Author: hucktech

BootStomp: Android bootloader vulnerability finder

~ hucktech ~ Leave a comment

BootStomp is a boot-loader bug finder. It looks for two different class of bugs: memory corruption and state storage vulnerabilities. For more info please refer to the BootStomp paper. To run BootStomp’s analyses, please read the following instructions. Note that BootStomp works with boot-loaders compiled for ARM architectures (32 and 64 bits both) and that results might slightly vary depending on angr and Z3’s versions. This is because of the time angr takes to analyze basic blocks and to Z3’s expression concretization results.[…]

https://seclab.cs.ucsb.edu/academic/publishing/#bootstomp-security-bootloaders-mobile-devices-2017

https://github.com/ucsb-seclab/BootStomp/blob/master/tools/huawei_tools/oeminfo_exploit.py

https://github.com/ucsb-seclab/BootStomp

print “[!] Usage: “ + sys.argv[0] + “ <oeminfo.img> <exploit_oeminfo.img>\n“

Lots of links to read at the end of the github readme web page.

 

Smart grid security

~ hucktech ~ Leave a comment

Smart electrical grids more vulnerable to cyber attacks

Electricity distribution systems in the USA are gradually being modernized and transposed to smart grids, which make use of two-way communication and computer processing. This is making them increasingly vulnerable to cyber attacks.[…]

https://www.sciencedaily.com/releases/2017/08/170816100230.htm

https://www.elsevier.com/about/press-releases/research-and-journals/smart-electrical-grids-more-vulnerable-to-cyber-attacks

http://www.sciencedirect.com/science/article/pii/S1874548217300495?via%3Dihub

NXP security during the boot process

~ hucktech ~ Leave a comment

Data Protection with the NXP QorIQ Platform Trust Architecture
Mike Slonosky
With the increased sophistication of embedded applications, systems designers and their customers are expressing heightened concerns regarding the importance of protecting the data residing in their systems, and by extension, their investment in intellectual property. Curtiss-Wright Defense Solutions has given data protection a very high priority in the design of its Power Architecture single board computers (SBC). Curtiss-Wright utilizes NXP’s (formerly Freescale) next generation system-on-chip (SoC) QorIQ T2080 Platform for its rugged, SWaP-optimized Power Architecture modules. The QorIQ Platform’s Trust Architecture allows for developing systems to achieve higher levels of security, with reductions in cost, size and power. This paper will refer solely to the T2080 Processor when stating the name of this QorIQ processor family. For a detailed review of the P4080 Processor, please read the following white paper: Embedded High Assurance Computing Using NXP Trust Architecture. This paper presents an overview of the potential threats to an embedded system, and how the Trust Architecture can effectively defend against these threats.[…]

https://www.curtisswrightds.com/infocenter/white-papers/trusted-architecture—data-protection-with-the-qoriq-platform-trust-architecture.html

https://www.curtisswrightds.com/content/images/T2080-with-QorIQ-Trust-Architecture.JPG

SiFive appoints new CEO

~ hucktech ~ Leave a comment

SiFive Appoints Naveed Sherwani as CEO

SAN FRANCISCO – August 15, 2017 – SiFive, the first fabless provider of customized, open-source-enabled semiconductors, today announced that industry veteran Naveed Sherwani has joined the company as CEO to lead it through its next phase of growth. Stefan Dyckerhoff, who had held the top spot at the company since its inception, will remain a member of the SiFive board of directors. “Naveed brings a lifetime of experience not only in the semiconductor and open source sectors, but also in growing successful startups into industry leaders,” Dyckerhoff said. “SiFive has achieved significant industry milestones since its founding, and we continue to drive innovations that are leveling the playing field for those priced out of the traditional silicon market. We are excited to have Naveed join the team, and look forward to further growth under his leadership.” Sherwani joins SiFive with more than 25 years of experience in the industry at companies including Intel, Brite Semiconductor and Open Silicon. Over the course of his career, Sherwani has been involved in the development of more than 300 chips, and, through his work as founder and CEO of Open Silicon, was instrumental in leading the development of ASIC technologies, which offered lower cost alternatives to traditional, less reliable legacy offerings.[…]

https://www.sifive.com/posts/2017/08/15/sifive-appoints-naveed-sherwani-as-ceo/

https://riscv.org/

HiFive1

Absolute introduces Absolute Reach

~ hucktech ~ Leave a comment

https://www.brighttalk.com/webcast/14813/272099

https://www.absolute.com/en/resources/datasheets/reach

https://www.absolute.com/en/resources/videos/product/reach

Absolute Reach™ is a flexible endpoint security feature within the Absolute Platform that gives you the power to execute custom discovery, compliance, and remediation tasks across 100% of your endpoints on-demand, anytime or anywhere:

