Category: Uncategorized

HPE Synergy’s Unified API for UEFI and Redfish

~ hucktech ~ Leave a comment

HP, now called HPE, has enhanced firmware/pre-OS support in their new servers, with their Synergy product having a “Unified API” that addresses Pre-OS technologies like Redfish and UEFI. They have a new RESTful API, and a tool for using that API. I am unclear, I think they are related. (I don’t have access to the latest HP hardware to clarify.

More information:
http://www.computerworld.com/article/3010261/servers/hpes-synergy-is-a-new-type-of-composable-infrastructure.html
http://www.theregister.co.uk/2015/12/01/hpe_synergy/
http://www.pcworld.com/article/3010526/hpes-synergy-is-a-new-type-of-composable-infrastructure.html

http://www8.hp.com/us/en/products/servers/proliant/restful-interface-tool.html
https://github.com/HewlettPackard/PowerShell-ProLiant-SDK
https://github.com/HewlettPackard/python-proliant-sdk
http://www8.hp.com/us/en/products/server-software/product-detail.html?oid=7630408
http://www8.hp.com/us/en/products/server-software/product-detail.html?oid=6935826

goofibootm

~ hucktech ~ 1 Comment

[UPDATE: See Comment post (left) from Solus developer Ikey for more info.]

Softpedia notes that there is a Linux distribution called Solus, and it’s latest release supports UEFI, with Solus working on a gummiboot fork (of sorts), called goofibootm:

“As a heads up, we’ve forked gummiboot, the UEFI boot loader for Linux. It should be noted that gummiboot itself is dead upstream, and was ‘merged’ into the systemd tree as systemd-boot. Currently Solus uses gummiboot for UEFI everywhere, and as we need certain behaviours that systemd-boot will not be providing, and we’ve been told categorically it’s not a successor, we’re providing our own successor,” Ikey Doherty said on Google+.

http://news.softpedia.com/news/solus-is-getting-its-own-uefi-boot-loader-forked-from-gummiboot-496716.shtml

From the Solus Beta2 release notes:

“Solus will co-exist with other operating systems using UEFI, and will not add the boot loader to the firmware.”

I had not heard of Solus before reading this news. Apparently, Solus is designed and optimized for the desktop, and they may prefer speed over security, from the Solus web site:

We spend a lot of time optimising Solus to run better, faster, and more efficiently, on the hardware available to our users. Quite famously, we had an Intel NUC booting in 1.089s, using only 178MB of RAM idle on boot. We spend time working heavily on the toolchain, validating binary performance to ensure that you get the best possible experience for the desktop. We spend a significant amount of time on our kernel too […] we’re also going to do hardware-specific builds of Solus in the future. This means we’ll be offering builds of Solus, as an example, that would run exclusively on the Broadwell architecture, or Haswell, etc. These will be immensely optimised, building on all the work we already do, ensuring you’ll be using hardware specific builds of Solus, squeezing every last bit of juice out of that computer of yours (or: getting what you paid for). The upcoming v1 stable release on October 1st will feature a “fast-boot” option in the installer, which will involve the removal of the initrd. This will take the previous record of 1.089s cold boot time, and completely demolish it with a subsecond boot time, which we will make prominently public.

https://solus-project.com/2015/05/17/solus-operating-system-beta-2/

Welcome to Solus Project

It will be interesting to see if goofibootm will become useful to other distros besides Solus. I haven’t checked to see if they have the tummiboot fork or not (which has Intel TXT support). Sigh, too many boot loaders for Linux with different separate security features…

Linux and Secure Boot HOW-TO

~ hucktech ~ Leave a comment

Greig Paul has an article in Linux Journal, a new Security HOW-TO on UEFI Secure Boot.

Take Control of Your PC with UEFI Secure Boot

[..] This article focuses on a single useful but typically overlooked feature of UEFI: secure boot. Often maligned, you’ve probably encountered UEFI secure boot only when you disabled it during initial setup of your computer. Indeed, the introduction of secure boot was mired with controversy over Microsoft being in charge of signing third-party operating system code that would boot under a secure boot environment. In this article, we explore the basics of secure boot and how to take control of it. We describe how to install your own keys and sign your own binaries with those keys. We also show how you can build a single standalone GRUB EFI binary, which will protect your system from tampering, such as cold-boot attacks. Finally, we show how full disk encryption can be used to protect the entire hard disk, including the kernel image (which ordinarily needs to be stored unencrypted). […]

Full article:

http://www.linuxjournal.com/content/take-control-your-pc-uefi-secure-boot

Exploiting Intel DRAM

~ hucktech ~ Leave a comment

Reverse Engineering Intel DRAM Addressing and Exploitation
Peter Pessl, Daniel Gruss, Clémentine Maurice, Stefan Mangard

