Category: Uncategorized

Apple fixed firmware vulnerability found by Positive Technologies

~ hucktech ~ Leave a comment

June 14, 2018
The vulnerability allowed exploiting a critical flaw in Intel Management Engine and still can be present in equipment of vendors that use Intel processors. Apple released an update for macOS High Sierra 10.13.4, which fixes the firmware vulnerability CVE-2018-4251 found by Positive Technologies experts Maxim Goryachy and Mark Ermolov. For more details, see Apple Support.[…]

http://blog.ptsecurity.com/2018/06/apple-fixed-vulnerability-founde-by-PT-experts.html
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-4251
https://support.apple.com/en-us/HT208849

OEMs charge users to enable (or disable) security features

~ hucktech ~ Leave a comment

Does the automotive industry charge for seat belts? šŸ™‚

Maybe someone should create an open source project for Tianocore that has boot menu option (UEFI browser form) code to enable/disable everything that Intel/ARM/AMD/etc make configurble, an these menu options should be made available to any IBV/OEM that wants to include them. Having them there reduces friction for vendors who didn’t have those features before, and provides something for customers to point to when they say “I want more control of my security configurability in my firmware.”

https://twitter.com/Mario_Vilas/status/1007204344696098816

VW firmware was used to defeat emission tests

~ hucktech ~ Leave a comment

The above 3 tweets apply to EVERYTHING, not just the story that started it, VW firmware. It seems the forensics community still does very little with firmware:

Click to access diesel-sp17.pdf

YubiCo -vs- security researchers

~ hucktech ~ 1 Comment

Sorry, these tweets are not in chronological order.

https://www.yubico.com/2018/06/webusb-and-responsible-disclosure/

Security advisory YSA-2018-02

Multiple Security Issues in Ecos Secure Boot Stick (SBS)

~ hucktech ~ Leave a comment

 

Ecos Secure Boot Stick version 5.6.5 and System Management version 5.2.68 suffers from credential disclosure and various other security vulnerabilities that can lead to information disclosure.

https://telematik.prakinf.tu-ilmenau.de/ecos-sbs/advisory.html

https://packetstormsecurity.com/files/148180/Ecos-Secure-Boot-Stick-5.6.5-Credential-Disclosure-Information-Leak.html

https://www.ecos.de/en/products/access-components/secure-boot-stick/

 

 

New Intel mobile web app to remotely control Intel AMT systems

~ hucktech ~ Leave a comment

[[SuperMicro has a phone app to control their systems’ IPMI. Now Intel has a phone app to control Intel AMT-based systems. I hope mobile systems are secure, these would seem to make great ‘pivots’ for attackers…]]

MeshCentral2 – New Mobile Web Application
By Ylian S. (Intel), published on June 12, 2018

Itā€™s been a while since the last announcement but I have been hard at work on MeshCentral, the web-based open source remote management software. This week we got a big new feature with release of MeshCentral v0.1.8-c on NPM, we now have a new web application for mobile devices. When you install your own MeshCentral server and access it using a mobile device (like a phone or tablet), you will see a new web page tailored for small devices. This is the first version of it, but already it offers many of the main usages that are offered on the main web site in a more compact form.[…]

https://software.intel.com/en-us/blogs/2018/06/12/meshcentral2-new-mobile-web-application

https://www.npmjs.com/package/meshcentral

http://www.meshcommander.com/meshcentral2

 

ZeroTrace: enables building systems secure against side-channels in SGX enclaves

~ hucktech ~ Leave a comment

https://twitter.com/sergey_nog/status/1006582302057619456

ZeroTrace(ZT) is the first system that enabled instantiations of Oblivious-RAMs(ORAMs) on a server-device that supports Intel-SGX. ZT is also secure against known side-channel attacks against SGX.* Oblivous RAM or ORAMs have been theoretically known for a long while now [1], with the advent of secure hardware modules like Intel SGX, we notice an opportunity to make these incredible cryptographic primitives, deployable in practical scenarios.[…]

https://github.com/sshsshy/ZeroTrace

 

10-Part Introduction to KiCad video series available

~ hucktech ~ Leave a comment

A 10-part video introduction to KiCad is now available:

Expliot: IoT Exploitation Framework (pronounced – expl-aa-yo-tee)

~ hucktech ~ 1 Comment

Expliot (Pronounced – expl-aa-yo-tee)

Internet Of Things Exploitation Framework

Expliot is a framework for security testing IoT and IoT infrastructure. It provides a set of plugins (test cases) and can be extended easily to create new plugins. The name expliot is a pun on exploit and explains the purpose of the framework i.e. IoT exploitation. It is developed in python3[…]

https://gitlab.com/expliot_framework/expliot

 

Intel Floating Point issue?

