bootoption – Create a new EFI RT variable like BootXXXX but store the data in a property list

January 1, 2018 ~ hucktech ~ Leave a comment

bootoption: A program to create and save an EFI boot load option – so that it might be added to the firmware menu later. May be used to work around situations where it is problematic to modify BootOrder, BootXXXX in NVRAM, while targeting a given instance of a loader from the booted OS: during loader installation, for example.

Usage: bootoption -p path -d description -o file
-p path to EFI executable
-d boot option description
-o file to write to (XML property

https://github.com/vulgo/bootoption

pcie_injector – PCIe Injector Gateway – based on Xilinx Artix7 FPGA and FTDI USB FT601 chip

December 31, 2017 ~ hucktech ~ Leave a comment

Latest commit: 2 days ago

Want to masquerade as a PCIe device? Want to learn DMA attack? Check out the cheapest FPGA based PCIe over USB 3 card with DDR3 RAM. Made in colab. with @enjoy_digital. Soon supported by @UlfFrisk for PCILeech as shown @ #ccc https://t.co/EgHC9TpYKo pic.twitter.com/oc4kp6KUWd

— key two (@key2fr) December 29, 2017

PCIe Injector Gateware

The PCIe bus is now the main high speed communication bus between a processor and its peripherials. It is used in all PC (sometime encapsulated in Thunderbolt) and now even in mobile phones. Doing security research on PCIe systems can requires very expensive tools (>$50k) and packet generaration for such tools is not a common feature. PCIe Injector provides a such tool at a more reasonable price. Currently, only few attacks were made on PCIe devices. Most of them were done using a Microblaze inside a Xilinx FPGA to send/receive the TLPs, making it hard to really analyze. (Using embedded C software to generate/analyze traffic) An other way is to use USB3380 chip, but it is also not flexible enough (only supporting 32bits addressing) and does not allow debugging the PCIe state machine.

The PCIe injector is based on a Artix7 FPGA from Xilinx connected to a DDR3 and a high speed USB 3.0 FT601 chip from FTDI. It allows:
* Having a full control of the PCIe core.
* Sending/Receiving TLPs through USB 3.0 (or bufferize it to/from DDR3)
* Using flexible software/tools on the Host for receiving/generating/analyzing the TLPs. (Wireshark dissectors, scapy, …)

https://github.com/enjoy-digital/pcie_injector

http://www.enjoy-digital.fr/

http://pcisig.com/

ps4-namedobj-exploit: Playstation 4 Kernel Exploit

December 31, 2017 ~ hucktech ~ Leave a comment

Dumping a PS4 Kernel in "Only" 6 Days: https://t.co/8lEJWTXvmZ

— fail0verflow (@fail0verflow) December 27, 2017

I've published my writeup of the PS4 4.05 Kernel Exploit! Please feel free to send corrections to me if you find any errors 🙂 https://t.co/IQs6WKuk0B

— Specter (@SpecterDev) December 27, 2017

https://fail0verflow.com/blog/2017/ps4-namedobj-exploit/

https://github.com/Cryptogenic/PS4-4.05-Kernel-Exploit

https://github.com/Cryptogenic/Exploit-Writeups/blob/master/PS4/%22NamedObj%22%204.05%20Kernel%20Exploit%20Writeup.md

A fully implemented kernel exploit for the PS4 on 4.05FW. In this project you will find a full implementation of the “namedobj” kernel exploit for the PlayStation 4 on 4.05. It will allow you to run arbitrary code as kernel, to allow jailbreaking and kernel-level modifications to the system. This release however, does not contain any code related to defeating anti-piracy mechanisms or running homebrew. This exploit does include a loader that listens for payloads on port 9020 and will execute them upon receival.

oppo_decrypt – Oppo/Oneplus .ops Firmware decrypter

December 31, 2017 ~ hucktech ~ Leave a comment

https://t.co/JtDm8h1BhI
Oppo .ozip OTA Firmware decrypter with automatic key detection 🙂

— Bjoern Kerler (@viperbjk) November 16, 2017

https://t.co/RnzrCl4bPU
Oppo/Oneplus Firmware Frida.re script (Decrypt firmware + Enable readback)#mobilesecurity #androidsecurity

— Bjoern Kerler (@viperbjk) August 22, 2017

oppo_decrypt – Oppo/Oneplus .ops Firmware decrypter

Tested with “MSMDownloadTool V4.0” for Oneplus 5, Frida 10.4 and Windoze
backdoor.py : Enables hidden “readback” functionality
decrypt.py : Decrypts any part of the firmware
Based on Frida.re and python 3.6
Windows only, sorry folks !
Oneplus 5 QD-Loader decryption: ‘python decrypt.py “MsmDownloadTool V4.0.exe” 0 0x92880’
Enable readback mode: ‘python backdoor.py “MsmDownloadTool V4.0.exe”‘

https://github.com/bkerler/oppo_decrypt

http://www.oppo.com/
https://oneplus.net/

dump_avb_signature: dump/verify Android Verified Boot signature hash

December 31, 2017 ~ hucktech ~ Leave a comment

Dump/Verify Android Verified Boot Signature Hash (Python Script) for AVB Version 1 from boot/recovery imagehttps://t.co/pXSNkhGIFX #MobileSecurity

