Firmware Test Suite 16.02.00 is released

Ivan Hu of Canonical has announced the release of FirmWare Test Suite (FWTS) version 16.02.00.

New Features:
  * ACPICA: Update to version 20160212 (LP: #1545099)
  * Full ACPI compliance testing for the FADT
   * FADT: enable compiling on non-x86 architectures
   * FADT: non-x86 machines need an FADT but x86 can survive without one
   * FADT: disable SCI_EN and RESET_REG tests when in reduced hardware mode
   * FADT: add in code to log basic info about the various FADT flag fields
   * Add in bit masks for FACS flags.
   * FADT: move log info out of test2, will provide it elsewhere
   * ACPI: Add hypervisor ID field to FADT.
   * FADT: minor cleanup and initial compliance tests
   * FADT: expand the compliance test for FIRMWARE_CTRL fields
   * FADT: expand compliance checks for DSDT and X_DSDT fields
   * FADT: add compliance tests for reserved fields, PM profile, reduced hardware
   * FADT: restructure test sequence around reduced hardware mode
   * FADT: expand compliance tests for the SMI_CMD field
   * FADT: add compliance tests for the ACPI_ENABLE and ACPI_DISABLE fields
   * FADT: add compliance tests for S4BIOS_REQ and PSTATE_CNT fields
   * FADT: extend and add PM address block compliance tests
   * FADT: enhance compliance tests for GPE blocks
   * FADT: add compliance test for the CST_CNT field
   * FADT: add in compliance tests for C2/C3 latency fields
   * FADT: add in SLEEP_CONTROL_REG and SLEEP_STATUS_REG compliance tests
   * FADT: remove no longer useful variables from test1
   * FADT: add safety checks for older versions of FADT
  * acpi: method: add _PMC test
  * acpi: method: add _PRT test
  * acpi: method: add _RDI test
  * acpi: method: add _LPI test
  * data: klog.json: update to sync with 4.6 kernel changes

See the changelog or full announcement for the list of fixed bug:

https://launchpad.net/ubuntu/+source/fwts
http://fwts.ubuntu.com/release/fwts-V16.02.00.tar.gz
https://launchpad.net/~firmware-testing-team/+archive/ubuntu/ppa-fwts-stable
https://wiki.ubuntu.com/FirmwareTestSuite/ReleaseNotes/16.02.00
http://wiki.osdev.org/FADT

Cr4sh on SMM exploits in Lenovo firmware!

Dmytro Oleksiuk aka Cr4sh has a new blog post on SMM exploits on Lenovo firmware! Very well written and detailed, with source code!

Exploiting SMM callout vulnerabilities in Lenovo firmware
Hi, everyone. In this article I’ll continue to publish my research in PC firmware security field. In previous article, “Breaking UEFI security with software DMA attacks”, I’ve shown how to exploit UEFI boot script table vulnerability and get access to the SMRAM using software DMA attack under Linux. This time we will talk about discovering and exploitation of SMI dispatch vulnerabilities in UEFI System Management Mode drivers. For anyone who’s not familiar with architecture of SMM phase firmware code on UEFI based platforms I’ll strongly recommend to read my other article “Building reliable SMM backdoor for UEFI based platforms”, especially the part about communicating with SMM code using software SMI.

SMM vulnerabilities that I will talk about in this article aren’t new. Around one year ago LegbaCore and Intel Security published two works: “How Many Million BIOSes Would you Like to Infect?” and “A New Class of Vulnerabilities in SMI Handlers” correspondingly, they rediscovered some security issues in SMI handlers code that was actually a known problem among PC firmware developers (for example, same attacks was described in Loïc Duflot work “System Management Mode Design and Security Issues” presented six years ago). Nevertheless, researchers were able to find and report a lot of firmware vulnerabilities of this class in products like Lenovo, Dell, HP laptops and many others (CERT VU#631788). To play with these vulnerabilities I got ThinkPad T450s laptop. According to original security advisory by Lenovo (apparently, it has a lack of technical details) — some unspecified SMM callout vulnerabilities were patched in the latest version of it’s firmware and everything that we need to do is just find out and exploit one of these vulns. […]

http://blog.cr4.sh/2016/02/exploiting-smm-callout-vulnerabilities.html
https://github.com/Cr4sh/fwexpl

 

Interview with Andrei Warkentin, OpenPOWER UEFI porter

There are two ports of UEFI to the OpenPOWER architecture. Andrei E. Warkentin is a developer of one of them. I did an email interview with Andrei. I’ll hopefully have another post in the future with Benjamin, author of the second port. The answers below are from Andrei:

Q: Andrei, how goes your port?

