Category: Uncategorized

ACPI 6.1 released

~ hucktech ~ Leave a comment

ACPI v6.1 spec has been released, apparently. I have yet to read it, so not sure what has changed yet.

http://uefi.org/acpi

The UEFI Forum has already started doing EDK-II trunk checkins for 6.1 support for UEFI.

[edk2] [patch] MdePkg: Add ACPI6.1 definition.
Add ACPI 6.1 definitions from the ACPI
Specification Revision 6.1 January, 2016.

MdePkg/Include/IndustryStandard/Acpi61.h | 2375 ++++++++++++++++++++++++++++++
1 file changed, 2375 insertions(+)
create mode 100644 MdePkg/Include/IndustryStandard/Acpi61.h

diff –git a/MdePkg/Include/IndustryStandard/Acpi61.h b/MdePkg/Include/IndustryStandard/Acpi61.h
new file mode 100644

More info:

https://lists.01.org/mailman/listinfo/edk2-devel
.

coreboot update

~ hucktech ~ Leave a comment

coreboot is nearing it’s 4.3 release. Their last post shows stats of project activity for a single week this month, especially 36 contributors, 11 of them new. The week before there were 13 new contributors!

– Total commits: 111
– New authors: 11
– Total authors: 36
– Total lines added: 10885
– Total lines removed: -604
– Delta: 10281

Two new mainboards – the Google Tidus board (Lenovo ThinkCentre Chromebox), and the Purism Librem 13 laptop are added.

There’s even Ada compiler support added to the toolchain. There are many other changes, not mentioned here, see the full post:

coreboot changelog Jan 20 – Jan 26

NTCTL (NFIT Defined Control) tests added to LUV

~ hucktech ~ Leave a comment

Megha Dey of Intel just checked in a 5-part patch to the LUV project, adding a new NDCTL (NFIT Defined Control) test suite to LUV.

This patchset adds the NDCTL(NFIT Defined Control) test suite to LUV. Apart from the recipe, it updates the Linux kernel headers, adds the related binaries and a parser to the final LUV image.It addresses issue 58. We also compile and install the required kernel modules for running the  NDCTL test suite and add the configurations needed by the NDCTL testsuite as config fragments to the default config values from v4.4 kernel. A Non-Volatile DIMM (NVDIMM), is a module that can be integrated into the main memory of a compute platform, perform workloads at DRAM speeds, yet be persistent & provide data retention in the event of a power failure or system crash. The LIBNVDIMM subsystem provides block device drivers for three types of NVDIMMs namely nd_pmem (NFIT enabled version of existing ‘pmem’ driver), nd_blk (mmio aperture method for accessing persistent storage) and nd_btt(give persistent memory disk semantics)that can simultaneously support both PMEM and BLK mode access. The NVDIMM Firmware Interface Table (NFIT) numerates persistent memory ranges, memory-mapped-I/O apertures, physical memory devices (DIMMs), and their associated properties. Prior to the arrival of the NFIT, non-volatile memory was described to a system only using a single system-physical-address range where writes are expected to be durable after a system power loss. Now, the NFIT specification standardizes not only the description of PMEM, but also BLK and platform message-passing entry points for control and configuration. The NDCTL test suite has 5 tests in total divided into 2 sets of tests: One uses the manufactured NFIT (NVDIMM Firmware Interface Table) to build the nfit_test module as an external module and arrange for the external module replacements of nfit, libnvdimm, nd_pmem, and nd_blk and the other which has the actual *destructive* tests that create namespaces and perform I/O tests on them.

  luv: NDCTL:  Update the linux kernel headers
  core-image-efi-initramfs: Add NDCTL binaries
  luv-test-manager: Add stderr output to LUV parser
  luv : NDCTL: Add NDCTL test suite
  linux-efi-yocto-test: build NDCTL test suite

More info:
https://github.com/01org/luv-yocto/issues/58
https://www.kernel.org/doc/Documentation/nvdimm/nvdimm.txt

Click to access ACPI_6.0.pdf

https://github.com/pmem/ndctl
http://permalink.gmane.org/gmane.linux.kernel.commits.head/535671
https://lists.01.org/mailman/listinfo/luv
https://lwn.net/Articles/640891/

LUV/BITS/CHIPSEC ported from x64 to x86!!

