Brian speaking at Bsides Huntsville

Brian Richardson of Intel will be speaking about firmware at a security conference, BSides Huntsville.

https://software.intel.com/en-us/meet-the-developers/evangelists/team/Brian-Richardson

https://www.bsideshuntsville.org/

 

Coreboot Conference 2017 announced!

https://twitter.com/coreboot_org/status/818889514772992000

European Coreboot Conference 2017
Location: Germany

We are currently planning to  host a coreboot conference with 2 days of talks and an additional 2 days of hacking. Sometime in October 2017 in Bonn or Bochum, Germany.
The dates will probably either be October 19-22 or October 26-29,  i.e. directly before or after Embedded Linux Conference Europe and LinuxCon Europe.
Ticket prices haven’t been decided yet and depend on the location and venue availability.  Add your email address to be sent an invite to the conference when it is announced.

https://www.coreboot.org/events/ecc2017

 

more on ME Cleaner

I did a brief post on ME Cleaner, found on an article pointed out to me by a reader (i.e., I missed it). Phoronix has a story on ME Cleaner, including a pointer to it’s hardware/firmware-compatibility page, which I also missed:

https://github.com/corna/me_cleaner/wiki/me_cleaner-status

 

http://www.phoronix.com/scan.php?page=news_item&px=Intel-ME-Cleaning

https://github.com/corna/me_cleaner

ME Cleaner

 

Intel Fortville vulnerability

Intel ID:      INTEL-SA-00063
Product family:      Intel® Ethernet Controller X710 family and Intel® Ethernet Controller XL710 family
Impact of vulnerability:      Denial of Service
Severity rating:      Important
Original release:      Jan 09, 2017

A security vulnerability in the Intel® Ethernet Controller X710 and Intel® Ethernet Controller XL710 family of products (Fortville) has been found in the Non-Volatile Flash Memory (NVM) image.  A security vulnerability in the Intel® Ethernet Controller X710 and Intel® Ethernet Controller XL710 family of products (Fortville) has been found in the Non-Volatile Flash Memory (NVM) image.  Under certain use conditions the Ethernet controller will stop sending and receiving data until the controller is reset.  All NVM versions 5.04 and earlier contain this vulnerability which is fully mitigated in NVM version 5.05. […]

Full announcement:

https://security-center.intel.com/advisory.aspx?intelid=INTEL-SA-00063&languageid=en-fr

Attacking UEFI Runtime Services

Ulf has an informative new article (and video) about attacking UEFI Runtime Services on Linux-based systems using PCILeech:

Attackers with physical access are able to attack the firmware on many fully patched computers with DMA – Direct Memory Access. Once code execution is gained in UEFI/EFI Runtime Services it is possible to use this foothold to take control of a running Linux system. The Linux 4.8 kernel fully randomizes the physical memory location of the kernel. There is a high likelyhood that the kernel will be randomized above 4GB on computers with sufficient memory. This means that DMA attack hardware only capable of 32-bit addressing (4GB), such as PCILeech, cannot reach the Linux kernel directly. Since the EFI Runtime Services are usually located below 4GB they offer a way into Linux on high memory EFI booting systems. Please see the video below for an example of how an attack may look like. […]

Full post:

http://blog.frizk.net/2017/01/attacking-uefi-and-linux.html

 

FOSDEM

The other day I mentioned that coreboot was going to be at FOSDEM’17.

coreboot at FOSSDEM

(I mistakingly called it FOSSDEM instead of FOSDEM. And I mistakingly pointed to the FOSDEM’16 expo layout, ignore that.) 😦

In addition to coreboot presence, there are also multiple interesting presentations, including (but not limited to):

https://fosdem.org/2017/schedule/event/libreboot/
https://fosdem.org/2017/schedule/event/abusing_chromium_ec/
https://fosdem.org/2017/schedule/event/sniffing_usb/
https://fosdem.org/2017/schedule/event/secure_safe_embedded_updates/
https://fosdem.org/2017/schedule/event/terrible_bsp/
https://fosdem.org/2017/schedule/event/lava_laboratory/
https://fosdem.org/2017/schedule/event/testing_with_volcanoes/
https://fosdem.org/2017/schedule/track/internet_of_things/
https://fosdem.org/2017/schedule/event/panopticon/
https://fosdem.org/2017/schedule/event/securing_qemu_guest/
https://fosdem.org/2017/

FSF: back the Raptor Talos Secure Workstation

A message from Donald Robertson of the Free Software Foundation, quoted verbatim:

