SlideShare a Scribd company logo

Thunderbolts and Lightning: Very Very Frightening

•
•
B
blowmenowpls

People keep talking about Thunderbolt DMA attacks as though they're a foregone conclusion. Thus far, we haven't seen one that doesn't involve using a Thunderbolt to FireWire adapter. This kind of attack, when performed against current hardware, is subject to the same limitations and mitigations as the FireWire DMA attacks we've seen since Kiwicon's very own Metlstorm winlockpwned his way to fame in 2006. In this talk, rzn and snare will discuss their approach to attacking systems with a Thunderbolt port. Will our heroes triumph over evil, or will they get hit by a bus?

Technology
1 of 77
Download to read offline
SNARE & RZN @ SYSCAN APRIL 2014 THUNDERBOLTS AND LIGHTNING VERY, VERY FRIGHTENING
Thunderbolts and Lightning ⚡⚡⚡Very,Very FrighteningThunderbolts and Lightning ⚡⚡⚡Very,Very Frightening WHO ARE THESE IDIOTS? OBLIGATORY INTRO SLIDE ‣ rzn aka Sam ‣PhD student at UoA ‣research into ray-tracing on FPGAs ‣extensive collection of name tags and hair nets ‣ snare aka Loukas ‣computer guy at Azimuth Security ‣did some OS X kernel and UEFI firmware stuff one time ‣world’s strongest millionaire ‣internet-famous feet
Thunderbolts and Lightning ⚡⚡⚡Very,Very FrighteningThunderbolts and Lightning ⚡⚡⚡Very,Very Frightening WHAT IS THIS TALK ABOUT? ‣ Apparently Thunderbolt DMA attacks are totally a thing ‣ But we haven’t seen a PoC yet ‣ And it sounded like fun ‣ It’s not actually about Lightning (the iDevice connector) ‣Sorry Stefan
Thunderbolts and Lightning ⚡⚡⚡Very,Very FrighteningThunderbolts and Lightning ⚡⚡⚡Very,Very Frightening THINGS WHAT WE IS GOING TO TALK ABOUT AGENDA ‣ FireWire DMA attacks ‣ Thunderbolt ‣ How is PCIe formed? ‣ What the fuck is an FPGA? ‣ Our approach to attacking Thunderbolt ‣ Sweet stunt hack demo and stuff ‣ Defence
Thunderbolts and Lightning ⚡⚡⚡Very,Very FrighteningThunderbolts and Lightning ⚡⚡⚡Very,Very Frightening FIREWIRE DMA ATTACKS HIT BY THE SHORT BUS ‣ See Metlstorm’s “Hit By A Bus” circa 2006 (Ruxcon) ‣ First done by Quinn the Eskimo (Apple awesome dude) ‣ Won MacHack 2002 by drawing a screensaver over FireWire! ‣ See also Inception - a FireWire DMA tool ‣ How does it work? ‣ Using SBP-2 ‣ Firewire chipset does DMA R/W on PCIe bus ‣ Stream data out FW interface
Thunderbolts and Lightning ⚡⚡⚡Very,Very FrighteningThunderbolts and Lightning ⚡⚡⚡Very,Very Frightening FIREWIRE DMA ATTACKS HIT BY THE SHORT BUS
Thunderbolts and Lightning ⚡⚡⚡Very,Very FrighteningThunderbolts and Lightning ⚡⚡⚡Very,Very Frightening FIREWIRE DMA ATTACKS HIT BY THE SHORT BUS TARGET HOST MEMORY MCH FIREWIRE PCI EXPRESS
Thunderbolts and Lightning ⚡⚡⚡Very,Very FrighteningThunderbolts and Lightning ⚡⚡⚡Very,Very Frightening FIREWIRE DMA ATTACKS HIT BY THE SHORT BUS TARGET HOST MEMORY MCH FIREWIRE PCI EXPRESS ANALYSIS HOST FIREWIRE PCI EXPRESS STORAGE
Thunderbolts and Lightning ⚡⚡⚡Very,Very FrighteningThunderbolts and Lightning ⚡⚡⚡Very,Very Frightening FIREWIRE DMA ATTACKS HIT BY THE SHORT BUS TARGET HOST MEMORY MCH FIREWIRE PCI EXPRESS ANALYSIS HOST FIREWIRE PCI EXPRESS STORAGEbro, read data at 0xDEADBEA7
Thunderbolts and Lightning ⚡⚡⚡Very,Very FrighteningThunderbolts and Lightning ⚡⚡⚡Very,Very Frightening FIREWIRE DMA ATTACKS HIT BY THE SHORT BUS TARGET HOST MEMORY MCH FIREWIRE PCI EXPRESS ANALYSIS HOST FIREWIRE PCI EXPRESS STORAGEDMA read 0xDEADBEA7
Thunderbolts and Lightning ⚡⚡⚡Very,Very FrighteningThunderbolts and Lightning ⚡⚡⚡Very,Very Frightening FIREWIRE DMA ATTACKS HIT BY THE SHORT BUS TARGET HOST MEMORY MCH FIREWIRE PCI EXPRESS ANALYSIS HOST FIREWIRE PCI EXPRESS STORAGEhere ya go pal
Thunderbolts and Lightning ⚡⚡⚡Very,Very FrighteningThunderbolts and Lightning ⚡⚡⚡Very,Very Frightening LIMITATIONS HIT BY THE SHORT BUS ‣ Obviously requires that there be a FireWire interface ‣ 32-bit addressing = only lower 4GB of RAM ‣ On OS X FireWire DMA is disabled when the screen is locked & FileVault is enabled ‣ Kernel tells FW chipset not to do DMA any more ‣ #sadface
Thunderbolts and Lightning ⚡⚡⚡Very,Very FrighteningThunderbolts and Lightning ⚡⚡⚡Very,Very Frightening EH? ‣ Thunderbolt == PCIe + DisplayPort + pixie dust ! ! ! ! ! ! ! ‣ Send DMA requests directly over PCIe? WHAT’S A THUNDERBOLT?
