Category: Uncategorized

IBV Sage Engineering

~ hucktech ~ Leave a comment

A while ago, the web site for Sage Electronic Engineering LLC went down.

I notice in recent Phoronix post it mentions that Sage went out of business:

https://www.phoronix.com/scan.php?page=news_item&px=AMD-Zen-Will-It-Coreboot

I’m unclear when they stopped operations, perhaps last July, when Jeff left?

Jeff Thomas leaves Sage Engineering

This is a damn shame, they were a very open source-friendly IBV, now there are none. I had the chance to meet their CTO when they were at the Intel Minnowboard booth at LinuxFestNorthWest.org. I hope they re-emerge and continue providing open source-friendly IBV services.

https://www.linkedin.com/company/sage-electronic-engineering

http://iotsolutionsalliance.intel.com/member-roster/sage-electronic-engineering-llc

http://wiki.minnowboard.org/SageBIOS

http://web.archive.org/web/*/http://www.se-eng.com/

Open Hardware Summit 2016 date announced

~ hucktech ~ Leave a comment

The date/location for the 2016 Open Hardware Summit has been announced:

October 7, 2016

Portland, Oregon

Here’s their definition of Open Source Hardware:

Definition (English)

Drew has a new blog post on why OSH matters:

Open Source Hardware (OSHW), why it matters and what is pseudo OSHW

I wonder why (OSHWA, Linux Foundation, FreeBSD Foundation, Free Software Foundation) isn’t involved with local communities like Hackster, focusing on OSH subset of hardware (and the FSF definition of Free Hardware), and work on crowdfunding of new devices with these projects, perhaps as Open Compute Projects, not just random ‘blinky lights’ artsy ‘open hardware’. Maybe the enterpreneurs that run Hackster should get involved, projects for them, and may be able to help with this cat herding problem with their platform, perhaps in conjunction with CrowdSupply…

https://www.hackster.io/

Whole Library (or Program) LLVM

~ hucktech ~ Leave a comment

Tristan Ravitch has a nice tool on github called Whole Program LLVM, or WWLVM (Whole Library LLVM), and talks about it in a recent blog post, using it to find defects in libOTR. From the github readme:

“WLLVM provides tools for building whole-program (or whole-library) LLVM bitcode files from an unmodified C or C++ source package. It currently runs on *nix platforms such as Linux, FreeBSD, and Mac OS X. WLLVM provides python-based compiler wrappers that work in two steps. The wrappers first invoke the compiler as normal. Then, for each object file, they call a bitcode compiler to produce LLVM bitcode. The wrappers also store the location of the generated bitcode file in a dedicated section of the object file. When object files are linked together, the contents of the dedicated sections are concatenated (so we don’t lose the locations of any of the constituent bitcode files). After the build completes, one can use an WLLVM utility to read the contents of the dedicated section and link all of the bitcode into a single whole-program bitcode file. This utility works for both executable and native libraries. Currently, WLLVM works with either clang or the gcc dragonegg plugin. This two-phase build process is necessary to be a drop-in replacement for gcc or g++ in any build system. Using the LTO framework in gcc and the gold linker plugin works in many cases, but fails in the presence of static libraries in builds. WLLVM’s approach has the distinct advantage of generating working binaries, in case some part of a build process requires that. […]”

Hacking for Charity: Automated Bug-finding in LibOTR

https://github.com/travitch/whole-program-llvm

This project is not new, I just noticed it. 🙂 It isn’t Avatar/S2E, but it also interesting. I wonder if anyone is using this to test virtualized versions of coreboot, U-Boot, UEFI, SeaBIOS, and other firmware code?

User Mode Linux: security improvements

~ hucktech ~ Leave a comment

Nice to see UML getting more security!

https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=4f31d774dd5239e563f22ffe1403292414e6f779

http://user-mode-linux.sourceforge.net/

https://git.kernel.org/cgit/linux/kernel/git/rw/uml.git/log/?h=linux-next

Google Ubiquity and IoT security

~ hucktech ~ Leave a comment

Google’s Ubiquity Dev Summit just ended, some of the video is online. There is one talk on IoT security:

https://ubiquity.withgoogle.com/

https://ubiquity.withgoogle.com/stream

https://ubiquity.withgoogle.com/schedule

“Brillo has a defense-in-depth strategy to device security built around verified boot, software fault isolation, and field updates of devices. Paul Covell explains the architecture of each of these mechanisms and how they work together to help Brillo devices be more resistant to exploit and create mechanisms for recovery if an exploit occurs.“

