Modern microarchitectures incorporate optimization techniques such as speculative loads and store forwarding to improve the memory bottleneck. The processor executes the load speculatively before the stores, and forwards the data of a preceding store to the load if there is a potential dependency. This enhances performance since the load does not have to wait for preceding stores to complete. However, the dependency prediction relies on partial address information, which may lead to false dependencies and stall hazards. In this work, we are the first to show that the dependency resolution logic that serves the speculative load can be exploited to gain information about the physical page mappings. Microarchitectural side-channel attacks such as Rowhammer and cache attacks rely on the reverse engineering of the virtual-to-physical address mapping. We propose the SPOILER attack which exploits this leakage to speed up this reverse engineering by a factor of 256. Then, we show how this can improve the Prime+Probe attack by a 4096 factor speed up of the eviction set search, even from sandboxed environments like JavaScript. Finally, we improve the Rowhammer attack by showing how SPOILER helps to conduct DRAM row conflicts deterministically with up to 100% chance, and by demonstrating a double-sided Rowhammer attack with normal user’s privilege. The later is due to the possibility of detecting contiguous memory pages using the SPOILER leakage.
Microarchecture Workshop: video available
Intel announces IntelSGX Card
Purism announces PureBoot
Flashing the BIOS on the PC Engines APU4c4
https://twitter.com/lattera/status/1092959249011924992
This shows how to update BIOS on a FreeBSD-based environment:
https://github.com/lattera/articles/blob/master/hardware/apu/2019-02-05_flashing_bios/article.md
Super UEFIinSecureBoot Disk is a bootable image with GRUB2 bootloader designed to be used as a base for recovery USB flash drives
Super UEFIinSecureBoot Disk
Super UEFIinSecureBoot Disk is a bootable image with GRUB2 bootloader designed to be used as a base for recovery USB flash drives. Key feature: disk is fully functional with UEFI Secure Boot mode activated. It can launch any operating system or .efi file, even with untrusted, invalid or missing signature.
HowTo-setup-an-UEFI-Development-PC
There’s a new short document on setting up UEFI Tianocore development environment, it is Windows-centric:
https://github.com/MinnowWare/HowTo-setup-an-UEFI-Development-PC
see-also: https://github.com/tianocore/tianocore.github.io/wiki/Windows-systems
NDSS Workshop on Binary Analysis Research (BAR) 2019: slides uploaded
https://twitter.com/_jsoo_/status/1099845953287204865
B2R2: Building an Efficient Front-End for Binary Analysis
Rapidly Mitigating Vulnerabilities with Security Workarounds
A Cross-Architecture Instruction Embedding Model for Natural Language Processing-Inspired Binary Code Analysis
Binary Mutation Analysis of Tests Using Reassembleable Disassembly
CLIK on PLCs! Attacking Control Logic with Decompilation and Virtual PLC
Enhancing Symbolic Execution by Machine Learning Based Solver Selection
Symbolic Path Tracing to Find Android Permission-Use Triggers
Towards Automatically Generating a Sound and Complete Dataset for Evaluating Static Analysis Tools
Performance, Correctness, Exceptions: Pick Three
Intel open-sources HBFA app to help with firmware security testing
Intel announced plans today to open-source a new firmware security testing tool named HBFA –or the Host-based Firmware Analyzer. The new project, a security testing tool for UEFI-based firmware, will be formally introduced at next week’s RSA 2019 security conference that will be held in San Francisco.[…]
https://www.zdnet.com/article/intel-open-sources-hbfa-app-to-help-with-firmware-security-testing/
Latch-Up: a conference dedicated to free and open source silicon
We encourage anybody involved in the open source semiconductor engineering space to come along and give share your work or experience. Presentations slots as short as 3 minute lightning-talks up to 30 minute talks with Q and A are available. So if you’ve designed, worked on or even just used open source IP cores and/or management systems, verification IP, build flows, SoCs, simulators, synthesis tools, FPGA and ASIC implementation tools, languages and DSLs, compilers, or anything related we’d love to have you join us to share your experience.
https://fossi-foundation.org/2019/02/24/announcing-latchup-portland
https://fossi-foundation.org/latchup/
Finding Undocumented Intel Atom MSR’s in the Viliv S5 Through BIOS Reverse Engineering
There’s an URL to the rom.bin at the end of the article.
