Category: Uncategorized

Red Balloon Security

~ hucktech ~ Leave a comment

http://www.redballoonsecurity.com/

“Red Balloon Security was founded in 2011 by two of the world’s leading cyber-security researchers. We are a Columbia Portfolio Company and a Microsoft Ventures Accelerator Company. “

“Project Symbiote: The First Universal Embedded Defense for all embedded devices. Cyber-security threat actors today are shifting to the lowest hanging fruit. Most networked devices shipping today are not desktops, laptops or servers and none of them have strong host-based defense. Your automotive, point-of-sale, unified communications, Internet-of-Things, SCADA, home and office equipment are highly vulnerable and are actively being compromised today, whether for corporate espionage, financial fraud, or state-to-state cyber warfare. Red Balloon Security is devoted to hardening all devices against malicious intrusion. Device manufacturers can now inject Symbiote Defense into any device regardless of CPU type and operating system. No hardware or source code modifications required. “

IBV scare from 2013

~ hucktech ~ Leave a comment

AntiVirus Today just ‘revived’ an old story from 2013, AFAICT no new news at all:

https://twitter.com/antivirustoday/status/652933400479711232

http://www.antivirustoday.com/ami-pc-firmware-upgrade-scare-the-global-security-meltdown-that-wasnt.html?utm_source=ReviveOldPost&utm_medium=social&utm_campaign=ReviveOldPost

http://www.theregister.co.uk/2013/04/11/ami_uefi_key_leak/

It is old news, but a good read if you missed this story 3 years ago, and it does remind vendors about the need for security in your firmware.

rowhammer and unnamed memory vendors

~ hucktech ~ Leave a comment

“We had anonymous contact offering to act as a go between between us and unnamed memory companies, with a view to paying us not release the new version of MemTest86. Who knows how serious the offer was.”

https://lackingrhoticity.blogspot.com/2015/10/passmark-received-offer-to-not-release-rowhammer-test.html

Android 6.0 OEMs: support Verified Boot

~ hucktech ~ Leave a comment

Multiple news sites have a story about Android 6.0 and Google’s new security requirements for OEMs, such as including Android Verified Boot.

http://www.tomshardware.com/news/marshmallow-encryption-fingerprints-verified-boot,30369.html

http://www.zdnet.com/article/google-now-requires-full-device-encryption-on-new-android-6-0-devices/

http://www.androidauthority.com/new-google-oem-marshmallow-requirements-650266/

SysMagazine: English translations of Nikolaj’s UEFI security series

~ hucktech ~ Leave a comment

I just noticed “Sysmagazine geek daily blog: a translation of the popular Russian IT blog, Habrahabr.ru”. So, it contains English translated versions of Nikolaj’s Russian UEFI security series on habrahabr.ru. I’d been using Google Translate, this is slightly easlier to use. Here’s the English version of Nikolaj’s series:

http://sysmagazine.com/posts/266935/
http://sysmagazine.com/posts/267197/
http://sysmagazine.com/posts/267237/
http://sysmagazine.com/posts/267491/
http://sysmagazine.com/posts/267953/
http://sysmagazine.com/posts/268135/
http://sysmagazine.com/posts/268423/

Here’s the original series:
http://habrahabr.ru/users/coderush/topics/

In the last part of the series, he lists various people of interest, but not much about himself.  Nikolaj’s UEFI Tool is consistently at the top of Github’s active list for UEFI. More popular than Intel CHIPSEC, or the TianoCore Git mirrors. UEFItool is also one of the better maintained tools in the field of firmware security, very active at fixes. I’d put him near the top of the list, along with ITL, LegbaCore, and Intel ATR/CHIPSEC team, as a prime source of firmware security knowledge. He’ll be speaking at ZeroNights in Moscow this December on UEFI…

http://2015.zeronights.org/agenda.html#schlej
http://2015.zeronights.org/speakers.html#schlej

Open Estuary: ecosystem for AArch64 systems

~ hucktech ~ Leave a comment

Quoting their documentation:

Estuary provides a total solution for general-purpose computer based on aarch64 architecture. Anyone can quickly bring up an ARM64 platform – both software and hardware with Estuary. The major goals for Estuary project are:
* A stable\available quick start solution based on ARM64 computer, so that anyone can easily get and bring up the complete development environment, so that you can just focus on your particular field quickly.
* A common basic platform, which should be sustainable and will be continuously improved, can attract\absorb and integrate all 3rd part achievement ceaselessly.
* Sufficient technological documentation, so that any user or partner can easily get useful help from it.
* Simple and effective communication forum for ARM64 ecosystem, so that users can interact and share each other to improve ARM64 ecosystem.
* A bug tracking system, so that anyone can raise, track and help to resolve the issues, this will help to mature the solution and enhance the ecosystem.
* Multiple ARM64-based hardware platforms, and related software to speed up the ARM64 ecosystem development.
* The most key goal of Estuary project is to support, enable and speed up the maturity of ARM64 ecosystem.