Intel updates SGX documentation

~ hucktech ~ Leave a comment

https://twitter.com/aionescu/status/686664051582210049

https://software.intel.com/en-us/isa-extensions/intel-sgx

Click to access 319433-022.pdf

Click to access 329298-002.pdf

https://software.intel.com/en-us/sgx-sdk/documentation
https://software.intel.com/en-us/sgx-sdk-support/documentation

Click to access Software-Guard-Extensions-Enclave-Writers-Guide.pdf

Click to access Intel-SGX-SDK-Users-Guide-for-Windows-OS.pdf

Click to access Intel-SGX-SDK-Release-Notes-for-Windows-OS.pdf

Click to access Intel-SGX-SDK-Installation-Guide-for-Windows-OS.pdf

Alas, Windows only, no Linux or FreeBSD release, AFAICT. 😦

 

Nikcon camera firmware tools

~ hucktech ~ Leave a comment

https://github.com/simeonpilgrim/nikon-firmware-tools
https://nikonhacker.com/wiki/Main_Page#Firmware_information
https://nikonhacker.com/index.php

Tools used during the reversing of the Nikon D5100, D7000 firmware.
This site is primary files hosting service used for Nikon Hacker team efforts.
The forums are at NikonHacker.com Forums
The main wiki we use is at hosted on NikonHacker.com Wiki
The online patch tool is hosted Online Patch Tool

Clang hardening

~ hucktech ~ Leave a comment

While improving the documentation (d’oh!) of our home grew obfuscator based on LLVM, we wrote a cheat sheet on clang’s hardening features, and some of ld ones. It turns out existing hardening guides generally focus on GCC, while Clang also has an interesting set of hardening features. So let’s share it in this blog post!
Note0: Everything in this post is based on Clang/LLVM 3.7
Note1: Debian provides a very interesting hardening guide here: https://wiki.debian.org/Hardening
Note2: This post does not cover the use of Asan. Unlike the options presented here, it’s unlikely to go into release build, rather in debug builds.

http://blog.quarkslab.com/clang-hardening-cheat-sheet.html

Virt-Manager updated with UEFI (OVMF/AVMF) support

~ hucktech ~ Leave a comment

Virt-Manager, as of 1.2, has support for UEFI’s OVMF/AVMF format!

http://www.phoronix.com/scan.php?page=news_item&px=UEFI-OVMF-Virt-Manager-1.2
http://blog.wikichoon.com/2016/01/uefi-support-in-virt-install-and-virt.html
http://www.phoronix.com/scan.php?page=news_item&px=Virt-Manager-1.2-Released
https://www.redhat.com/archives/virt-tools-list/2015-May/msg00010.html
https://virt-manager.org/

I missed this news, but luckily Phoronix did not…

BTW, Virt-Manager is a SPICE client, and UEFI has some SPICE support. I don’t know what that means, I’ve been meaning to learn… 🙂 There is information on this in the below OVMF whitepaper:

http://www.spice-space.org/
http://www.linux-kvm.org/downloads/lersek/ovmf-whitepaper-c770f8c.txt

bunnie seeking feedback on lowRISC usage

~ hucktech ~ Leave a comment

Quoting bunnie’s forum post:
It’s not quite got the specs to make a decent laptop — it’s missing graphics and SATA. The effective performance of a system built around this would feel much more sluggish than a Novena, which means it’ll be tough to use on a daily basis for productivity work. It does have tagged memory and minion cores, which means it’ll be great for security and some types of I/O; but there is no integrated Ethernet controller, so application in network stacks is limited. It is also going to be the first open-to-the-RTL processor you can buy, so maybe despite the limitations some people would prefer to use it as a primary computing solution, but wondering if there aren’t other niches this can occupy.

http://www.kosagi.com/forums/viewtopic.php?pid=2556
https://twitter.com/hashtag/lowRiscWish?src=hash

RISC-V/LowRISC update

~ hucktech ~ Leave a comment

The recent RISC-V workshop is over, presentations are online, videos are not yet online:

http://riscv.org/workshop-jan2016.html
http://riscv.org/

RISC-V and coreboot:

