Wow, it looks like EFIDroid project is porting Qt to UEFI!!
Qt Base (Core, Gui, Widgets, Network, …) with UEFI support
https://github.com/efidroid/qtbase
Category: Uncategorized
UEFIThreads: EFIDroid’s port of LittleKernel’s thread library for UEFI
UEFI is event-based, not thread-based. Earlier this month, Michael Zimmermann of the EFIDroid project posted a message on the EDK2-devel list about EFIDroid’s thread library support for UEFI, which is based on the Little Kernel threads implementation, and comparing it to the GreenThreads-UEFI project. Edited (footnotified) version of Michael’s message below.
IMO this [GreenThreads-UEFI] library[0] has some crucial problems like changing the TPL during context switching. For my project “EFIDroid” I’ve invested many months analyzing, testing and implementing my own threading implementation based on LK(LittleKernel, a MIT licensed project) threads and get/set -context. The result is a pretty stable implementation which can even be used in UEFI drivers[1]. I’m currently using this lib for my LKL(LinuxKernelLibrary) port to be able to use linux touchscreen drivers in UEFI – so you could say it has been well tested. The only “problem” is that it only supports ARM right now and that the get/set context implementation was copied (and simplified) from glibc which means that this part is GPL code.
From the Little Kernel web site:
Who is using LK?
* LK is the Android bootloader and is also used in Android Trusted Execution Environment – “Trusty TEE” Operating System.
* Newer Android phones have some chance of LK running all the time alongside Linux.
* A few ARM SoC manufacturers use LK as their default bootloader such as DragonBoard 410c based on Qualcomm Snapdragon 410 processor.
* The Fuchsia Operating System’s microkernel, Zircon is based on LK.
[0] https://github.com/Openwide-Ingenierie/GreenThreads-UEFI
[1] https://github.com/efidroid/uefi_edk2packages_EFIDroidLKLPkg/tree/master/UEFIThreads
http://efidroid.org/
https://github.com/littlekernel
https://github.com/littlekernel/lk/wiki/Introduction
https://github.com/littlekernel/lk/blob/master/kernel/thread.c
Click to access lm80-p0436-1_little_kernel_boot_loader_overview.pdf
https://android.googlesource.com/kernel/lk/
Full message: 2017-11-02 post on EDK2-devel.
Thunderbolt-software-user-space in Ubuntu
Colin Ian King of Canonical has been packaging up the Intel Thunderbolt user-space software for Ubuntu. His Tweets are private, but he just tweeted that the tool is now in Ubuntu!
https://github.com/01org/thunderbolt-software-user-space
https://launchpad.net/~colin-king/+archive/ubuntu/thunderbolt/+packages
https://thunderbolttechnology.net/
https://01.org/thunderbolt-sw
https://thunderbolttechnology.net/fun-facts
Thunderbolt user-space components:
[…]The user-space components implement device approval support:
* Easier interaction with the kernel module for approving connected devices.
* ACL for auto-approving devices white-listed by the user.
So far, I’ve not found a public security page for Thunderbolt. Only a “Fun Facts” page… 😦 I was hoping to find a page listing Thunderstrike, Thunderstrike2, the Legbacore t2e tool, CIA Sonic Screwdriver, PCILeech, etc.