• Assess and enhance security posture: Always-on visibility and control—on and off the network
• Eliminate blind spots: Remediate known vulnerabilities on the spot
• Gather precise insights from any endpoint: Evaluate risk and prove compliance
• Remediate with lightning speed: Script once. Deploy everywhere
• Validate delivery for compliance assurance: Receive confirmation of successful delivery and execution

 

eventstat for Linux

~ hucktech ~ Leave a comment

Colin Ian King just tweeted about eventstat. But his tweets are protected, so you have to login to Twitter and Follow him in order to see them.

Eventstat periodically dumps out the current kernel event state. It keeps track of current events and outputs the change in events on each output update. The tool requires sudo to run since it needs to write to /proc/timer_stats to start and stop the event monitoring.

http://kernel.ubuntu.com/~cking/eventstat/

https://github.com/ColinIanKing/eventstat

https://launchpad.net/~colin-king/+snap/eventstat

Maybe there’ll be a blog post on it shortly, as well.

http://smackerelofopinion.blogspot.co.uk/

 

Minoca 0.4 released

~ hucktech ~ Leave a comment

I just noticed that Yabits  has a new Github project called “uefi”, which is a:

“A minoca based UEFI coreboot payload”

https://github.com/yabits/uefi

Yikes, I don’t know what Minoca is.

“Minoca OS is a general purpose operating system written from scratch. It aims to be lean, maintainable, modular, and compatible with existing software. It features a POSIX-like interface towards application software, and a growing suite of popular packages already built and ready to go. On the backend, it contains a powerful driver model between device drivers and the kernel. The driver model enables drivers to be written in a forward compatible manner, so that kernel level components can be upgraded without necessarily requiring a recompilation of all device drivers. Minoca OS is event driven, preemptible, SMP ready, and network capable. It currently runs on x86 PCs and a range of ARM boards.”

https://github.com/minoca/os/tree/master/boot/bootman/efi
https://github.com/minoca/os
https://www.minocacorp.com/documentation/developers/debug/docs/reference/
https://blog.minocacorp.com/minoca-os-0-4-we-love-the-eighties-170a93112db1
https://fossbytes.com/minoca-os-interview-open-source/
https://www.minocacorp.com/product/

Installing Git on Minoca OS

 

Usenix WOOT presentations available

~ hucktech ~ Leave a comment

” (Sign in to your USENIX account to download these files.)”

https://www.usenix.org/conference/woot17/workshop-program

Context on firmware security

~ hucktech ~ Leave a comment

https://twitter.com/CTXIS/status/897055250078715904

Part I: An Overview of Firmware Storage Options
Firmware storage options
By Scott Lester and Steven Day, 09 Aug. 2017

The security of a device’s firmware, as the first or an early part of a trusted chain, can have implications for the security of the whole system. At Context we often obtain the firmware for a device so that we can extract it and take a good look at the underlying code for both the operating system and applications. For a recent example see our blog on the Virgin Media SuperHub. This blog is the first in a series of blogs on how firmware is commonly stored on embedded devices, and the techniques for extracting it. This first blog covers how and where firmware can be stored on a device. Future blogs will focus on some of the cheap, and not-so-cheap, methods of extraction.[…]

https://www.contextis.com/resources/blog/part-i-overview-firmware-storage-options/
https://www.contextis.com/

ARM updates C/C++ compilers

~ hucktech ~ Leave a comment

ARM has updated it’s C/C++ compiler toolchains.

