• Share
  • Email
  • Embed
  • Like
  • Save
  • Private Content
DefCon 2012 - Finding Firmware Vulnerabilities
 

DefCon 2012 - Finding Firmware Vulnerabilities

on

  • 672 views

 

Statistics

Views

Total Views
672
Views on SlideShare
669
Embed Views
3

Actions

Likes
0
Downloads
13
Comments
0

1 Embed 3

http://storify.com 3

Accessibility

Categories

Upload Details

Uploaded via as Adobe PDF

Usage Rights

CC Attribution-NonCommercial-ShareAlike LicenseCC Attribution-NonCommercial-ShareAlike LicenseCC Attribution-NonCommercial-ShareAlike License

Report content

Flagged as inappropriate Flag as inappropriate
Flag as inappropriate

Select your reason for flagging this presentation as inappropriate.

Cancel
  • Full Name Full Name Comment goes here.
    Are you sure you want to
    Your message goes here
    Processing…
Post Comment
Edit your comment

    DefCon 2012 - Finding Firmware Vulnerabilities DefCon 2012 - Finding Firmware Vulnerabilities Presentation Transcript

    • RED BALLOON Security FRAK: Firmware Reverse Analysis Konsole Ang Cui a@redballoonsecurity.com7.27.2012   Defcon  20  
    • 5th Year Ph.D. Candidate Intrusion Detection Systems Lab Columbia University W h o a m I What do I DO7.27.2012   Defcon  20  
    • 5th Year Ph.D. Candidate Intrusion Detection Systems Lab Columbia University Co-Founder and CEO Red Balloon Security Inc. W h o a m www.redballoonsecurity.com I What do I DO7.27.2012   Defcon  20  
    • 5th Year Ph.D. Candidate Intrusion Detection Systems Lab Columbia University Co-Founder and CEO Red Balloon Security Inc. W h o a m www.redballoonsecurity.com I Past publications: •  What do I Pervasive Insecurity of Embedded Network Devices. [RAID10] •  A Quantitative Analysis of the Insecurity DO of Embedded Network Devices. [ACSAC10] •  Killing the Myth of Cisco IOS Diversity: Towards Reliable Large-Scale Exploitation of Cisco IOS. [USENIX WOOT 11] •  Defending Legacy Embedded Systems with Software Symbiotes. [RAID11] •  From Prey to Hunter: Transforming Legacy Embedded Devices Into Exploitation Sensor Grids. [ACSAC11]7.27.2012   Defcon  20  
    • 5th Year Ph.D. Candidate Intrusion Detection Systems Lab Columbia University Co-Founder and CEO Red Balloon Security Inc. W h o a m www.redballoonsecurity.com I Past Embedded Tinkerings: •  What do I •  Interrupt-Hijack Cisco IOS Rootkit HP LaserJet Printer Rootkit DO7.27.2012   Defcon  20  
    • Interrupt-Hijack Shellcode [blackhat USA 2011]7.27.2012   Defcon  20  
    • HP-RFU Vulnerability HP LaserJet 2550 Rootkit [28c3] Attacker 4. Win: Reverse Shell Server -> Kitteh 1. Reverse Proxy Printer -> Attacker Firewall 2. Reverse Proxy Printer -> Victim Server Network Printer 3. Attacker -> Server Via Reverse Proxy7.27.2012   Defcon  20  
    • WORKFLOW [XYZ Embedded {Offense|Defense}] Unpacking Process:Binary Firmware Image Analysis and Manipulation Firmware Re-Packing Process 7.27.2012   Defcon  20  
    • WORKFLOW [XYZ Embedded {Offense|Defense}] Unpacking Process:Binary Firmware Image Parse Analysis and Manipulation Package Manifest Firmware Re-Packing Process 7.27.2012   Defcon  20  
    • WORKFLOW [XYZ Embedded {Offense|Defense}] Unpacking Process: De{cript,compress}Binary Firmware Image For each "Record" Record Parse In Firmware Record Record Record Digitally Encrypted? Compressed? Checksummed? Analysis and Manipulation Package Signed? Manifest Known Algorithm or Proprietary Algorithm? Firmware Re-Packing Process 7.27.2012   Defcon  20  
