https://echo360.org/media/5fef9dbf-3c2a-4fa3-bfba-8f507847aefc/public
Author: hucktech
Intel announces IntelSGX Card
Purism announces PureBoot
Flashing the BIOS on the PC Engines APU4c4
https://twitter.com/lattera/status/1092959249011924992
This shows how to update BIOS on a FreeBSD-based environment:
https://github.com/lattera/articles/blob/master/hardware/apu/2019-02-05_flashing_bios/article.md
Super UEFIinSecureBoot Disk is a bootable image with GRUB2 bootloader designed to be used as a base for recovery USB flash drives
Super UEFIinSecureBoot Disk
Super UEFIinSecureBoot Disk is a bootable image with GRUB2 bootloader designed to be used as a base for recovery USB flash drives. Key feature: disk is fully functional with UEFI Secure Boot mode activated. It can launch any operating system or .efi file, even with untrusted, invalid or missing signature.
HowTo-setup-an-UEFI-Development-PC
There’s a new short document on setting up UEFI Tianocore development environment, it is Windows-centric:
https://github.com/MinnowWare/HowTo-setup-an-UEFI-Development-PC
see-also: https://github.com/tianocore/tianocore.github.io/wiki/Windows-systems
NDSS Workshop on Binary Analysis Research (BAR) 2019: slides uploaded
https://twitter.com/_jsoo_/status/1099845953287204865
B2R2: Building an Efficient Front-End for Binary Analysis
Rapidly Mitigating Vulnerabilities with Security Workarounds
A Cross-Architecture Instruction Embedding Model for Natural Language Processing-Inspired Binary Code Analysis
Binary Mutation Analysis of Tests Using Reassembleable Disassembly
CLIK on PLCs! Attacking Control Logic with Decompilation and Virtual PLC
Enhancing Symbolic Execution by Machine Learning Based Solver Selection
Symbolic Path Tracing to Find Android Permission-Use Triggers
Towards Automatically Generating a Sound and Complete Dataset for Evaluating Static Analysis Tools
Performance, Correctness, Exceptions: Pick Three
Intel open-sources HBFA app to help with firmware security testing
Intel announced plans today to open-source a new firmware security testing tool named HBFA –or the Host-based Firmware Analyzer. The new project, a security testing tool for UEFI-based firmware, will be formally introduced at next week’s RSA 2019 security conference that will be held in San Francisco.[…]
https://www.zdnet.com/article/intel-open-sources-hbfa-app-to-help-with-firmware-security-testing/
Latch-Up: a conference dedicated to free and open source silicon
We encourage anybody involved in the open source semiconductor engineering space to come along and give share your work or experience. Presentations slots as short as 3 minute lightning-talks up to 30 minute talks with Q and A are available. So if you’ve designed, worked on or even just used open source IP cores and/or management systems, verification IP, build flows, SoCs, simulators, synthesis tools, FPGA and ASIC implementation tools, languages and DSLs, compilers, or anything related we’d love to have you join us to share your experience.
https://fossi-foundation.org/2019/02/24/announcing-latchup-portland
https://fossi-foundation.org/latchup/
Finding Undocumented Intel Atom MSR’s in the Viliv S5 Through BIOS Reverse Engineering
There’s an URL to the rom.bin at the end of the article.
https://stragedevices.blogspot.com/2019/02/finding-verified-intel-atom-msrs-in.html
coreboot: Trusted Boot integration
Eclypsium: The Missing Security Primer for Bare Metal Cloud Services
Thunderclap
https://twitter.com/osxreverser/status/1100410945107505153
The Thunderclap vulnerabilities are security flaws that affect the way modern computers interact with peripheral devices such as network cards, storage, and graphics cards. These vulnerabilities allow an attacker with physical access to a Thunderbolt port to compromise a target machine in a matter of seconds, running arbitrary code at the highest privilege level and potentially gaining access to passwords, banking logins, encryption keys, private files, browsing and other data. Attacks exploiting these vulnerabilities can also be carried out by seemingly innocuous peripherals like chargers and projectors that correctly charge or project video but simultaneously compromise the host machine. The Thunderclap platform is a hardware/software stack for research into the security of computer peripherals and their interaction with operating systems. It was used to discover the Thunderclap vulnerabilities and develop proof-of-concept exploits. […]
The Thunderclap platform consists of an FPGA that runs the Thunderclap application. The FPGA then plugs into a computer via PCI Express or Thunderbolt. The Thunderclap application makes the FPGA behave to the computer like a genuine Ethernet card (the Intel 82574L network interface card or NIC). The operating system will identify the ethernet peripheral, load drivers, allow the device to access memory (via DMA and an IOMMU if enabled), and ask it to send and receive packets. With this deep interaction with the operating system, Thunderclap’s device model provides hooks that allow payload functions to be added to device behavior. For example, when the operating system asks the NIC to send a packet, it provides the NIC with the address of the data to send. A payload function might search nearby memory looking for plaintext data that was intended for a different network device.
