Justin Hall of Microsoft has an updated article on partitioning drives for OEMs and system builders. Useful background on how Windows is expecting GPT partitions and related storage issues.
Tag: Microsoft
Microsoft’s RIoT (Robust IoT)
Microsoft Research has released a paper on their new Robust IoT platform:
RIoT – A Foundation for Trust in the Internet of Things
Paul England, Andrey Marochko, Dennis Mattoon, Stefan Thom, and David Wooten
21 April 2016
MSR-TR-2016-18
RIoT (Robust Internet-of-Things) is an architecture for providing foundational trust services to computing devices. The trust services include device identity, sealing, attestation, and data integrity. The term “Robust” is used because the minimal trusted computing base is tiny, and because RIoT capabilities can remotely re-establish trust in devices that have been compromised by malware. The term IoT is used because these services can be provided at low cost on even the tiniest of devices.
http://research.microsoft.com/apps/pubs/default.aspx?id=264838
Troy Martin’s Windows Device Guard trilogy
Troy Martin of 1E has written the final of this 3-part blog posts on Device Guard, a new feature of Windows 10, targetting enterprise sysadmins.
[…]
Welcome to the third and final blog in the series on Device Guard!!
Device Guard hardens various attack surfaces on an endpoint creating a “chain of trust” from the hardware through to the Windows OS kernel and to software running in Windows.
Device Guard components run in isolation from the Windows kernel and is secured by a Windows Hyper-V container called Virtual Secure Mode (VSM).
It is evident that Device Guard provides revolutionary endpoint security in Windows 10; a formidable opponent and offense against viruses, malware, bad actors and other modern day threats. Time to start taking advantage of it and securing the enterprise!!
[…]
ASUS brick warning for Windows updates
Some ASUS users are having UEFI-related Windows update problems that may brick their systems. A few news sites have stories on this:
[…] KB3133977, a security update for Windows 7, has been identified as the cause for this problem. Following its installation, it forces Windows 7 to enable Secure Boot, even though it is actually not supported by Microsoft anymore. This eventually prevents the system from properly rebooting. Microsoft has clearly stated that it is in no way responsible for this predicament. Providing clarification, a company spokesperson stated that the problem occurs because of how Asus has created some of its motherboards with its own modified version of the Secure Boot feature. In other words, users facing problems in this regard will have to contact Asus directly to have the issue addressed. […]
http://tech.firstpost.com/news-analysis/a-microsoft-windows-7-update-is-bricking-some-pcs-with-asus-motherboards-313729.html
http://www.thecountrycaller.com/60295-microsoft-corporation-msft-windows-7-update-is-bricking-pcs/
http://www.pcper.com/news/General-Tech/Another-reason-not-use-UEFI-Secure-Boot
List of UEFI vendors who care about security
Which UEFI vendors care — or at least may care — about security? The list (alphabetically) is shorter than you might expect:
AMD
AMI
Apple
Dell
Hewlett Packard Enterprises
HP Inc.
Insyde Software
Intel Corp.
Lenovo
Microsoft
Phoenix Technologies
Nobody else. If your vendor is not listed above, ask them why you should purchase a UEFI-based system from them.
The above list is from the list of vendors who have feedback mechanisms listed on the UEFI Forum’s security contact page.
OSR on Windows IoT on Rasberry PI 3
Peter at OSR has a new blog post about using Embedded Windows — now called Windows IoT — on a Rasberry PI3, with a lot of advice for embedded Windows developer using this beta platform.
