android-efi is a simple EFI bootloader for Android™ boot images. It accepts the partition GUID of an Android boot partition on the command line, loads the kernel, ramdisk and command line and finally hands over control to the kernel.[…]
Author: hucktech
uefi-rs – library to enable writing UEFI apps in Rust language
This library allows you to write UEFI applications in Rust. UEFI is the successor to the BIOS. It provides an early boot environment for OS loaders and other low-level applications. The objective of this library is to provide safe and performant wrappers for UEFI interfaces, and allow developers to write idiomatic Rust code. This crate’s documentation is fairly minimal, and you are encouraged to refer to the UEFI specification for detailed information. You can find some example code in the tests directory, as well as use the build.py script to generate the documentation. This repo also contains a x86_64-uefi.json file, which is a custom Rust target for 64-bit UEFI applications.[…]
UEFIStarter: framework to simplify UEFI development with TianoCore EDK2
This is a small C framework for UEFI development built on top of TianoCore EDK2. This project is not a comprehensive course in UEFI development. If you’re just starting to write UEFI code you’ll need to use additional material like the official TianoCore documentation, and the UEFI Specification. The library and UEFI applications included in this code are meant to simplify a few repetitive tasks when developing UEFI code. For example there is a configurable command line argument parser that will validate input strings and convert them into the target datatype, e.g. integers. This project started out with another UEFI development kit (gnu-efi) but eventually outgrew the original SDK, so I migrated it to TianoCore EDK2017. As a result of this there are still a few library functions included that are already built-in into TianoCore. It is my hope that this code helps anyone looking into, or starting with, UEFI development: I did that myself a few months ago and found parts of the various documentations frustratingly lacking. If I can spare you some of the headache I had I’m happy.
SecurityPlanner.org
An interesting site for consumer devices, not enough on firmware yet.
Eclypsium to offer firmware training at REcon
Defending From Platform Firmware Threats
Instructor: Yuriy Bulygin, Oleksandr Bazhaniuk
Dates: 29 to 31 January 2018
Price: 2625 EURO before January 1, 3500 EURO after.
A variety of attacks targeting system firmware have been discussed publicly, drawing attention to the pre-boot and firmware components of the platform such as BIOS and SMM, OS loaders and secure booting. This training will detail and organize objectives, attack vectors, vulnerabilities and exploits against various types of system firmware such as legacy BIOS, SMI handlers and UEFI based firmware, mitigations as well as tools and methods available to analyze security of such firmware components. It will also detail protections available in hardware and in firmware such as Secure Boot implemented by modern operating systems against bootkits. The training includes theoretical material describing a structured approach to system firmware security analysis and mitigations as well as many hands-on exercises to test system firmware for vulnerabilities. After the training you should have basic understanding of platform hardware components and various types of system firmware, security objectives and attacks against system firmware, mitigations available in hardware and firmware. You should be able to apply this knowledge in practice to identify vulnerabilities in BIOS and perform forensic analysis of the firmware.
https://recon.cx/2018/brussels/training/trainingfirmware.html
PS: Looking forward to when Eclypsium will release their ARM port of the GPL CHIPSEC project. They’ve been saying they’d release this since Black Hat. It would be nice if ARM OEMs could use it, not just Eclypsium clients.
CCC videos uploaded
https://twitter.com/NikolajSchlej/status/946761209721835521
Re: CCC: https://firmwaresecurity.com/2017/12/26/intel-me-at-ccc/
the videos are already uploaded! Thanks, CCC staff!
https://media.ccc.de/b/congress/2017
NVIDIA to stop 32-bit driver development
By Kathleen Maher December 27, 2017
Bye-bye 32, says Nvidia
In a no frills, no hoopla, in a very un-Nvidia like fashion, the company announced that after Release 390, Nvidia will no longer release drivers for 32-bit operating systems for any GPU architecture. The company is currently shipping WHQL driver version 388.71 which suggests there will be a few more 32-bit drivers before the cutoff. Later driver release versions will not operate, nor install, on 32-bit operating systems. Driver enhancements, driver optimizations, and operating system features in driver versions after Release 390 will not be incorporated back into Release 390 or earlier versions. This impacts operating systems such as Microsoft Windows 7, Microsoft Windows 8/8.1, Microsoft Windows 10, Linux, and FreeBSD—applicable to operating systems running on x64 and x32 CPU architectures.
