out while my computers were still on.
I do not know how the MIPS is being hacked. Tablets have an accerometer and gyroscope which contain a piezoelectric two way transducers. As part 1 discussed, I purchased an external battery pack to prevent the piezoelectric transducers from using a ground wire to create a cave-link radio. I removed the speaker and microphone. Can piezoelectric transducers in accerometer and gyroscope produce ultrasound and very low frequency sound to essentially create radio?
I will try to identify the accerometer and gyroscope on the motherboard and destroy them. A tablet really doesn't need them if don't use the camera and use just one view: portrait or landscape. Landscape view is what I use for typing using anysoftkeyboard from f-droid.org. I will see if landscape view continues to work after destroying the accerometer and gyroscope.
Gyroscope identified on Allwinner A13 motherboards: http://moveontechnology.com/hugoenchina/wp-content/uploads/2013/01/SAM_0233-Copy.bmp
Accerometer identified on Allwinner A10 motherboards: http://moveontechnology.com/hugoenchina/wp-content/uploads/2013/04/T901-1-version.jpg
Accerometegyroscope are adjacent to camera chips on the two above referenced motherboards. After reviewing the motherboards, I am guessing the accerometer is underneath the LCD ribbon cable between the Samsung NAND and above where the battery wires are soldered to the motherboard. After drilling that chip, tablet won't turn on. I connected the external battery pack. Tablet still won't turn on. I connected the power adapter with barrel plug. Tablet immediately turned on.
Display is blue background and black font. No other colors. Display is dim. I had to adjust the brightness higher. Tablet did not auto rotate. To better test whether I destroyed the accerometegyroscope, I installed Alarm Klock and set the alarm to vibrate. Instead of vibrating, Alarm Klock rotated the screen from landscape to portrait. Evidence I had not destroyed the accerometegrycroscope.
Battery indicator remains inaccurate. BatteryBotPro's alarms do not function. No blinking light or vibration (or screen rotation).
Tablet shut down though there was ample battery charge. I could not turn it back on. External battery pack could not turn it back on. Connecting it momentarily to the barrel plug power adapter turned it on.
What is the chip I destroyed? I would appreciate help identifying chips on the motherboard.
Snippets of aLogcat logs reporting GSM, SIM toolkit, backup, etc. are posted in part III: http://www.reddit.com/badBIOS/comments/2f0rjo/secret_implanted_gsm_in_mips_tablet/