Support the Talos Secure Workstation by January 14th Raptor Computing Systems is crowdfunding on Crowd Supply to produce, from the ground up, a high-powered computer with no proprietary software or firmware blobs called the Talos Secure Workstation. The project’s decision to raise funds via [Crowd Supply][0] means that you can support their work with anonymous payments, and without the use of [proprietary JavaScript][1]. We wrote about this project previously, and encouraged people to [voice their support][2]. While there are several companies that offer refurbished computers that have been freed to [Respect Your Freedom][3], the Talos Secure Workstation will be built from its inception with freedom in mind. But in order for that to happen, the project needs your help to meet their fund raising goal. The project has set a crowdfunding goal of $3.7 million and still has a ways to go to reach that mark. It may seem like they are asking for a lot of money, but relative to the scope of what the folks at Raptor Computing are trying to accomplish, it is a small amount. As Raptor Computing Systems Senior Electrical Engineer Timothy Pearson explained:

‘Large, complex systems such as Talos require minimum order quantities to be met for the component parts in use, in addition to R&D expenditure for prototyping, validation, and conformance testing. We have set the goal at the minimum level required to ensure that we can not only design the Talos systems, but also purchase the parts needed to manufacture these complex machines.’

They need every dollar they can get to make this system a reality. It is a difficult goal, but also one that is critical for the future of free computing. As they note in their explanation[4] of the problem:

‘As of this writing, all currently manufactured, low- to mid-range and higher x86 devices, with the exception of two obsolete AMD CPUs, incorporate a security processor that is cryptographically signed, updateable, unauditable, and for which no source code or documentation has been made public. Worse, these security processors must load and continually execute this signed firmware for the system to either be brought online (AMD) or for it to remain operational (Intel).’

If we want a future in which we can continue to have fully free systems that run only free software, we have to build that future ourselves. The Talos Secure Workstation is a proposed system to help secure that future. Their plans are to create a device that will meet the criteria for [Respects Your Freedom][3] certification, but in order for their plans to come to fruition, they need your help. You can support their work by backing the project via their [crowdfunding page][0], or even better, by purchasing a mainboard andaccessory package. Every little bit counts. Will you help support the future of free computing?

[0]: https://www.crowdsupply.com/raptor-computing-systems/talos-secure-workstation
[1]: https://www.gnu.org/philosophy/javascript-trap.en.html
[2]: https://www.fsf.org/blogs/licensing/interested-in-a-powerful-free-software-friendly-workstation
[3]: https://www.fsf.org/resources/hw/endorsement/respects-your-freedom
[4]: https://www.crowdsupply.com/raptor-computing-systems/talos-secure-workstation/updates/a-word-on-lockdown

 

SMM training at WhiskeyCon

 

 

This course is for people who want to find out more information about the most privileged and mysterious operating mode of x86 processors: System Management Mode. You will learn what it actually is, how to get there and what can be done by an attacker once his code is executed in SMM. Are there SMM rootkits in the wild? How feasible it is to create such rootkit? Can a kernel mode antivirus or a hypervisor protect against attacks from SMM? Can SMM rootkit be detected using memory forensics? Can you put an ultimate antivirus in SMM to fight SMM and kernel mode rootkits? We will cover these topics in much detail. There will be many lab exercises which will help you to better understand the ideas and techniques. By the end of the course you will have a good understanding of SMM security principles. You will also have a hands-on experience with implementing and detecting SMM rootkits.

Look at the site for more about the author and the daily schedule.

Longkit: a UEFI/BIOS/SMM rootkit (at ICISSP’17)

ICISSP 2017, in Portugal, has an upcoming UEFI/BIOS/SMM rootkit presentation that sounds interesting:

Longkit: A UEFI/BIOS Rootkit in the System Management Mode. ICISSP 2017
Julian Rauchberger, Robert Luh, Sebastian Schrittwieser.

