Author: hucktech

Intel releases 17 security advisories!

~ hucktech ~ 1 Comment

https://twitter.com/qrs/status/1039855784912465921

https://twitter.com/qrs/status/1039855789601636353

https://www.intel.com/content/www/us/en/security-center/default.html

Intel® Distribution for Python 2018 for Windows Advisory
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00181.html

Intel® Centrino® Wireless-N and Intel® Centrino® Advanced-N products Bluetooth Driver Advisory
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00177.html

Intel® NUC Firmware Security Advisory
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00176.html

Intel® IoT Developers Kit Permissions Advisory
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00173.html

OpenVINO™ Toolkit for Windows Permissions Issue Advisory
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00172.html

Intel® Data Migration Software Improper Permissions Advisory
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00170.html

Intel® Driver & Support Assistant and Intel® Software Asset Manager Advisory
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00165.html

Intel® Extreme Tuning Utility Advisory
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00162.html

Intel® Baseboard Management Controller (BMC) firmware Advisory
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00149.html

Intel® Server Board TPM Advisory
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00148.html

Intel® Data Center Manager SDK Advisory
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00143.html

Intel® Platform Trust Technology (PTT) Update Advisory
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00142.html

Intel® Active Management Technology 9.x/10.x/11.x/12.x Security Review Cumulative Update Advisory
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00141.html

Power Management Controller (PMC) Security Advisory
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00131.html

Intel® CSME Assets Advisory
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00125.html

INTEL-SA-00086 Detection Tool DLL Injection Issue Advisory
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00119.html

Falkervisor hypervisor for fuzzing

~ hucktech ~ Leave a comment

Falkervisor_grilled_cheese:  This is the latest C version of my hypervisor and probably some of the best C code I’ve ever written (I’ve since switched to Rust, you should too). This was used roughly between 2015-2016, and replaced with a Rust version in late 2016.

https://github.com/gamozolabs/falkervisor_grilled_cheese

See-also:

https://github.com/gamozolabs/falkervisor_beta/

SALT – SLUB ALlocator Tracer for the Linux kernel (including GDB plugin)

~ hucktech ~ Leave a comment

Welcome to salt, a tool to reverse and learn kernel heap memory management. It can be useful to develop an exploit, to debug your own kernel code, and, more importantly, to play with the kernel heap allocations and learn its inner workings.

This tool helps tracing allocations and the current state of the SLUB allocator in modern linux kernels.

It is written as a gdb plugin, and it allows you to trace and record memory allocations and to filter them by process name or by cache. The tool can also dump the list of active caches and print relevant information.

This repository also includes a playground loadable kernel module that can trigger allocations and deallocations at will, to serve both as a debugging tool and as a learning tool to better understand how the allocator works.

https://github.com/PaoloMonti42/salt

Click to access presentation.pdf

screenshot

 

AMI releases Unrestricted (Free) Version of AMIDuOS

~ hucktech ~ 1 Comment

Re: https://firmwaresecurity.com/2018/06/01/ami-retires-duos/

AMI has rmade DuOS — which runs both Android and Windows simultaneously — available again:

https://ami.com/en/amiduos/?amiduos=activation

PS: AMI: Please add Linux support to your feature list.

Qubes announces U2F Proxy

~ hucktech ~ Leave a comment

Today we’d like to announce the Qubes U2F Proxy. It is a secure proxy intended to make use of U2F two-factor authentication devices with web browsers without exposing the browser to the full USB stack, not unlike the USB keyboard and mouse proxies we’ve already implemented in Qubes.[…]

https://www.qubes-os.org/news/2018/09/11/qubes-u2f-proxy/

https://github.com/QubesOS/qubes-app-u2f

BeeBug: A tool for checking exploitability

~ hucktech ~ Leave a comment

Beebug is a tool that can be used to verify if a program crash could be exploitable. This tool was presented at r2con 2018 in Barcelona. Some implemented functionality are:

* Stack overflow on libc
* Crash on Program Counter
* Crash on branch
* Crash on write memory
* Heap vulnerabilities
* Read access violation (some exploitable cases)
* Help to analyze a crash (graph view)

https://github.com/invictus1306/beebug

 

