Category: Uncategorized

Windows 10 Secure Boot information

~ hucktech ~ Leave a comment

Yung Chou has a blog post on Windows 10’s implementation of UEFI Secure Boot:

An Introduction of UEFI Secure Boot in Windows 10 Enterprise

As a firmware interface standard to replace BIOS (Basic Input/Output System), UEFI (Unified Extensible Firmware Interface) specification has been a collective effort by UEFI Forum members for a while. UEFI is in essence an abstraction layer between firmware and OS, and independent of device hardware and architecture. Which provides flexibility for supporting multiple and various OS environments and as well acts as a generic target boot environment of drivers for cross-platform compatibility, as opposed to the need to develop a particular driver for particular hardware. With UEFI, there are also security opportunities to better defend a class of malware like bootkit and rootkit targeting the pre-boot environment of a device. […]

An Introduction of UEFI Secure Boot and Disk Partitions in Windows 10

Windows Device Guard information

~ hucktech ~ Leave a comment

Ash de Zylva of Microsoft has a blog post on Windows 10’s Device Guard and Credential Guard:
Windows 10 Device Guard and Credential Guard Demystified
While helping Windows Enterprise customers deploy and realize the benefits of Windows 10, I’ve observed there’s still a lot of confusion regarding the security features of the operating system. This is a shame since some of the key benefits of Windows 10 involve these deep security features. This post serves to detail the Device Guard and Credential Guard feature sets, and their relationship to each other. […]
http://blogs.technet.com/b/ash/archive/2016/03/02/windows-10-device-guard-and-credential-guard-demystified.aspx

 

DIY Google USB Type-C USB sniffer

~ hucktech ~ Leave a comment

Rajaram Regupathy has a blog post on building your own Google USB-PD Sniffer:

Explore Google Chromium USB Type-C example designs using USB – C Thru

One of the early adopters of USB Type-C and USB Power Delivery is Google for their Chromium projects. More interestingly Google shared the complete design of the USB Type-C products in public domain right from schematic to source code of the solutions. This article explores how to use USB C-Thru board to explore Google’s designs there by enabling you to develop custom USB Type-C design of your own. This article enables you to make your own Google USB-PD Sniffer aka  “Twinkie” using USB C-Thru and a STM32 development board for just 65$ in 3 steps […]

https://www.linkedin.com/pulse/explore-google-chromium-usb-type-c-example-designs-using-regupathy

lowRISC project enters GSoC 2016

~ hucktech ~ Leave a comment

“The lowRISC is taking part in the 2016 Google Summer of Code (GSoC). Additional projects mentored by other organisations that may benefit lowRISC and the open source hardware eocsystem include multi-threaded TCG in QEMU, developing a RISC-V processor model for ArchC, improving the RISC-V port of Coreboot, or working on cross-bootstrap in Debian. Also see the MyHDL projects. Student applications are open between March 14th and March 25th. Project ideas (in no particular order):

Porting musl libc to RISC-V
Improve device-tree support for the Linux RISC-V port
Schematic Viewer for Netlists (SVG/JavaScript)
An alternative flow for ice40 place and route
Port a teaching operating system to the lowRISC platform
Integrate more open-source IP for lowRISC on FPGAs
Implement a Trusted Execution Environment
Trace-debug analysis tool
Generic hardware/software interface for software-defined radio
Implement a SPIR-V front end for Nyuzi
Port an operating system kernel to Nyuzi”

http://www.lowrisc.org/docs/gsoc-2016-ideas/

Updating Android devices

~ hucktech ~ Leave a comment

Sam Varghese has a story on ITWire about how Android-based devices are hard to update, including some conversation about firmware:

[…] x86 processors have a long history of standardisation. An x86 processor is mostly made of the CPU and an interface to the BIOS/UEFI firmware on the motherboard. From there the operating system can gather the information about the hardware components present in the system. In comparison, ARM processors, especially in the Android/embedded market are System-on-Chips (SoCs). This means, apart from the CPU the SoC provides most to all peripheral components on one die (e.g. network chip, USB chip, display chip, etc). Apart from that, although ARM has standard components for the core system (e.g. interrupt controller, timers etc), most ARM SoCs implement their custom components here, which needs their own drivers in the kernel. The reason is because many companies which produce ARM-based processors have a long history in the mobile phone market in the pre-smartphone era. They have core components which were developed years ago and they want to re-utilise them, as they have a deep knowledge on how they work and their custom software drivers. Third, especially in the embedded world, the ARM processors don’t use the Unified Extensible Firmware Interface (UEFI) to communicate with the firmware. To tell the Linux kernel which components are present, the bootloader passes a device tree blob to the kernel. So there is no dynamic way to tell the kernel which components are present. This is changing a lot and the Linux community are putting a big effort in standardising the firmware interface (EFI, PSCI, ACPI). […]

http://www.itwire.com/business-it-news/open-source/71698-why-updating-android-without-vendor-help-is-a-nightmare.html

FreeBSD 10.3.b3 adds new commands to UEFI boot loader

~ hucktech ~ Leave a comment

https://twitter.com/freebsdcentral/status/704750542468325377

Marius Strobl of the FreeBSD project has announced the 10.3-BETA3 FreeBSD. In terms of UEFI, there are two new UEFI bootloader commands, ‘gop‘ and ‘uga‘:

 Two new commands have been added to the amd64 framebuffer driver
  of the UEFI boot loader.  The first is `gop` (as in Graphics Output
  Protocol), which allows to diagnose problems with efifb(4) but also
  to set the current graphics mode on machines employing GOP.  With
  `uga` (as in Universal Graphics Adapter), it is possible to do the
  same on systems using the UGA protocol, which mainly translates to
  Apple hardware.  The latter change also generally introduced UGA
  support and currently hardcodes the necessary settings for mid-2007
  iMacs (iMac7,1) and late-2007 MacBooks (MacBook3,1).  But it is
  likewise possible to manually supply the necessary information for
  additional systems.

https://lists.freebsd.org/pipermail/freebsd-stable/2016-February/084238.html

Open Compute Project’s Hardware Hackathon

~ hucktech ~ Leave a comment

The Open Compute Project is having a Summit in March in San Jose, California. As part of that, they are having a hackathon, and giving away $10K in prizes.

[…] Do you have a great idea for innovating data center technologies or want to hack on hardware to seed your company? Join us for our Hardware Hackathon at the OCP U.S. Summit 2016 on March 9-10 in San Jose, California. You could win cash prizes to help you seed your initial idea – up to $10K! Winners will present their hacks and receive their prizes on stage during OCP U.S. Summit 2016. Hackathon seating is limited to 100 people. Everyone who registers and participates will receive a special OCP Hackathon t-shirt. We ask that once you register for the hack, you participate in the entire hack, which will last 12-24 hours over the course of the two-day summit. The OCP Hardware Hackathon will consist of 2 tracks: the first track will encompass all active hardware projects under the Open Compute Project — Server, Storage, Network, Open Rack, Hardware management; the second track allows you to hack on hardware that is outside of the existing active OCP projects. […]

http://www.opencompute.org/ocp-u.s.-summit-2016/ocp-hardware-hackathon/
https://registration.opencompute.org/ocp/hackathon
https://registration.opencompute.org/ocp
http://www.opencompute.org/home/SearchForm?Search=Hackathon

Coreboot adds U-Boot as a Payload

~ hucktech ~ Leave a comment

Michael Larabel of Phoronix reports that Coreboot now supports U-Boot as another payload option:

Coreboot users have generally relied upon the SeaBIOS or TianoCore payloads for booting up into a Linux distribution, but now a U-Boot payload is supported as another option. Intel-based Chromebooks have long been using U-Boot as a payload for Coreboot while now all of that support is going upstream. A commit today adds U-Boot as a possible payload for x86 systems when configured via the new Kconfig options. The commit by Google’s Martin Roth explains, “Graphics worked in U-Boot correctly by initializing the VBIOS and setting up a console mode. Tested in QEMU and on Minnowboard Max.”

