Author: hucktech

CVE-2018-3968: Cisco using outdated U-boot in Cujo

~ hucktech ~ Leave a comment

Let’s hope Cisco Talos will let Mitre/NVD about the details soon. No info on the Talos or Cisco security sites, nor even *Twitter*!, AFAICT. 🙂

https://lists.denx.de/pipermail/u-boot/2018-August/336973.html

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-3968

——– Forwarded Message ——–
Subject: [U-Boot] Talos Security Advisory (TALOS-2018-0633/CVE-2018-3968 )
Date: Thu, 2 Aug 2018 18:52:03 +0000

Hello,

Cisco Talos team discovered a security issue impacting Cujo product using an outdated version of U-boot. We’ve assigned a CVE for this issue (CVE-2018-3968) and have attached a copy of the security advisory provided to Cujo.

Blog has second poster: Paul English of PreOS Security

~ hucktech ~ Leave a comment

So far, this blog has been my daily education, writing down URLs of things I learn that day. A few people also feed me interesting URLs. Paul English, co-founder of PreOS Security[1], has been giving me more and more links, so I’ve asked him to deal with them, instead of asking me to do posts on those URLs. 🙂

This is Paul’s first post:

Meet Us At Black Hat USA 2018

He’s also trying to help fix the WordPress-based site to be more usable. It looks like the font has already changed.

[1] https://preossec.com/

 

Back Doors for Cross-Signed Windows Drivers

~ hucktech ~ Leave a comment

https://twitter.com/geoffchappell/status/1024757182687010818

Four undocumented registry values vary the default validation of signatures on kernel-mode code such that Windows 10 may allow cross-signed drivers when it is otherwise documented as requiring Microsoft-signed drivers. This may be welcome for running your own drivers on your own computers without having to send them to Microsoft. Or it may be an unwelcome exposure to software that would install drivers by surprise, including to let malware elevate from administrative access to kernel-mode execution. Setting these values requires administrative access. Their action is subject to System Integrity policy, which provides the best defence.[…]

http://www.geoffchappell.com/notes/security/whqlsettings/

Intel updates 2 security whitepapers

~ hucktech ~ Leave a comment

Click to access Managed-Runtime-Speculative-Execution-Side-Channel-Mitigations.pdf

Click to access 337879-analyzing-potential-bounds-Check-bypass-vulnerabilities.pdf

SMM disabling and verification techniques

~ hucktech ~ Leave a comment

3mdeb points out that there is a patent by Intel with information focused on disabling Intel SMM.

Don’t click on this link if you’re an engineer and are not allowed to view patent information.

 

https://patents.google.com/patent/US20170168844

System call dispatching on Windows ARM64

~ hucktech ~ Leave a comment

Microsoft recently announced that there will be Windows ARM64 devices. This article briefly documents the system call dispatching mechanism for Windows on ARM64. Readers are assumed to be familiar with ARM64 assembly and system call dispatching on Windows x86/x64.[…]

https://gracefulbits.com/2018/07/26/system-call-dispatching-for-windows-on-arm64/

Installing Coreboot on Lenovo X210

~ hucktech ~ Leave a comment

[…]The other fun thing about it is that none of the firmware flashing protection is enabled, including Intel Boot Guard. This means running a custom firmware image is possible, and what would a ridiculous custom Thinkpad be without ridiculous custom firmware? A shadow of its potential, that’s what. So, I read the Coreboot[1] motherboard porting guide and set to.[…]

https://mjg59.dreamwidth.org/50924.html

Lenovo should be giving Matthew a free X210 for this effort:

Debian UEFI Secure Boot report from DebConf

~ hucktech ~ Leave a comment

DebConf, the Debian conference is happening, and there’s a EFI Secure Boot talk. Slides are listed on the debian-efi list below:

https://lists.debian.org/debian-efi/2018/07/msg00015.html

https://meetings-archive.debian.net/pub/debian-meetings/2018/DebConf18/?

 

ftriage: automating forensic artifact acquisition, reduction, and analysis

~ hucktech ~ Leave a comment

My attempt at automating forensic artifact acquisition, reduction, and analysis.

fTriage leverages dozens of popular, open source tools to triage suspect memory/disk image(s). Each script automates a step in the investigation an analyst would otherwise perform manually. Moreover, I’ve written a wrapper to execute collections of data acquisition scripts. There is no limit to how many scripts you can run at once, but naturally there are some that need to be run before others, review the “Recommended Usage” section for example usage of prebuilt script lists.

https://github.com/matthewclarkmay/ftriage

 

Fail0verflow: PS4 Aux Hax 1: Intro & Aeolia

~ hucktech ~ Leave a comment

PS4 Aux Hax 1: Intro & Aeolia

By ps4_enthusiast
Filed under ps4 vulnerability exploit

In the PS4 Aux Hax series of posts, we’ll talk about hacking parts of the PS4 besides the main x86 cores of the APU. In this first entry, we’ll give some background for context and describe how we managed to run arbitrary code persistently on Aeolia, the PS4 southbridge.[…]

https://fail0verflow.com/blog/2018/ps4-aeolia/