For hardware, they currently support two AArch64 SOC boards, D01, D02 boards. For OS, they support Linux or Windows. For, firmware they say they support “Multi-kinds of boot loader will be enabled for Estuary, include but not limited to UEFI\Grub, uboot.” But currently they appear to support UEFI and GRUB. Amongst the other tools included in Estuary is a LAVA system, Linaro’s Automated Validation system, which performs continuous integration on QEMU- and multiple ARM-based devices, letting you reinstall firmware, OS, run pre-OS tests, and gather results.

They include their UEFI changes in their project changelogs, eg their 2.0 release from last month included two entries on UEFI:
9. Pubished the latest UEFI source code for D02 and eanbled building UEFI from source code directly.
11. Upgraded UEFI to add PCIE scaning.
    a. Remove GE4 and keep only GE5 on UEFI, to avoid confusion with 2 NICs.
    b. Re-enable PCI Express link up for port 1 and 2 (According to PCI Express slots on the board).
    c. Fix PXE timeout issue.
    d. Re-enable showbrdnum and setbrdnum commands on EBL.
    e. Fix several other bugs.

They are still using Ubuntu 12.04.
More information:

http://open-estuary.com/uefi-and-grub
https://github.com/open-estuary/uefi
https://github.com/open-estuary/uefi.git
http://git.savannah.gnu.org/cgit/grub.git
http://open-estuary.com/estuary/
http://open-estuary.com/estuary-v2-0/
http://open-estuary.com/d02-2/
http://open-estuary.com/d01-2/

VZ on Secure Boot, Intel TXT, Linux, and UEFI

~ hucktech ~ Leave a comment

Earlier today, Matthew Garret posted a problem on Twitter about Intel Linux and Intel TXT mode:

MJG on Secure Boot, Intel TXT, Linux, and security

Later that day, Vincent Zimmer of Intel is apparently helping to get that Intel project working with UEFI:

A few weeks ago, a similar thing happened with Intel SGX. Intel is lucky to have Vincent Zimmer, who is very engaged with Linux security/development community, in helping to fix Intel projects to properly support UEFI. Many large companies do not have this kind of public individual involvement.

Joe Grand, Tools of the Hardware Hacking Trade

~ hucktech ~ Leave a comment

Joe Grand is giving a presentation, “Tools of the Hardware Hacking Trade”, at Duo Security’s Duo Tech Talks in Michigan

Joe Grand (@joegrand) will be trekking to Ann Arbor to teach you all the tools and tricks you need to get into hardware hacking and reversing! Joe currently runs Grand Idea Studio and is a bit of a hardware legend. He was a member of the hacking collective L0pht (along with Mudge, a previous Duo Tech Talk speaker) and was responsible for many years of the coolest DEFCON badges:

https://foundry.net/joegrand/defcon_electronic_badges

Meetup.com event page:
http://www.meetup.com/Duo-Tech-Talks/events/223379457/

http://www.grandideastudio.com/

MJG on Secure Boot, Intel TXT, Linux, and security

~ hucktech ~ Leave a comment

A short security lesson from Matthew (click on Twitter link for follow-up post):

[BTW, sorry WordPress doesn’t seem to render Twitter’s HTML table when scrolling through the site If you ever see multiple blank lines in the post it is probably a Twitter URL that WordPress didn’t render, refresh to fix. You have to refresh on new pages, often, or view the post on a separate page (which generates a refresh). I post messages while online and finding news, but don’t spend a huge amount of extra time formatting the posting, simple ASCII text plus a few URLs. The interactive WordPress HTML UI to add a hyperlink triples the time to post each message, and WordPress won’t accept HTML <A> links. WordPress renders some URLs differently, like showing the image of a JPEG/PNG/etc, and showing the Youtube video link and hiding the rest of a web page which contains a Youtube URL — like Kickstart funding pages.]

Change.org petition for more user control in Windows 10

~ hucktech ~ Leave a comment

Users need data from firmware vendors, not just application vendors, about details of the update. Right now, all OEMs/IHVs/ODMs are terrible at this. Some of the issues in this petition are asking for more information about vendor information, excerpts:

1) Microsoft must give Windows 10 users more control over when updates are installed. We need the ability to delay or hide damaging updates that impact the computing experience, have undesirable side effects such as blue screens of death, or reduce the functionality to attached devices. Under the current system of mandated updates, we have been adversely impacted by forced driver and firmware updates plus other patches; we’ve wasted hours dealing with the unwanted side effects. As long-time Windows users, we understand the need to have quicker and more agile security updating. But this agility should not introduce additional risks to our systems. Windows 10 updates have already caused loss of system functionality, video and display issues, and other significant issues.

