Eclypsium: new Supermicro firmware research

https://twitter.com/ABazhaniuk/status/1004835960507559936

https://blog.eclypsium.com/2018/06/07/firmware-vulnerabilities-in-supermicro-systems/

https://www.bleepingcomputer.com/news/security/firmware-vulnerabilities-disclosed-in-supermicro-server-products/

[…]We have confirmed missing firmware storage access controls and insecure firmware updates on specific Supermicro systems. Many other systems are likely to have similar vulnerabilities, leaving them exposed to attacks targeting firmware and hardware. Since most organizations do not monitor at this deep level, these attacks may go unnoticed for an extended period. By providing this summary of the vulnerabilities, impacts, and mitigation strategies, we hope to assist organizations in understanding and defending against threats at this level.

I did not see any CVE yet, I hope SuperMicro has seen this.

Teddy Reed on U-Boot’s Verified Boot

Teddy Reed, author of UEFI Firmware Parser, among other things, has some U-Boot Verified Boot issues:

Verified boot production uses question

Hi all, question, is anyone using the U-Boot verified-boot in production? I am using configuration verification for several OpenCompute/OpenBMC boards. After a deep-dive review I found some edge cases that in rare circumstances could lead to a signature check bypass. I think this is low-risk at best since the scenario requires special hardware behavior to exist. Our board were susceptible in the general sense, but we had implemented some additional sanity checks on the FIT structures that
prevented this. There are some proposed changes that attempt to mitigate this [1], [2], [3]. Any one of these changes mitigates the bypass scenario. If you don’t mind reaching out to me I can share the exact situation/details.

[1] https://lists.denx.de/pipermail/u-boot/2018-June/330454.html
[2] https://lists.denx.de/pipermail/u-boot/2018-June/330487.html
[3] https://lists.denx.de/pipermail/u-boot/2018-June/330599.html

https://lists.denx.de/pipermail/u-boot/2018-June/330898.html

Shadow-Box: Lightweight and Practical Kernel Protector for x86 (or ARM)

Lightweight Hypervisor-Based Kernel Protector

Shadow-box v2 (for ARM) is a next generation of Shadow-box v1 (for x86). If you want to know about Shadow-box for ARM, please visit Shadow-box for ARM project.

https://github.com/kkamagui/shadow-box-for-x86

https://github.com/kkamagui/shadow-box-for-arm

ACM SIG Int’l Symposium on Microarchitecture 2017: slides “temporarily available”

https://drive.google.com/drive/folders/1cmjix6YEPiyRde7Be2vshtny4mHjZ50p

https://www.microarch.org/micro50/

https://dl.acm.org/citation.cfm?id=3123939

http://www.wikicfp.com/cfp/servlet/event.showcfp?eventid=60858

Graz: School on Security and Correctness in the IoT 2018

Welcome to our second School on Security & Correctness in the Internet of Things 2018, held from 3.-9. September. It is hosted by the research center “Dependable Internet of Things“, located at Graz University of Technology. This school targets graduate students interested in security aspects of tomorrow’s IoT devices. Current advances in technology drive miniaturization and efficiency of computing devices, opening a variety of novel use cases like autonomous transportation, smart cities and health monitoring devices. However, device malfunction could potentially threaten human welfare or even life. Malfunction might not only be caused by design errors but also by intentional impairment. As computing devices are supposed to have high and permanent network connectivity, an attacker finding a vulnerability might easily target millions of devices at once. Moreover, integration of computing devices in everyday items exposes them to a potentially hostile physical environment. A central requirement of tomorrow’s IoT is the ability to execute software dependably on all kinds of devices. IoT devices need to provide security in the presence of network attacks as well as against attackers having physical access to the device. During the five-day school, participants will gain awareness of these IoT-related challenges. Introductory classes are supplemented by advanced courses in the area of system security, cryptography as well as software and hardware side-channels. During spare time participants are invited to enjoy the city of Graz and attend organized events.

https://www.securityweek.at/school/

ZFS-on-Root-Installer: Install ZFS on Root with Ubuntu

A Bare Metal Installer for ZFS on Root

This repository is intended to produce a bootable UEFI image that allows installing a full bare system with ZFS disks. Be aware that it is not intended for building dual-boot systems. While you are given the ability to choose which disks are used, the EFI boot system will wipe other OS entries. It uses an Ubuntu kernel and a minimal ramdisk builder to host the scripts used to perform the actual install.[…]

https://github.com/symmetryinvestments/zfs-on-root-installer

 

eWeek: Processor Flaws Force Chip Producers to Make Security Top Priority

[…]Here are five of the most serious that were reported in the past year.
1. Spectre, Meltdown variants post triple threat
2. Researchers find flaws related to Speculative Store Bypass
3. Intel acknowledges flaws in ME, AMT subsystems
4. When 140 years is not long enough: the ROCA flaw
5. Insensitive disclosure of sensitive issues: AMD PSP flaws

http://www.eweek.com/security/processor-flaws-force-chip-producers-to-make-security-top-priority