C and C++ update for Arm Compiler 6:
As you are hopefully aware, Arm Compiler 6 has been available for 3+ years now, and has grown in maturity, and optimization quality release on release. As I write this, the latest available version is 6.8, and 6.6 has been qualified for use in safety-related development. We offer full support for the latest Arm processors, across the Cortex-A, R, and M, and SecureCore families. Arm Compiler 6 is available within DS-5 and Keil MDK toolchains. Furthermore the qualified version is available for purchase stand-alone. Arm Compiler 6 is based on the LLVM framework, using the modern Clang compiler front-end, and this is reflected in the name of the executable, Armclang. The compiler is then integrated into the full Arm tools suite, enabling use of legacy assembler code built with Armasm, as well as gas format assembler directly with Armclang. Finally the Arm linker (Armlink) brings in the optimized C and C++ libraries, or if desired the size optimized Arm C MicroLib library, as well as (optionally) implementing link-time optimizations across the source code.[…]

https://community.arm.com/tools/b/blog/posts/c-and-cpp-update-for-arm-compiler-6
https://developer.arm.com/products/software-development-tools/compilers/Arm-compiler

NXP: designing IoT devices with secure boot

~ hucktech ~ Leave a comment

NXP has a webinar for IoT makers, talking about secure booting. ‘Webinar’ scared me, but there’s no registration required. 🙂

Watch this on-demand presentation to learn how to:
* Manage the life cycle of an IoT edge node from development to deployment.
* Leverage hardware and software offerings available with the Kinetis MCU portfolio that can help you protect against attacks.
* Ease the burden of secure IoT edge node development using new processors and architectures from ARM.

https://community.arm.com/processors/trustzone-for-armv8-m/b/blog/posts/designing-secure-iot-devices-starts-with-a-secure-boot

http://www.nxp.com/video/designing-secure-iot-devices-starts-with-a-secure-boot:DESIGNING-SECURE-IOT-DEVICES

slides: https://www.nxp.com/docs/en/supporting-information/Designing-Secure-IoT-Devices-Starts-with-a-Secure-Boot.pdf

Click to access Designing-Secure-IoT-Devices-Starts-with-a-Secure-Boot.pdf

Roee Hay’s abootool: fuzzer for Android bootloader

~ hucktech ~ Leave a comment

fastboot oem vuln: Android Bootloader Vulnerabilities in Vendor Customizations:
We discuss the fastboot interface of the Android bootloader, an area of fragmentation in Android devices. We then present a variety of vulnerabilities we have found across multiple Android devices. Most notable ones include Secure Boot & Device Locking bypasses in the Motorola and OnePlus 3/3T bootloaders. Another critical flaw in OnePlus 3/3T enables easy attacks by malicious chargers – the only prerequisite is a powered-off device to be connected. An unexpected attack vector in Nexus 9 is also shown – malicious headphones. Other discovered weaknesses allow for data exfiltration (including a memory dumping of a Nexus 5X device), enablement of hidden functionality such as access to the device’s modem diagnostics and AT interfaces , and attacks against internal System-on-Chips (SoCs) found on the Nexus 9 board.

abootool: Simple fuzzer for discovering hidden fastboot gems. Modus Operandi: Based on static knowledge (strings fetched from available bootloader images), dynamically fuzz for hidden fastboot OEM commands.

https://github.com/alephsecurity/abootool
https://www.usenix.org/conference/woot17/workshop-program/presentation/hay
https://alephsecurity.com/

abootool

Hardened Linux and firmware

~ hucktech ~ Leave a comment

I recently noticed Hardened Linux, because they were calling CHIPSEC. I just noticed they have some informational pages with info on Intel ME/AMT/UEFI and other technologies:

https://github.com/hardenedlinux/firmware-anatomy

https://github.com/hardenedlinux/firmware-anatomy/blob/master/hack_ME/firmware_security.md

https://github.com/hardenedlinux/firmware-anatomy/tree/master/hack_ME

https://github.com/hardenedlinux/firmware-anatomy/blob/master/hack_ME/me_info.md

https://hardenedlinux.github.io/about3/

https://hardenedlinux.github.io/system-security/2017/07/31/firmware_chipsec.html

https://translate.google.com/translate?hl=enu&u=https://hardenedlinux.github.io/system-security/2017/07/31/firmware_chipsec.html

 

AMI supports AMD Threadripper

~ hucktech ~ Leave a comment

AMI has a few press releases about AMD Rhyzen support:

https://ami.com/en/tech-blog/amd-ryzen–aptiov/

https://ami.com/en/news/press-releases/american-megatrends-aptio-v-uefi-firmware-supports-amd-ryzen-threadripper-highperformance-gaming-processor-product-line/

new book on Apple reversing/debugging

~ hucktech ~ Leave a comment

Advanced Apple Debugging & Reverse Engineering
Explore code through LLDB, Python and DTrace, to discover more about any program than you ever thought possible.

https://store.raywenderlich.com/products/advanced-apple-debugging-and-reverse-engineering?_ga=2.129698885.852507492.1502412840-255700375.1502412840