In this paper, we present a method to reverse engineer DRAM addressing functions based on a physical bus probing. Second, we present an automatic and generic method to reverse engineer DRAM addressing functions merely from performing a timing attack. This timing attack can be performed on any system without privileges and even in virtual machines to derive information about the mapping to physical DRAM channels, ranks and banks. We reversed the complex adressing functions on a diverse set of Intel processors and DRAM configurations. Our work enables side-channel attacks and covert channels based on inner-bank row conflicts and overlaps. Thus, our attack does not exploit the CPU as a shared resource, but only the DRAM that might even be shared across multiple CPUs. We demonstrate the power of such attacks by implementing a high speed covert channel that achieves transmission rates of up to 1.5Mb/s, which is three orders of magnitude faster than current covert channels on main memory. Finally, we show how our results can be used to increase the efficiency of the Rowhammer attack significantly by reducing the search space by a factor of up to 16384.

http://arxiv.org/abs/1511.08756

TRUSTNONE: a TrustZone vulnerability

~ hucktech ~ Leave a comment

https://twitter.com/firewaterdevs/status/670719778252791808

Fire Water has disclosed TRUSTNONE, a TrustZone vulnerability, related to signed comparison on unsigned user input leading to arbitrary read/write capabilities of secure memory/registers in an ARM TrustZone implementation.

“Discovered and documented by Sean Beaupre (beaups)”

“This vulnerability was successfully exploited to unlock the Motorola Droid Turbo’s bootloader.”

Click to access TRUSTNONE_1.0-11282015.pdf

UBU 1.43 released

~ hucktech ~ Leave a comment

UEFI BIOS Updater (UBU) 1.43 has been released, according to multiple news sources:

https://twitter.com/freewareactive/status/670077533774311425

http://www.majorgeeks.com/files/details/uefi_bios_updater.html

http://www.softpedia.com/get/System/System-Miscellaneous/UEFI-BIOS-Updater.shtml

http://www.win-raid.com/t154f16-Tool-Guide-News-quot-UEFI-BIOS-Updater-quot-UBU.html

This is not an open source tool. It is closed-source freeware, which works on Microsoft Windows systems. I’ve not used this, but I’ve heard of others who use and recommend it. If you are going to use it, please read all the documentation first, there are many caveats and warnings.

Nikolaj’s ZeroNights presentation available

~ hucktech ~ Leave a comment

Congratulations to Nikolaj on his first presentation! His presentation is now available!

The section on Protections is especially worth reading!

https://twitter.com/NikolajSchlej/status/669902996046761984

https://github.com/NikolajSchlej/ZeroNights2015

Click to access FixItYourself_Schlej.pdf

GTA04 devices available, last run

~ hucktech ~ Leave a comment

Dr. H. Nikolaus Schaller of Goldelico posted a message to the Replicant mailing list, about GTA04 boards finally becoming available, and that this will be the last batch!

Message:

Hi, finally (after 2 years work/wait) we will produce the last batch of GTA04A5 boards. There will be also ~40 complete devices (with display, case, battery etc.).

Replicant 4.2 is also available. And Lukas is working to patch/upgrade to a 4.3 kernel (needs backporting some Android features) so that we have the most modern basis that we can get to run Replicant on top.

For details see:
http://lists.goldelico.com/pipermail/gta04-owner/2015-November/006878.html

Note that it will be the last batch we can produce since we can’t get some components any more.

Full post:
http://lists.osuosl.org/mailman/listinfo/replicant

https://shop.goldelico.com/wiki.php

Booting UEFI over IPv6 using iPXE

~ hucktech ~ Leave a comment

“Here at Redpill Linpro we make extensive use of network booting to provision software onto our servers. Many of our servers don’t even have local storage – they boot from the network every time they start up. Others use network boot in order to install an operating system to local storage. The days when we were running around in our data centres with USB or optical install media are long gone, and we’re definitively not looking back. Our network boot infrastructure is currently built around iPXE, a very flexible network boot firmware with powerful scripting functionality. Our virtual servers (using QEMU/KVM) simply execute iPXE directly. Our physical servers, on the other hand, use their standard built-in PXE ROMs in order to chainload an iPXE UNDI ROM over the network. IPv6 PXE was first included in UEFI version 2.3 (Errata D), published five years ago. However, not all servers support IPv6 PXE yet, including the ageing ones in my lab. I’ll therefore focus on virtual servers for now, and will get back to IPv6 PXE on physical servers later.” […]

Full article:

http://blog.toreanderson.no/2015/11/16/ipv6-network-boot-with-uefi-and-ipxe.html

Router Security’s checklist

~ hucktech ~ Leave a comment

This is an excellent resource!

