DefCon 2012 - Firmware Vulnerability Hunting with FRAK
Upcoming SlideShare
Loading in...5
×
 

DefCon 2012 - Firmware Vulnerability Hunting with FRAK

on

  • 1,875 views

"Embedded Device Firmware Vulnerability Hunting Using FRAK, the Firmware Reverse Analysis Konsole -- FRAK is a framework for unpacking, analyzing, modifying and repacking the firmware images of ...

"Embedded Device Firmware Vulnerability Hunting Using FRAK, the Firmware Reverse Analysis Konsole -- FRAK is a framework for unpacking, analyzing, modifying and repacking the firmware images of proprietary embedded devices. The FRAK framework provides a programmatic environment for the analysis of arbitrary embedded device firmware as well as an interactive environment for the disassembly, manipulation and re-assembly of such binary images.

We demonstrate the automated analysis of Cisco IOS, Cisco IP phone and HP LaserJet printer firmware images. We show how FRAK can integrate with existing vulnerability analysis tools to automate bug hunting for embedded devices. We also demonstrate how FRAK can be used to inject experimental host-based defenses into proprietary devices like Cisco routers and HP printers. "

Statistics

Views

Total Views
1,875
Views on SlideShare
1,726
Embed Views
149

Actions

Likes
0
Downloads
24
Comments
0

3 Embeds 149

http://labmistress.com 145
http://storify.com 3
http://www.slashdocs.com 1

Accessibility

Categories

Upload Details

Uploaded via as Adobe PDF

Usage Rights

CC Attribution-NonCommercial-ShareAlike LicenseCC Attribution-NonCommercial-ShareAlike LicenseCC Attribution-NonCommercial-ShareAlike License

Report content

Flagged as inappropriate Flag as inappropriate
Flag as inappropriate

Select your reason for flagging this presentation as inappropriate.

Cancel
  • Full Name Full Name Comment goes here.
    Are you sure you want to
    Your message goes here
    Processing…
Post Comment
Edit your comment

    DefCon 2012 - Firmware Vulnerability Hunting with FRAK DefCon 2012 - Firmware Vulnerability Hunting with FRAK Presentation Transcript

