Editor's Note: Here's a link to part 2, The Eye-Fi: A Case Study in Next-Generation Application Security Issues.
The moment we laid our eyes on the Eye-Fi, it was evident that this device would be something out of the ordinary. Not only did the advertising promise to turn any digital camera into a wireless device, but it appeared as if backend technology that makes all this happen would be all but invisible to the end user. As a gadget lover, there was no way I could sit back and ignore something like this. And as a security researcher, the possibilities for exploitation and abuse were too great to disregard. So, thanks to InformIT, we received our copy at Christmas and started to tear the solution apart. The following double article will provide you with the details of our research and is guaranteed to provide a few eye-opening revelations.
The first part of this series is going to focus on the technical details of the card and provide you with an indepth look at how the device and its software counterparts work together to create a truly unique solution. The second article builds off the first and looks at the intricate web of overlapping technologies to demonstrate how this type of solution can leave a user exposed to abuse and/or create the digital peeping tom's ultimate victim.
Beauty Is in the Eye-Fi of the Beholder
From the moment we got our Eye-Fi card in the mail, we were impressed. The first thing that got our attention rarely warrants a mention on most articles about a new technological marvel—the packaging, or in this case the "eye candy." The actual device comes in a small rectangle box that has no obvious edges or things to lift open (see Figure 1). Yet, it doesn't take much thought to do what feels natural—pull the orange tab on the side of the box. When you do this, the opposite side of the box slides out to expose the Eye-Fi card neatly nestled in its resting place (see Figure 2). We honestly can't think of any other packaging that has ever caught our attention like this. So, like all good researchers we tore it apart and found a patent notice from Burgopak.
Figure 1 The Eye-Fi package
Figure 2 The Eye-Fi package open