Thunderbolts and Lightning ⚡⚡⚡Very,Very FrighteningThunderbolts and Lightning ⚡⚡⚡Very,Very Frightening EH? ‣ Thunderbolt == PCIe + DisplayPort + pixie dust ! ! ! ! ! ! ! ‣ Send DMA requests directly over PCIe? WHAT’S A THUNDERBOLT? PIXIE DUST
Thunderbolts and Lightning ⚡⚡⚡Very,Very Frightening PICS OR GTFO WHAT’S A THUNDERBOLT? Slightly more useful diagram
Thunderbolts and Lightning ⚡⚡⚡Very,Very FrighteningThunderbolts and Lightning ⚡⚡⚡Very,Very Frightening CHEATING WITH FIREWIRE THUNDERBOLT DMA THUS FAR ‣ “Thunderbolt DMA” ‣ Connect Thunderbolt to FireWire adapter ‣ ??? ‣ Profit ‣ Subject to the same limitations as regular FireWire
Thunderbolts and Lightning ⚡⚡⚡Very,Very FrighteningThunderbolts and Lightning ⚡⚡⚡Very,Very Frightening WHEN PCI AND PCI-X LOVE EACH OTHER VERY MUCH HOW IS PCIE FORMED? ‣ Serial point-to-point interconnect
Thunderbolts and Lightning ⚡⚡⚡Very,Very FrighteningThunderbolts and Lightning ⚡⚡⚡Very,Very Frightening WHEN PCI AND PCI-X LOVE EACH OTHER VERY MUCH HOW IS PCIE FORMED? ‣ Serial point-to-point interconnect ‣ A lane consists of a tx and rx differential pair 
 (4 wires per lane)
Thunderbolts and Lightning ⚡⚡⚡Very,Very FrighteningThunderbolts and Lightning ⚡⚡⚡Very,Very Frightening WHEN PCI AND PCI-X LOVE EACH OTHER VERY MUCH HOW IS PCIE FORMED? ‣ Serial point-to-point interconnect ‣ A lane consists of a tx and rx differential pair 
 (4 wires per lane) ‣ Scalable number of lanes, negotiated at link setup
Thunderbolts and Lightning ⚡⚡⚡Very,Very FrighteningThunderbolts and Lightning ⚡⚡⚡Very,Very Frightening WHEN PCI AND PCI-X LOVE EACH OTHER VERY MUCH HOW IS PCIE FORMED? ‣ Serial point-to-point interconnect ‣ A lane consists of a tx and rx differential pair 
 (4 wires per lane) ‣ Scalable number of lanes, negotiated at link setup ‣ Layered, packet based, transaction protocol ‣ Physical layer ‣ Data link layer ‣ Transaction layer
Thunderbolts and Lightning ⚡⚡⚡Very,Very FrighteningThunderbolts and Lightning ⚡⚡⚡Very,Very Frightening WHEN PCI AND PCI-X LOVE EACH OTHER VERY MUCH HOW IS PCIE FORMED? ‣ Serial point-to-point interconnect ‣ A lane consists of a tx and rx differential pair 
 (4 wires per lane) ‣ Scalable number of lanes, negotiated at link setup ‣ Layered, packet based, transaction protocol ‣ Physical layer ‣ Data link layer ‣ Transaction layer ‣ Level sensitive or message signaled interrupts
Thunderbolts and Lightning ⚡⚡⚡Very,Very FrighteningThunderbolts and Lightning ⚡⚡⚡Very,Very Frightening DMA HOW IS PCIE FORMED? ‣ Four transaction types ‣ I/O read/write ‣ Configuration read/write ‣ Memory read/write ‣ Messaging ‣ DMA: ‣ Configuration write to grant device “bus master” ‣ Write target address and command to device ‣ Device interrupts when finished
Thunderbolts and Lightning ⚡⚡⚡Very,Very FrighteningThunderbolts and Lightning ⚡⚡⚡Very,Very Frightening [1] WIKIPEDIA WTF IS AN FPGA? ‣ Field Programmable Gatorade Gate Array
Thunderbolts and Lightning ⚡⚡⚡Very,Very FrighteningThunderbolts and Lightning ⚡⚡⚡Very,Very Frightening [1] WIKIPEDIA WTF IS AN FPGA? ‣ Field Programmable Gatorade Gate Array ‣ Matrix of configurable logic blocks, each containing ‘slices’