~ hucktech ~ 1 Comment

According to the oss-security list, there’s an ‘Intel FP issue’, and the BSDs are doing patches against it:

https://marc.info/?l=openbsd-cvs&m=152818076013158&w=2

http://lists.dragonflybsd.org/pipermail/commits/2018-June/672324.html

https://svnweb.freebsd.org/base?view=revision&revision=335072

I don’t know more about this FP issue other than above. For the record, I prefer the old days, when kernel mode didn’t rely on floating point, so the OS didn’t have to save state for drivers. šŸ™‚

Facebook open sources Sonar, debugging tool

~ hucktech ~ Leave a comment

Open-sourcing Sonar, a new extensible debugging tool
Emil Sjƶlander

One challenge that comes from having many engineers working collaboratively on larger apps is that typically no single person knows how every module works. This segmentation of knowledge and expertise can make it difficult to develop new features, investigate bugs, or optimize performance. To help engineers at Facebook manage this complexity, we built Sonar, an extensible cross-platform debugging tool. Sonar gives us a surface where framework experts and developers can convey important information to framework users. Now we are adding functionality and sharing Sonar as an open source project to help others accelerate the app development process. With Sonar, engineers have a highly flexible, intuitive way to inspect and understand the structure and behavior of their iOS and Android applications. We believe Sonar improves on current tools by providing a more visual and interactive experience that is extensible to fit engineers’ specific needs.[…]

https://github.com/facebook/Sonar/

https://code.facebook.com/posts/1461914677288302/open-sourcing-sonar-a-new-extensible-debugging-tool/

https://fbsonar.com/

Windows: new feature using IOMMU to block DMA access for Thunderbolt devices when machine is locked

~ hucktech ~ Leave a comment

The latest version of Windows apparently has new protections against PCILeech and related attacks:

Introducing graphene-ng: running arbitrary payloads in SGX enclaves

~ hucktech ~ Leave a comment

fig1

Jun 11, 2018 by Joanna Rutkowska

A few months ago, during my keynote at Black Hat Europe, I was discussing how we should be limiting the amount of trust when building computer systems. Recently, a new technology from Intel has been gaining popularity among both developers and researchers, a technology which promises a big step towards such trust-minimizing systems. Iā€™m talking about Intel SGX, of course. Intel SGX caught my attention for the first time about 5 years ago, a little while before Intel has officially added information about it to the official Software Developerā€™s Manual. Iā€™ve written two posts about my thoughts on this (then-upcoming) technology, which were a superposition of both positive and negative feelings. Over the last 2 years or so, together with my team at ITL, weā€™ve been investigating this fascinating technology a bit closer. Today Iā€™d like to share some introductory information on this interesting project weā€™ve been working on together with our friends at Golem for several months now.[…]

https://blog.invisiblethings.org/2018/06/11/graphene-ng.html

 

Ā 

An ice-cold Boot to break BitLocker

~ hucktech ~ Leave a comment

An ice-cold Boot to break BitLocker
By Olle Segerdahl & Pasi Saarinen

A decade ago, academic researchers demonstrated how computer memory remanence could be used to defeat popular disk encryption systems. Not much has happened since, and most seem to believe that these attacks are too impractical for real world use. Even Microsoft have even started to play down the threat of memory remanence attacks against BitLocker, using words such as ā€œthey are not possible using published techniquesā€. We will publish techniques that allow recovery of BitLocker encryption keys from RAM on most, if not all, currently available devices. While BitLocker is called out in the title, the same attacks are also valid against other platforms and operating systems.

Olle is a veteran of the IT-security industry, having worked with both ā€œbreakingā€ and ā€œbuildingā€ security solutions for almost 20 years. During that time, he has worked on securing classified systems, critical infrastructure and cryptographic products as well as building software whitelisting solutions used by industrial robots and medical equipment. He is currently the Swedish Principal Security Consultant with F-Secureā€™s technical security consulting practice.

Pasi is an experienced security researcher with a background in both software and network security. In previous employment he has worked on a modern framework for white-box fuzz testing of binaries and security standardization of the 5G mobile network. While he has a very Finnish name, he plays for team Sweden in F-Secureā€™s technical security consulting practice.

 

https://www.sec-t.org/talks/