— Bjoern Kerler (@viperbjk) December 30, 2017

https://t.co/pXSNkhGIFX

Update: Now extracts modulus and exponent from recovery/boot image and generates QC TZ "Root of Trust" for image verification in aboot#MobileSecurity

— Bjoern Kerler (@viperbjk) December 31, 2017

Dump/Verify Android Verified Boot Signature Hash
For researching Android Verified Boot issues
To exploit TZ image verification 🙂

python verify_signature.py boot.img

Issues: Might not work with AVB Version 2.0 or higher

https://github.com/bkerler/dump_avb_signature

android-efi – EFI bootloader for Android boot images

December 30, 2017 ~ hucktech ~ Leave a comment

android-efi is a simple EFI bootloader for Android™ boot images. It accepts the partition GUID of an Android boot partition on the command line, loads the kernel, ramdisk and command line and finally hands over control to the kernel.[…]

https://github.com/me176c-dev/android-efi

uefi-rs – library to enable writing UEFI apps in Rust language

December 30, 2017 ~ hucktech ~ Leave a comment

This library allows you to write UEFI applications in Rust. UEFI is the successor to the BIOS. It provides an early boot environment for OS loaders and other low-level applications. The objective of this library is to provide safe and performant wrappers for UEFI interfaces, and allow developers to write idiomatic Rust code. This crate’s documentation is fairly minimal, and you are encouraged to refer to the UEFI specification for detailed information. You can find some example code in the tests directory, as well as use the build.py script to generate the documentation. This repo also contains a x86_64-uefi.json file, which is a custom Rust target for 64-bit UEFI applications.[…]

https://github.com/GabrielMajeri/uefi-rs

UEFIStarter: framework to simplify UEFI development with TianoCore EDK2

December 29, 2017 ~ hucktech ~ Leave a comment

This is a small C framework for UEFI development built on top of TianoCore EDK2. This project is not a comprehensive course in UEFI development. If you’re just starting to write UEFI code you’ll need to use additional material like the official TianoCore documentation, and the UEFI Specification. The library and UEFI applications included in this code are meant to simplify a few repetitive tasks when developing UEFI code. For example there is a configurable command line argument parser that will validate input strings and convert them into the target datatype, e.g. integers. This project started out with another UEFI development kit (gnu-efi) but eventually outgrew the original SDK, so I migrated it to TianoCore EDK2017. As a result of this there are still a few library functions included that are already built-in into TianoCore. It is my hope that this code helps anyone looking into, or starting with, UEFI development: I did that myself a few months ago and found parts of the various documentations frustratingly lacking. If I can spare you some of the headache I had I’m happy.

https://github.com/rinusser/UEFIStarter

SecurityPlanner.org

December 29, 2017 ~ hucktech ~ Leave a comment

Enjoying your new digital devices during the holidays? Make sure to check out Security Planner! It gives you hints on how to make your online experience more secure: https://t.co/OiW5puOakZ

— The Citizen Lab (@citizenlab) December 27, 2017

https://securityplanner.org/

An interesting site for consumer devices, not enough on firmware yet.

Eclypsium to offer firmware training at REcon

December 29, 2017 ~ hucktech ~ Leave a comment

Learn about security of system firmware (BIOS and UEFI), understand attacks against the system firmware and mitigations, learn how to identify vulnerabilities and perform basic forensics on the system firmware.https://t.co/UIfzbokvEi @c7zero @ABazhaniuk pic.twitter.com/OoM9S3W61z

— REcon Brussels (@reconbrx) December 28, 2017

Defending From Platform Firmware Threats
Instructor: Yuriy Bulygin, Oleksandr Bazhaniuk
Dates: 29 to 31 January 2018
Price: 2625 EURO before January 1, 3500 EURO after.