[…] You can’t connect WinDbg to the RPI 3 via the network. You have to use the serial port. To be successful in this endeavor, you’ll need a super-secret TTL to USB Serial Port cable (this one from Adafruit works just dandy). […]
Secrets of Using Win10 IoT Core on the RPI 3 (and staying sane)
If you do Windows, and have not looked at OSR’s online resources, it is worth a look, they have some tools that beat SysInternals, and the NTDev mailing list is probably the best public source of NT experienced developers, and one of the few places outside MSDN blogs that Microsoft developers publicly post technically useful information:
http://www.osronline.com/section.cfm?section=27
http://www.osronline.com/cf.cfm?PageURL=showlists.cfm?list=NTDEV
new Microsoft ACPI table: WSMT
As mentioned earlier this week, Microsoft just released a spec for their new ACPI table WSMT (Windows SMM Security Mitigations Table):
The Windows SMM Security Mitigations Table specification contains details of an ACPI table that was created for use with Windows operating systems that support Windows virtualization-based security (VBS) features. This information applies for Windows Server Technical Preview 2016, and Windows 10, version 1607. […]
Full spec:
http://download.microsoft.com/download/1/8/A/18A21244-EB67-4538-BAA2-1A54E0E490B6/WSMT.docx
The UEFI Forum maintains ACPI specs. AFAICT, their ACPI spec list does not yet list this new WSMT table.
http://www.uefi.org/acpi
Also, there’s a strange copyright in this spec:
Portions of this software may be based on NCSA Mosaic. NCSA Mosaic was developed by the National Center for Supercomputing Applications at the University of Illinois at Urbana-Champaign. Distributed under a licensing agreement with Spyglass, Inc.
Maybe I am just noticing this paragraph, and Microsoft always uses that on copyright pages, and does not mention other old software, only NCSA Mosaic. But why NCSA Mosaic-centric copyrights in an WSMT ACPI table?? Microsoft IE 1.0 was based on NCSA Mosaic source code, via Spyglass purchase, but that was long before EFI or ACPI. I didn’t notice anything Win9x/BIOS/ISA-PNP-centric about WSMT. :-).
In related news, Jiewen Yao of Intel has submitted the WSMT definition into the tianocore EDK-II project:
MdePkg: Add WSMT definition. This patch adds Windows SMM Security Mitigation Table @ http://download.microsoft.com/download/1/8/A/18A21244-EB67-4538-BAA2-1A54E0E490B6/WSMT.docx
…/WindowsSmmSecurityMitigationTable.h | 39 ++++++++++++++++++++++
1 file changed, 39 insertions(+)
+#define EFI_ACPI_WINDOWS_SMM_SECURITY_MITIGATION_TABLE_SIGNATURE SIGNATURE_32(‘W’, ‘S’, ‘M’, ‘T’)
Jiewen also submitted a 12-part patch, enhancing SMM to deal with this new table:
[PATCH 00/12] Enhance SMM Communication by using fixed comm buffer. This series patches are generate to meet Microsoft WSMT table definition on FIXED_COMM_BUFFERS requirement. Before this series patches, the DXE or OS module can use any non-SMM memory as communication buffer to exchange data with SMM agent. Microsoft WSMT table has requirement to support fixed communication buffer – so that SMM agent can only support communication buffer with type EfiReservedMemoryType/EfiRuntimeServicesCode/EfiRuntimeServicesData/EfiACPIMemoryNVS, which will not be used by OS during runtime. So we clean up all SMM handler to only use these memory regions for SMM communication, and enhance check in SmmMemLib to catch the violation. This series patches are validated on real platforms with SMM enabled. This series patches are validated on OVMF ia32-x64 with SMM enabled.
For full patch, see list archives:
https://lists.01.org/mailman/listinfo/edk2-devel
Windows SMM Security Mitigations Table
https://twitter.com/rootkovska/status/72268142072921292
Windows SMM Security Mitigations Table v1.0
http://download.microsoft.com/download/1/8/A/18A21244-EB67-4538-BAA2-1A54E0E490B6/WSMT.docx
MWR Labs’ Windbg python plugin
MWR Labs has a new blog post on using Python with Windbg, the Microsoft Windows system debugger.
https://twitter.com/mwrlabs/status/722397141499539456
https://labs.mwrinfosecurity.com/blog/heap-tracing-with-windbg-and-python/
https://github.com/sam-b/windbg-plugins
https://labs.mwrinfosecurity.com/
(I wish Microsoft would properly integrate Python to Windbg, instead of requiring third parties to do so.)