“The most expert person in the world can only make a router as secure as the firmware (router OS) allows. The following list of security features lets you judge how secure a router can potentially get. This is not a list of things to do to make a router more secure. That list includes a number of actions, like changing the default password, that are common to all routers and thus not in the list below. If you care about securing a router, look for it to have the features below. Sadly, reviews of routers never discuss any of this.” […]

http://routersecurity.org/checklist.php

also:

http://routersecurity.org/bugs.php

Windows Phone Internals 1.0 released

~ hucktech ~ Leave a comment

I am proud to announce the immediate availability of Windows Phone Internals 1.0. This tool allows you to unlock the bootloader of selected Lumia Windows Phone models. After unlocking the bootloader, you can enable Root Access on the phone or create and flash Custom ROM’s. I created a short introduction video to show the features of the tool. Root Access allows you to load your own homebrew software onto the phone with high privileges. Apps can escape from their sandboxes. The tool can also create backup-images of the phone and access the file-system in Mass Storage mode. The tool supports most versions of Windows Phone 8.1 and Windows 10 Mobile. For a complete list of supported phones and Operating Systems have a look at the Getting Started section of the tool. The download package also contains an SDK, which helps you to easily access the filesystem and registry on the phone from your own homebrew app.

Be careful and have fun!
Heathcliff74

http://www.wpinternals.net/

UEFI updated to IPMI v2.0

~ hucktech ~ Leave a comment

Daocheng Bu of Intel has added IPMI 2.0 definitions to the EDK2 project.

MdePkg/Include/IndustryStandard/Ipmi.h             |  26 +
…/IndustryStandard/IpmiNetFnAppDefinitions.h     | 614 +++++++++++++++++++++
…/IndustryStandard/IpmiNetFnBridgeDefinitions.h  | 238 ++++++++
…/IndustryStandard/IpmiNetFnChassisDefinitions.h | 294 ++++++++++
…/IpmiNetFnFirmwareDefinitions.h                 |  26 +
…/IpmiNetFnGroupExtDefinitions.h                 |  26 +
…/IpmiNetFnSensorEventDefinitions.h              |  44 ++
…/IndustryStandard/IpmiNetFnStorageDefinitions.h | 514 +++++++++++++++++
…/IpmiNetFnTransportDefinitions.h                | 531 ++++++++++++++++++
9 files changed, 2313 insertions(+)

For more information see the edk2-devel posts (or look at the current EDK2 trunk in the above files):
https://lists.01.org/mailman/listinfo/edk2-devel

Netconsole added to LUV

~ hucktech ~ Leave a comment

Gayatri Kammela of Intel posted a new feature patch to LUV: the netconsole. From the patch’s comments:

This is about adding a Linux feature called Netconsole in Linux* UEFI Validation. In LUV netconsole feature is enabled only for the test suites that run once  the Linux takes control over and BITS test suite will be excluded from  having this kind of support.

Why this feature: Netconsole in LUV help us debug the kernel panics or system hangs by  sending not only kernel messages but also information regarding the running tests simultaneously on to the remote machine via ethernet. Now the remote machine can  be on same subnet or different subnet with respective to the local machine  ( machine you are trying to boot LUV). To enable netconsole feature in LUV, changes are made in various files to include kernel modules like netconsole  and different network utilites that can send messages  via ethernet.Besides these changes are made to luv-test-manger to make all the  running tests information sent to dmesg to make the debugging more easy.

How this feature works: Liberty is given to user to choose the ip address and port number where he/she wants all messages to sent to. once decided , user can replace the dummy ip address given  in grub.cfg as @,64001@10.11.12.13/ with the destined address and port number.  The same information is mentioned in README file , so that user can get  to know the usage of netconsole.

Requirements for this feature: Not many changes are required for this feature , except enabling some of the kernel config options. Luv kernel has config optons enabled that are  obsolutely necessary for the image and to keep the kernel size as low as possible. Since netconsole require lot of options enabled related to TCP/IP , IPV4 , IPV6 and  filesystem related options. These information can be overwhelming and just for the sake of clarity some of the important options that needs to enabled are given below […]

See checkin post for full comment and sources:
https://lists.01.org/mailman/listinfo/luv

Red Hat creates Certificates-Shipped project

~ hucktech ~ Leave a comment

Nice, Kiur Seifried of Red Hat has a new project listing the certs/keys the use. I wish all vendors did this.

——– Forwarded Message ——–
Subject:     [oss-security] Announcing https://github.com/RedHatProductSecurity/Certificates-Shipped/
Date:     Tue, 24 Nov 2015 21:38:35 -0700
From:     Kurt Seifried <kseifried@redhat.com>
To:     oss-security <oss-security@lists.openwall.com>

https://github.com/RedHatProductSecurity/Certificates-Shipped/

The idea is to create a comprehensive list of shipped certs/keys/etc by open source vendors/distributions/projects so that:

1) we have a list of secrets maintained by external parties that we rely upon
2) we can audit them and make sure we should be trusting them
3) also spot changes more easily (since the existing corpus is available)

I’m guessing there are some surprises waiting for us.