The theoretical threat of malware inside the BIOS or UEFI of a computer has been known for almost a decade. It has been demonstrated multiple times that exploiting the System Management Mode (SMM), an operating mode implemented in the x86 architecture and executed with high privileges, is an extremely powerful method for implanting persistent malware on computer systems. However, previous BIOS/UEFI malware concepts described in the literature often focused on proof-of-concept implementations and did not have the goal of demonstrating the full range of threats stemming from SMM malware. In this paper, we present Longkit, a novel framework for BIOS/UEFI malware in the SMM. Longkit is universal in nature, meaning it is fully written in position-independent assembly and thus also runs on other BIOS/UEFI implementations with minimal modifications. The framework fully supports the 64-bit Intel architecture and is memory-layout aware, enabling targeted interaction with the operating system’s kernel. With Longkit we are able to demonstrate the full potential of malicious code in the SMM and provide researchers of novel SMM malware detection strategies with an easily adaptable rootkit to help evaluate their methods.

http://www.icissp.org/

https://www.jrz-target.at/2016/12/22/paper-accepted-at-icissp-2017/

Popcorn: another UEFI research OS

The list of UEFI research OSes has grown by one. Justin Miller has created Popcorn:

popcorn: A toy microkernel x64 UEFI OS: popcorn is a hobby OS for x64 UEFI environments to play with building a microkenerl architecture. It’s far from finished, or even being usable – for now, it’s a sandbox for me to explore the UEFI architecture, microkernels, and OS-related concepts that I want to play with.

https://github.com/justinian/popcorn

With Popcorn, that makes about 7 that I’ve seen (and I’m not watching academic news sources, where others may be hanging out). Here’s the other ones I’m aware of:

UEFI-OS

new EFI-based operating systems

 

 

Secure Linux containers with Intel SGX

Diogo Mónica, Security Lead at Docker, posts this:

https://twitter.com/diogomonica/status/817454942369812482
We looked at Haven earlier this year, which demonstrated how Intel’s SGX could be used to shield an application from an untrusted cloud provider. Today’s paper choice, SCONE, looks at how to employ similar ideas in the context of containers.[…] What’s the best way to adapt a container to run within an enclave, accommodating all of the restrictions that come with that? Can it be done in a way that doesn’t break compatibility with existing container platforms (e.g., Docker)? Will the end result pay too high a performance overhead to be usable in practice? […]

SCONE: Secure Linux containers with Intel SGX

Warthog9 leaves Intel

If you have been following the Intel MinnowBoard in particular, or open source hardware/hardware and Intel in general, and you probably know of John ‘Warthog9’ Hawley. He’s leaving Intel! I wonder if someone will fill his role? Below is John’s verbatim posting to the MinnowBoard mailing list:

Taking a step back
Just wanted to let folks know that today was my last day at Intel.  It’s been a blast, but it’s time to move on to new things.  I’ll still be hanging around here in the community, but I will no longer be directly speaking for MinnowBoard as a whole: I’ll just be another community member.  To say the least, this community has been amazing – and the things people are doing, and creating here have continually astonished me, and I look forward to seeing what else people have in store.

More info:
http://lists.elinux.org/mailman/listinfo/elinux-minnowboard

Team Security on UEFI malware

https://twitter.com/security_de/status/817428032336052225

Team Security has an article on firmware malware, focusing on UEFI-centric malware, with many references to VirusTotal.com-based images.

[…]”We would like to specially thank Teddy Reed, developer of the UEFI firmware python parser, he has been instrumental in helping us overcome our ignorance about BIOS, UEFI, and its ecosystem.”

https://tsecurity.de/de/109335/IT-Security/Malware-Trojaner-Viren/Putting-the-spotlight-on-firmware-malware/

Leif on QEMU and USB host device pass-through

Leif has a new blog post on using UEFI with USB pass-through.

[…]”One thing that is unsurprising, but very cool and useful, is that this works well cross-architecture. So you can test that your drivers are truly portable by building (and testing) them for AARCH64, EBC and X64 without having to move around between physical machines.

http://blog.eciton.net/uefi/qemu-usb-passthrough.html

Checkout his previous blog post, on UEFI driver development, as well as older posts on Linaro/ARM/UEFI history.

 

Lenovo’s Think BIOS Config Tool

http://thinkdeploy.blogspot.com/2017/01/thinkpad-bios-to-uefi-conversion-using.html?spref=tw

https://docs.microsoft.com/en-us/sccm/osd/deploy-use/task-sequence-steps-to-manage-bios-to-uefi-conversion

http://thinkdeploy.blogspot.com/2016/08/the-think-bios-config-tool.html

Some related Lenovo BIOS tools:
https://support.lenovo.com/us/en/documents/ht100612
http://support.lenovo.com/us/en/downloads/ds014169
http://support.lenovo.com/us/en/products/laptops-and-netbooks/thinkpad-l-series-laptops/thinkpad-l420/downloads/ds019499

[I confess still not understanding what this “BIOS to UEFI” thing that Windows admin tools now have. Is it switching from Legacy to UEFI firmware then redoing the OS bits to handle that? Why are these boxes using Legacy  mode in the first place? Oh well.]