 

Two guys, one laptop (hacking a Toshiba BIOS laptop)

~ hucktech ~ Leave a comment

This is a great story about hacking a BIOS-level locked Toshiba laptop. There will be plenty of hardware hacking, reverse engineering and perseverance. And some crypto as well.[…] The whole process took 3 years – but the actual work took about 2 weeks, the rest was Michał waiting for Sergiusz to dump the chips. They reported their findings to Toshiba, which promised to deliver updates and change the encryption scheme.[…]

Two guys, one laptop

 

Intel: The TPM2 Software Stack: Introducing a Major Open Source Release

~ hucktech ~ Leave a comment

A newly completed Trusted Platform Module 2.0 (TPM2) software stack is being introduced, developed to comply with the most recent Trusted Computing Group (TCG) v1.38 specification and work on any TPM2 implementation. Partnering with key players within the domain of Trusted Computing such as Infineon and Fraunhofer SIT, Intel has made large investments in code improvements and new functionality compared to the previous version. This includes the initialization of the TSS Stack development and the SAPI, TCTI and abrmd layer. Based on this development, Infineon and Fraunhofer SIT enabled the support of the Enhanced System API (ESAPI) layer, which is intended to reduce programming complexity and to simplify the use and integration of the TPM.[…]

https://software.intel.com/en-us/blogs/2018/08/29/tpm2-software-stack-open-source

 

Lenovo ThinkPad X1 6en: Enabling S3 Sleep for Linux after Firmware Update

~ hucktech ~ Leave a comment

https://brauner.github.io/2018/09/08/thinkpad-6en-s3.html

BlackHat 2018 God Mode Unlocked: hardware backdoors in x86 CPUs, released

~ hucktech ~ Leave a comment

Re: https://firmwaresecurity.com/2018/08/10/rosenbridge-hardware-backdoors-in-some-x86-cpus/

Blackhat has released the video of this presentation:

 

sb-kmod-signload.sh: UEFI Secure Boot sign and load utility for Linux kernel modules

~ hucktech ~ Leave a comment

This script provides commands to sign a designated list of kernel modules and loads them via modprobe into the linux kernel. This was built to specfically address the issue of having to re-sign and reload kernel modules after upgrading the linux kernel, so they are not rejected by UEFI Secure Boot. (e.g. virtualbox kernel modules). As an example, this script is defaulted to load virtualbox kernel modules and will look for the private key and x509 cert in a specific directory. Please change these values inside the script as needed.[…]

https://github.com/plyint/sb-kmod-signload.sh

 

 

vdexExtractor: Unhide APIs when decompiling files from Android P

~ hucktech ~ Leave a comment

https://github.com/anestisb/vdexExtractor/commit/6f69698ba310599dfbf7f7253773956d2c2f99cd

https://github.com/anestisb/vdexExtractor

vdexExtractor is a tool to decompile & extract Android Dex bytecode from Vdex files.

SiFive open sources RISC-V Freedom U540-C000’s Bootloader

~ hucktech ~ Leave a comment

It is good to see SiFive open-source their stack. RISC-V is Free as in Beer, not Freedom, so an implementor may make a closed-source implementation, and we need to encourage implementors to make open-source implementations. 😉

https://www.sifive.com/blog/2018/09/06/an-open-source-release-of-the-freedom-u540-c000s-bootloader/

ECR_Toolkit: hypervisor introspection of VM guests (Who Watches the Watchers?)

~ hucktech ~ Leave a comment

https://twitter.com/JacobTorrey/status/1038391417306062848

https://github.com/ainfosec/ecr_toolkit

Click to access paper_who_watches_the_watcher_detecting_hypervisor_introspection_from_unprivileged_guests.pdf

AIS HOME 23

Microsoft Bitlocker countermeasures and Thunderbolt DMA protection

~ hucktech ~ Leave a comment

https://docs.microsoft.com/en-us/windows/security/information-protection/bitlocker/bitlocker-countermeasures

https://docs.microsoft.com/en-us/windows/security/information-protection/kernel-dma-protection-for-thunderbolt