WinFlashROM: moving hosts
Darmawan Salihun has posted a new blog about WinFlashROM, a Windows port of FlashROM he did, and is moving it from Google Code to Github:
“This is old news because the code haven’t been updated for years. However, it might still relevant for those who want to port flashrom or other similar utility to present day Windows. I haven’t developed Windows driver anymore since Windows Server 2003. I’m not even sure if WDM-style driver is still in use in Windows. But, I might be returning to develop Windows driver this year. So, yeah, you (and I) never know.”
More information:
https://github.com/pinczakko/winflashrom
http://bioshacking.blogspot.co.id/2016/04/moving-winflashrom-code-to-github.html
(I haven’t looked into this, but I wonder if the CHIPSEC HAL for Windows (and Linux) might be useful in such a port. At least the kernel driver is maintained by Intel….)
ByoSoft supports Intel Firmware Engine
https://twitter.com/FirmwareEngine/status/720168913229590528
Intel Developer Forum (IDF) takes place in San Francisco and also in China, and the one in ShenZhen is in the news now. Nanjing Byosoft Co., Ltd — aka Byosoft, a UEFI firmware vendor, announced that their ByoCore(TM) BIOS will fully support Intel Firmware Engine:
“Byosoft is the first vendor announce to fully support Intel® Firmware Engine among the independent firmware vendors in the industry, and the Intel® Firmware Engine technology will offer a low-cost, high-flexibility, easy-to-use service solution to Byosoft’s customers in Internet of Thing (IoT) and embedded market.”
“Byosoft believe Intel® Firmware Engine can greatly help customer to use ByoCoreTM BIOS and finish the customization, especially for those who don’t purchase source code of the ByoCoreTM. Intel® Firmware Engine offers flexible method of firmware customization based on binary, and without involving Byosoft engineer direct support, the customer can finish the firmware modification by themselves to create the required image.”
“Byosoft has co-worked with Intel and upgraded the ByoCoreTM BIOS codebase to support Intel® Firmware Engine. ByoCoreTM customer can fast customize ByoCoreTM firmware through Intel® Firmware Engine, configuring, adding or removing the existed firmware packages, and integrate user-defined payload. With Intel® Firmware Engine, ByoCoreTM customer can build customized firmware faster and easier.”
Full announcement:
http://www.byosoft.com.cn/xwzxx/98.htm
This is great news for the Windows UEFI ecosystem. Again, I wish Intel would release a Linux version of the Windows-only Firmware Engine. 😦
Microsoft relicensed EDK2 FatPkg to BSD!!
Laszlo Ersek of RedHat has updated the EDK2’s FatPkg to use the BSD license!
“This is huge. It will enable Fedora to ship OvmfPkg and ArmVirtPkg builds. It will enable RHEL to ship OVMF in Main. Of course other GNU/Linux distros will benefit similarly.”
I rarely say this as much as I’d like to, but: “Great job Microsoft!”
http://thread.gmane.org/gmane.comp.bios.edk2.devel/9930/focus=9956
Windows 10 Secure Boot information
Yung Chou has a blog post on Windows 10’s implementation of UEFI Secure Boot:
An Introduction of UEFI Secure Boot in Windows 10 Enterprise
As a firmware interface standard to replace BIOS (Basic Input/Output System), UEFI (Unified Extensible Firmware Interface) specification has been a collective effort by UEFI Forum members for a while. UEFI is in essence an abstraction layer between firmware and OS, and independent of device hardware and architecture. Which provides flexibility for supporting multiple and various OS environments and as well acts as a generic target boot environment of drivers for cross-platform compatibility, as opposed to the need to develop a particular driver for particular hardware. With UEFI, there are also security opportunities to better defend a class of malware like bootkit and rootkit targeting the pre-boot environment of a device. […]
An Introduction of UEFI Secure Boot and Disk Partitions in Windows 10
Windows Device Guard information
Ash de Zylva of Microsoft has a blog post on Windows 10’s Device Guard and Credential Guard:
Windows 10 Device Guard and Credential Guard Demystified
While helping Windows Enterprise customers deploy and realize the benefits of Windows 10, I’ve observed there’s still a lot of confusion regarding the security features of the operating system. This is a shame since some of the key benefits of Windows 10 involve these deep security features. This post serves to detail the Device Guard and Credential Guard feature sets, and their relationship to each other. […]
http://blogs.technet.com/b/ash/archive/2016/03/02/windows-10-device-guard-and-credential-guard-demystified.aspx
Windows UEFI development course
WinInsider — probably via Alex Ionescu — has a UEFI development course available. Alex is the author of VisualUEFI, which hides the non-Visual Studio’isms of EDK-II development. Alex, along with others at Wininternals, is also one of the current authors of the “Windows Internals” book from Microsoft Press, now a 2-volume 6th edition set, originally called “Inside Windows NT”, written by Helen Custer.