Intel releases SMM-free processor! :-)

Time to stock up new FreeDOS-capable hardware, while you have a chance. 😉

Actually, I’m not sure, maybe this limited edition processor *DOES* have SMM, that’d be interesting in other ways.

https://www.intel.com/content/www/us/en/products/processors/core/i7-processors/i7-8086k.html

https://game.intel.com/8086sweepstakes/

https://www.intel.com/content/dam/products/hero/foreground/core-i7-8086k-limited-edition-1x1.png.rendition.intel.web.225.225.png

https://www.bleepingcomputer.com/news/hardware/intel-announces-the-intel-core-i7-8086k-5ghz-limited-edition-cpu/

https://www.bleepingcomputer.com/news/hardware/intel-core-i7-8086k-5ghz-anniversary-edition-cpus-leaked-online/

Two random tweets

 

Virtualization-based security (VBS) memory enclaves: Data protection through isolation

I’m glad that Virtualization-Based Security has replaced VisualBasic Script as the new acronym for VBS. 🙂

The escalating sophistication of cyberattacks is marked by the increased use of kernel-level exploits that attempt to run malware with the highest privileges and evade security solutions and software sandboxes. Kernel exploits famously gave the WannaCry and Petya ransomware remote code execution capability, resulting in widescale global outbreaks. Windows 10 remained resilient to these attacks, with Microsoft constantly raising the bar in platform security to stay ahead of threat actors. Virtualization-based security (VBS) hardens Windows 10 against attacks by using the Windows hypervisor to create an environment that isolates a secure region of memory known as secure memory enclaves.[…]

https://cloudblogs.microsoft.com/microsoftsecure/2018/06/05/virtualization-based-security-vbs-memory-enclaves-data-protection-through-isolation/

 

Duo Labs: organizations can be “software secure but firmware vulnerable”

Duo Labs, who has EFIgy, an EFI firmware update status tool for Mac, is interviewed by InfoSecurity Magazine on the topic of EFI security:

[…]Although efforts to compromise EFI are most often carried out as part of highly targeted attacks, they remain a major threat to organizations, he warned. […] Smith revealed newly updated research from Duo Security which details shortcomings in Apple’s EFI update processes. Drawing on data collected from 73,000 customer machines, the findings show that 4.2% were running the wrong EFI version – much higher than the 1% or so expected. That rose to nearly 43% for the oldest Mac model on the market, dating back to 2015. The results also showed that organizations could be “software secure but firmware vulnerable.” […] He called on tech firms to introduce “the same degree” of transparency into the firmware update process as they do with software updates. Duo Security chose to study Apple because the firm’s singular ecosystem made it easier to analyze, but Smith warned that failings in the Wintel space are arguably even more acute.[…]

https://www.infosecurity-magazine.com/news/infosec18-experts-in-efi-update/

 

Rufus: 2 unspecified vulnerabilities hinted-at

Stefan Kanthak has submitted a bug against Pete Batard’s Rufus, a Win32 GDI tool that helps create USB thumbdrives. Rufus is — these days — somewhat of a rarity, an open source tool that is a native Win32 GDI GUI C application. These days, most open source GUI tools are Qt or GTK. Even Microsoft has basically given up on Win32. Old School Windows tool. 🙂

I wish Stefan was less of an <EXPLETIVE> in how he reported it.

Pete has been writing EFI-centric Free Software for a long time, not many people can write UEFI file system drivers and Win32 GDI GUI applications. Thanks for creating all these tools for people, Pete!

https://rufus.ie/
https://pete.akeo.ie/
https://skanthak.homepage.t-online.de/home.html
https://github.com/pbatard/rufus
http://www.openwall.com/lists/oss-security/2018/05/31/1

PT Security: new Intel ME research

https://github.com/ptresearch

Click to access Intel%20ME%20Security%20keys%20Genealogy%2C%20Obfuscation%20and%20other%20Magic.pdf

Eclypsium on BloombergTV

Re: https://firmwaresecurity.com/2018/05/17/eclypsium-in-bloomberg/

Eclypsium was on BloombergTV today! Hmm, I can’t find the URL of the video, if you can, please add it as a Comment to this blog.