https://trmm.net/Thunderstrike
https://github.com/legbacore/t2e_integrity_check
GRsecurity drops 0day
https://grsecurity.net/~spender/sorry_kees.c
#infosec
https://t.co/PC1SbcMR5V
— Joanna Rutkowska (@rootkovska) November 23, 2017
Serious Cryptography
Duo Labs releases EFIgy 10.13
A bit more on INTEL-SA-00086 (Intel ME update)
Intel’s advisory updated overnight:
https://www.intel.com/content/www/us/en/support/articles/000025619/software.html
https://security-center.intel.com/advisory.aspx?intelid=INTEL-SA-00086&languageid=en-fr
More OEM announcements:
http://pc-dl.panasonic.co.jp/itn/info/osinfo20171121.html
https://support.hpe.com/hpsc/doc/public/display?docId=emr_na-a00036596en_us
https://us.answers.acer.com/app/answers/detail/a_id/51890
Updating Intel Management Engine firmware on a Lenovo without a Windows Install
New ACPI IDs for November: Nexstgo and Insyde
Here’s the list of new ACPI specs for 2017 (so far), 2 new entries in November, first update since Summer:
Company ACPI ID Approved on Date
VR Technology Holdings Limited 3GVR 01/19/2017
Exar Corporation EXAR 02/28/2017
Coreboot Project BOOT 02/28/2017
Marvell Technology Group Ltd. MRVL 05/25/2017
IHSE GmbH IHSE 06/22/2017
Insyde Software INSY 11/10/2017
Nexstgo Company Limited NXGO 11/13/2017
http://www.uefi.org/acpi_id_list
http://www.uefi.org/uefi-acpi-export (XLS download)
For the 2 new entries, I can’t find any data on what their ACPI tables do, nor where their specs are:
http://www.nexstgo.com/
http://www.catalog.update.microsoft.com/ScopedViewInline.aspx?updateid=1724ebc5-cbbf-407f-a4da-c3b769f88690
It is a shame that the spreadsheet doesn’t have a column with more useful info, eg: URL to the vendor’s spec, perhaps which HW/OS it is valid for, which version of ACPI it requires, flag if table has FWTS test, license of vendor’s spec (eg, click-through EULA required for some ARM/MSFT/TCG docs), etc.
More on INTEL_SA-00086 (Intel ME update)
Advisory doc updated overnight:
https://security-center.intel.com/advisory.aspx?intelid=INTEL-SA-00086&languageid=en-fr
Vendors are starting to issue advisories:
https://support.lenovo.com/us/en/product_security/len-17297
http://www.dell.com/support/article/us/en/19/sln308237/dell-client-statement-on-intel-me-txe-advisory–intel-sa-00086-?lang=en
http://www.dell.com/support/article/us/en/19/qna44242/dell-server-statement-on-intel-me-txe-advisory–intel-sa-00086-?lang=en
https://www.intel.com/content/www/us/en/support/articles/000026230/mini-pcs.html
https://www.us-cert.gov/ncas/current-activity/2017/11/21/Intel-Firmware-Vulnerability
A few researchers’ comments on the quality of this advisory:
If you disable Intel ME, does that mean Intel SGX, Boot Guard, and other tech is also broken? Pandora’s box is full of toys…
https://twitter.com/NikolajSchlej/status/932753528875114496
Duo Labs releases: IDAPython, Coretex M Firmware and Amnesia modules
https://twitter.com/tmanning/status/932421897370812417
Examining Personal Protection Devices: Hardware and Firmware Research Methodology in Action
Todd Manning, Duo Labs
[…]This paper describes a methodology for retrieving device firmware, and for loading firmware into IDA Pro, a common disassembler. This paper focuses on the disassembly of this firmware, and the discussion of a novel approach to defeating readback protection discovered in one ARM Cortex M implementation. During the course of this research, I developed code for IDA Pro to assist in loading and grooming Cortex M firmware images. The IDAPython code is comprised of two modules. The first module annotates Cortex M vector tables, which gives IDA Pro hints about where code exists in the firmware image. The Cortex M module can automatically annotate firmware with a vector table located at the start of a firmware image, or can be tailored by the end user to work with relocated tables. The second module, called Amnesia, uses byte-level heuristics to detect ARM instructions in the firmware. Amnesia also contains heuristics that operate at the ARM instruction level to determine function boundaries based on common ARM function prologues and epilogues.[…]
Cortex M Firmware (cortex_m_firmware.py): This Cortex M Firmware module grooms an IDA Pro database containing firmware from an ARM Cortex M microcontroller. This module will annotate the firmware vector table, which contains a number of function pointers. This vector table annotation will cause IDA Pro to perform auto analysis against the functions these pointers point to. The Cortex M Firmware module also calls into the Amnesia module to automate discovery of additional code in the firmware image using the Amnesia heuristics.
