Category: Uncategorized

Aaron Guzman @ SecureFest’18: Finessing fake firmware security for Friday fun

~ hucktech ~ Leave a comment

In light of the uprising spike in IoT botnets impacting critical infrastructures around the world, purchasing products that claim to be “secure” captivate our curiosity and skepticism. With so much fud, snake oil, and self proclaimed secure features, it’s become our due diligence to verify these claims. In other words, device manufactures must walk it like they talk it. Come learn how you can debunk firmware security controls by trying, before buying.

https://securityfest.com/schedule/

Elcomsoft: iOS 11.4.1 Second Beta Extends USB Restricted Mode with Manual Activation

~ hucktech ~ Leave a comment

 

Thinking Apple is done with USB Restricted Mode? Not yet. They have at least one more deus ex machina to shake up the forensic community. More than a month ago, we made a report iOS 11.4 to Disable USB Port After 7 Days: What It Means for Mobile Forensics. The feature was not included into the final release of iOS 11.4, but returned in a much different shape in iOS 11.4.1 beta (iOS 11.4.1 Beta: USB Restricted Mode Has Arrived). The feature is also part of the first iOS 12 beta introduced a a few days later. Finally, Apple has officially confirmed the existence of USB Restricted Mode, and the law enforcement community is not happy about it. (Cops Are Predictably Pissed About Apple’s Plan to Turn Off USB Data Access on iPhones). Some sources speculated about LE being able to break into the phones without the warrant.[…]

https://blog.elcomsoft.com/2018/06/ios-11-4-1-second-beta-extends-usb-restricted-mode-with-manual-activation/

 

Airbus-seclab: iLO4_toolbox: more info uploaded

~ hucktech ~ Leave a comment

Re: https://firmwaresecurity.com/2018/06/11/subverting-your-server-through-its-bmc-the-hpe-ilo4-case-presentation-toolbox/

Click to access sstic_2018_backdooring_ilo4_slides_en.pdf

Click to access SSTIC2018-Article-subverting_your_server_through_its_bmc_the_hpe_ilo4_case-gazet_perigaud_czarny.pdf

https://github.com/airbus-seclab/ilo4_toolbox

Hardware Trojans – Attack Models

~ hucktech ~ Leave a comment

Hardware Trojans – Attack Models

Whenever I am involved in a discussion about Hardware Trojans most questions are focused on the following topics / problems:
what would a professional attack look like?
how realistic is the attack by interfering with an integrated circuit?
and finally, is it even a real threat?

These questions will be discussed in that order. The Trojan-related attack models for integrated circuits are closely linked to the supply chain and the contractors in the silicon production process. Currently, microelectronics uses the so-called foundry model, which separates the production of chips (silicon) from the design of integrated circuits. The manufacturing is carried out by separate companies or business units within the same organization. This model takes its name from a similar process in the automotive industry (and heavy industry) where the design of the vehicle (machine) is done by companies and institutions other than steelworks and foundries. Sometimes a very large car company can afford to buy a steelwork, or a steelwork has shares of a car company. An example of analogy in the world of electronics would be Intel, which does both, designs and manufactures integrated circuits.[…]

 

https://adamkostrzewa.github.io/jekyll/update/2018/06/19/fabless-companies-en.html

 

REcon U-Boot talk, slides uploaded [temporarily]

~ hucktech ~ Leave a comment

Click to access recon.pdf

EFI3M: EFI Multi-boot Menu Maker

~ hucktech ~ Leave a comment

EFI3M builds a Multi-boot menu for computers with an EFI firmware. The menu will be displayed when booting the computer and allows the user to start any of the installed system from its EFI boot loader: not only Linux distributions, but also BSD distributions, Microsoft Windows, Apple OS X, pretty much any system that has a boot loader in an ESP (EFI System Partition) on any drive of the computer, be it a hard disk, a SSD, a NVMe, whatever. The multi boot menu is installed in an internal ESP as /EFI/efibootmenu/BOOTx64.EFI alongside its configuration file grub.cfg and also, optionally, in /EFI/BOOT/ which is the fall back directory looked at by the firmware, if it is not not already busy. It can also be installed on an USB stick, to allow booting any installed system if for some reason booting would otherwise fail.

https://github.com/DidierSpaier/EFI3M

Cyberus Tech: more info on Intel Lazy Floating Point vuln

~ hucktech ~ Leave a comment

Re: https://firmwaresecurity.com/2018/06/15/cyberus-tech-intel-lazyfp-vulnerability-exploiting-lazy-fpu-state-switching/

the PDF that was not previously available appears to be available…

Click to access lazyFP.pdf

https://blog.cyberus-technology.de/posts/2018-06-06-intel-lazyfp-vulnerability.html

Circumference: OpenStack Progress with Network Booting

~ hucktech ~ Leave a comment

Circumference is a miniaturised datacentre-in-a-box, complete with programmable power distribution and sequencing, instrumentation, cooling, networking, and a switchable remote console — all packaged in custom-designed desktop enclosures which eliminate cable clutter and give you complete control over the hardware inside.