More information:

http://www.phoronix.com/scan.php?page=news_item&px=Coreboot-U-Boot-Payload

http://anzwix.com/a/Coreboot/PayloadsAddUBootAsACorebootpayload

Intel SGX Encryption Engine

~ hucktech ~ Leave a comment

Cryptographic protection of memory is an essential ingredient for any technology that allows a closed computing system to run software in a trustworthy manner and handle secrets, while its external memory is susceptible to eavesdropping and tampering. An example for such a technology is Intel’s emerging Software Guard Extensions technology (Intel SGX) that appears in the latest processor generation, Architecture Codename Skylake. This technology operates under the assumption that the security perimeter includes only the internals of the CPU package, and in particular, leaves the DRAM untrusted. It is supported by an autonomous hardware unit called the Memory Encryption Engine (MEE), whose role is to protect the confidentiality, integrity, and freshness of the CPU-DRAM traffic over some memory range. To succeed in adding this unit to the micro architecture of a general purpose processor product, it must be designed under very strict engineering constraints. This requires a careful combination of cryptographic primitives operating over a customized integrity tree that mostly resides on the DRAM while relying only on a small internally stored root. The purpose of this paper is to explain how this hardware component of SGX works, and the rationale behind some of its design choices. To this end, we formalize the MEE threat model and security objectives, describe the MEE design, cryptographic properties, security margins, and report some concrete performance results.

Click to access 332680-002.pdf

Click to access 204.pdf

https://software.intel.com/en-us/isa-extensions/intel-sgx

AMD microcode issue impacts Linux

~ hucktech ~ Leave a comment

[…] It happens only with 0x6000832 ucode, and Piledriver-based CPUs: i.e. newer AMD FX, and Opteron 300 series (4300, 6300 etc.). The visible effects are in ~80% of cases incorrect RSP leading to bad ‘rets’ into kernel data/bss or stack-protector faults. But there are also more elusive ones, like registers being cleared before use in indirect memory fetches or so. I can trigger it from within qemu guest (non-root), causing bad RIP in the host kernel. When testing, a couple of times (maybe 2) out of maybe 30 seen oopses, I was able to set it to user-space addresses mapped in the guest. It greatly depends on timing, but I think with some more effort and populating kernel stack with guest addresses it’d be possible to create a more reliable qemu-guest to host ring0 escape. I CC’d some AMD engineers from this list, and on of them replied with “We are working on the final testing of a new microcode patch to replace 0x06000832.” but without specifying any errata no, or ETA for the new ucode. […]

https://lkml.org/lkml/2016/2/26/876

Firmadyne: automated analysis of Linux embedded firmware

~ hucktech ~ Leave a comment

FIRMADYNE is an automated and scalable system for performing emulation and dynamic analysis of Linux-based embedded firmware. It includes the following components:

* modified kernels (MIPS: v2.6.32, ARM: v4.1, v3.10) for instrumentation of firmware execution;
* a userspace NVRAM library to emulate a hardware NVRAM peripheral;
* an extractor to extract a filesystem and kernel from downloaded firmware;
* a small console application to spawn an additional shell for debugging;
* and a scraper to download firmware from 42+ different vendors.

We have also written the following three basic automated analyses using the FIRMADYNE system.

* Accessible Webpages: This script iterates through each file within the filesystem of a firmware image that appears to be served by a webserver, and aggregates the results based on whether they appear to required authentication.
* SNMP Information: This script dumps the contents of the public and private SNMP v2c communities to disk using no credentials.
* Vulnerability Check: This script tests for the presence of 74 vulnerabilities using exploits from Metasploit and other sources.

https://github.com/firmadyne/firmadyne/

Windows UEFI development course

~ hucktech ~ Leave a comment

WinInsider — probably via Alex Ionescu — has a UEFI development course available.  Alex is the author of VisualUEFI, which hides the non-Visual Studio’isms of EDK-II development. Alex, along with others at Wininternals, is also one of the current authors of the “Windows Internals”  book from Microsoft Press, now a 2-volume 6th edition set, originally called “Inside Windows NT”, written by Helen Custer.