Click to access Tues1345%20riscvcoreboot.pdf

RISC-V and UEFI:

Click to access Tues1415%20RISC-V%20and%20UEFI.pdf

There is some post-workshop coverage here:
https://blog.riscv.org/2016/01/3rd-risc-v-workshop-presentations-breakouts/
http://www.lowrisc.org/blog/2016/01/third-risc-v-workshop-day-one/
http://www.lowrisc.org/blog/2016/01/third-risc-v-workshop-day-two/

Why I will be using RISC-V in my next chip


http://www.eetimes.com/document.asp?doc_id=1328620&

LowRISC, a related project to RISC-V is also making progress. From the below EE Times article:

“The LowRISC project at the University of Cambridge is attracting interest as the likely first source of real development hardware. The team which includes members of the Raspberry Pi project hopes to have first silicon this year and plans to make development boards available in 2017, likely for $50-100.”

http://www.lowrisc.org/

http://www.eetimes.com/document.asp?doc_id=1328620&

I missed this news, it is interesting to see Google, HP, and Oracle getting involved with RISC-V.

http://www.eetimes.com/document.asp?doc_id=1328561&

 

Intel Skylake bug

~ hucktech ~ Leave a comment

Don’t do any “complex workloads” on your Skylake boxes until you get a BIOS update…

https://communities.intel.com/mobile/mobile-access.jspa#jive-content?content=%2Fapi%2Fcore%2Fv3%2Fcontents%2F524553

BIOS updates on the way to fix problem says Intel

Four days ago Intel reported that its engineering department had identified the issue which “only occurs under certain complex workload conditions… [when] the processor may hang or cause unpredictable system behaviour”. It has released a fix for the issue to hardware partners which will be distributed via BIOS updates for Skylake compatible motherboards. Now users will just have to wait for their motherboard vendors to publish BIOS updates with the Intel fix incorporated.

Full story:

http://hexus.net/tech/news/cpu/89636-intel-skylake-bug-seizes-pcs-running-complex-workloads/

You might want to check here for updates from Intel-based devices:

https://security-center.intel.com/SearchResults.aspx

interview with AMI founder, Subramonian Shankar

~ hucktech ~ Leave a comment

http://www.basicinputoutput.com/2016/01/must-see-tvs-shankar.html

As reported by William Leara, a BIOS engineer at Dell, the “This Week In Tech” (TWIT episode 226) podcast did an inteview with Mr. Subramonian Shankar, founder of AMI in November. Excerpting from William’s blog post:

The interview discusses everything from how Shankar started AMI, to what he’s up to today, with lots of colorful anecdotes along the way.  I especially appreciated all the old Michael Dell stories, among other great stories.  It turns out Dell Inc. and AMI were allies from their infancy and helped each other grow to be the large, successful companies they are today.  It was also interesting to hear about the new Android products AMI is working on, especially AMIDuOS—and it’s only $10!

https://twit.tv/shows/triangulation/episodes/226?autostart=false

U-Boot and UEFI at Seattle Hardware Startups event

~ hucktech ~ Leave a comment

The January 2016 Seattle Hardware Startups event will be firmware focused, hosted by our local group, the Pacific NorthWest FirmWare Hackers (PNWFWH), topics will be on U-Boot and UEFI, Meetup announcement below. If you are in the Seattle area later this month, drop by!

http://www.meetup.com/Seattle-Hardware-Startups/events/227429885/

What: Seattle Hardware Startup: Kirkland Edition
When: Thursday, January 28, 2016, 6:00 PM to 8:00 PM
Where: Nytec Innovation Center, 416 6th Street South, Kirkland, WA

This month we are welcoming Pacific NorthWest FirmWare Hackers. PNWFHW meets randomly at various places, speaking on development and security topics of modern system firmware (UEFI, U-Boot, core boot, etc.). I am pleased to have them lead an event for us.

Speakers:

1. The first speaker is Emergency Mexican (his DEF CON goon nym). He works at a local hardware startup working on ARM32 systems. He’ll be speaking on using building custom payloads with the U-Boot boot loader.