Chris Dent has a blog post about netbooting the Circumference.

https://www.crowdsupply.com/ground-electronics/circumference
https://groundelectronics.com/products/circumference/

In my previous posting on the Circumference I said that I wanted to get the eight Raspberry Pi nodes to netboot from the front end processor so I could more easily manage the nodes on which I wanted to install nova-compute. This post provides a very quick update on those explorations. Newer Pi 3 B have firmware that can allow them to netboot without any SD card in place, but it requires a fair bit of set up. I was struggling to make headway, never seeing bootpc packets from the nodes. Turns out a newer firmware is needed. Andrew Back, from Ground Electronics the company building the Circumference, pointed to a useful cookbook blog post, Network Booting a Raspberry Pi 3 from an Ubuntu Server, that includes pointers to the new firmware. That got me a bit further. I’m now able to see some nodes, sometimes choosing to send bootpc packets and otherwise talking to the network.[…]

https://anticdent.org/circumference-25-netbooting.html
https://anticdent.org/circumference-25-beta.html
https://www.crowdsupply.com/ground-electronics/circumference/updates/openstack-progress-with-network-booting

 

GPUTop: a GPU profiling tool

~ hucktech ~ Leave a comment

Intel posted info about a new blog post using GPUTop with Caledon (Intel-flavored Android):

We are excited to bring out a new tutorial for profiling gpu on Android. Gputop exposes many GPU parameters module wise such as frequency, busyness, threads, EU activeness etc. These are very helpful in identifying performance bottlenecks as well as impact of performance improvements on the GPU either through graphics software stack or through the graphics application. If you are learning/ new to gpu, this should attract you even more. Please take a look, try out and feel free to share your feedback.

https://01.org/projectceladon/documentation/tutorials/profiling-gpu

https://github.com/rib/gputop

GPU Top is a tool to help developers understand GPU performance counters and provide graphical and machine readable data for the performance analysis of drivers and applications. GPU Top is compatible with all GPU programming apis such as OpenGL, OpenCL or Vulkan since it primarily deals with capturing periodic sampled metrics. GPU Top so far includes a web based interactive UI as well as a non-interactive CSV logging tool suited to being integrated into continuous regression testing systems. Both of these tools can capture metrics from a remote system so as to try an minimize their impact on the system being profiled. GPUs supported so far include: Haswell, Broadwell, Cherryview, Skylake, Broxton, Apollo Lake, Kabylake, Cannonlake and Coffeelake.

https://lists.01.org/mailman/listinfo/celadon

WooKey: USB Devices Strike Back

~ hucktech ~ Leave a comment

WooKey: USB Devices Strike Back
Date : 13 juin 2018 à 17:15 — 30 min.

The USB bus has been a growing subject of research in recent years. In particular, securing the USB stack (and hence the USB hosts and devices) started to draw interest from the academic community since major exploitable flaws have been revealed by the BadUSB threat. The work presented in this paper takes place in the design initiatives that have emerged to thwart such attacks. While some proposals have focused on the host side by enhancing the Operating System’s USB sub-module robustness, or by adding a proxy between the host and the device, we have chosen to focus our efforts on the device side.

https://www.sstic.org/2018/presentation/wookey_usb_devices_strike_back/

Click to access SSTIC2018-Slides-wookey_usb_devices_strike_back-michelizza_lefaure_renard_thierry_trebuchet_benadjila_WUAopX7.pdf

 

Writing simple BIOS bootloaders using NASM

~ hucktech ~ Leave a comment

 

https://blog.benjojo.co.uk/post/interactive-x86-bootloader-tutorial

The tutorial ends with a pointer to some BIOS interrupts. It should have mentioned Ralph Brown’s classic list.

http://www.cs.cmu.edu/~ralf/files.html

https://en.wikipedia.org/wiki/Ralf_Brown%27s_Interrupt_List

memory loading

QuarksLab: intro to TEE: ARM’s TrustZone

~ hucktech ~ 1 Comment

[…]This starts a series of two blogposts discussing hardware technologies that can be used to support TEE implementations:
* TrustZone from ARM
* SGX from Intel
As suggested by the title, this blogpost tells you more about TrustZone.[…]

https://blog.quarkslab.com/introduction-to-trusted-execution-environment-arms-trustzone.html

 

Facebook BOLT: Binary Optimization and Layout Tool, used for optimizing performance of binaries

~ hucktech ~ Leave a comment

https://code.facebook.com/posts/605721433136474/accelerate-large-scale-applications-with-bolt/

https://github.com/facebookincubator/BOLT