A: So UEFI on OpenPOWER is my idea of a nice relaxing side project to hack on in the late hours with my family asleep, and I haven’t had much time in the last few months to work on it due to vacations, work, … 🙂 But the current state is being able to boot to a UEFI shell with just the OPAL console being supported.  A FAT filesystem image can be passed to qemu via the ‘initrd’ option to be accessible from UEFI. This means that my port is good enough to start writing UEFI applications, for example, or to start thinking about booting PPC64LE Linux, but there is no I/O support for PCI devices (no disk, no networking, no video console, etc).

Q: Is there any consideration of merging two projects into a single one?

A: Probably not. I’m not affiliated with Benjamin’s work, IBM or OzLabs and I am making a point of not looking over at Ben’s work as I address various parts of the UEFI port, because it’s fun to figure out things like this on your own and that’s why I’m working on OpenPOWER UEFI in the first place. I think it will be interesting to see the difference in approaches.

Q: Does OpenPOWER have any involvement in these ports, and official UEFI support, or are these strictly unofficial?

A: Actually one of the reasons I embarked on porting UEFI to PPC64LE is because I couldn’t find any evidence that a project like it was already being done by someone else :-). Power CPUs are not an officially supported platform for UEFI, but proof-of-concept work like this is the first step towards putting together an official specification, provided there is industry interest of course! Having two independent ports goes a long way towards identifying the real minimum requirements and any implementation assumptions to filter out. I think UEFI on OpenPower is interesting because it reduces the barrier to entry for hardware vendors to potentially start making more OpenPower gear. They will be able to use existing knowledge, skills, tooling, etc.

Q: Is there any hardware-level debugger, like an Intel ICE/ITP, for tracing at the instruction level, through OpenPOWER firmware? Perhaps a GUI dev toolchain like like ARM DS-5 or Intel ISS?

A: While I’m not aware of any hardware debuggers, I highly recommend Ben’s OpenPower QEMU ‘powernv’ target. This is what I have been using for my Power8 hacks and UEFI development, and while there’s always the risk of writing code that may not be 100% architecturally correct when using an emulator, it feels 1000x faster than the official IBM simulator, and you can use GDB for an ICE-like experience. For UEFI I have a Py script to facilitate source debugging (See https://github.com/andreiw/andreiw-wip/tree/master/gdb).

Q: How does your UEFI implementation interact — replace or chain after or otherwise integrate with — OpenPOWER’s firmware, OPAL (Open Power Abstraction Layer) firmware, hostboot, petitboot, and other related components I’m not aware of?

A: My UEFI implementation is just another ‘skiboot’ payload, to be loaded instead of ‘petitboot’, and fully meant to leverage OPAL. OPAL runtime services are used today for console access, and would be used for NVRAM, RTC, simple I/O, PCI, power state transitions, etc. The goal is a fully generic UEFI implementation that is not specific to any particular OpenPower platform. This is achieved by using OPAL and the skiboot-produced FDT to abstract platform binding and configuration. This way if a particular work flow requires UEFI, then it’s just another loader stage, similar to the OFW->ARC shim used for the old Windows NT PReP port. The goal is that OPAL services that don’t have corresponding UEFI RT matches would be provided as extra UEFI RT services, to avoid having the OS to deal with supporting two completely different runtime services environments.