—
Kurt Seifried — Red Hat — Product Security — Cloud
PGP A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993
Red Hat Product Security contact: secalert@redhat.com

OpenBSD’s new native hypervisor

~ hucktech ~ Leave a comment

Many people are reporting OpenBSD’s new native hypervisor:

More information:

http://undeadly.org/cgi?action=article&sid=20151122214050&mode=expanded

http://cvsweb.openbsd.org/cgi-bin/cvsweb/~checkout~/src/sys/arch/amd64/amd64/vmm.c?rev=1.6

 

many embedded devices with exploitable SSH keys

~ hucktech ~ Leave a comment

Excerpt of Vulnerability Note VU#566724:

Embedded devices use non-unique X.509 certificates and SSH host keys that can be leveraged in impersonation, man-in-the-middle, or passive decryption attacks. Research by Stefan Viehböck of SEC Consult has found that numerous embedded devices accessible on the public Internet use non-unique X.509 certificates and SSH host keys. Products are identified as vulnerable if unpacked firmware images are found to contain hard-coded keys or certificates whose fingerprints can be matched to data from the Internet-wide scan data repository, scans.io (specifically, see SSH results and SSL certificates). Affected devices range broadly from home routers and IP cameras to VOIP phones. For the majority of vulnerable devices, reuse of certificates and keys are limited to the product lines of individual vendors. There are some instances where identical certificates and keys are used by multiple vendors. In these cases, the root cause may be due to firmware that is developed from common SDKs, or OEM devices using ISP-provided firmware. Vulnerable devices may be subject to impersonation, man-in-the-middle, or passive decryption attacks. It may be possible for an attacker to obtain credentials or other sensitive information that may be used in further attacks. For additional details about the research and affected products by certificates and SSH host keys, refer to SEC Consult blog post on the topic. […] In most cases, the CERT/CC is unaware of a practical solution to this problem.[…]

 

See the full vulnerability note for lists of affected systems, and more information:

http://www.kb.cert.org/vuls/id/566724

security issues when recycling firmware

~ hucktech ~ Leave a comment

As pointed out on a few Twitter feeds, including:

Computer Weekly has an article titled “Avoiding security issues when recycling hardware” by Peter Ray Allison:

“Each year companies have to deal with an increasing amount of obsolete hardware. This is equipment that is under-powered or out of warranty, but nonetheless working and still functionally useful. The bulk of this equipment is typically desktop PCs and laptops, but the same also applies to peripherals, such as monitors, USB hard-drives and projectors.” […]

Full article:

http://www.computerweekly.com/feature/Avoiding-security-issues-when-recycling-hardware

Beyond the above article, for more information, read NIST SP 80-147 for firmware security guidance for the Disposition phase of hardware.

http://csrc.nist.gov/publications/PubsSPs.html

None of the above covers what PII is stored in your firmware. Most firmware have some kind of password. UEFI has the concept of ‘logging in’ to your firmware, unsure where this is stored. I used to only be concerned about hard drives when I recycled systems. But post-BIOS, I am concerned about any NVRAM chip on the system where firmware may store data (main image, video, network cards, etc.). Do any vendors have UEFI firmware wipe utilities? Lenovo has a TPM reset CD, which is nice.  If you know the places in the UEFI spec and/or EDK2 sources where UEFI stores PII, or where any vendor implementations store this data, please email me or leave a Comment to this post. If you are a large enterprise, you should have your vendor explain how to deal with firmware PII during the Disposition phase before you purchase the hardware, i.e., this data should be in pre-sales information for products…

Updated UEFI training from Intel SSG

~ hucktech ~ Leave a comment

It appears there are a few new files on Tianocore.org, beyond latest EDK-II trunk source changes.

Intel has a multi-day training course for (presumably) Intel employees and partners. Intel releases the presentations and lab workshop materials for the course for public access, as part of the Tianocore project, and updates it periodically. And they recently updated it again, grab the 2 files at the top of the list, with recent dates. I just downloaded it, unsure what is new in the labs yet…
http://sourceforge.net/projects/edk2/files/Training/TrainingMaterial/

Also see updated versions of the online presentations here:
http://sourceforge.net/projects/edk2/files/Training/
https://github.com/tianocore/tianocore.github.io/wiki/UEFI%20EDKII%20Learning%20Dev

I think this page may be slightly out-of-date for the moment:
http://firmware.intel.com/learn/uefi/uefi-training-materials

As for other updates to tianocore/EDK2, the EDK-II C Coding Conventions have been revised:
http://sourceforge.net/projects/edk2/files/Specifications/

I usually find it is best to find fresh Tianocore files by looking at these two locations first:
https://github.com/tianocore
http://sourceforge.net/projects/edk2/files/