~ hucktech ~ Leave a comment

Get ready to test your Intel x86 systems!

Megha Dey of Intel submitted an 8-part patch to LUV that enables it to build on x86.

LUV has been useful for 64-bit x64 systems, and now is getting useful for 32-bit x86 systems!

Including 32-bit versions of BITS and CHIPSEC!

Is this the first time that pre-compiled binaries of CHIPSEC for x86 systems have been available? Not sure. Anyway, if you build from source you can start now, otherwise, look for the LUV-live binary download site to start having 32- and 64-bit versions, hopefully

Excerpt from part 0 of the patch:

[PATCH 0/8] Build and run LUV on 32 bit platforms

Currently LUV can be built only for 64 bit target platforms. This patchset contains patches which make sure that LUV can be compiled and run on both 32 as well as 64 bit target platforms. This required reworking of the PE header checks, adding call wrappers used by the shim bootloader to store and restore context, making sure chainloader.c compiled for 32 bit systems, adding support to ensure correct direct directory structure for 32 bit case and removing bugs in chipsec so that it could build without any erros on 32 bit systems. Also, the bits recipe is updated to build the grub EFI image only for target builds.This patchset addresses the following issue:
https://github.com/01org/luv-yocto/issues/57

grub: chainloader: shim: rework PE header checks
grub: shim: Add call wrappers for 32 bit systems
grub: shim: compile chainloader.c for 32bit system
luv : Correct directory structure for 32 bit case
luv: Add the ARCH parameter to chipsec Makefile
luv: chipsec : compile for 32 bit systems
bits: only build grub EFI image for target builds
bits: grub: specify location of images and modules for mkimage

More information:

https://lists.01.org/mailman/listinfo/luv

Libreboot introduction and Lenovo X60/X200 tutorial

~ hucktech ~ Leave a comment

There’s a talk from Kyle Rankin of Final Inc, on using Libreboot. It covers coreboot, Intel ME, Intel AMT, and covers replacing Lenovo X60 and X200 firmware with Libreboot, as well as covering use of Arduino as part of the reflashing solution.

https://twitter.com/lordbaco/status/691711050727702532

http://greenfly.org/talks/security/libreboot.html

https://github.com/bibanon/Coreboot-ThinkPads/wiki/Hardware-Flashing-with-Raspberry-Pi

VirusTotal now targets firmware

~ hucktech ~ Leave a comment

http://blog.virustotal.com/2016/01/putting-spotlight-on-firmware-malware_27.html

http://www.pcworld.com/article/3027433/security/googles-virustotal-now-picks-out-suspicious-firmware.html

In related news, Teddy Reed’s UEFI Firmware Parser has been recently updated:

https://github.com/theopolis/uefi-firmware-parser

REcon2015 CHIPSEC video online

~ hucktech ~ Leave a comment

Video of the Intel CHIPSEC team from 2015’s REcon is now online.

Intel ATR posts RECon and CSW presentations

Recon 2015 presentation on firmware security available

 

VMware

~ hucktech ~ Leave a comment

Business changes at EMC, impacting VMWare, multiple news sites with stories on it.

 

http://fortune.com/2016/01/26/vmware-charge-changes-cfo/

http://www.wsj.com/articles/vmware-names-new-cfo-will-cut-800-jobs-1453847929

http://www.theregister.co.uk/2016/01/27/vmware_fusion_and_workstation_development_team_fired/

http://www.computerworld.com/article/3026842/virtualization/vmware-cuts-800-jobs-as-it-transitions-from-older-blockbuster-compute-products.html

 

HardwareCon

~ hucktech ~ Leave a comment

HardwareCon3 is happening this March. It is a conference for hardware startups:

http://www.hardwarecon.com/hardwarecon-2016-the-future-of-hardware/
http://www.hardwarecon.com/schedule-2/full-schedule/
https://www.eventbrite.com/e/hardwarecon-2016-tickets-15904516838?discount=meetup15
http://www.hardwarecon.com/