    • RED BALLOON Security FRAK: Firmware Reverse Analysis Konsole Ang Cui a@redballoonsecurity.com7.27.2012   Defcon  20  
    • 5th Year Ph.D. Candidate Intrusion Detection Systems Lab Columbia University W h o a m I What do I DO7.27.2012   Defcon  20  
    • 5th Year Ph.D. Candidate Intrusion Detection Systems Lab Columbia University Co-Founder and CEO Red Balloon Security Inc. W h o a m www.redballoonsecurity.com I What do I DO7.27.2012   Defcon  20  
    • 5th Year Ph.D. Candidate Intrusion Detection Systems Lab Columbia University Co-Founder and CEO Red Balloon Security Inc. W h o a m www.redballoonsecurity.com I Past publications: •  What do I Pervasive Insecurity of Embedded Network Devices. [RAID10] •  A Quantitative Analysis of the Insecurity DO of Embedded Network Devices. [ACSAC10] •  Killing the Myth of Cisco IOS Diversity: Towards Reliable Large-Scale Exploitation of Cisco IOS. [USENIX WOOT 11] •  Defending Legacy Embedded Systems with Software Symbiotes. [RAID11] •  From Prey to Hunter: Transforming Legacy Embedded Devices Into Exploitation Sensor Grids. [ACSAC11]7.27.2012   Defcon  20  
    • 5th Year Ph.D. Candidate Intrusion Detection Systems Lab Columbia University Co-Founder and CEO Red Balloon Security Inc. W h o a m www.redballoonsecurity.com I Past Embedded Tinkerings: •  What do I •  Interrupt-Hijack Cisco IOS Rootkit HP LaserJet Printer Rootkit DO7.27.2012   Defcon  20  
    • Interrupt-Hijack Shellcode [blackhat USA 2011]7.27.2012   Defcon  20  
    • HP-RFU Vulnerability HP LaserJet 2550 Rootkit [28c3] Attacker 4. Win: Reverse Shell Server -> Kitteh 1. Reverse Proxy Printer -> Attacker Firewall 2. Reverse Proxy Printer -> Victim Server Network Printer 3. Attacker -> Server Via Reverse Proxy7.27.2012   Defcon  20  
    • WORKFLOW [XYZ Embedded {Offense|Defense}] Unpacking Process:Binary Firmware Image Analysis and Manipulation Firmware Re-Packing Process 7.27.2012   Defcon  20  
    • WORKFLOW [XYZ Embedded {Offense|Defense}] Unpacking Process:Binary Firmware Image Parse Analysis and Manipulation Package Manifest Firmware Re-Packing Process 7.27.2012   Defcon  20  
    • WORKFLOW [XYZ Embedded {Offense|Defense}] Unpacking Process: De{cript,compress}Binary Firmware Image For each "Record" Record Parse In Firmware Record Record Record Digitally Encrypted? Compressed? Checksummed? Analysis and Manipulation Package Signed? Manifest Known Algorithm or Proprietary Algorithm? Firmware Re-Packing Process 7.27.2012   Defcon  20  
    • WORKFLOW [XYZ Embedded {Offense|Defense}] Unpacking Process: De{cript,compress} For eachBinary Firmware Image For each "Record" "unpacked Record" Record In Firmware Parse In Firmware Record Record Record Digitally FileSystem Extraction Encrypted? Compressed? Checksummed? Analysis and Manipulation Package Signed? Manifest Known Algorithm or Proprietary Algorithm? Known Format or Proprietary Format? Firmware Re-Packing Process 7.27.2012   Defcon  20  
    • WORKFLOW [XYZ Embedded {Offense|Defense}] Unpacking Process: De{cript,compress} For eachBinary Firmware Image For each "Record" "unpacked Record" Record In Firmware Parse In Firmware Record Record Record Digitally FileSystem Extraction Encrypted? Compressed? Checksummed? Analysis and Manipulation Package Signed? Manifest Known Algorithm or Proprietary Algorithm? Known Format or Proprietary Format? Firmware Re-Packing Process 7.27.2012   Defcon  20  
    • WORKFLOW [XYZ Embedded {Offense|Defense}] Unpacking Process: De{cript,compress} For eachBinary Firmware Image For each "Record" "unpacked Record" Record In Firmware Parse In Firmware Record Record Record Digitally FileSystem Extraction Encrypted? Compressed? Checksummed? Analysis and Manipulation Package Signed? Manifest Known Algorithm or Proprietary Algorithm? Known Format or Proprietary Format? Firmware For each "unpacked Record" Re-Pack Modified In Firmware File System Known Format or Proprietary Format? Re-Packing Process 7.27.2012   Defcon  20  
    • WORKFLOW [XYZ Embedded {Offense|Defense}] Unpacking Process: De{cript,compress} For eachBinary Firmware Image For each "Record" "unpacked Record" Record In Firmware Parse In Firmware Record Record Record Digitally FileSystem Extraction Encrypted? Compressed? Checksummed? Analysis and Manipulation Package Signed? Manifest Known Algorithm or Proprietary Algorithm? Known Format or Proprietary Format? Firmware For each "unpacked Re-{cript,compress}, Recalculate Checksum, etc Record" Re-Pack Modified In Firmware Record Record Record Record Digitally File System Encrypted? Compressed? Checksummed? Signed? Known Format or Proprietary Format? Known Algorithm or Proprietary Algorithm? Re-Packing Process 7.27.2012   Defcon  20  