Windows UEFI Development (3 Days or 5 Days)

In this course, one can expect to learn the internals of the Unified Extensible Firmware Interface inside and out, from the high-level concepts and overview of its functionality, down to the low-level development of actual UEFI applications, drivers, and services. The seminar will go over the history of UEFI’s development, from its original “Intel Boot Initiative” days to today’s SecureBoot facilities (and controversies), discuss the core UEFI data structures that form the basis of the environment, describe the different internal boot phases of the UEFI Runtime, and go in detail over the main UEFI protocols and their semantics. The course will also cover how UEFI leverages several Microsoft technologies, such as Authenticode and the Portable Executable (PE) format. Finishing off the lecture section will be a deep dive on how Windows 8 and later take advantage of UEFI to support booting off GPT disks, implementing SecureBoot, and speeding up the boot experience. Windows user-mode and kernel-mode APIs that interact with UEFI, as well as internal kernel data structures and capabilities in the UEFI HAL will also be shown off. Alongside the lecture period, attendees will get their hands dirty with bare-to-the-metal UEFI development using Visual Studio, as well as learning how to setup the UEFI SDK (EDK) to work alongside Microsoft’s development tools. Participants will get the chance to build their own UEFI applications, drivers, and runtime services, as well as learn how to debug and test their work in the OVMF environment alongside QEMU, without requiring actual UEFI hardware. The course will also show how to develop and build SecureBoot-compatible binaries. Finally, attendees will discover the Windows-specific Boot Application Runtime Environment, how to build compatible applications, and how to leverage the environment from both a UEFI and PCAT perspective. Attendees will then write both offensive and defensive UEFI code that hooks and/or protects the Windows Boot Loader.

UEFI Course Outline:
* Introduction to UEFI
* UEFI Architecture
* UEFI Protocols & Services
* Windows and UEFI
* Windows Boot Application Environment
* Windows Boot Loader Internals
* EDK and Visual Studio Development
* Windows & UEFI Interfacing

Topics:
* UEFI Protocols: UEFI Device Handles, UEFI Text and Graphics, UEFI Local and Remote I/O, UEFI USB & PCI, UEFI File System, Custom Protocols
* UEFI Services: UEFI Boot Services & Runtime Services, UEFI System Table, ACPI & UEFI, Custom Services
* UEFI Architecture: Measured Boot & Secure Boot, UEFI Stages & Layers (SEC, PEI, DXE), GPT Partitioning, Types of UEFI Binaries
* Windows & UEFI: Calling UEFI Services, Accessing UEFI Variables, Windows Boot Library and UEFI, BCD and UEFI, HAL and UEFI
* Windows Boot Environment: PCAT and UEFI Portability, Core Data Structures, Entrypoint and Callbacks,  Building a Windows Boot Application
* Windows Boot Loader: Boot Stages, Boot Loader Functionality, Security Services (BitLocker and more), Boot Structures, Handoff to Kernel
* UEFI Development: Obtaining and Installing the EDK, Setting up Visual Studio with the EDK, EDK Hello World, Interfacing with EDK Libraries, Obtaining and Installing OVMF
* Offensive UEFI: Hooking UEFI Services and Protocols, Windows Boot Environment Hooks, Persistence with UEFI
* Defensive UEFI: Checking for Boot Loader Integrity, Detecting UEFI Hooks and Bootkits

http://www.windows-internals.com/?page_id=1673

http://www.alex-ionescu.com/

Plutomaniac’s ME Analyzer

~ hucktech ~ Leave a comment

There are three tools from the win-raid.com firmware modding community that I’ve not used, but I’ve heard are quite awesome tools. The first is UBU[1], the second is GOPupd[2], and the third is ME Analyzer, the subject of this blog post. ME Analyzer is a tool by Plutomaniac, a member of the win-raid.com firmware modding community. The tool parses Intel BIOS images and provides various infos about Management Engine Firmware in them. It also has a related Firmware Database which contains a lot of interesting information.