2. The second speaker is Vincent Zimmer, a senior principal engineer at Intel, working on UEFI. Vincent chairs the UEFI Forum network and security subteams. Vincent will talk about the latest updates in the UEFI specifications for security and networking. He’ll also discuss open source community updates.

Please RSVP early so we call the pizza man and make proper arrangements.

Adam
PS: Did you know that January 15th is Hardware Freedom Day?
http://www.hardwarefreedomday.org/main/about.html

Code available for new rowhammer research

~ hucktech ~ Leave a comment

More on this recent research:

Skylake and Rowhammer

https://github.com/IAIK/rowhammerjs/tree/master/native

The source is a single C++ file (not Javascript, like the Github project name hints at), built targets for Sandy/Ivy/Haswell/Skylake, works on 64-bit Linux. Usage:

# ./rowhammer[-architecture] [-t nsecs] [-p percent] [-c cores] [-d dimms] [-r row] [-f first_offset] [-s second_offset]
    ”-c” the number of cores (only important with ”#define EVICTION_BASED”)
    ”-p” percent of memory to use
    ”-d” number of dimms (very important)
    ”-r” loop only over the specified row
    ”-f” only test addresses with the specified first aggressor offset
    ”-s” only test addresses with the specified second aggressor offset

 

 

Intel on Intel SGX enclaves

~ hucktech ~ Leave a comment

https://twitter.com/intelswfeed/status/685961977324265472

 

Intel SGX: Debug, Production, Pre-release what’s the difference?

Simon Johnson, Dan Zimmerman, and Derek B., all of Intel, presumably on the Intel SGX team, posted a new article on the Intel blog, on Intel SGX.

Since release the SDK we’ve had a few questions about debug vs pre-release vs release mode (production) enclaves. Part of the security model of Software Guard Extensions is to prevent software from peaking inside and getting at secrets inside the enclave… but no-one writes perfect code the first time round; so how do you debug an enclave?
[…]

Full post:

https://software.intel.com/en-us/blogs/2016/01/07/intel-sgx-debug-production-prelease-whats-the-difference

 

Intel Memory Encryption Engine (MEE)

~ hucktech ~ Leave a comment

https://drive.google.com/file/d/0Bzm_4XrWnl5zOXdTcUlEMmdZem8/edit?pref=2&pli=1

Real World Cryptography Conference 2016
6-8 January 2016, Stanford, CA, USA
Intel® Software Guard Extensions (Intel® SGX)
Memory Encryption Engine (MEE)
Shay Gueron
Intel Corp., Intel Development Center, Haifa, Israel
University of Haifa, Israel

Skylake and Rowhammer

~ hucktech ~ Leave a comment

 

Reverse Engineering Intel DRAM Addressing and Exploitation
Peter Pessl, Daniel Gruss, Clémentine Maurice, Michael Schwarz, Stefan Mangard

In this paper, we present a method to reverse engineer DRAM addressing functions based on a physical bus probing. Second, we present an automatic and generic method to reverse engineer DRAM addressing functions merely from performing a timing attack. This timing attack can be performed on any system without privileges and even in virtual machines to derive information about the mapping to physical DRAM channels, ranks and banks. We reversed the complex adressing functions on a diverse set of Intel processors and DRAM configurations. Our work enables side-channel attacks and covert channels based on inner-bank row conflicts and overlaps. Thus, our attack does not exploit the CPU as a shared resource, but only the DRAM that might even be shared across multiple CPUs. We demonstrate the power of such attacks by implementing a high speed covert channel that achieves transmission rates of up to 1.5Mb/s, which is three orders of magnitude faster than current covert channels on main memory. Finally, we show how our results can be used to increase the efficiency of the Rowhammer attack significantly by reducing the search space by a factor of up to 16384.

http://arxiv.org/abs/1511.08756

Intel Curie

~ hucktech ~ Leave a comment

Intel announced Curie back in the Summer:

Arduino 101, an Intel Curie-based device

And they’re doing it again at CES:

https://software.intel.com/en-us/articles/intels-newest-wearable-module-intel-curie
http://www.intel.com/content/www/us/en/wearables/wearable-soc.html

Click to access Intel_CURIE_Module_Factsheet.pdf

Click to access intel-curie-module-fact-sheet.pdf

I still can’t tell you that flavor of firmware it uses, UEFI, BIOS, or something else. If you know, please leave a Comment (see left).