Amnesia (amnesia.py): Amnesia is an IDAPython module designed to use byte level heuristics to find ARM thumb instructions in undefined bytes in an IDA Pro database. Currently, the heuristics in this module find code in a few different ways. Some instructions identify and define new code by looking for comon byte sequences that correspond to particular ARM opcodes. Other functions in this module define new functions based on sequences of defined instructions.
Intel Management Engine Critical Firmware Update
Intel® Management Engine Critical Firmware Update (Intel SA-00086)
Intel Q3’17 ME 11.x, SPS 4.0, and TXE 3.0 Security Review Cumulative Update (INTEL-SA-00086)
Product family: Various
Impact of vulnerability: Elevation of Privilege
Severity rating: Important
Original release: Nov 20, 2017
Last revised: Nov 20, 2017
In response to issues identified by external researchers, Intel has performed an in-depth comprehensive security review of our Intel® Management Engine (ME), Intel® Server Platform Services (SPS), and Intel® Trusted Execution Engine (TXE) with the objective of enhancing firmware resilience. As a result, Intel has identified security vulnerabilities that could potentially place impacted platforms at risk. Systems using ME Firmware versions 11.0/11.5/11.6/11.7/11.10/11.20, SPS Firmware version 4.0, and TXE version 3.0 are impacted.[…]Based on the items identified through the comprehensive security review, an attacker could gain unauthorized access to platform, Intel® ME feature, and 3rd party secrets protected by the Intel® Management Engine (ME), Intel® Server Platform Service (SPS), or Intel® Trusted Execution Engine (TXE). This includes scenarios where a successful attacker could:
* Impersonate the ME/SPS/TXE, thereby impacting local security feature attestation validity.
* Load and execute arbitrary code outside the visibility of the user and operating system.
* Cause a system crash or system instability.
[…]
Acknowledgements:
* External Security Researchers and Intel Validation.
* Intel would like to thank Mark Ermolov and Maxim Goryachy from Positive Technologies Research for working collaboratively with Intel on a coordinated disclosure for CVE-2017-5705.
https://security-center.intel.com/advisory.aspx?intelid=INTEL-SA-00086&languageid=en-fr
https://www.intel.com/content/www/us/en/support/articles/000025619/software.html
Detection tool for Linux and Windows:
https://downloadcenter.intel.com/download/27150
Nick FitzGerald of ESET on scanning UEFI
ESET recently released a scanner for UEFI. Nick FitzGerald, ESET, Senior Research Fellow, has an article on why you should scan your UEFI firmware.
UEFI 101, and why you need it scanned
By Nick FitzGerald
Monday, November 20, 2017 – 15:16
In the rapidly evolving world of security software development, recent research has shown that UEFI scanning has transformed from a “nice to have” into a “must have” feature. Initially deemed a theoretical threat, there was little information about real-world UEFI attacks in the wild. However over time, enough data was collected and analyzed by cybersecurity vendors to conclude that UEFI protection is now required.[…]
https://www.networksasia.net/article/uefi-101-and-why-you-need-it-scanned.1511162171
CERT/CC VU #817544 : Windows ASLR Vulnerability
U.S. Department of Homeland Security US-CERT National Cyber Awareness System: Windows ASLR Vulnerability
Original release date: November 20, 2017
The CERT Coordination Center (CERT/CC) has released information on a vulnerability in Windows Address Space Layout Randomization (ASLR) that affects Windows 8, Windows 8.1, and Windows 10. A remote attacker could exploit this vulnerability to take control of an affected system. US-CERT encourages users and administrators to review CERT/CC VU #817544 and apply the necessary workaround until a patch is released.
https://www.us-cert.gov/ncas/current-activity/2017/11/20/Windows-ASLR-Vulnerability
Linux Power Management summit
Juri Lelli of Red Hat announced the OSPM-Summit 2018, on the Linux-(pm,acpi,pci,rt-user,kernel) lists. Edited version of that announcement below.