Hmm, I can’t find this info on the NVIDIA pr site:
Video of Joanna Security through Distrusting at BHEU uploaded
QBDI – QuarksLab – dynamic binary instrumentation framework for Intel/ARM Linux/Mac/Android/iOS/Windows
https://github.com/quarkslab/QBDI
https://events.ccc.de/congress/2017/Fahrplan/events/9006.html
QuarkslaB Dynamic binary Instrumentation (QBDI) is a modular, cross-platform and cross-architecture DBI framework. It aims to support Linux, macOS, Android, iOS and Windows operating systems running on x86, x86-64, ARM and AArch64 architectures.
UK gov on firmware vulnerabilities, and updated guidance for Windows
Firmware bugs are like buses
Created: 23 Nov 2017
Author: Mike H
[…]These vulnerabilities serve as a great example of the importance of firmware updates and the need for a strategy to be in place to automate them. If you are not already applying firmware updates within your organisation, maybe this is a good time to think about starting.
https://www.ncsc.gov.uk/guidance/eud-security-guidance-windows-10-1703#devicefirmware
https://www.ncsc.gov.uk/blog-post/firmware-bugs-are-buses
Hopefully they update their Linux guidance to include recent firmware security advice, not just the Windows guidance. 🙂
See-also:
https://www.ncsc.gov.uk/guidance/end-user-device-security
eg:
https://www.ncsc.gov.uk/guidance/end-user-device-guidance-factory-reset-and-reprovisioning
Intel ME at CCC
It appears PTSecurity may have a GUI Debugger for Intel ME??
The “Minix Inside” stickers look great, click on the tweet from frdnd.
Hoping CCC staff does the great job they do ever year and get the videos for these events online quickly! 😉
https://twitter.com/frdnd/status/942984718613610496
https://fahrplan.events.ccc.de/congress/2017/Fahrplan/events/8762.html
https://fahrplan.events.ccc.de/congress/2017/Fahrplan/events/8782.html
PS: Of course, this isn’t all that is happening at CCC. There are multiple other interesting talks, eg:
https://fahrplan.events.ccc.de/congress/2017/Fahrplan/events/9111.html
https://fahrplan.events.ccc.de/congress/2017/Fahrplan/events/9056.html
https://fahrplan.events.ccc.de/congress/2017/Fahrplan/events/9205.html
https://fahrplan.events.ccc.de/congress/2017/Fahrplan/events/8725.html
https://fahrplan.events.ccc.de/congress/2017/Fahrplan/events/9207.html
https://fahrplan.events.ccc.de/congress/2017/Fahrplan/events/8920.html
https://fahrplan.events.ccc.de/congress/2017/Fahrplan/events/8950.html
https://fahrplan.events.ccc.de/congress/2017/Fahrplan/events/9237.html
https://fahrplan.events.ccc.de/congress/2017/Fahrplan/events/9202.html
https://fahrplan.events.ccc.de/congress/2017/Fahrplan/events/9195.html
https://fahrplan.events.ccc.de/congress/2017/Fahrplan/events/8784.html
https://fahrplan.events.ccc.de/congress/2017/Fahrplan/events/8831.html
https://fahrplan.events.ccc.de/congress/2017/Fahrplan/events/9159.html
https://fahrplan.events.ccc.de/congress/2017/Fahrplan/events/9058.html
https://fahrplan.events.ccc.de/congress/2017/Fahrplan/events/8956.html
Cutter 1.1 released
Vesion 1.1 of Cutter, the GUI for Radare2 formerly known as Iaito, has been released. Click on the second tweet below for an animation of the GUI in action.
https://github.com/radareorg/cutter
Sysdream article on using PCILeech to attack Windows
Nice article by Sysdream on using PCIleech to attack Windows DMA.