thunderclap.io/thunderclap-paper-ndss2019.pdf
X86-64-Semantics: Semantics of x86-64 in K
The project presents the most complete and thoroughly tested formal semantics of x86-64 to date. Our semantics faithfully formalizes all the non-deprecated, sequential user-level instructions of the x86-64 Haswell instruction set architecture. This totals 3155 instruction variants, corresponding to 774 mnemonics. The semantics is fully executable and has been tested against more than 7,000 instruction-level test cases and the GCC torture test suite.
https://github.com/kframework/X86-64-semantics
see-also:
http://www.kframework.org/index.php/Main_Page
https://runtimeverification.com/blog/k-framework-an-overview/
https://github.com/davidlazar/llvm-semantics
x86-assembly-cheat and arm-assembly-cheat
x86-assembly-cheat:
x86 IA-32 and x86-64 userland minimal examples tutorial. Hundreds of runnable asserts. Nice GDB setup. IO done with libc, so OS portable in theory. NASM and GAS covered. Tested in Ubuntu 18.04. Containers (ELF), linking, calling conventions.
https://github.com/cirosantilli/x86-assembly-cheat
arm-assembly-cheat:
ARMv7 and ARMv8 assembly userland minimal examples tutorial. Runnable asserts on x86 hosts with QEMU user mode or natively on an ARM guests. Nice GDB step debug setup. Tested on Ubuntu 18.04 host and Raspberry Pi 2 and 3 guests.
UEFI gets Shadow Stack Support for X86 SMM
UEFI Utility DisplayBMP Updated to Support More Formats and Scrolling
This post details recent updates to a simple UEFI shell utility for displaying BMP images that I first released in 2015 and subsequently updated in 2017, and again this year. Source code for the previous versions is available on Github at UEFI-Utilities-2016 and UEFI-Utilities-2018 respectfully.[…]
Microsoft Windows: System Guard Secure Launch and SMM protection
[I think this documentation is new. Maybe the feature is new as well.]
This topic explains how to configure System Guard Secure Launch and System Management Mode (SMM) protection to improve the startup security of Windows 10 devices. The information below is presented from a client perspective.[…]
UefiBootMenu: A graphic uefi boot menu as application
A graphic uefi boot menu as application ( post Dxe only )
https://github.com/oO0oO0oO0o0o00/UefiBootMenu
Insider Attack Resistance in the Android Ecosystem
https://twitter.com/rene_mobile/status/1099877929318641665
The threat model for a mobile device ecosystem is complex. In addition to the obvious physical attacks on lost or stolen devices and malicious code threats, typical mobile devices integrate a significant amount of code from different organizations into their system images, which are in turn executed on an increasingly complex hardware infrastructure. Both benign mistakes, as well as malicious attacks, could happen on any of these layers, by any of these organizations. Therefore, users as well as app developers and service providers currently have to trust every single one of these organizations. Note that OEMs (original equipment manufacturers) in their role as integrators typically verify their supply chain and components they integrate. However, there are also other parties in the full chain that can tamper with devices after they leave an OEM and before they are in the hands of users. Summarizing, many people could—by honest mistake or malicious intent—tamper with components of a modern smartphone to compromise user security. We call such attacks insider attacks, independently of the motivation or association of these insiders. The basic threat is that insiders have privileged access to some components during the manufacturing or update chain that would allow them to make modifications that third parties could not. This talk will introduce the complexity of the insider attack problem (which is not unique to Android) and introduce some defenses that have already been put in place. In Android, we counter such insider attacks on multiple levels and aim to remove or limit the capability of insiders to harm users, which implies the limiting required trust in many of the involved parties. At the secure hardware level, Android Pie 9.0 introduced insider attack resistance (IAR) for updates to tamper-resistant hardware such as secure elements that is used to validate the user knowledge factor in authentication and for deriving, storing, and using cryptographic key material. Even Google and the respective OEM are technically incapable of distributing modified firmware to such tamper-resistant hardware to exfiltrate user keys without their cooperation. On the system software level, some devices make the hash of their currently running firmware available for (anonymous) local and remote verification. The combination of these features already provide transparency on the system software level and severely limit the possibility of targeted attacks on firmware and system software levels. We continue to work on this problem, and this talk is partially a call to action for the security community to devise additional novel methods to mitigate against insider attacks on components in the mobile device landscape.
https://www.mayrhofer.eu.org/talk/enigma2009/
Click to access enigma2019.pdf
Firmware Security 
You must be logged in to post a comment.