    • WORKFLOW [XYZ Embedded {Offense|Defense}] Unpacking Process: De{cript,compress} For eachBinary Firmware Image For each "Record" "unpacked Record" Record In Firmware Parse In Firmware Record Record Record Digitally FileSystem Extraction Encrypted? Compressed? Checksummed? Analysis and Manipulation Package Signed? Manifest Known Algorithm or Proprietary Algorithm? Known Format or Proprietary Format? Firmware Re-Packing Process 7.27.2012   Defcon  20  
    • WORKFLOW [XYZ Embedded {Offense|Defense}] Unpacking Process: De{cript,compress} For eachBinary Firmware Image For each "Record" "unpacked Record" Record In Firmware Parse In Firmware Record Record Record Digitally FileSystem Extraction Encrypted? Compressed? Checksummed? Analysis and Manipulation Package Signed? Manifest Known Algorithm or Proprietary Algorithm? Known Format or Proprietary Format? Firmware Re-Packing Process 7.27.2012   Defcon  20  
    • WORKFLOW [XYZ Embedded {Offense|Defense}] Unpacking Process: De{cript,compress} For eachBinary Firmware Image For each "Record" "unpacked Record" Record In Firmware Parse In Firmware Record Record Record Digitally FileSystem Extraction Encrypted? Compressed? Checksummed? Analysis and Manipulation Package Signed? Manifest Known Algorithm or Proprietary Algorithm? Known Format or Proprietary Format? Firmware For each "unpacked Record" Re-Pack Modified In Firmware File System Known Format or Proprietary Format? Re-Packing Process 7.27.2012   Defcon  20  
    • WORKFLOW [XYZ Embedded {Offense|Defense}] Unpacking Process: De{cript,compress} For eachBinary Firmware Image For each "Record" "unpacked Record" Record In Firmware Parse In Firmware Record Record Record Digitally FileSystem Extraction Encrypted? Compressed? Checksummed? Analysis and Manipulation Package Signed? Manifest Known Algorithm or Proprietary Algorithm? Known Format or Proprietary Format? Firmware For each "unpacked Re-{cript,compress}, Recalculate Checksum, etc Record" Re-Pack Modified In Firmware Record Record Record Record Digitally File System Encrypted? Compressed? Checksummed? Signed? Known Format or Proprietary Format? Known Algorithm or Proprietary Algorithm? Re-Packing Process 7.27.2012   Defcon  20  
    • WORKFLOW [XYZ Embedded {Offense|Defense}] Unpacking Process: De{cript,compress} For eachBinary Firmware Image For each "Record" "unpacked Record" Record In Firmware Parse In Firmware Record Record Record Digitally FileSystem Extraction Encrypted? Compressed? Checksummed? Analysis and Manipulation Package Signed? Manifest Known Algorithm or Proprietary Algorithm? Known Format or Proprietary Format? Firmware For each "unpacked Re-{cript,compress}, Recalculate Checksum, etc Record" Re-Pack Modified In Firmware Repack Record Record Record Record Digitally File System All Binary Encrypted? Compressed? Checksummed? Signed? "records" Known Format or Proprietary Format? Known Algorithm or Proprietary Algorithm? Re-Packing Process 7.27.2012   Defcon  20  
    • WORKFLOW [XYZ Embedded {Offense|Defense}] Unpacking Process: De{cript,compress} For eachBinary Firmware Image For each "Record" "unpacked Record" Record In Firmware Parse In Firmware Record Record Record Digitally FileSystem Extraction Encrypted? Compressed? Checksummed? Analysis and Manipulation Package Signed? Manifest Known Algorithm or Proprietary Algorithm? Known Format or Proprietary Format? Firmware For each "unpacked Re-{cript,compress}, Recalculate Checksum, etc Record" Re- Re-Pack Modified In Firmware Repack Record generate Record Record Record Digitally File System All Binary Encrypted? Compressed? Checksummed? Package Signed? "records" Manifest Known Format or Proprietary Format? Known Algorithm or Proprietary Algorithm? Re-Packing Process 7.27.2012   Defcon  20  