2) Microsoft should provide detailed information on what’s in each update — along with what system changes we should see with each cumulative-update release. We applaud the cumulative-update model, but the lack of documentation doesn’t let us to perform the due diligence required for safely deploying and maintaining Windows 10 systems in our organizations. […]

https://www.change.org/p/satya-nadella-microsoft-what-computer-users-want-changed-in-windows-10

http://www.eweek.com/developing-stories/change.org-petition-calls-for-microsoft-to-revamp-windows-10-updates.html

https://windows.uservoice.com/forums/265757-windows-feature-suggestions/suggestions/9483897-we-need-better-knowledge-base-articles-for-windows

https://windows.uservoice.com/forums/265757-windows-feature-suggestions/suggestions/7960296-windows-update-configuration-options

XDA Developers on Android security -vs- control

~ hucktech ~ Leave a comment

There is a good article over on XDA Developers about how device security comes at the cost of owner control. Article is focused on Android, but really applies to many platforms these days.

Walled Gardens: The Trade-off Between Security and Modifiability

With the recent changes in Android 6.0 (Marshmallow) looking set to make life much more difficult for tinkerers, tweakers and modders, a question people often ask me is “why?” – why does (Company name) want to stop me modifying my phone? In this article, I aim to give a (hopefully) complete run-down of many of the factors at play here, and the motivations of involved parties, and who they actually are. There’s no way I will manage to completely cover every angle, but I shall give it my best shot – feel free to add anything you think I forgot in the comments below. […]

Article:

http://www.xda-developers.com/walled-gardens-the-trade-off-between-security-and-modifiability/

 

China defines ‘golden image’ as source, apparently

~ hucktech ~ Leave a comment

A few weeks ago, when I thought the ‘golden image’ in NIST SP800-147’s Provisioning phase required source access to the firmware, the below story would be an example of the only way vendors would get access to the source code to their closed-source firmware:

http://www.theinquirer.net/inquirer/news/2431029/ibm-shows-its-source-code-to-chinese-authorities-as-a-gesture-of-good-faith

However, as clarified in email ‘interview'[1] with Andrew of NIST, the ‘golden image’ can also be a closed-source blob, in which case we’re supposed to *TRUST* the vendor. Now that “cyberwar” is a mainstream topic, governments will likely not trust closed-source blobs from foreign countries much anymore, at the firmware, operating system, or application level. But consumers don’t have the pressure that governments do, so we get to continue to *TRUST* the vendor, and the PKI backing the firmware, most of the keys of which we cannot verify, no acts of good faith from vendors to non-government players. 😦

[1] https://firmwaresecurity.com/2015/10/13/interview-with-andrew-regenscheid-of-nist/

 

 

 

Arduino 101, an Intel Curie-based device

~ hucktech ~ Leave a comment

Quoting the Intel blog post:

The Verge reports some big news was announced at Maker Faire Rome today: The Arduino 101, a low-cost, low-energy Arduino-branded device based on Intel’s Curie module, the first such product to hit the market. The Arduino 101 is reported to sell for around $30 and includes Bluetooth Low Energy, a gyroscope and accelerometer.

I do not know what firmware it uses, yet…

http://www.theverge.com/2015/10/16/9548177/intel-curie-arduino-maker-board

http://blogs.intel.com/evangelists/2015/10/16/meet-the-arduino-101-the-first-intel-curie-based-product/

UP, Intel x5 IoT prototype board on Kickstarter

~ hucktech ~ Leave a comment

Excerpting the Intel blog:

This is the UP, a new IoT prototyping board built on Intel’s x5-Z8300 QuadCore 1.44Ghz (1.84GHz) 64 bit 2W CPU: “The 40 Pin I/O connector, the USB 3.0 OTG, the Gigabit Ethernet, the HDMI and more other features make it a perfect solution for different domains and products like Robotics, Drone, Machine Vision, Smart Home, Education, Digital Signage, Intelligent Cars, Internet Of Things.” UP’s Kickstarter is now live with 44 days left to go. Produced by Aaeon, industrial embedded company part of ASUS group, the UP board makes a wonderful (high powered) addition to the growing line-up of powerful Intel-based IoT platforms. According to up-board.org, UP store will be available starting Dec. 17th, check it out on Kickstarter today.