Stepping back a bit, conceptually, I don’t think UEFI ought to replace the existing OpenPOWER booting strategy, but simply complement to give more power to the user, to the IHV, the OEM and the OS vendor. My 10 years of experience with both architecture- and platform ports of UEFI, both in writing and in dealing with buggy implementations and drivers has convinced me that it was a mistake to use this highly complex mini-OS, with a non-trivial driver and firmware<->OS interaction model as the first-stage system IPL to be flashed into ROM. This is not meant as a slight against UEFI or Tiano itself, as I think it would be equally a mistake to leverage any other OS or kernel here: it’s just too big. There is way too much code involved – too many moving parts. A lot of these moving parts are part of ‘generic’ code distributed as Tiano where no one looks until something catastrophic happens. The expectation that IHV and hardware engineers are going to write functionally correct drivers is flawed – not everyone is a kernel engineer! For example, UEFI implementers are expected to come up with a proper platform NVRAM driver and the ‘Bds’ driver, the later being a key part that basically unifies all of the end user’s interaction and boot selection activities. Writing NVRAM drivers and ‘Bds’ correctly is hard because introducing subtle bugs is easy and few seem to consider the ‘unexpected’ situations. We’ve already seen plenty industry bugs where setting or clearing the wrong NV variable from the OS turns computers into unusable bricks. I’ve seen a lot of bugs relating to folks not really understanding how runtime services really work, or what sort of things are allowed to be done during UEFI quiesce callbacks. But the conceptual problem here is an environment that pushes all the complexity of OS development onto firmware integrators.

Q: As I understand it, OpenPOWER has some form of Flattened Device Tree (FDT) support? Will that be exposed via your UEFI implementation?

A: The device tree is consumed by the UEFI implementation to figure out how the machine is configured, how to set itself and its own drivers and I/O support up. The device tree would be exposed to a booting Linux kernel, similar to how it is exposed on AArch32 and AArch64 UEFI implementations.

Q: FDT aside, what/how is your port dealing with ACPI, if at all?

A: One of the things I wanted to scope out specifically is presenting OpenPower as a ‘reduced-hardware’ ACPI environment, similar to how the AArch64 ecosystem is doing. ‘Reduced hardware’ means that the requirements around some legacy x86 fixed hardware are dropped, making it possible to support ACPI for platform discovery, configuration and power management across a wide range of very different environments, ranging from embedded SoCs to powerful servers. From a birds eye view, ACPI and device tree are quite similar – both describe hardware as a hierarchical tree of devices with certain identifiers and properties. ACPI differs from DT in that it removes the need to describe certain platform knowledge (and consume it in a driver) and hides it instead in device methods written in this interpreted byte code called AML. It is a heavier system, in many ways significantly less elegant than device tree, but it allows for potentially more homogenous-looking hardware, and it is a de facto standard across server and motherboard manufacturers, so I think having ACPI support for OpenPower would reduce the barrier to entry for hardware vendors to potentially start making more compatible OpenPower gear. I have not started thinking about ACPI support just yet, and this would of course involve changes to the ‘powernv’ support in the Linux kernel.

Q: Besides Github project, do either of you have any upcoming conference presentions or research papers on your projects that we should be looking for?

A: Not that I am aware of. Certainly, if there is interest, I would be happy to present my work at any applicable conferences.

Thanks for the answers, Andrei!

BTW, originally I thought that both ports were from IBM developers, but that’s not the case, Andrei is not from IBM. My previous OpenPOWER blog post is incorrect.

Tianocore for OpenPOWER


https://github.com/andreiw/ppc64le-edk2
https://github.com/ozbenh/edk2

Tianocore for OpenPOWER

Kali for Intel Edison

hackgnar has a new blog post out, showing how to build Kali for Edison targets:

Building Kali Linux for Intel Edison: This documentation goes though the process of manually building a base Kali Linux image for the Intel Edison board. These steps were derived from frankensteining the edison build scripts for Debian Jessie and some of the Kali Linux ARM build scripts. All of the content from this post can be found in my github repo for this project here, along with pre compiled images (coming soon!) and ansible scripts for automated building. Note, all of these steps were tested in Ubuntu Linux 14.04 x64 LTS. As of this writing, this OS/Version has the most support for doing Edison source builds. I have done these steps in other operating systems, but the process is not as clean due to bugs, script tweaks, etc. […]

http://www.hackgnar.com/2016/02/building-kali-linux-for-intel-edison.html
https://github.com/hackgnar/kali_intel_edison