    • Payload Design Reasons why Ang stays home on Friday night7.27.2012   Defcon  20  
    • Payload Design Reasons why Ang stays home on Friday night Payload Developement7.27.2012   Defcon  20  
    • Payload Design Reasons why Ang stays home on Friday night Payload Developement Payload Testing7.27.2012   Defcon  20  
    • Payload Design Reasons why Ang stays home on Friday night Payload Developement Payload Testing STARE @ BINARY BLOB7.27.2012   Defcon  20  
    • Payload Design Reasons why Ang stays home on Friday night Payload DevelopementDesign Payload Payload Design Payload Payload Testing Developement STARE THIS PART @ BINARY L   BLOB7.27.2012   Defcon  20  
    • F R A K irmware everse nalysis onsole [Better Living Through Software Engineering]7.27.2012   Defcon  20  
    • F R A K irmware everse nalysis onsole Firmware Unpacking Firmware Analysis Engine Engine Firmware Modification Firmware Repacking Engine Engine Programmatic API Interactive Console7.27.2012   ACCESS Defcon  20   Access
    • F R A K irmware everse nalysis onsole HP-RFU Cisco IOS Cisco-CNU XYZ-Format Arbitrary Module Module Module Module Firmware Image of Unknown Format Firmware Unpacking Firmware Unpacking Firmware Analysis Engine Engine Engine Firmware Modification Firmware Modification Firmware Repacking Engine Engine Engine Programmatic API Programmatic Interactive Console7.27.2012   ACCESS ACCESS Defcon  20   Access
    • F R A K irmware everse nalysis onsole HP-RFU Cisco IOS Cisco-CNU XYZ-Format Arbitrary Module Module Module Module Firmware Image of Unknown Format Firmware Unpacking Firmware Unpacking Firmware Analysis Engine Engine Engine Unpacked Firmware Binary Firmware Modification Firmware Modification Firmware Repacking Engine Engine Engine Programmatic API Programmatic Interactive Console7.27.2012   ACCESS ACCESS Defcon  20   Access
    • F R A K irmware everse nalysis onsole HP-RFU Cisco IOS Cisco-CNU XYZ-Format Arbitrary Module Module Module Module Firmware Image of Unknown Format Firmware Unpacking Firmware Unpacking Firmware Analysis Engine Engine Engine Unpacked XYZ Dynamic Firmware Software Instrumentation Binary Symbiotes & Rootkit Firmware Modification Firmware Modification Firmware Repacking Engine Engine Engine Programmatic API Programmatic Interactive Console7.27.2012   ACCESS ACCESS Defcon  20   Access
    • F R A K irmware everse nalysis onsole HP-RFU Cisco IOS Cisco-CNU XYZ-Format Arbitrary Module Module Module Module Firmware Image of Unknown Format Firmware Unpacking Firmware Unpacking Firmware Analysis Engine Engine Engine Unpacked XYZ Dynamic Firmware Software Instrumentation Binary Symbiotes & Rootkit Firmware Modification Firmware Modification Firmware Repacking Engine Engine Engine Programmatic API Programmatic Interactive Console7.27.2012   ACCESS ACCESS Defcon  20   Access
    • F R A K irmware everse nalysis onsole Unpack, Analyze, Modify, Repack: Cisco IOS7.27.2012   Defcon  20  
    • Payload Design Payload Reasons why Ang stays Developement home on Friday night Payload Developement Payload Testing Payload Design Payload Testing STARE @ BINARY BLOB ? STARE THIS PART @ BINARY L   BLOB Thanks FRAK!7.27.2012   Defcon  20  
    • Demos •  Packer/Repacker for Cisco IOS, HP-RFU •  Automagic Binary Analysis •  IDA-Pro Integration •  Entropy-related Analysis •  Automated IOS/RFU Rootkit Injection7.27.2012   Defcon  20  
    • FRAK Konsole7.27.2012   Defcon  20  
    • FRAK is still WIP. For Early Access Contact Frak-request@redballoonsecurity.com7.27.2012   Defcon  20  
    • 7.27.2012   Defcon  20