There's an organization (sounds like: Master Large Brickwall) and they have this system (sounds like: RichMom). We are "passing the hat", asking for your help to buy a couple of RichMom devices for a hands-on security evaluation.

Background on the system:

The system is used to send encrypted messages over the air. Due to the proliferation of sports gambling, the security of this system should be of great interest to all Americans and anyone with an interest in American sports.

Previous analysis:

For about five years, evm and strikeout have been evaluating RichMom as much as possible without access to hardware. We've performed captures of RichMom signals in the field and written software to demodulate the waveform. Our analysis shows that the demodulated payload has a 64-bit encrypted payload, which indicates they are probably using 64-bit (breakable) cryptography. Firmware images are available but they are encrypted and we believe decryption happens within a custom bootloader on the device. We have met with high level folks at Master Large Brickwall and shared our findings and they said "yup, everything's fine!" But no details are published on the algorithm and so we just have to take their word for it. The Brickwall people said that there is some kind of key rotation that happens during usage, but we have no idea what that looks like.

Up until now the company that makes RichMom had very restrictive legal restrictions around acquiring a system. Systems were only leased at $2K/year for 2 years (a $4K investment) and you had to prove you were a ... brickwall team. Now they've made single systems available for direct purchase at $1K.

What we'll do with this money:

The money collected in this fundraiser will only be used to acquire RichMom devices. We'd love to raise enough money to buy two sets. We intend to do two things with the devices hands-on: 1) Look for undocumented commands in the custom bootloader that might be used to dump unencrypted program memory. 2) If non-destructive analysis doesn't allow us to recover the bootloader, we'll attempt to recover the bootloader and any associated keys that might be used to decrypt the firmware.

What are you hoping to accomplish?

It's a bedrock principle of information security that secret algorithms and protocols provide no security, and that the strongest systems are evaluatable. Once we have decrypted program memory, we'll be able to analyze the program and determine what kind of cryptography algorithm they are using, and if any key rotation is being used (and how it works). We want to perform a full open analysis so that everyone can have confidence that this system is secure. We expect to show that RichMom is using insecure signalling, but that by upgrading to 128-bit algorithms they can still hit their power budget and have better security.

Is this legal?

Our understanding is that it is 100% legal. Our lawyers have said that in-the-wild captures of signals potentially break the Wiretap Act but generally this would only allow someone to sue for damages if we revealed the contents of private communication. Reverse engineering devices is legal but would possibly cause the company to terminate their relationship with us, or sue for damages, but we intend to follow the principles of responsible disclosure and help the company to upgrade first. The company pushes out firmware upgrades so a firmware upgrade to a stronger algorithm should be easily possible.

Keep us informed?

This is the first thing I've done on FreeFunder - but we hope to be able to keep everyone who donates informed on our progress and share as much as we can (respecting responsible disclosure).