Author: hucktech

Intel releases version 066 of the Software Dev Manuals

~ hucktech ~ Leave a comment

https://software.intel.com/en-us/articles/intel-sdm

At present, downloadable PDFs of all volumes are at version 066. The downloadable PDF of the Intel® 64 and IA-32 architectures optimization reference manual is at version 039. Additional related specifications, application notes, and white papers are also available for download.

 

MORF – AMI’s open source Redfish Framework in OpenBMC

~ hucktech ~ Leave a comment

https://github.com/ami-megarac/

https://lists.ozlabs.org/pipermail/openbmc/2018-March/011255.html

Click to access MegaRAC%20Open%20Redfish%20Framework%20(MORF).pdf

 

Total Meltdown for Windows 7: follow-up

~ hucktech ~ Leave a comment

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1038

DiskImageCreator: designed to help people attack the machine with a secure chain-of-trust boot process in UEFI BIOS

~ hucktech ~ Leave a comment

[[
UPDATE: adding URL, which I forgot in original post:
https://github.com/tsunghowu/DiskImageCreator
]]

DiskImageCreator : A python utility to process the input raw disk image and sign MBR/partitions with given corresponding keys.

Signing Tool for boot security validation.

This python utility is designed to provide a baseline for people who may be interested in attaching the machine with secure boot process built-in. The secure boot process is a customized chain-of-trust boot flow in UEFI BIOS. It will exam the target disk image(in MBR) and see if it is properly signed by the root key controlled by owner. This utility is to help owner to create a signed image with owner keys.

This tool is designed to help people attack the machine with a secure chain-of-trust boot process in UEFI BIOS.

cgasm: command line tool that provides x86 assembly docs

~ hucktech ~ Leave a comment

We’re insanely passionate about command line asm documentation in the cloud, and we’re crushing it!
cgasm is a standalone, offline terminal-based tool with no dependencies that gives me x86 assembly documentation. It is pronounced “SeekAzzem”.[…]
TODO: Nothing. No other features. Ever.
Contributing: I. Will. Cut. You.

https://github.com/bnagy/cgasm

PS4 4.55 BPF Race Condition Kernel Exploit Writeup

~ hucktech ~ Leave a comment

https://twitter.com/cybergibbons/status/979680338006958081

PS4 4.55 BPF Race Condition Kernel Exploit Writeup
Cryptogenic Update PS4 4.55 BPF Race Condition Kernel Exploit Writeup

Note: While this bug is primarily interesting for exploitation on the PS4, this bug can also potentially be exploited on other unpatched platforms using FreeBSD if the attacker has read/write permissions on /dev/bpf, or if they want to escalate from root user to kernel code execution. As such, I’ve published it under the “FreeBSD” folder and not the “PS4” folder.[…]

https://github.com/Cryptogenic/Exploit-Writeups/blob/master/FreeBSD/PS4%204.55%20BPF%20Race%20Condition%20Kernel%20Exploit%20Writeup.md

Update on Microsoft UEFI Github projects

~ hucktech ~ Leave a comment

Re: https://firmwaresecurity.com/2017/11/01/microsoft-uefi-capsule-update-package-on-github/

Last year at the UEFI Forum Spring Plugfest, Microsoft announced a new Github tree with UEFI-centric code.

This year, they talked about some new code on that tree.

Honestly, I thought that they haven’t been doing anything in a year, but it ends up all the activity has been in the BRANCHES:

https://github.com/Microsoft/MS_UEFI

For example:

https://github.com/Microsoft/MS_UEFI/tree/share/MsCapsuleSupport

So, there’s a lot of new Microosoft UEFI-related code on this tree, just not on the master. 🙂

Stealthy dopant-level hardware Trojans

~ hucktech ~ Leave a comment

Stealthy dopant-level hardware Trojans: extended version
Georg T. Becker, Francesco Regazzoni, Christof Paar, Wayne P. Burleson

In recent years, hardware Trojans have drawn the attention of governments and industry as well as the scientific community. One of the main concerns is that integrated circuits, e.g., for military or critical-infrastructure applications, could be maliciously manipulated during the manufacturing process, which often takes place abroad. However, since there have been no reported hardware Trojans in practice yet, little is known about how such a Trojan would look like and how difficult it would be in practice to implement one. In this paper we propose an extremely stealthy approach for implementing hardware Trojans below the gate level, and we evaluate their impact on the security of the target device. Instead of adding additional circuitry to the target design, we insert our hardware Trojans by changing the dopant polarity of existing transistors. Since the modified circuit appears legitimate on all wiring layers (including all metal and polysilicon), our family of Trojans is resistant to most detection techniques, including fine-grain optical inspection and checking against “golden chips”. We demonstrate the effectiveness of our approach by inserting Trojans into two designs—a digital post-processing derived from Intel’s cryptographically secure RNG design used in the Ivy Bridge processors and a side-channel resistant SBox implementation—and by exploring their detectability and their effects on security.