https://stragedevices.blogspot.com/2019/02/finding-verified-intel-atom-msrs-in.html
coreboot: Trusted Boot integration
Eclypsium: The Missing Security Primer for Bare Metal Cloud Services
Thunderclap
https://twitter.com/osxreverser/status/1100410945107505153
The Thunderclap vulnerabilities are security flaws that affect the way modern computers interact with peripheral devices such as network cards, storage, and graphics cards. These vulnerabilities allow an attacker with physical access to a Thunderbolt port to compromise a target machine in a matter of seconds, running arbitrary code at the highest privilege level and potentially gaining access to passwords, banking logins, encryption keys, private files, browsing and other data. Attacks exploiting these vulnerabilities can also be carried out by seemingly innocuous peripherals like chargers and projectors that correctly charge or project video but simultaneously compromise the host machine. The Thunderclap platform is a hardware/software stack for research into the security of computer peripherals and their interaction with operating systems. It was used to discover the Thunderclap vulnerabilities and develop proof-of-concept exploits. […]
The Thunderclap platform consists of an FPGA that runs the Thunderclap application. The FPGA then plugs into a computer via PCI Express or Thunderbolt. The Thunderclap application makes the FPGA behave to the computer like a genuine Ethernet card (the Intel 82574L network interface card or NIC). The operating system will identify the ethernet peripheral, load drivers, allow the device to access memory (via DMA and an IOMMU if enabled), and ask it to send and receive packets. With this deep interaction with the operating system, Thunderclap’s device model provides hooks that allow payload functions to be added to device behavior. For example, when the operating system asks the NIC to send a packet, it provides the NIC with the address of the data to send. A payload function might search nearby memory looking for plaintext data that was intended for a different network device.
thunderclap.io/thunderclap-paper-ndss2019.pdf
X86-64-Semantics: Semantics of x86-64 in K
The project presents the most complete and thoroughly tested formal semantics of x86-64 to date. Our semantics faithfully formalizes all the non-deprecated, sequential user-level instructions of the x86-64 Haswell instruction set architecture. This totals 3155 instruction variants, corresponding to 774 mnemonics. The semantics is fully executable and has been tested against more than 7,000 instruction-level test cases and the GCC torture test suite.
https://github.com/kframework/X86-64-semantics
see-also:
http://www.kframework.org/index.php/Main_Page
https://runtimeverification.com/blog/k-framework-an-overview/
https://github.com/davidlazar/llvm-semantics
x86-assembly-cheat and arm-assembly-cheat
x86-assembly-cheat:
x86 IA-32 and x86-64 userland minimal examples tutorial. Hundreds of runnable asserts. Nice GDB setup. IO done with libc, so OS portable in theory. NASM and GAS covered. Tested in Ubuntu 18.04. Containers (ELF), linking, calling conventions.
https://github.com/cirosantilli/x86-assembly-cheat
arm-assembly-cheat:
ARMv7 and ARMv8 assembly userland minimal examples tutorial. Runnable asserts on x86 hosts with QEMU user mode or natively on an ARM guests. Nice GDB step debug setup. Tested on Ubuntu 18.04 host and Raspberry Pi 2 and 3 guests.
UEFI gets Shadow Stack Support for X86 SMM
UEFI Utility DisplayBMP Updated to Support More Formats and Scrolling
This post details recent updates to a simple UEFI shell utility for displaying BMP images that I first released in 2015 and subsequently updated in 2017, and again this year. Source code for the previous versions is available on Github at UEFI-Utilities-2016 and UEFI-Utilities-2018 respectfully.[…]
Microsoft Windows: System Guard Secure Launch and SMM protection
[I think this documentation is new. Maybe the feature is new as well.]
This topic explains how to configure System Guard Secure Launch and System Management Mode (SMM) protection to improve the startup security of Windows 10 devices. The information below is presented from a client perspective.[…]
UefiBootMenu: A graphic uefi boot menu as application
A graphic uefi boot menu as application ( post Dxe only )
https://github.com/oO0oO0oO0o0o00/UefiBootMenu
Firmware Security 
You must be logged in to post a comment.