Eloi Sanfélix y Javier Moreno - Hardware hacking on your couch [RootedCON 2012]

Hardware hacking on your coach Intro to affordable embedded hacking Eloi Sanfelix <eloi@riscure.com> Javi Moreno <javi.moreno@nruns.com> #rootedHW

The life of a software security guy during the day

The life of a software security guy during the night

Hardware = FUN Source: http://www.flickr.com/photos/neimod/

This is NOT about....

... but more ... Source: http://dontstuffbeansupyournose.com

Overview

InfoGathering

Classic Embedded System

Mapping of the device 10

Open Source Info Gathering• Search the web – Part # / Chip model  Datasheets – Similar models – Exploits for similar devices – ...

InterfacingEmbedded Systems

Interesting interfaces Interface Typical uses RS232 Shells , debug output Debug output, peripheral management, i2c / SPI serial EEPROM, ... JTAG Testing and debuggingUSB / Ethernet / SATA / Etc Same as your PC ;-)

Finding interfaces

Bus Pirate v3.x

Openbench Logic Sniffer

DEMO: Interfacing & sniffing

DumpingFirmware

How to obtain firmware?• Online firmware updates• Flash dumping – SPI for serial ROMs – Via debug access (e.g JTAG) – Desoldering + external flash readers • Commercial readers • Microcontroller-based dumpers

Placa ROMs

Binary Visualization

Firmware Reverse Engineering

Debugging

JTAG interface

Debugging with JTAG• Boundary Scan only: – Reading / Modifying memory – Checking control lines (inputs/outputs)• Using additional aids: – Private instructions – Debugging logic • ARM: EmbeddedICE • MIPS: EJTAG • Motorola: BDM

Debugging with JTAG (2)• Provides: – Hardware breakpoints – Hardware watchpoints – Register access• Example: EJTAG

DEMO: Meet the BUS BLASTER

Locating JTAG AB D C

Locating JTAG (2)

Locating JTAG (3)

Locating JTAG (4)

Image source: www.hirox-usa.com

BGA (2)• Drilling through the PCB Balls on CPU: Balls through PCB:

Can’t debug? Emulate!• You still can use emulators – Qemu – GXEmul – Skyeye – ...

SecuringEmbedded Systems

Secure Embedded System

Key security features Feature Description Internal boot code / core must assure Secure boot integrity of loaded firmware Security subsystem must assure integrity Runtime integrity of running code Debug interfaces must either be disabled Interface protection or (securely) protected Sensitive keys must be stored within the Key storage chipset and not readable to the application Content stored in external memory (RAM) during runtime must be protectedExternal memory protection from attackers. (scrambling and maybe authentiaction) Need to withstand SCA/FI attacks in Protected crypto cores order to properly protect keys.

Conclusion• Embedded hacking = FUN• Attacker’s challenges – Info gathering often difficult – Interfacing trickier than with software• Defender’s challenges – Device running under hostile environment

Shopping list Item Price Arduino / Other dev boards 20-60€ each / 20 to 300€ Bus Pirate 25€ Bus Blaster / GoodFET 30€ / DIYOpenbench Logic Sniffer / Saleae Logic Analyzer 40€ / 120€ Cables, solder, screwdrivers, probes, ... - DSO Oscilloscope Nano / Quad 70€ / 150€ USB Microscope ~20 € OpenVizsla (when available) 100 – 200 EUR

Some things to look at• Routers, modems, STBs, MFPs ...• Gaming consoles, modern TVs• PC parts• (Smart)phones• Smart meters, alarms, SCADA/PLCs...• Car or vehicle electronics• Home appliances, domotics• Gadgets

HW Hacking resources• Hack a day – www.hackaday.com• /dev/ttyS0 – www.devttys0.com• Bunnie’s blog – www.bunniestudios.com• Debugmo.de – debugmo.de• Pagetable – www.pagetable.com• HW vendors’ forums: SeedStudio, Sparkfun , adafruit.com, Dangerous Prototypes , ...• Fritzing – www.fritzing.org• [... The list goes on ...]

Thanks!Eloi Sanfelix (@esanfelix) Javi Moreno (@vierito5) eloi@riscure.com javi.moreno@nruns.com

Eloi Sanfélix y Javier Moreno - Hardware hacking on your couch [RootedCON 2012]

by RootedCON

Accessibility

Categories

Upload Details

Usage Rights

2 Embeds 3

Statistics

Eloi Sanfélix y Javier Moreno - Hardware hacking on your couch [RootedCON 2012] Presentation Transcript

https://si0.twimg.com	2
https://twimg0-a.akamaihd.net	1