NVIDIA signed firmware for Linux

http://www.phoronix.com/scan.php?page=news_item&px=NVIDIA-Blobs-In-Linux-Firmware

http://www.linuxjournal.com/content/nvidia-releases-new-blobs-too-little-too-late

http://git.kernel.org/cgit/linux/kernel/git/firmware/linux-firmware.git/commit/?id=8d1fd61a3723ab8cb6b7bfeb8be38e16282cc1ed

http://git.kernel.org/cgit/linux/kernel/git/firmware/linux-firmware.git/commit/?id=c4f6a36d694bc4dbaeb6c9edae4889b4af2659ce

tool: GOPupd

As I’ve mentioned, I don’t know much about the firmware modding community. It is amazing the things they can do to a system, in ways completely unrelated to security. 🙂 But other readers of this blog are accomplished firmware modders, and one of the smarter ones have suggested a new tool to mention on the blog:  GOPupd.

UBU has already been mentioned in previous blog posts, it was done by the win-raid.com forum members, as is this other tool. GOPupd is also hosted on the win-raid.com forum by one if it’s members, LordKAG, who you may have noticed as one of source of many of UEFItools bug reports.

GOPupd is a tool that updates a GOP portion of VideoBIOS dumped from various AMD/ATI and Nvidia graphic cards.  Advanced users can use the tool to not only dump, but also can insert a GOP into a VBIOS without it, basically making an older GPU compatible to pure UEFI (non-CSM) mode. That sounds like a risky operation, but it appears that many readers of this blog are smarter than the writer of this blog, so I presume a few of you would be able to handle this, I’m not sure I would. 🙂 The tool is written in Python. You have to register to the forum to get access to their download URLs.

[…] If you are interested in this thread, then you should know a thing or two about GOP. If you need/want pure UEFI Boot (CSM disabled) or Fast Boot, then you need a GOP for your GPU/iGPU, otherwise it is optional (for now). For the iGPU side there is not much you can do, because manufacturers have included them in the UEFI firmware, with GOP drivers from Intel, AMD, ASPEED, Nvidia (recently) and even Matrox. This thread only deals with external cards and only with AMD and Nvidia. This is further limited by the fact that only specific generations have GOP support: for AMD there is a list of IDs in each GOP version, but it is safe to assume that every card after 7xxx generation should work, maybe even 6xxx; for Nvidia there are 6 generations supported – GT21x, GF10x, GF119, GK1xx/GK2xx, GM1xx, GM2xx. […]

http://www.win-raid.com/t892f16-AMD-and-Nvidia-GOP-update-No-requests-DIY.html
http://www.win-raid.com/u369_lordkag.html

Apple, FBI, Security Enclaves, and firmware

Security Enclave was first described in the Apple iOS Security Guide, listed below.

Apple updates iOS Security Guide

Apple can comply with the FBI court order

https://www.quora.com/What-is-Apple%E2%80%99s-new-Secure-Enclave-and-why-is-it-important

LDRAlite added to ARM updated DS-5

ARM DS-5 Development Studio Extends Support for Functional Safety with LDRA’s MISRA Compliance Tools

Cambridge, UK, Feb. 23, 2016 – ARM today announced the integration of industry-leading MISRA (Motor Industry Software Reliability Association) conformance tools into the ARM® DS-5 Development Studio tool suite. The addition of a MISRA-checking capability to its TÜV-certified ARM Compiler and safety qualification kit makes DS-5 the ideal software development platform for ARM-based products in use in safety-critical markets such as automotive, healthcare and industrial automation. LDRAlite™ for ARM DS-5 software is supplied by LDRA, a member of the MISRA Standards Committee. The company has been providing industry safety expertise for markets including avionics, automotive, medical, industrial, and rail for more than 40 years. The LDRAlite tool will be a key enabler for developers creating functional safety applications with the DS-5 Development Studio as it enables compliance with functional safety standards including ISO 26262 and IEC 61508. These standards, used widely in safety-critical applications in the automotive and industrial markets, recommend the use of the MISRA programming guidelines for C/C++ to improve software product quality, consistency, clarity, and maintainability. To achieve MISRA compliance in these safety-critical markets cost-effectively, the LDRAlite MISRA checker automates the process of analyzing code to ensure adherence to the guidelines in the standard, saving time, energy and money compared with traditional manual inspection methods. LDRAlite strengthens the ARM-based functional safety qualification kit by augmenting the DS-5 TUV certified compiler and simplifying the end-product certification process. LDRAlite will be included with DS-5 starting from version 5.24 as a 30-day evaluation and can be converted to a full license through LDRA.