A variety of attacks targeting system firmware have been discussed publicly, drawing attention to the pre-boot and firmware components of the platform such as BIOS and SMM, OS loaders and secure booting. This training will detail and organize objectives, attack vectors, vulnerabilities and exploits against various types of system firmware such as legacy BIOS, SMI handlers and UEFI based firmware, mitigations as well as tools and methods available to analyze security of such firmware components. It will also detail protections available in hardware and in firmware such as Secure Boot implemented by modern operating systems against bootkits. The training includes theoretical material describing a structured approach to system firmware security analysis and mitigations as well as many hands-on exercises to test system firmware for vulnerabilities. After the training you should have basic understanding of platform hardware components and various types of system firmware, security objectives and attacks against system firmware, mitigations available in hardware and firmware. You should be able to apply this knowledge in practice to identify vulnerabilities in BIOS and perform forensic analysis of the firmware.

https://recon.cx/2018/brussels/training/trainingfirmware.html

https://www.eclypsium.com/

PS: Looking forward to when Eclypsium will release their ARM port of the GPL CHIPSEC project. They’ve been saying they’d release this since Black Hat. It would be nice if ARM OEMs could use it, not just Eclypsium clients.

@c7zero @ABazhaniuk Hi, any chance you will release the ChipSec and expl. code for your Blue Pill Presentation ? Would like to do some arm smc/tz tests/fuzzing without reinventing the wheel (coding as solution already available).

— Bjoern Kerler (@viperbjk) December 28, 2017

CCC videos uploaded

December 29, 2017 ~ hucktech ~ Leave a comment

https://twitter.com/NikolajSchlej/status/946761209721835521

Re: CCC: https://firmwaresecurity.com/2017/12/26/intel-me-at-ccc/

the videos are already uploaded! Thanks, CCC staff!

https://media.ccc.de/b/congress/2017

NVIDIA to stop 32-bit driver development

December 27, 2017 ~ hucktech ~ Leave a comment

Bye-bye 32, says Nvidia

By Kathleen Maher December 27, 2017
Bye-bye 32, says Nvidia

In a no frills, no hoopla, in a very un-Nvidia like fashion, the company announced that after Release 390, Nvidia will no longer release drivers for 32-bit operating systems for any GPU architecture. The company is currently shipping WHQL driver version 388.71 which suggests there will be a few more 32-bit drivers before the cutoff. Later driver release versions will not operate, nor install, on 32-bit operating systems. Driver enhancements, driver optimizations, and operating system features in driver versions after Release 390 will not be incorporated back into Release 390 or earlier versions. This impacts operating systems such as Microsoft Windows 7, Microsoft Windows 8/8.1, Microsoft Windows 10, Linux, and FreeBSD—applicable to operating systems running on x64 and x32 CPU architectures.

Hmm, I can’t find this info on the NVIDIA pr site:

https://nvidianews.nvidia.com/

Video of Joanna Security through Distrusting at BHEU uploaded

December 27, 2017 ~ hucktech ~ Leave a comment

Re: https://firmwaresecurity.com/2017/12/07/joanna-on-trusting-hardware/

Slides & video of my #BHEU keynote "Security through Distrusting":https://t.co/9QBoTLXv0L https://t.co/xd3qCvI8rb

— Joanna Rutkowska (@rootkovska) December 27, 2017

QBDI – QuarksLab – dynamic binary instrumentation framework for Intel/ARM Linux/Mac/Android/iOS/Windows

December 27, 2017 ~ hucktech ~ Leave a comment

I can finally release 2.5 years of work on DBIs with @nezetic at @quarkslab!#QBDI 0.5 is released and available here: https://t.co/37Uacclkjb
The github is here: https://t.co/PGFnld5mN5

Come see our talk at #34c3ِ the 28th at 22:00 in saal Dijkstra! https://t.co/zme3x6qeec

— Charles Hubain (@haxelion) December 26, 2017

https://github.com/quarkslab/QBDI

https://events.ccc.de/congress/2017/Fahrplan/events/9006.html

https://qbdi.quarkslab.com/

QuarkslaB Dynamic binary Instrumentation (QBDI) is a modular, cross-platform and cross-architecture DBI framework. It aims to support Linux, macOS, Android, iOS and Windows operating systems running on x86, x86-64, ARM and AArch64 architectures.

UK gov on firmware vulnerabilities, and updated guidance for Windows

December 27, 2017 ~ hucktech ~ Leave a comment

Intel's report last week on security vulnerabilities emphasises the importance of automating firmware updates! https://t.co/EEjrXqJaR5 pic.twitter.com/sPBeJwBL1o

— NCSC UK (@NCSC) December 27, 2017

Firmware bugs are like buses
Created: 23 Nov 2017
Author: Mike H
[…]These vulnerabilities serve as a great example of the importance of firmware updates and the need for a strategy to be in place to automate them. If you are not already applying firmware updates within your organisation, maybe this is a good time to think about starting.

https://www.ncsc.gov.uk/guidance/eud-security-guidance-windows-10-1703#devicefirmware

https://www.ncsc.gov.uk/blog-post/firmware-bugs-are-buses

Hopefully they update their Linux guidance to include recent firmware security advice, not just the Windows guidance. 🙂

See-also:

https://www.ncsc.gov.uk/guidance/end-user-device-security
eg:

https://www.ncsc.gov.uk/guidance/end-user-device-guidance-factory-reset-and-reprovisioning

Intel ME at CCC

December 26, 2017 ~ hucktech ~ 1 Comment

It appears PTSecurity may have a GUI Debugger for Intel ME??