Power Management and Scheduling in the Linux Kernel II edition (OSPM-summit 2018)
April 16-18, 2018
Scuola Superiore Sant’Anna
Pisa, Italy
Deadline for submitting topics/presentations is 9th of December 2017.
Focus: Power management and scheduling techniques to reduce energy consumption while meeting performance and latency requirements are still receiving considerable attention from the Linux Kernel development community. After the success of the first edition, II edition of the Power Management and Scheduling in the Linux Kernel (OSPM) summit aims at replicating such focused discussions, understanding what has been achieved and what instead still remains to be addressed. The summit is organised to cover three days of discussions and talks. Topics:
* Power management techniques
* Real-time and non real-time scheduling techniques
* Energy awareness
* Mobile/Server power management real-world use cases (successes and failures)
* Power management and scheduling tooling (configuration, integration, testing, etc.)
* Tracing
* Recap lightning talks (what has been achieved w.r.t. I edition?)
http://retis.sssup.it/ospm-summit/
https://goo.gl/forms/QHebUBdSWgFeSrKv2
http://retis.sssup.it/ospm-summit/#site
https://goo.gl/maps/2pPXG2v7Lfp
https://docs.google.com/spreadsheets/d/1ZPfASW6zVOM3xQvOrcaDEf1c-Pxi1XnFukVYHHwGUq4/edit?usp=sharing
https://lwn.net/Articles/721573/
Full announcement:
http://vger.kernel.org/majordomo-info.html
Purism replies on CHIPSEC failures, adds TPM add-on, starts Heads work
Re: https://firmwaresecurity.com/2017/11/15/purism-librem15-fails-chipsec-security-tests/
Purism responds to the CHIPSEC failures here:
https://forums.puri.sm/t/user-flashable-coreboot-vs-chipsec-security-test-cases/1918
They also point out in that forum, and here:
https://puri.sm/posts/tpm-addon-for-librem-laptops/
that Purism is getting ready to start using Heads payload. They’ve been talking about it for months, maybe it’ll be a real option for upcoming Librem customers? I’m very excited to see a Heads system available by an OEM, instead of DIY and not an easy task.
And they’re adding a TPM as an ‘add-on’ to existing Librem laptops. Heads needs TPM for it’s measurements. (Hmm, I thought TPMs were an integral and tamper-resistant part of the system, and something that could be added on for trust was called a smartcard, but ok. I guess you have to solder the HW to the system. I presume attackers will be ordering spare add-ons so they can swap out units.)
In the above Purism forum, there was this user comment:
“I like the idea of putting a demo Librem notebook to a BlackHat conf where they try to break into the devices. Would be a nice test and a good commercial for you.”
They cannot do that with current Librem models. 🙂 This will need to wait for TPMs to be pre-installed and Heads as the payload.
This response from the above Purism forum seems a bit invalid:
“So there’s no way to access a BIOS menu to change the boot sequence (boot from USB) or set a machine password etc?”
“No, there is no such thing. The BIOS boots into your machine in roughly 450 milliseconds, there is no support for a menu, there is no time even for the user to press a key on the keyboard to enter a menu. The idea of coreboot is to do the minimum hardware initialization and then go to a payload. In our case, we use SeaBIOS which itself will initialize the video card and show the splash screen logo, and wait for 2 seconds for you to press ESC to show you the boot menu and let you choose your device (otherwise, it just boots to the default one). The boot choice isn’t saved, it’s just a boot override. If you want to change an option in coreboot, you need to change the config in the source and recompile coreboot then reflash it. If you want to change the boot order, you need to change the boot order in a file embeded in the flash, then reflash the BIOS.”