http://www.arm.com/about/newsroom/arm-ds-5-development-studio-extends-support-for-functional-safety-with-ldras-misra-compliance-tools.php
http://www.ldra.com/en/company/technology-partners/toolintegration/27
http://www.ldra.com/en/company/event/event?ident=258

Microsoft EMET pre-5.5 exploitable

Microsoft Releases Update for EMET

US-CERT is aware of a vulnerability in Microsoft Enhanced Mitigation Experience Toolkit (EMET) versions prior to 5.5. Exploitation of this vulnerability may allow a remote attacker to bypass or disable EMET to take control of an affected system. US-CERT recommends users and administrators visit the Microsoft Security TechCenter and upgrade to EMET version 5.5.

https://technet.microsoft.com/en-us/security/jj653751
https://www.fireeye.com/blog/threat-research/2016/02/using_emet_to_disabl.html
https://www.us-cert.gov/ncas/current-activity/2016/02/23/Microsoft-Releases-Update-EMET

Linux UEFI systemd patch goes upstream

The Linux patch that protects from EFI and systemd is going upstream:

https://news.ycombinator.com/item?id=11152880

Merge branch ‘x86-urgent-for-linus’ of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull x86 fixes from Ingo Molnar:

“This is unusually large, partly due to the EFI fixes that prevent accidental deletion of EFI variables through efivarfs that may brick machines.  These fixes are somewhat involved to maintain compatibility with existing install methods and other usage modes, while trying to turn off the ‘rm -rf’ bricking vector.

Other fixes are for large page ioremap()s and for non-temporal user-memcpy()s”

* ‘x86-urgent-for-linus’ of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  x86/mm: Fix vmalloc_fault() to handle large pages properly
  hpet: Drop stale URLs
  x86/uaccess/64: Handle the caching of 4-byte nocache copies properly in __copy_user_nocache()
  x86/uaccess/64: Make the __copy_user_nocache() assembly code more readable
  lib/ucs2_string: Correct ucs2 -> utf8 conversion
  efi: Add pstore variables to the deletion whitelist
  efi: Make efivarfs entries immutable by default
  efi: Make our variable validation list include the guid
  efi: Do variable name validation tests in utf8
  efi: Use ucs2_as_utf8 in efivarfs instead of open coding a bad version
  lib/ucs2_string: Add ucs2 -> utf8 helper functions

https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=0389075ecfb6231818de9b0225d3a5a21a661171

OpenREIL

Dmytro Oleksiuk has a project called OpenREIL, an open source library and tools for Reverse Engineering Intermediate Language (REIL).

REIL was initially developed by Zynamics as part of their BinNavi framework, proprietary code analysis software written in Java. […] However, after Zynamics was acquired by Google they abandoned BinNavi, so, I decided to develop my own implementation of REIL. I made it relatively small and portable in comparison with original, the translator itself is just a single library written in C++, it can be statically linked with any program for static or dynamic code analysis. The higher level API of OpenREIL is written in Python, so, it can be easily utilized in plugins and scripts for your favourite reverse engineering tool (almost all modern debuggers and disassemblers has Python bindings). OpenREIL is not a 100% compatible with Zynamics REIL, it has the same ideology and basics, but there’s some changes in IR instruction set and representation of the traget hardware platform features. […]

https://github.com/Cr4sh/openreil

AMI adds Linux Ext2/Ext4 support to Aptio

AMI has Linux file system support in their UEFI implementation! I hope ZFS is also on AMI’s radar. 🙂

American Megatrends Adds Support for EXT(x) File System in Aptio V

American Megatrends Inc. (AMI) is offering EXT(x) file system support in Aptio V, an additionally licensed component driver. File systems keep track of information on storage mediums and there are various file systems that are used by different operating systems such as Windows and Linux. Normally at the UEFI firmware level, the legacy FAT (File Allocation Table) file system is supported. In order to overcome limitations of early file systems, the Linux community created the EXT file system. Over time, the EXT filesystem has gone through four revisions (EXT, EXT2, EXT3 and EXT4) and is specifically designed to improve storage space and performance. Support for different file systems has been added to Aptio over time and the EXT(x) file system joins as the newest addition. With the new support for EXT(x) drivers, any EXT(x) formatted media can be accessed by the UEFI firmware. This addition allows for files to be read and UEFI programs to be executed from EXT(x) media. Customers have the ability to develop pre-boot applications without having to provide a separate FAT file system, making the process simpler and more seamless. The new EXT(x) driver is designed to be read-only to support all EXT versions and to maintain filesystem integrity.