ME Analyzer is an Intel Engine Firmware Analysis Tool, a tool that you can show various details about Intel Engine Firmware (Management Engine, Trusted Execution Engine, Service Platform Services) images. It can be used to identify whether the firmware is updated, what Release, Type, SKU it is etc. Features:
* Supports all current & legacy Engine firmware (ME 1.x – 11.x , TXE 1.x – 2.x & SPS 1 – 4)
* All types of firmware files are supported (ME/TXE/SPS Regions, BIOS images etc)
* Partial Firmware Update support for Corporate ME 8-11 enabled platforms
* UEFI Bios Updater (UBU) and Lordkag’s Extractor integration support
* Firmware Family (ME, TXE or SPS), Date & Version number detection
* Production, Pre-Production & ROM-Bypass firmware release detection
* Region (Stock or Extracted) & Update firmware type detection
* Identification of the platform that the firmware was configured for via FITC
* SKU & target platform detection for all supported firmware releases
* Security Version Number (SVN), Version Control Number (VCN) & PV-bit detection
* Intel SPI Flash Descriptor Access Region detection, Skylake compatible
* Identification of whether the imported Engine firmware is up-to-date
* Proper CPT/PBG SKU & BlackList Table detection for ME 7.x firmware
* Special Apple Macintosh ME 7.0 & 9.5 firmware SKU support
* FWUpdate OEMID detection at Region & SPI/BIOS images
* Multiple drag & drop & sorting of rare/problematic Engine Firmware
* Multiple Engine Firmware Region detection, number only
* Unidentifiable Engine Firmware Region (ex: Corrupted, Compressed) detection
* Reports unknown firmware not found at the Engine Repository Database
* Reports unknown firmware Major, Minor, SKU, Type etc releases
* Shows colored text to signify the importance of notes, warnings, errors etc

Engine Firmware Repository Database:

ME Analyzer’s main goal is to allow users to quickly determine & report new firmware versions without the use of special Intel tools (FIT/FITC, FWUpdate) or Hex Editors. To do that effectively, a database had to be built. The Intel Engine Firmware Repositories is a collection of every ME, TXE & SPS firmware I have found. It’s existence is very important for ME Analyzer as it allows me to find new types of firmware, compare same major version releases for similarities, check for updated firmware etc. Bundled with ME Analyzer there’s a file called MEA.dat which is required for the program to run. It includes all CSE firmware that are available at the Repository thread. This accommodates two actions: a) Check whether the imported firmware is up to date and b) Help find new CSE firmware releases sooner by reporting them at the Intel Management Engine: Drivers, Firmware & System Tools or Intel Trusted Execution Engine: Drivers, Firmware & System Tools threads respectively.

ME Analyzer is closed source freeware, targetting Microsoft Windows platform. As always, if you can’t review the code, be cautious where/how you use it, until you are ready to ‘trust’ the author.

ME Analyzer requires ME Util v0.1, and includes a modified version of it:
https://github.com/skochinsky/me-tools

More information:
http://www.win-raid.com/t840f39-ME-Analyzer-Intel-Engine-Firmware-Analysis-Tool.html
http://www.win-raid.com/t832f39-Intel-Management-amp-Trusted-Execution-Engine-Firmware-Repository.html
http://www.win-raid.com/t596f39-Intel-Management-Engine-Drivers-Firmware-amp-System-Tools.html
http://www.win-raid.com/t624f39-Intel-Trusted-Execution-Engine-Drivers-Firmware-amp-System-Tools.html

[1]

UBU 1.43 released

Tool review: UBU-helpers


[2]

tool: GOPupd

BIOS analysis presentation at Analyze 2016

~ hucktech ~ Leave a comment

Analyze 2016 takes place in March in San Francisco. It is a “Security community event for malware and exploit analysis research”. Amongst the presentations is one on BIOS analysis by two of the Intel Advanced Threat Research (ATR) team!