Yes, there is thing, which the reply says does not exist then a few sentences later explains that it does exist. The BIOS menu to change the boot order is available to anyone with physical access to the system, and presses the ESC key within 2 seconds of poweron. The unprotected BIOS and MBR-based hard drive can be quickly overwritten with malware on the attacker’s boot thumbdrive. Attendees of ‘a BlackHat conf’ will have such skills. 🙂
Purism is spending all their time undoing Intel’s features — Intel ME, Intel FSP, and now re-embracing older features — Intel TPM. Intel SMM is still an issue, STM is not being used by Purism. Intel ME may be disabled, but it’s a black-box device, who knows when attackers will start reactivating it and putting their malware-based version of Minix on that chip? You’re going to need tools to detect if ME is really disabled. I hope Purism’s roadmap has a RISC-V chip-based laptop in it, so they can stop fighting Intel features and have a fully-open stack. If they keep fighting the Intel stack, I hope they add the ‘stateless laptop’ that Joanna has proposed to their roadmap:
https://blog.invisiblethings.org/2015/12/23/state_harmful.html
It might be useful to add coreboot Verified Boot to help secure their SeaBIOS payload, but that could probably only secure PureOS, and distro hoppers will have no benefit. But I don’t think Heads and Verified Boot are compatible? SeaBIOS also has TPM support, that’d be nice to see those measurements used, if they are embracing a TPM. And now that they have a TPM, they can start using Intel TXT too. 🙂
I am a little perplexed about Purims customer audience, who is concerned about privacy, and yet has so little concern for security, in exchange for the convenience feature of being easy to distro-hop. Anyway, if you want security, wait for the TPM and Heads to be integrated with future Librems.
https://trmm.net/Installing_Heads
Toms Hardware: Win10 unsupported disk layout UEFI error howto
Tom’s Hardware – an example of a computer review site that never shows CHIPSEC results 😦 — has a new article on how to fix a common UEFI/Windows problem:
How To Fix Windows 10 Unsupported Disk Layout UEFI Error
by Seth Colaner November 17, 2017 at 1:30 PM
A common problem that Windows users have encountered when trying to update Windows 10 is the “Unsupported Disk Layout for UEFI Firmware” error. This error basically means that the partition structure of your hard drive is not supported by the version of Windows 10 that you want to upgrade to. This error can be resolved by creating a Microsoft Reserved Partition (MSR), which is used on Unified Extensible Firmware Interface (UEFI)/GUID Partition Table (GPT) disks. Without getting too technical, we will outline the steps to fix this error when attempting to update.[…]
http://www.tomshardware.com/news/how-to-fix-windows-10-unsupported-disk-layout-uefi-error,35960.html
PS: Tom, please start showing CHIPSEC (and FWTS) results in your reviews, less on what colors the cases come in, and more on what security the HW/FW fails to offer. Thanks!
FWTS 17.11.00 released (and added to LUV)
The November 2017 release of FirmWare Test Suite is out, with many ACPI changes, and a few UEFI changes.