https://link.springer.com/article/10.1007/s13389-013-0068-0

CeLoader: A UEFI bootloader for Windows CE

~ hucktech ~ Leave a comment

CELoader is an EFI application that can load and boot to a Windows CE kernel (NK.EXE). The code is fairly simple but demonstrates the ability to read and write the console, read files and query and configure the graphics system. The loader configures the BootArgs structure with information needed by the kernel. Finally, the loader jumps to the entry point of the CE kernel.

https://github.com/dougboling/CeLoader

Duo Security: Microcontroller Firmware Recovery Using Invasive Analysis

~ hucktech ~ Leave a comment

Microcontroller Firmware Recovery Using Invasive Analysis

by Mikhail Davidov

https://duo.com/blog/microcontroller-firmware-recovery-using-invasive-analysis

 

LLVM: Speculative Load Hardening (a Spectre variant #1 mitigation)

~ hucktech ~ Leave a comment

http://lists.llvm.org/pipermail/llvm-dev/2018-March/122085.html

 

SDQAnalyzer: A Saleae analyzer plugin for the SDQ (Apple Lightning, MagSafe, Battery) protocol

~ hucktech ~ Leave a comment

https://github.com/nezza/SDQAnalyzer

“A Saleae analyzer plugin for the SDQ (Apple Lightning, MagSafe, Battery) protocol.”

https://support.saleae.com/hc/en-us/articles/115005987726-Protocol-Analyzer-SDK

Example of the analyzer in action

UbootKit: A Worm Attack for the Bootloader of IoT Devices

~ hucktech ~ Leave a comment

https://www.blackhat.com/asia-18/briefings.html#ubootkit-a-worm-attack-for-the-bootloader-of-iot-devices

bootKit: A Worm Attack for the Bootloader of IoT Devices

The security of the IoT has never been so important, especially when millions of devices become parts of everyday life. Most of the IoT devices, however, are vulnerable to cyberattacks, as the hardware resources are limited or the security design is missing during the development. Tencent Anti-Virus Laboratory demonstrates a new worm prototype dubbed UbootKit, which targets the bootloader of IoT devices, to indicate how a worm can propagate between variable devices and why it is difficult to eliminate. UbootKit attack is a kind of manipulation attack against the bootloader, causing infected devices to be remotely controlled and spread malware to other devices. UbootKit is extremely difficult to remove, even by physically pressing the reset button, and is able to attack various kinds of IoT devices with Linux system. A demonstration will be introduced to explain how UbootKit is able to propagate between ARM and MIPS based devices. First, the worm rewrites the bootloader to parasite on the host. Second, the modified bootloader hijacks the start procedure of the Linux kernel in memory. The malicious code in the kernel will download a worm program and execute it with the root privilege. Finally, the downloaded worm program attacks other devices through password scanning or remote execution exploits. The experiment affirms that UbootKit is able to infect real IoT products, such as routers and webcams. Just to clarify, all experiments were restricted in the laboratory environment, and no harmful payload has ever been applied. The reason the UbootKit attack can be launched is that the integrity verification for bootloader is missing for most IoT devices. At the end of the paper, a mitigation solution – which is adding an integrity verification procedure at the on-chip code – is explained to address the vulnerability.

slides:

Click to access asia-18-Yang-UbootKit-A-Worm-Attack-for-the-Bootloader-of-IoT-Devices.pdf

paper:

Click to access asia-18-Yang-UbootKit-A-Worm-Attack-for-the-Bootloader-of-IoT-Devices-wp.pdf

Microsoft Windows: Kernel Virtual Address (KVA) Shadow: mitigating Meltdown

~ hucktech ~ Leave a comment

KVA Shadow: Mitigating Meltdown on Windows

On January 3rd, 2018, Microsoft released an advisory and security updates that relate to a new class of discovered hardware vulnerabilities, termed speculative execution side channels, that affect the design methodology and implementation decisions behind many modern microprocessors. This post dives into the technical details of Kernel Virtual Address (KVA) Shadow which is the Windows kernel mitigation for one specific speculative execution side channel: the rogue data cache load vulnerability (CVE-2017-5754, also known as “Meltdown” or “Variant 3”). KVA Shadow is one of the mitigations that is in scope for Microsoft’s recently announced Speculative Execution Side Channel bounty program. It’s important to note that there are several different types of issues that fall under the category of speculative execution side channels, and that different mitigations are required for each type of issue. Additional information about the mitigations that Microsoft has developed for other speculative execution side channel vulnerabilities (“Spectre”), as well as additional background information on this class of issue, can be found here. Please note that the information in this post is current as of the date of this post.[…]

https://blogs.technet.microsoft.com/srd/2018/03/23/kva-shadow-mitigating-meltdown-on-windows/