Category: Uncategorized

Dell Inspiron 20-3052 BIOS update concerns

~ hucktech ~ Leave a comment

If you have this Dell, be careful about the current update, multiple users have the problem. Quoting the Register article:

As one forum wag noted: “Some send out ‘WannaCry’, others send out BIOS upgrades”.

https://www.theregister.co.uk/2017/05/18/dell_bios_update_borks_pcs/

http://en.community.dell.com/support-forums/desktop/f/3514/t/20012309?pi21953=1

http://en.community.dell.com/support-forums/desktop/f/3514/p/19435778/20050222

PS: These are nice references from Dell’s support wiki:

http://en.community.dell.com/support-forums/desktop/w/desktop/3624.beep-codes-and-psa-diagnostic-chart

http://en.community.dell.com/support-forums/desktop/w/desktop/3634.extremely-long-psa-code-chart

 

SiFive Coreplex IP for RISC-V

~ hucktech ~ Leave a comment

RISC-V is a free and open instruction set architecture based on modern design techniques and decades of computer architecture research. With over 60 member companies and a robust software ecosystem, RISC-V is set to be the standard architecture in all modern computing devices, from 32-bit embedded microcontrollers to 64-bit application processors and datacenter accelerators and beyond. SiFive Coreplex IP are the most widely deployed RISC-V cores in the world and are the lowest risk, easiest path to RISC-V. SiFive Coreplex IP are fully synthesizable and verified soft IP implementations that scale across multiple design nodes, making them ideal for your next SoC design.

https://www.sifive.com/products/coreplex-risc-v-ip/

 

Textplained

~ hucktech ~ Leave a comment

“On its brand new online store, French start-up Texplained (Valbonne, France) presents itself as the leading expert in the reverse engineering and security analysis of integrated circuits. The company aims to review every major IC on the market to create a library of detailed information and analysis about IC hardware from leading chip manufacturers.[…]”

http://www.smart2zero.com/news/hacking-secure-chips-common-good

http://www.texplained.com/texplained

 

 

MemoryMonRWX: Windows hypervisor to detect rootkits

~ hucktech ~ Leave a comment

Modern malware and spyware platforms attack existing antivirus solutions and even Microsoft PatchGuard. To protect users and business systems new technologies developed by Intel and AMD CPUs may be applied. To deal with the new malware we propose monitoring and controlling access to the memory in real time using Intel VT-x with EPT. We have checked this concept by developing MemoryMonRWX, which is a bare-metal hypervisor. MemoryMonRWX is able to track and trap all types of memory access: read, write, and execute. MemoryMonRWX also has the following competitive advantages: fine-grained analysis, support of multi-core CPUs and 64-bit Windows 10. MemoryMonRWX is able to protect critical kernel memory areas even when PatchGuard has been disabled by malware. Its main innovative features are as follows: guaranteed interception of every memory access, resilience, and low performance degradation.

http://igorkorkin.blogspot.com/2017/03/memorymonrwx-detect-kernel-mode.html

RPMB

~ hucktech ~ Leave a comment

I learned a new word today: “RPMB” (Replay Protected Memory Block). 🙂

https://github.com/OP-TEE/optee_os/blob/master/documentation/secure_storage_rpmb.md

https://lwn.net/Articles/694798/

https://lwn.net/Articles/682276/

Leviathan Framework

~ hucktech ~ Leave a comment

Leviathan is a mass audit toolkit which has wide range service discovery, brute force, SQL injection detection and running custom exploit capabilities. It consists open source tools such masscan, ncrack, dsss and gives you the flexibility of using them with a combination. The main goal of this project is auditing as many system as possible in country-wide or in a wide IP range.[…]

https://github.com/leviathan-framework/leviathan
https://leviathan-framework.org/

Not to be confused with Leviathan Security’s Lotan.

http://www.leviathansecurity.com/lotan

sniffROM

~ hucktech ~ Leave a comment

sniffROM: A tool for passive data capture and reconnaissance of serial flash chips. It is used in conjunction with a Saleae logic analyzer to reconstruct flash memory contents and extract contextual information about device operations. Supports SPI and I²C flash chips. Recognizes most flash commands across different chip vendors. Preserves actual memory addresses of captured data. Binary visualization of reconstructed image.

usage: sniffROM.py [-h] [–addrlen [{2,3,4}]] [–endian [{msb,lsb}]] [–filter [{r,w}]] [-o [O]] [–summary] [–graph] [-v] input_file

https://github.com/alainiamburg/sniffROM

 

UEFI-SecureBoot-SignTool

~ hucktech ~ Leave a comment

Aneesh Neelam has written UEFI-SecureBoot-SignTool, a script to sign external Linux kernel modules for UEFI Secure Boot.