    • WORKFLOW [XYZ Embedded {Offense|Defense}] Unpacking Process: De{cript,compress} For eachBinary Firmware Image For each "Record" "unpacked Record" Record In Firmware Parse In Firmware Record Record Record Digitally FileSystem Extraction Encrypted? Compressed? Checksummed? Analysis and Manipulation Package Signed? Manifest Known Algorithm or Proprietary Algorithm? Known Format or Proprietary Format? Firmware For each "unpacked Re-{cript,compress}, Recalculate Checksum, etc Record" Re-Pack Modified In Firmware Repack Record Record Record Record Digitally File System All Binary Encrypted? Compressed? Checksummed? Signed? "records" Known Format or Proprietary Format? Known Algorithm or Proprietary Algorithm? Re-Packing Process 7.27.2012   Defcon  20  
    • WORKFLOW [XYZ Embedded {Offense|Defense}] Unpacking Process: De{cript,compress} For eachBinary Firmware Image For each "Record" "unpacked Record" Record In Firmware Parse In Firmware Record Record Record Digitally FileSystem Extraction Encrypted? Compressed? Checksummed? Analysis and Manipulation Package Signed? Manifest Known Algorithm or Proprietary Algorithm? Known Format or Proprietary Format? Firmware For each "unpacked Re-{cript,compress}, Recalculate Checksum, etc Record" Re- Re-Pack Modified In Firmware Repack Record generate Record Record Record Digitally File System All Binary Encrypted? Compressed? Checksummed? Package Signed? "records" Manifest Known Format or Proprietary Format? Known Algorithm or Proprietary Algorithm? Re-Packing Process 7.27.2012   Defcon  20  
    • Payload Design Reasons why Ang stays home on Friday night7.27.2012   Defcon  20  
    • Payload Design Reasons why Ang stays home on Friday night Payload Developement7.27.2012   Defcon  20  
    • Payload Design Reasons why Ang stays home on Friday night Payload Developement Payload Testing7.27.2012   Defcon  20  
    • Payload Design Reasons why Ang stays home on Friday night Payload Developement Payload Testing STARE @ BINARY BLOB7.27.2012   Defcon  20  
    • Payload Design Reasons why Ang stays home on Friday night Payload DevelopementDesign Payload Payload Design Payload Payload Testing Developement STARE THIS PART @ BINARY L   BLOB7.27.2012   Defcon  20  
    • F R A K irmware everse nalysis onsole [Better Living Through Software Engineering]7.27.2012   Defcon  20  
    • F R A K irmware everse nalysis onsole Firmware Unpacking Firmware Analysis Engine Engine Firmware Modification Firmware Repacking Engine Engine Programmatic API Interactive Console7.27.2012   ACCESS Defcon  20   Access
    • F R A K irmware everse nalysis onsole HP-RFU Cisco IOS Cisco-CNU XYZ-Format Arbitrary Module Module Module Module Firmware Image of Unknown Format Firmware Unpacking Firmware Unpacking Firmware Analysis Engine Engine Engine Firmware Modification Firmware Modification Firmware Repacking Engine Engine Engine Programmatic API Programmatic Interactive Console7.27.2012   ACCESS ACCESS Defcon  20   Access
    • F R A K irmware everse nalysis onsole HP-RFU Cisco IOS Cisco-CNU XYZ-Format Arbitrary Module Module Module Module Firmware Image of Unknown Format Firmware Unpacking Firmware Unpacking Firmware Analysis Engine Engine Engine Unpacked Firmware Binary Firmware Modification Firmware Modification Firmware Repacking Engine Engine Engine Programmatic API Programmatic Interactive Console7.27.2012   ACCESS ACCESS Defcon  20   Access
    • F R A K irmware everse nalysis onsole HP-RFU Cisco IOS Cisco-CNU XYZ-Format Arbitrary Module Module Module Module Firmware Image of Unknown Format Firmware Unpacking Firmware Unpacking Firmware Analysis Engine Engine Engine Unpacked XYZ Dynamic Firmware Software Instrumentation Binary Symbiotes & Rootkit Firmware Modification Firmware Modification Firmware Repacking Engine Engine Engine Programmatic API Programmatic Interactive Console7.27.2012   ACCESS ACCESS Defcon  20   Access
    • F R A K irmware everse nalysis onsole HP-RFU Cisco IOS Cisco-CNU XYZ-Format Arbitrary Module Module Module Module Firmware Image of Unknown Format Firmware Unpacking Firmware Unpacking Firmware Analysis Engine Engine Engine Unpacked XYZ Dynamic Firmware Software Instrumentation Binary Symbiotes & Rootkit Firmware Modification Firmware Modification Firmware Repacking Engine Engine Engine Programmatic API Programmatic Interactive Console7.27.2012   ACCESS ACCESS Defcon  20   Access
    • F R A K irmware everse nalysis onsole Unpack, Analyze, Modify, Repack: Cisco IOS7.27.2012   Defcon  20  
    • Payload Design Payload Reasons why Ang stays Developement home on Friday night Payload Developement Payload Testing Payload Design Payload Testing STARE @ BINARY BLOB ? STARE THIS PART @ BINARY L   BLOB Thanks FRAK!7.27.2012   Defcon  20  
    • Demos •  Packer/Repacker for Cisco IOS, HP-RFU •  Automagic Binary Analysis •  IDA-Pro Integration •  Entropy-related Analysis •  Automated IOS/RFU Rootkit Injection7.27.2012   Defcon  20  
    • FRAK Konsole7.27.2012   Defcon  20  
    • FRAK is still WIP. For Early Access Contact Frak-request@redballoonsecurity.com7.27.2012   Defcon  20  
    • 7.27.2012   Defcon  20