[…] “As the hardware revolution has matured, startups can no longer rely on first to market and record breaking crowdfunding campaigns to help establish a business.  Competition has rapidly expanded and once revolutionary new products are fast becoming commodity.  But new sub-sets of markets are simultaneously arising – “enchanted objects” and new M2M devices are just starting to see mass adoption and are opening whole new markets.  At the request of hardware entrepreneurs and last year’s participants, HardwareCon 2016 is expanding this year to include a Hardware University day at its start on Friday March 4th in addition to the expert advice and hard data provided to participants at HardwareCon.” […]

First to market with insecure product is no longer a reliable tactic? Nice to know! I can’t find anything on security at this conference. I am afraid this is one source of insecure IoT products, or as they like to call them, “enchanted objects”, after the book of the same name. If this conference continues, I hope the 4th/subsequent ones have a track on security.

http://enchantedobjects.com/

FDA draft medical device security guidelines

~ hucktech ~ Leave a comment

Postmarket Management of Cybersecurity in Medical Devices
Draft Guidance for Industry and Food and Drug Administration Staff
DRAFT GUIDANCE
Document issued on: January 22, 2016

From Lexology.com:

Is Your Medical Device Cybersecure? FDA Issues Draft Guidance on Postmarket Cybersecurity in Medical Devices

Recently, the U.S. Food and Drug Administration (FDA) issued draft guidance outlining the agency’s recommendations for Postmarket Management of Cybersecurity in Medical Devices.  The guidance is applicable to medical devices that contain software (including firmware) or programmable logic, as well as software that meets the definition of a medical device.  The guidance does not apply to experimental or investigational medical devices.  Comments on the draft guidance are due by April 21, 2016.

Full story:

http://www.lexology.com/library/detail.aspx?g=0d71435c-cfd5-4e49-8a43-198b9be8558e

 

Henry Newman on Firmware, rootkits, and security

~ hucktech ~ Leave a comment

Henry Newman has a new post on Enterprise Storage Forum about firmware, rootkits and security:

[…] The issue for both of these hacks was that the chain of custody of the firmware was not tracked.
[…] What I think is really meant is that, in most cases, there is a change in the firmware to allow the device to either boot something that is not what you expected or to run something that you did not expect. It could be firmware on the motherboard (which is also called BIOS) or firmware on peripheral equipment such as a storage controller, network or even the disk or SSD drives. So how would you secure a system against an attack on the basic firmware of the system, whether it be from the inside or outside, or a bit of both?
[…] I think as we move forward, it is time to start asking vendors the following questions:
    1. Who develops your firmware?
    2. Where is it developed (country)?
    3. How is the firmware inspected for malicious or bad code?
    4. Is the firmware being developed for the hardware on systems that are connected to the Internet?
    5. Is the firmware managed with secure hashes to ensure it is not perturbed from creation to loading?
[…] Firmware, I believe, is the next frontier in what is going to be attacked given how hard it is to detect bad firmware. Servers, networks, disks and SSD drives are all at risk unless vendors have a way of securing firmware. A secure firmware supply chain for your critical information – whether you are a small business, health care provider or a large multinational trying to protect your IP – is today, and will be tomorrow, a large challenge. […]

Full article:
http://www.enterprisestorageforum.com/storage-technology/rootkits-and-security.html

Shodan: showcasing lack of IoT security

~ hucktech ~ Leave a comment

Charlie Osborne has an article in ZDNet about Shodan a search engine focused on non-existant security IoT:

Shodan: The IoT search engine for watching sleeping kids and bedroom antics

Shodan has made it even easier for our inner voyeur to spy upon the open webcams of homes across the world — but are the ramifications more pronounced than idle surveillance? Launched in 2013, Shodan is a search engine used to find Internet of Things (IoT) connected devices around the world. Webcams, security systems and routers are only some of the devices which, once connected to the Web, can offer a glimpse into our lives behind locked doors should poor security turn the key. Unfortunately, despite a steep rise in home Internet connectivity and the use of connected home devices — from lighting to cameras — and IoT-based vehicles, security comes up short. […]

Full post:
http://www.zdnet.com/article/shodan-the-iot-search-engine-which-shows-us-sleeping-kids-and-how-we-throw-away-our-privacy/

https://www.shodan.io/

Using TPMs in embedded systems

~ hucktech ~ Leave a comment

Stefan Thom (Microsoft), Steve Hanna (Infineon), and Stacy Cannady (Cisco) have an article in Electronic Design on TPM use in embedded systems. If you are new to TPM, this is a nice introduction.