New Features:
* acpi: devices: add a new test for acpi ec device
* acpi: devices: add a new test for ACPI AC adapter device
* acpi: devices: add a new test for ACPI battery device
* acpi: devices: add a new test for smart battery device
* acpi: devices: add new tests for power and sleep button devices
* acpi: madt: check GICD’s system vector according to mantis 1819 (ACPI 6.2a)
* acp: nfit: add platform capability according to manit 1831 (ACPI 6.2a)
* lib: add new large resource data type for _CRS methods
* acpi: sdev: add ACPI SDEV test (mantis 1632)
* acpi: dppt: add ACPI PDTT test (mantis 1576)
* acpi: devices: add new tests for lid device
* acpi: devices: add new tests for ambient light sensor device
* acpi: devices: add new tests for time and alarm device
* acpi: devices: add new tests for wireless power calibration device
* acpi: add tests for _SRT control method
* auto-packager: mkpackage.sh: add bionic
* fwts: add bash command-line completion
* Add ACPI 1.0 RSDP test to make sure RSDT field isn’t null
* ACPICA: Update to version 20171110
* uefi: uefidump: add dumping for BluetoothLE device path
* uefi: uefidump: add dumping for DNS device path
* uefi: uefibootpath: add test for BluetoothLE device path
* uefi: uefibootpath: add test for DNS device path
https://launchpad.net/ubuntu/+source/fwts
http://fwts.ubuntu.com/release/fwts-V17.11.00.tar.gz
https://launchpad.net/~firmware-testing-team/+archive/ubuntu/ppa-fwts-stable
https://wiki.ubuntu.com/FirmwareTestSuite/ReleaseNotes/17.11.00
See full announcement for list of few-dozen bugfixes.
Full announcement:
https://lists.ubuntu.com/archives/fwts-announce
In related news, Gayatri Kammela has added this updated FWTS to LUV.
Update FWTS to version v17.11.00
Full patch:
https://lists.01.org/mailman/listinfo/luv
DJI drone firmware exposes private keys on Github for years
As reported by the Register, security researcher Kevin Finisterre discovered the Chinese firm had left the private keys of the DJI HTTPS domain on GitHub, exposed for all to see for roughly four years. To make matters worse, DJI had also made AWS credentials and firmware AES keys available for anyone to search for through the GitHub repository.[…]Earlier this year the US Army issued a blanket ban on the use of DJI products by its personnel. It gave no reason for doing so, other than unspecified “cyber vulnerabilities,” and was rapidly followed in doing so by the Australian military. Several British police forces also use DJI drones for operations, in place of helicopters.[…]
https://www.theregister.co.uk/2017/11/16/dji_private_keys_left_github/
US-CERT ST17-001: Securing the IoT
Security Tip (ST17-001): Securing the Internet of Things
The Internet of Things is becoming an important part of everyday life. Being aware of the associated risks is a key part of keeping your information and devices secure. The Internet of Things refers to any object or device that sends and receives data automatically through the Internet. This rapidly expanding set of “things” includes tags (also known as labels or chips that automatically track objects), sensors, and devices that interact with people and share information machine to machine.[…]
Kaspersky 2018 Threat Predictions: Sophisticated UEFI and BIOS attacks
Kaspersky Security Bulletin: Threat Predictions for 2018
Juan Andrés Guerrero-Saade, Costin Raiu, Kurt Baumgartner
[…]
Sophisticated UEFI and BIOS attacks.
The Unified Extensible Firmware Interface (UEFI) is a software interface which serves as the intermediary between the firmware and the operating system on modern PCs. Established in 2005 by an alliance of leading software and hardware developers, Intel most notable amongst them, it’s now quickly superseding the legacy BIOS standard. This was achieved thanks to a number of advanced features that BIOS lacks: for example, the ability to install and run executables, networking and Internet capabilities, cryptography, CPU-independent architecture and drivers, etc. The very advanced capabilities that make UEFI such an attractive platform also open the way to new vulnerabilities that didn’t exist in the age of the more rigid BIOS. For example, the ability to run custom executable modules makes it possible to create malware that would be launched by UEFI directly before any anti-malware solution – or, indeed, the OS itself – had a chance to start. The fact that commercial-grade UEFI malware exists has been known since 2015, when the Hacking team UEFI modules were discovered. With that in mind, it is perhaps surprising that no significant UEFI malware has been found, a fact that we attribute to the difficulty in detecting these in a reliable way. We estimate that in 2018 we will see the discovery of more UEFI-based malware.[…]
Click to access KSB_Predictions_2018_eng.pdf
Firmware Security 
You must be logged in to post a comment.