http://ami.com/products/bios-uefi-firmware/aptio-v/
http://ami.com/news/press-releases/?PressReleaseID=352

Open Connectivity Foundation

In the battle for IoT industry trade group standards, there is a new player, the Open Connectivity Foundation (OCF).

Home

https://blogs.intel.com/evangelists/2016/02/19/a-significant-step-toward-seamless-connectivity/
https://newsroom.intel.com/chip-shots/chip-shot-industry-leaders-take-significant-step-toward-iot-connectivity/

https://blogs.windows.com/windowsexperience/2016/02/19/new-open-connectivity-foundation-will-further-innovation-of-the-internet-of-things/
http://blogs.microsoft.com/iot/2016/02/19/microsoft-supports-open-connectivity-foundation-to-advance-innovation-in-the-internet-of-things/
https://blogs.microsoft.com/firehose/2016/02/19/microsoft-among-founding-members-of-new-organization-to-accelerate-industry-innovation-for-the-internet-of-things/
https://blogs.microsoft.com/iot/2015/04/14/simplifying-iot-connectivity-in-manufacturing/
https://blogs.microsoft.com/iot/2016/02/08/growing-partner-opportunities-in-the-internet-of-things/

Strange, if I put the below URL — CFF’s initial press release — anywhere earlier in the text, WordPress.com will truncate all subsequent content after that URL, so this URL has to be listed last.

http://openconnectivity.org/news/open-connectivity-foundation-brings-massive-scale-to-iot-ecosystem

OSHUG #46 — Embedded Platforms

Who: Open Source Hardware User Group
What: Event #46 — Embedded Platforms (BSD, OpenWRT, Plan 9 & Inferno)
When: 17 March 2016, 18:00 – 20:00
Where: BCS London, 1st Floor, The Davidson Building, 5 Southampton Street, London, WC2E 7HA

The forty-sixth OSHUG meeting will take a look at embedded platforms, with talks on the BSD family of operating systems, Linux and OpenWRT, and Plan 9 and Inferno in distributed systems.

The BSD Family of Operating Systems:
A familiar environment for your VAX, PIC32 or RISC-V ISA and many other platforms. The Berkeley Software Distribution started out as a patch set to AT&T UNIX in the 70’s and grew to a complete Operating Systems. Today several projects continue to develop variant operating systems based on the work originally started by the Computer Science Research Group, each with a different area of focus. This presentation will cover some of the benefits these operating systems can offer to aid the workflow of a hardware project.

Developing Linux based products in the connected devices ecosystem — The OpenWRT Approach:
Linux is accepted as a standard component of the Internet of Things domain. With the abundance of development platforms and the abhorrent state of vendor provided SDKs, getting started with and more importantly the maintenance of Linux powered devices is pretty much a dark art these days. This talk focuses on the mass market hardware platforms of interest to folks building the Next Great IoT ProductTM and how the development could be sped up with OpenWRT. To supplement the topic of product development, a couple of noteworthy System-on-Chip devices and how they could be adopted will also be discussed.

Embedded devices are often now part of a distributed system: my Pebble watch is linked to my Nexus phone, which is coupled to Google.
Plan 9 and Inferno are two distributed systems originally developed by the Bell Labs research centre that produced Unix. They allow a single large system to be composed from smaller cooperating systems performing specific tasks. (In other areas they illustrate an alternative time line that diverged from strict adherence to Unix’s details of the 1970’s.) Distributed systems infrastructure often focuses on algorithmic aspects, such as Paxos, and the operating system is largely irrelevant when it is not merely obstructive. Plan 9 and Inferno provide structural support for distribution, at the operating system level. Their defining novelty is the representation of all distributable resources as hierarchical name spaces, which can be composed in useful ways, and simplify design, development, testing and integration. This talk will give a brief summary of both systems, then begin to name names, including their use in embedded appliances in distributed systems.