Standardizing Trust for Embedded Systems

It’s time to get more serious about the lack of security in embedded products. With recently developed standards, it’s implementation just got easier. If you haven’t been concerned about malicious players hacking into your products in the past, or haven’t found success with previous efforts, it’s time for renewed attention and action. Hacking efforts aren’t slowing and, in fact, are on the rise. These days, hackers can accomplish far more than ever before—and the repercussions are far more costly. […]

Full article:
http://electronicdesign.com/embedded/standardizing-trust-embedded-systems

IoT security caution/tips for consumers

~ hucktech ~ Leave a comment

The Blogger News Network has an article focused on consumers blindly buying the latest IoT gadgets without thinking about the downsides, and includes some basic tips for users to ask before buying the device, maybe you can use this advice for friends who don’t follow technology:

Pay attention to your IoT Device Security

Wow cool! A device that lets you know, via Internet, when your milk is beginning to sour! And a connected thermostat—turning the heat up remotely an hour before you get home to save money…and “smart” fitness monitors, baby monitors, watches… Slow down. Don’t buy a single smart device until you ask yourself these 10 questions. And frankly, there’s a lot of effort in some of these questions. But, security isn’t always easy. Check it out. […]

Full post:
http://www.bloggernews.net/137438

I hope there are some contrarian entrepreneurs out there, building IoT-free devices…

Rhombus Tech Libre Laptop project

~ hucktech ~ Leave a comment

From FOSDEM, there’s a new laptop for those that care about about Open Source Hardware, and ‘blob’-free devices, to investigate, the Rombus Tech Libre Laptop, based on an Allwinner CPU.

[…] Luke Kenneth Casson Leighton (LKCL), did not give up on the idea, and has kept on working on EOMA68 standard with CPU cards from Allwinner and other SoC vendors. Recently, he’s been working on a Libre Laptop based on an Allwinner A20 EOMA68 CPU module, and will showcase the prototype at FOSDEM 2016 in Brussels this coming week-end. […]

http://rhombus-tech.net/community_ideas/laptop_15in/news/
http://lists.phcomp.co.uk/pipermail/arm-netbook/2016-January/thread.html
http://www.cnx-software.com/2016/01/26/rhombus-tech-15-6-libre-laptop-is-user-upgradeable-with-eoma68-cpu-cards/

ADI’s MinnowBoard Turbot in stock at Mouser

~ hucktech ~ Leave a comment

Mouser is now shipping the Minowboard Turbot, the latest flavor of Minnowboard, from ADI Engineering.

Mouser Electronics, Inc. is now stocking the MinnowBoard Turbot, an enhanced open source development board. The MinnowBoard Turbot, now available from Mouser Electronics, is a powerful and expandable open-source platform that allows endless customization and integration potential. This compact embedded board is compatible with MinnowBoard MAX but adds the higher-performing dual-core Intel® Atom(TM) processor, FCC and CE certification, and designs and features that support commercial usage. With 2GBytes of DDR3L, Intel(R) HD Graphics, micro HDMI, Gigabit Ethernet, USB 3.0 and 2.0, and a Lure expansion board interface, the MinnowBoard Turbot combines robust hardware with support for several different operating systems (including Windows 10, Android 4.4, Debian GNU/Linux, Ubuntu, and Fedora) to help designers develop high-performance embedded applications. […]

http://www.mouser.com/publicrelations_adi_engineering_minnowboard_turbot_2015final/
http://www.mouser.com/new/adi-engineering/minnowboard-turbot/
https://firmware.intel.com/projects/minnowboard-uefi-firmware
http://lists.elinux.org/pipermail/elinux-minnowboard/
http://minnowboard.org/