Windows UEFI Development (3 Days or 5 Days)
In this course, one can expect to learn the internals of the Unified Extensible Firmware Interface inside and out, from the high-level concepts and overview of its functionality, down to the low-level development of actual UEFI applications, drivers, and services. The seminar will go over the history of UEFI’s development, from its original “Intel Boot Initiative” days to today’s SecureBoot facilities (and controversies), discuss the core UEFI data structures that form the basis of the environment, describe the different internal boot phases of the UEFI Runtime, and go in detail over the main UEFI protocols and their semantics. The course will also cover how UEFI leverages several Microsoft technologies, such as Authenticode and the Portable Executable (PE) format. Finishing off the lecture section will be a deep dive on how Windows 8 and later take advantage of UEFI to support booting off GPT disks, implementing SecureBoot, and speeding up the boot experience. Windows user-mode and kernel-mode APIs that interact with UEFI, as well as internal kernel data structures and capabilities in the UEFI HAL will also be shown off. Alongside the lecture period, attendees will get their hands dirty with bare-to-the-metal UEFI development using Visual Studio, as well as learning how to setup the UEFI SDK (EDK) to work alongside Microsoft’s development tools. Participants will get the chance to build their own UEFI applications, drivers, and runtime services, as well as learn how to debug and test their work in the OVMF environment alongside QEMU, without requiring actual UEFI hardware. The course will also show how to develop and build SecureBoot-compatible binaries. Finally, attendees will discover the Windows-specific Boot Application Runtime Environment, how to build compatible applications, and how to leverage the environment from both a UEFI and PCAT perspective. Attendees will then write both offensive and defensive UEFI code that hooks and/or protects the Windows Boot Loader.
UEFI Course Outline:
* Introduction to UEFI
* UEFI Architecture
* UEFI Protocols & Services
* Windows and UEFI
* Windows Boot Application Environment
* Windows Boot Loader Internals
* EDK and Visual Studio Development
* Windows & UEFI Interfacing
Topics:
* UEFI Protocols: UEFI Device Handles, UEFI Text and Graphics, UEFI Local and Remote I/O, UEFI USB & PCI, UEFI File System, Custom Protocols
* UEFI Services: UEFI Boot Services & Runtime Services, UEFI System Table, ACPI & UEFI, Custom Services
* UEFI Architecture: Measured Boot & Secure Boot, UEFI Stages & Layers (SEC, PEI, DXE), GPT Partitioning, Types of UEFI Binaries
* Windows & UEFI: Calling UEFI Services, Accessing UEFI Variables, Windows Boot Library and UEFI, BCD and UEFI, HAL and UEFI
* Windows Boot Environment: PCAT and UEFI Portability, Core Data Structures, Entrypoint and Callbacks, Building a Windows Boot Application
* Windows Boot Loader: Boot Stages, Boot Loader Functionality, Security Services (BitLocker and more), Boot Structures, Handoff to Kernel
* UEFI Development: Obtaining and Installing the EDK, Setting up Visual Studio with the EDK, EDK Hello World, Interfacing with EDK Libraries, Obtaining and Installing OVMF
* Offensive UEFI: Hooking UEFI Services and Protocols, Windows Boot Environment Hooks, Persistence with UEFI
* Defensive UEFI: Checking for Boot Loader Integrity, Detecting UEFI Hooks and Bootkits
Microsoft EMET pre-5.5 exploitable
Microsoft Releases Update for EMET
US-CERT is aware of a vulnerability in Microsoft Enhanced Mitigation Experience Toolkit (EMET) versions prior to 5.5. Exploitation of this vulnerability may allow a remote attacker to bypass or disable EMET to take control of an affected system. US-CERT recommends users and administrators visit the Microsoft Security TechCenter and upgrade to EMET version 5.5.