The “Minix Inside” stickers look great, click on the tweet from frdnd.

Hoping CCC staff does the great job they do ever year and get the videos for these events online quickly! 😉

What about a GUI when debuging Intel ME? If you are intrigued visit our talk at #34c3 (https://t.co/6kHIOuRYJ9) #IntelME #JTAG pic.twitter.com/D9oMGVbX0g

— Mark Ermolov (@_markel___) December 25, 2017

https://twitter.com/frdnd/status/942984718613610496

It seems I forgot to announce it here, so here goes: I'll be speaking at 34c3 in Leipzig with Nicola Corna on Intel ME https://t.co/cJjA7mxhd1

— Igor Skochinsky (@IgorSkochinsky@infosec.exchange) (@IgorSkochinsky) December 25, 2017

https://fahrplan.events.ccc.de/congress/2017/Fahrplan/events/8762.html

https://fahrplan.events.ccc.de/congress/2017/Fahrplan/events/8782.html

PS: Of course, this isn’t all that is happening at CCC. There are multiple other interesting talks, eg:

I'm looking forward to talk about "Public FPGA based DMA Attacking" at the 34th Chaos Communication Congress #34c3 😀 https://t.co/jLttOyrA8V

— Ulf Frisk (@UlfFrisk) November 20, 2017

Cutter 1.1 released

December 25, 2017 ~ hucktech ~ Leave a comment

Vesion 1.1 of Cutter, the GUI for Radare2 formerly known as Iaito, has been released. Click on the second tweet below for an animation of the GUI in action.

Cutter 1.1 has been released! Merry christmas!https://t.co/DgZGabRDHK pic.twitter.com/53gmPBEN3b

— Cutter (@cutter_re) December 25, 2017

Smooth disassembly graph navigation – now in @r2gui!

Also allows true/false path navigation using the T & F keys. pic.twitter.com/VHgJetOMms

— Thomas Roth (@StackSmashing) December 14, 2017

https://github.com/radareorg/cutter

https://github.com/radareorg/cutter/releases/tag/v1.1

https://github.com/radareorg/cutter/commits/master

Sysdream article on using PCILeech to attack Windows

December 25, 2017 ~ hucktech ~ Leave a comment

Nice article by Sysdream on using PCIleech to attack Windows DMA.

Merry christmas from our lab, with this article on DMA attack against Windows: https://t.co/Y3GIkRPsww #infosec #dma #pcileech

Thanks @UlfFrisk !

— SysDream (@sysdream) December 22, 2017

Thanks, Awesome read about how to roll your own signatures to your advantage 😈 As mentioned, FPGA DMA is the way of the future – hope to present some upcoming news at #34c3

— Ulf Frisk (@UlfFrisk) December 22, 2017

https://sysdream.com/news/lab/2017-12-22-windows-dma-attacks-gaining-system-shells-using-a-generic-patch/

Nexmon_Debugger: for ARM microcontroller in the BCM4339 Wi-Fi chip

December 25, 2017 ~ hucktech ~ Leave a comment

Merry Christmas!
Our present for you is a hardware debugger firmware for the BCM4339 that you can try at https://t.co/C1oOSMruHg. It allows to set hardware breakpoints and memory watchpoints in the Wi-Fi Firmware without using JTAG. We present this feature at @reconbrx 2018.

— NexMon (@nexmon_dev) December 23, 2017

Nexmon Debugger

To analyze the FullMAC firmware running on the ARM microcontroller in the BCM4339 Wi-Fi chip, we created a debugger in software that directly accesses the hardware registers of the ARM Debugging core. As we do not have access to the JTAG port, we generate exceptions whenever a breakpoint or watchpoint is triggered. We handle those exceptions in our firmware patch and can then continue with the execution of the firmware code.[…]

https://github.com/seemoo-lab/nexmon_debugger

Intel ME research paper

December 25, 2017 ~ hucktech ~ Leave a comment

https://twitter.com/bitkeks/status/939900188210147328

The Intel Management Engine
This blog post is based on a research paper I wrote for university. Although my work was mainly reading and summarising, I hope this article helps to bring some clarification about the details of the ME. At the bottom, you will also find some sources I used. Please be aware that since I wrote this report until June 2017, a new generation of ME was deployed, the one running the Minix microkernel on a x86 coprocessor. Nevertheless–to understand the development and architecture of the whole concept, it’s good to understand the details up from 2009.[…]

https://bitkeks.eu/blog/2017/12/the-intel-management-engine.html