Regarding the next link (the video image), WordPress apparently converts Kickstarter.com-based URLs to only show the video on the page, like next link. For full Kickstarter web page, use link from Intel blog:

http://blogs.intel.com/evangelists/2015/10/16/up-a-new-quadcore-1-44ghz-iot-platform-on-kickstarter-now/

Homepage

Art Swift: How to fix the Internet of Broken Things

~ hucktech ~ Leave a comment

MIPS vendor Imagination Tech points to this article by Art Swift on  IoT security issues:

The Internet of Things is already permeating every part of our lives – from healthcare to aviation, automobiles to telecoms. But its security is fundamentally broken. In my previous two blogs I’ve shown how vulnerabilities found by security researchers could have catastrophic consequences for end users. This isn’t just about data breaches and reputational damage anymore – lives are quite literally on the line. The challenges are many: most vendors operate under the misapprehension that security-by-obscurity will do – and lobby for laws preventing the disclosure of vulnerabilities; a lack of security subject matter expertise creates major vulnerabilities; firmware can too easily be modified; and a lack of separation on the device opens up further avenues for attackers. But there is something we as an industry can do about it – if we take a new hardware-led approach. This is all about creating an open security framework built on interoperable standards; one which will enable a “root of trust” thanks to secure boot capabilities, and restrict lateral movement with hardware-based virtualization.

Microsoft Windows, Adobe Flash, Oracle Java – what do these software products have in common? They’re all proprietary closed source. And they’re all among the most vulnerable and exploited on the planet. Many mainstream browsers don’t even run Java; Flash is such a security concern that modern browsers offer the option to activate plugins on a per-page basis, while system administrators will be well aware that Windows receives numerous security updates every single month –the CVE database reports 120 Windows 7 vulnerabilities in 2015 alone, as of October 2015. The problem is that the security-by-obscurity mantra that many firms and IoT makers hold so dear is simply not effective any more. […]

Full article:

http://www.computer.org/web/prpl-matters/content?g=8459902&type=article&urlTitle=how-to-fix-the-internet-of-broken-things

AMI announces support for Intel Innovation Engine

~ hucktech ~ Leave a comment

Since IDF this Summer, a few UEFI Forum vendors have announced support for Intel’s “Innovation Engine”, which was announced at IDF. Recently, AMI just announced more support for it:

http://ami.com/news/press-releases/?PressReleaseID=335&/American%20Megatrends%20to%20Support%20New%20Intel%C2%AE%20Innovation%20Engine%20Platform%20in%20MegaRAC%C2%AE%20PMX%20Platform%20Management%20Solution/

The problem is, Intel has yet to provide ANY information on this Innovation Engine vaporware. These “we also support Intel IE” press releases, with no information on what Intel IE is, are getting tiresome. Intel, please produce some information on IE, not just get partners to ship vague vaporware press releases!

Bunnie asked to testify on Xbox reversing trial

~ hucktech ~ Leave a comment

Bunnie Huang, founder of Bunnie Studios, makers of the Open Source Hardware-based Novena laptops, is also the author of “Hacking the Xbox”, and is being asked to testify in an Xbox jailbreaking case, as the BoingBoing article says:

Terrified feds try to bar Bunnie Huang from testifying at Xbox jailbreaking trial

Bunnie “Chumby” Huang, whose Hacking the Xbox is a reverse-engineer’s bible, has been asked to testify at the trial of Anaheim’s Matthew Crippen, who faces three years in prison for jailbreaking Xbox 360s (that is, modding them so that they could run software that Microsoft hadn’t authorized). But federal prosecutors have asked the judge to prevent Bunnie from testifying.
    The 35-year-old Huang argues that mod-chipping is not a violation of the Digital Millennium Copyright Act, which makes it unlawful to circumvent technology designed to prevent copyright infringement. He said he hopes to prove that point to jurors via a step-by-step tutorial.
    “Basically, what he did was insufficient on his own to violate anything,” Huang said in a recent telephone interview from Singapore, where he serves as vice president of hardware and general manager for Chumby’s operations in Asia.

Full article:

Terrified feds try to bar Bunnie Huang from testifying at Xbox jailbreaking trial

(3  years in prision for modifying a device you ‘own’? Wow.)

List of UEFI-based Windows 10 features

~ hucktech ~ Leave a comment

Johan Arwidmark recently posted an article, “List of Windows 10 features that requires UEFI”

     
One of the many restrictions of the Windows 10 inplace-upgrade process is that it doesn’t support changing BIOS to EUFI (see my Windows 10 Upgrade Limitations post for complete listing). So, do you really need UEFI to deploy Windows 10?  The answer is no, Windows 10 can absolutely be deployed to BIOS-based machines, but some of it’s features does require UEFI. Here is the (current) list:

Full article:
http://deploymentresearch.com/Research/Post/514/List-of-Windows-10-features-that-requires-UEFI