UEFI Secure Boot sign tool
The default signed Linux kernel on Ubuntu (>=16.04.x), Fedora (>=18) and perhaps on other distributions as well, won’t load unsigned external kernel modules if Secure Boot is enabled on UEFI systems. Hence, any external kernel modules like the proprietary Nvidia kernel driver, Oracle VM VirtualBox’s host/guest kernel driver etc. won’t work. External kernel modules must be signed for UEFI Secure Boot using a Machine Owner Key (MOK). You can use the UEFI Secure Boot Sign Tool to sign kernel modules. This is useful if you can’t or don’t wish to disable Secure Boot on your UEFI-enabled system.[…]

https://github.com/aneesh-neelam/UEFI-SecureBoot-SignTool

 

 

Reversing Intel ME’s ROMP module

~ hucktech ~ Leave a comment

Reverse-engineering the Intel Management Engine’s ROMP module
Youness Alaoui, Hardware enablement developer

Last month, while I was waiting for hardware to arrive and undergo troubleshooting, I had some spare time to begin some Intel ME reverse engineering work. First, I need to give some shout out to Igor Skochinsky, a Hex-Rays developer, who had been working on reverse engineering the Intel ME for a while, and who has been very generous in sharing his notes and research on the ME with us, which is going to be a huge help and cut down months of reverse engineering and guesswork. Igor was very helpful in getting me to understand the bits that didn’t make sense to me. The first thing I wanted to try and reverse was the ROMP module. It is one of the two modules that me_cleaner doesn’t remove, and given how small it is (less than 1KB of code+data), I thought it would be a good starting point. Turns out my hunch was right, as I finished reverse engineering that module after only a couple of days.[…]

https://puri.sm/posts/reverse-engineering-the-intel-management-engine-romp-module/

https://github.com/kakaroto/purism-playground

Intel AMT, continued

~ hucktech ~ Leave a comment

Matthew Garrett has a new tool to check for AMT on Linux:

If AMT is enabled and provisioned and the AMT version is between 6.0 and 11.2, and you have not upgraded your firmware, you are vulnerable to CVE-2017-5689. Disable AMT in your system firmware.

https://github.com/mjg59/mei-amt-check

A little bird told me some info about Intel AMT and Linux:

* Some BMC/IPMI devices also listen on port 623 because they support the same asf-rmcp protocol. So if you are using nmap to scan networks you may see false positives from these devices.

* The Intel OpenAMT tool can be used on Linux to determine if AMT is enabled. The procedure is something like:
  * build with: ./configure;make
  * on the system to test, load the mei modules with: modprobe mei-me
  * run the src/lms binary (only uses standard libraries, no need to ‘make install’)
  * check daemon.log, not enabled should be something like “LMS: Cannot connect to Intel AMT via MEI driver”
  * clean up by killing the running lms process, removing the lms binary, and unloading the mei modules: rmmod mei-me mei
https://sourceforge.net/projects/openamt/

* On Linux, blacklisting the mei-me/mei modules will prevent local access to AMT, but doesn’t help if it’s already enabled.

Absolute seeks OEM Business Development Director

~ hucktech ~ Leave a comment

It is an exciting time for the Absolute and Microsoft partnership!  Absolute’s placement in Windows device firmware provides a truly unique position within the Microsoft partner ecosystem. We continue to strengthen this relationship by opening new doors of engagement through our recent product integration announcements. To further support the relationship, we are looking for a tenured Business Development Director[…]

http://jobs.jobvite.com/absolute/job/oarf5fwF

Intel AMT story, continued

~ hucktech ~ Leave a comment

A little bit more (warning: a few of these are related to Intel ME hardware, not Intel AMT firmware):

Rumor has it that OpenAMT can also be used for AMT detection:
https://sourceforge.net/p/openamt/wiki/Home/

AMT advisory from ASUS:
https://www.asus.com/News/uztEkib4zFMHCn5r

http://blog.trendmicro.com/tippingpoint-threat-intelligence-zero-day-coverage-week-may-8-2017/

https://community.rapid7.com/community/nexpose/blog/2017/05/11/on-the-lookout-for-intel-amt-cve-2017-5689

http://www.govinfosecurity.com/intels-amt-flaw-worse-than-feared-a-9901

Is Intel’s Management Engine Broken?

https://twitter.com/4Dgifts/status/862326241659150336