Full announcement:
http://oshug.org/event/46
http://oshug.org/cgi-bin/mailman/listinfo/oshug

status of MITRE Copernicus

AFAIK, Copernicus was the first firmware vulnerability analysis tool. MITRE’s research in this area is required reading for anyone learning x86 firmware security. But then, half of the 4-person team left MITRE to create LegbaCore, and have since both joined Apple. These days, AFAIK, Copernicus is not actively maintained.  I was not sure of status of MITRE Copernicus (or Copernicus2), so I asked MITRE, and K. Wright, their Public Affairs Lead gave me the current status of Copernicus:

“MITRE continues to research security risks associated with UEFI and firmware. However, development and feature enhancements on the proof-of-concept known as Copernicus is no longer active. Many of the emerging commercial offerings coming to the market show promise similar to what had been demonstrated in Copernicus as an off-the-shelf option.”

More information:

http://www.mitre.org/research/technology-transfer/technology-licensing/copernicus

 

Without fresh builds of Copernicus, Intel CHIPSEC is probably the main (only?) firmware vulnerability analysis tool actively maintained. It would be nice if there were a few other tools, ESPECIALY for non-Intel systems: ARM, AMD, MIPS, OpenPOWER, etc. I wish MITRE would open source their PoC so the open source community could help maintain/extend it (eg., port it to Linux).

Vincent Zimmer on the x-UEFI configuration language

Vincent Zimmer of Intel has a new blog post, explaining how UEFI’s HII user interface stuff works:

[…] The The x-UEFI configuration language is now a reality. The latest keywords can now be found at http://uefi.org/confignamespace.  This list should grow over time as more configuration data emerges based upon new platform technologies, features in the UEFI and other industry standards, etc. This type of facility helps provide infrastructure to provide visibility into ‘Is Features XYZ enabled.” A common instance of this is virtualization technology, hyper threading, and other art managed by the platform. Going forward, I can imagine OS viewer utilities, maybe /dev/hii in Linux and an associated Microsoft Windows interface, to exposing this information. The EDKII community on tianocore.org ought to investigate some simple shell applications to export the information, too. […]

Full blog post:

http://vzimmer.blogspot.com/2016/02/firmware-configuration-or-is-feature.html

The config namespace already has dozens of variables:

http://uefi.org/confignamespace

http://www.uefi.org/namespace_instructions

I am looking forward to someone writing a security test tool that works with this database. 🙂

 

Embedded Linux Conference

The Linux Foundation’s Embedded Linux Conference (ELC)  — and OpenIOT — agenda has just been published:

http://events.linuxfoundation.org/events/embedded-linux-conference/program/agenda

There are multiple IoT security-related talks. I see one firmware-related talk, from Intel Israel, on use of UEFI Secure Boot on IoT Things:

http://openiotelc2016.sched.org/event/6DAz/iot-devices-secure-boot-and-sw-maintenance-igor-stoppa-intel-otc?iframe=no&w=i:100;&sidebar=yes&bg=no

Hardware Startups have no concept of security

Someone needs to help slap the ecosystem that is spitting out Hardware Startups. They are completely ignoring security. Hardware Workshop is an example, look at how security is missing from their training:

 

Hardware Workshop is a series of two day workshops for hardware startup founders. Taught by experienced builders our purpose is simple: help founders build better companies. We started Hardware Workshop as a side project three years ago to give back to the startup community. Being hardware entrepreneurs ourselves we understood and appreciated the challenges in turning an idea into a successful startup. We are humbled to have helped over 1K hardware startups with their journey.

What Is Taught?
Each workshop varies slightly in content depending on the teachers available, but we generally teach key lessons from idea to shipping a successful product. The topics we generally cover include:

    Hardware Product Development Process
    Prototyping, Prototyping, Prototyping
    Launching A New Product
    Building Press Relationships
    Picking a Supplier
    IP and Patents
    Certifications
    Funding A Hardware Startup
    Building An Initial Team
    Consumer Distribution
    B2B Distribution
    Founder Panel

Thank you!

Also see agenda for the other related event:

HardwareCon

If you know these entrepreneurs, please help the IoT by getting security added to these agendas.