https://technet.microsoft.com/en-us/security/jj653751
https://www.fireeye.com/blog/threat-research/2016/02/using_emet_to_disabl.html
https://www.us-cert.gov/ncas/current-activity/2016/02/23/Microsoft-Releases-Update-EMET
Microsoft releases EMET 5.5
If you use Windows, you should probably check out EMET:
https://twitter.com/MattT_Cyber/status/694920707474530304
As Wikipedia describes: Microsoft’s Enhanced Mitigation Experience Toolkit (EMET) is a freeware security toolkit for Microsoft Windows . It provides a unified interface to enable and fine-tune Windows security features. It can be used as an extra layer of defence against malware attacks, after the firewall and before antivirus software.
http://blogs.technet.com/b/srd/archive/2016/02/02/enhanced-mitigation-experience-toolkit-emet-version-5-5-is-now-available.aspx
https://www.microsoft.com/en-us/download/details.aspx?id=50766&WT.mc_id=rss_windows_allproducts
https://en.wikipedia.org/wiki/Enhanced_Mitigation_Experience_Toolkit
Using TPMs in embedded systems
Stefan Thom (Microsoft), Steve Hanna (Infineon), and Stacy Cannady (Cisco) have an article in Electronic Design on TPM use in embedded systems. If you are new to TPM, this is a nice introduction.
Standardizing Trust for Embedded Systems
It’s time to get more serious about the lack of security in embedded products. With recently developed standards, it’s implementation just got easier. If you haven’t been concerned about malicious players hacking into your products in the past, or haven’t found success with previous efforts, it’s time for renewed attention and action. Hacking efforts aren’t slowing and, in fact, are on the rise. These days, hackers can accomplish far more than ever before—and the repercussions are far more costly. […]
Full article:
http://electronicdesign.com/embedded/standardizing-trust-embedded-systems
Windows 10 health check features
https://twitter.com/dfullerto/status/690555872917987328
Microsoft has an article that describes the new health check security features of Windows 10, which include use of UEFI Secure Boot and TPM technology, among others:
This article details an end-to-end solution that helps you protect high-value assets by enforcing, controlling, and reporting the health of Windows 10-based devices, including hardware requirements.
https://technet.microsoft.com/en-us/library/mt592023%28v=vs.85%29.aspx
Intel MPX support for Microsoft Visual Studio 2015
From the Microsoft Visual Studio blog, there’s a new post mentioning that VS2015.update1 has a new “Experimental” support of Microsoft MPX (Memory Protection Extensions).
This post is about Intel® Memory Protection Extensions (Intel MPX) support in Microsoft Visual Studio* 2015; content provided by Gautham Beeraka, George Kuan, and Juan Rodriguez from Intel Corporation. Update 1 for Visual Studio 2015 was announced on November 30, 2015. This update includes experimental compiler and debugger support for Intel MPX. Intel MPX can check all pointer reads and writes to ensure they remain within their declared memory bounds. This technology can detect buffer overflows and stop program execution at runtime, averting possible system compromises. It enables C/C++ code to make use of the new MPX instruction set and registers introduced in the 6th Generation Intel® Core™ Processors (“MPX-enabled platform”). The Microsoft Visual C++ Compiler* and linker can now generate checks automatically, a capability enabled by specifying a command line option. This blog explains how you can use automatic MPX code generation and debug MPX-enabled binaries. For more details on Intel MPX, please see the Intel MPX Technology web page. […]
Firmware Security 
You must be logged in to post a comment.