Talks:
Tom Bennett – Whose RAT Is It Anyways?
Aaron Shelmire – Sections, Segments, and Functions, oh my! Hashing your way to analytical shortcuts.
Edward Miles – Making sense of ProGuard’s mess
Oleksandr Bazhaniuk/Yuriy Bulygin – Different methods of BIOS analysis: Static, Dynamic and Symbolic execution
Darren Spruell – Malicious Traffic Distribution: Tactics and Response
Rick Wesson – Static Malware Analysis on GPUs
Chip McSweeney – DGA Antivenom: Stopping new configurations before analysis
Jing Xie – Risks of iOS Remote Hot-Patching
Alexander Matrosov – Distributing the reconstruction of IR for large scale malware analysis
http://www.analyze.cc/Waylon Grange – Wherefore by their crypto ye shall know them
Armin Buescher – Sanzoku APT

http://www.analyze.cc/

Zephyr

~ hucktech ~ Leave a comment

There’s another embedded OS on the market. Intel, NXP, Linux Foundation, and others are involved.

The Linux Foundation, the nonprofit organization enabling mass innovation through open source, today announced the Zephyr™ Project. This open source collaborative effort will unite leaders from across the industry to build a RTOS for the IoT. Early support for the Zephyr Project includes Intel® Corporation (including its acquired business groups Altera Corporation and Wind River), NXP Semiconductors N.V. (including its recent merger with Freescale), Synopsys, Inc. and UbiquiOS Technology Limited. Zephyr Project is inviting others interested in this technology to participate.

The Zephyr™ Kernel is a small-footprint, scalable, real-time operating system designed for use on resource-constrained systems: from simple embedded environmental sensors and LED wearables to sophisticated smart watches and IoT wireless gateways. It is designed to be supported by multiple architectures, including ARM, x86, and ARC. The Zephyr™ project associated with the kernel makes it available to users and developers under the Apache License, version 2.0.

It seems confusing that the *Linux* Foundation is pushing a new non-Linux OS, but ok. Given the current state of IoT security, it is concerning to see this comment in their press release:

“Minimal error checking. Provides minimal run-time error checking to reduce code size and increase performance. An optional error-checking infrastructure is provided to assist in debugging during application development.”

I want Maxmimal error checking in an IoT OS, not minimal! Optional means the error-checking infrastructure may not get used, and we know how security-savvy current IoT vendors are in this regard. 😦
https://www.zephyrproject.org/about/export-compliance
https://www.zephyrproject.org/content/zephyr-kernel-v100-release-notes
https://www.zephyrproject.org/
https://www.youtube.com/channel/UCohVfwDfzCZ_gh3DvIZ4fJA
http://www.linuxfoundation.org/news-media/announcements/2016/02/linux-foundation-announces-project-build-real-time-operating-system

I don’t know what kind of firmware it uses yet. 🙂

Open Garages starts Youtube channel

~ hucktech ~ Leave a comment

An excerpt from a Seattle-area announcement from Open Garages, a car hacking group, on availability of a new video feed from them:

OpenGarages YouTube Channel

OpenGarages now has a YouTube channel, you can watch the first intro video here:

https://www.youtube.com/watch?v=tKjMreFHTd4

The channel is going to cover vehicle “hacks” and modifications.  It will be a video series covering a lot of what is in the Car Hacker’s Handbook and showing off people’s modifications.  These will be really short segments on different topics 3-5 minutes.  This allows you to quickly locate the area you are working on and just view segment without skipping through some longer video.

The first tutorial video is now up as well, it is on Vehicle Networks and can be viewed here:

https://www.youtube.com/watch?v=tx5Ws6qdZCI

If you are in the Seattle area and want to demo something or see certain tutorials, let me know.  Please subscribe to the channel too, subscribing let’s us justify that there is a desire to see these videos and we can use them as justifications to get sponsors.

Speaking of sponsorship.  If you are a company that is interested in sponsoring one or more modules, please contact me as well. My goal is to make a video series that is better than just talking to my webcam.

Thanks and spread the word!

Craig Smith