Nexmon_Debugger: for ARM microcontroller in the BCM4339 Wi-Fi chip
Nexmon Debugger
To analyze the FullMAC firmware running on the ARM microcontroller in the BCM4339 Wi-Fi chip, we created a debugger in software that directly accesses the hardware registers of the ARM Debugging core. As we do not have access to the JTAG port, we generate exceptions whenever a breakpoint or watchpoint is triggered. We handle those exceptions in our firmware patch and can then continue with the execution of the firmware code.[…]
Intel ME research paper
https://twitter.com/bitkeks/status/939900188210147328
The Intel Management Engine
This blog post is based on a research paper I wrote for university. Although my work was mainly reading and summarising, I hope this article helps to bring some clarification about the details of the ME. At the bottom, you will also find some sources I used. Please be aware that since I wrote this report until June 2017, a new generation of ME was deployed, the one running the Minix microkernel on a x86 coprocessor. Nevertheless–to understand the development and architecture of the whole concept, it’s good to understand the details up from 2009.[…]
https://bitkeks.eu/blog/2017/12/the-intel-management-engine.html
ARM assembly syntax (and REtools)
Bidirectional ARM Assembly Syntax Specifications
One of the tantalising pieces of information contained in ARM’s machine readable specifications is a specification of the assembly syntax. A few years ago (on an earlier) version of the specification, Wojciech Meyer and I decided to try to transform this specification into assemblers and disassemblers. At the time, this was not very useful to ARM because we already had assemblers and disassemblers so, although technically successful, the project died and the code has been slowly bitrotting ever since. In a few days time, I will be giving a talk at the 34th Chaos Communication Congress in Leipzig about practical things you can do with ARM’s specification and I thought it would be a good idea to suggest that someone creates a similar tool. But maybe it would be a good idea if I showed you what Wojciech and I did to get you started? Let’s start by digging into the HTML rendering of the ARM spec with the ADD instruction. The assembly syntax is in four parts. The first two parts show you the opcode diagram and the overall assembly syntax and is almost directly usable as a specification.[…]
https://alastairreid.github.io/bidirectional-assemblers/
https://events.ccc.de/congress/2017/Fahrplan/events/8915.html
See the above tweet for a thread about a related tool:
retools: a reverse engineering toolkit for normies
Collection of tools (disassembler, emulator, binary parser) aimed at reverse enginering tasks, more specifically, bug finding related. Currently we target ARMv7 and Mach-O though in the future more architectures and formats are planned. retools is somewhat unique in that most of the semantics for relevant instructions are parsed out of the specification PDFs as opposed to being generated by hand. Currently the disassembler, emulator, and binary parsers are partially done, with a symbolic execution engine and instrumentation/hooking framework to come as I get more time.
https://github.com/agustingianni/retools
VbiosFinder and rom-parser
VBiosFinder: extract a VBIOS from a BIOS update.
This tool attempts to extract a VBIOS from a bios update.
Dependencies include: UEFIDump and rom-parser.
https://github.com/coderobe/VBiosFinder
—–
UEFIDump, of course, is included with UEFITool. But rom-parser is new to me.
To view ROM contents:
usage: rom-parser [ROM file]
This program does not have support for reading the ROM from pci-sysfs, please do this manually in advance, ex:
cd /sys/bus/pci/devices/0000:01:00.0/
echo 1 > rom
cat rom > /tmp/image.rom
echo 0 > rom
Pass the resulting image file as the argument to this program.
To modify ROM conents:
usage: rom-fixer [ROM file]
Obtain ROM as above, program prompts for modifying ROM vendor and device IDs and invalid checksums.
IMPORTANT: rom-fixer will update the ROM file in place. Make a backup!
Resolvit seeks CHIPSEC-savvy Pentester
It is still rare enough to see “CHIPSEC” in a job posting, that I still point them out.
Given job posting is a pentest role, this is also a ‘leading indicator’ that pentesters are starting to attack your firmware. 🙂
Penetration Tester – Product
Join Resolvit as a Penetration Tester and be part of a creative, forward-thinking team. Our success at deploying skilled, highly knowledgeable experts has landed us on the Inc. 5000 list of America’s fastest-growing companies four times – and we’re just getting started. As the Penetration Tester, you will configure security test targets such as servers, storage, and networking environments; perform product security assessments; create assessment reports; and work with global product teams to review assessment results.[…]
Experience with multiple of these security assessment tools: AppAudit, Arachni, Burp Suite Pro, CHIPSEC, nmap, Nessus, Protecode SC, and Metasploit
[…]
puppet-efibootmgr: Puppet module for managing EFI boot order
puppet-efibootmgr
Puppet module for managing EFI boot order
bootutils : utilities to create bootable disks, remaster ISO images, make multiboot disk images
bootutils: Utilities to create bootable disks, remaster ISO images, make multiboot disk images
Use cases:
1: Multiboot disk image
2: Remastering ISO
3: Create boot disk on separate disk
4: Fix grub-install errors
[…]
Firmware Security 
You must be logged in to post a comment.