Thunderbolts and Lightning ⚡⚡⚡Very,Very FrighteningThunderbolts and Lightning ⚡⚡⚡Very,Very Frightening [1] WIKIPEDIA WTF IS AN FPGA? ‣ Field Programmable Gatorade Gate Array ‣ Matrix of configurable logic blocks, each containing ‘slices’ ‣ Slice contents are the core of FPGA functionality ‣ Look up tables (LUTs) ‣ Flip-flops ‣ Carry chain ‣ Muxes
Thunderbolts and Lightning ⚡⚡⚡Very,Very FrighteningThunderbolts and Lightning ⚡⚡⚡Very,Very Frightening [1] WIKIPEDIA WTF IS AN FPGA? ‣ Field Programmable Gatorade Gate Array ‣ Matrix of configurable logic blocks, each containing ‘slices’ ‣ Slice contents are the core of FPGA functionality ‣ Look up tables (LUTs) ‣ Flip-flops ‣ Carry chain ‣ Muxes ‣ Additional general features: blockRAMs, FIFOs, DSP blocks, clocking resources (PLLs, DCMs)
Thunderbolts and Lightning ⚡⚡⚡Very,Very FrighteningThunderbolts and Lightning ⚡⚡⚡Very,Very Frightening [1] WIKIPEDIA WTF IS AN FPGA? ‣ Field Programmable Gatorade Gate Array ‣ Matrix of configurable logic blocks, each containing ‘slices’ ‣ Slice contents are the core of FPGA functionality ‣ Look up tables (LUTs) ‣ Flip-flops ‣ Carry chain ‣ Muxes ‣ Additional general features: blockRAMs, FIFOs, DSP blocks, clocking resources (PLLs, DCMs) ‣ Device specific features: PCIe, Ethernet, DDR2/3
Thunderbolts and Lightning ⚡⚡⚡Very,Very FrighteningThunderbolts and Lightning ⚡⚡⚡Very,Very Frightening [1] WIKIPEDIA WTF IS AN FPGA? ‣ Field Programmable Gatorade Gate Array ‣ Matrix of configurable logic blocks, each containing ‘slices’ ‣ Slice contents are the core of FPGA functionality ‣ Look up tables (LUTs) ‣ Flip-flops ‣ Carry chain ‣ Muxes ‣ Additional general features: blockRAMs, FIFOs, DSP blocks, clocking resources (PLLs, DCMs) ‣ Device specific features: PCIe, Ethernet, DDR2/3 ‣ Reprogrammable
Thunderbolts and Lightning ⚡⚡⚡Very,Very FrighteningThunderbolts and Lightning ⚡⚡⚡Very,Very Frightening LUTS LUTS LUTS WTF IS AN FPGA? ‣ logic ➤ truth table ➤ LUT ! ! ! ! ! ! ! ! ‣ A LUT is essentially a 6-input memory, containing the desired output for each set of inputs (addresses) ‣ It doesn’t matter how simple or complex the function, it is only limited by the inputs S1 S0 D C B A F 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 1 0 0 0 0 0 0 1 1 1 ⚡ ⚡ ⚡ ⚡ ⚡ ⚡ ⚡ 1 1 1 1 0 0 1 1 1 1 1 0 1 0 1 1 1 1 1 0 1 1 1 1 1 1 1 0 LUT I0 I1 I2 I3 I4 O INIT=11110F0F0303 A B C D S0 F S0 S1 F A B C D
Thunderbolts and Lightning ⚡⚡⚡Very,Very FrighteningThunderbolts and Lightning ⚡⚡⚡Very,Very Frightening IT’S ALL ABOUT THE LOLS WTF IS AN FPGA? ‣ Application logic is described in an HDL; verilog or vhdl
Thunderbolts and Lightning ⚡⚡⚡Very,Very FrighteningThunderbolts and Lightning ⚡⚡⚡Very,Very Frightening IT’S ALL ABOUT THE LOLS WTF IS AN FPGA? ‣ Application logic is described in an HDL; verilog or vhdl ‣ You can leave it all to the synthesis tool to infer logic, but it is important to understand how a LUT works
Thunderbolts and Lightning ⚡⚡⚡Very,Very FrighteningThunderbolts and Lightning ⚡⚡⚡Very,Very Frightening IT’S ALL ABOUT THE LOLS WTF IS AN FPGA? ‣ Application logic is described in an HDL; verilog or vhdl ‣ You can leave it all to the synthesis tool to infer logic, but it is important to understand how a LUT works ‣ Maximum frequency determined by “levels of logic” ‣ A level of logic is the combination of LUT delay and routing delay between two flip-flops ‣ LUT delay = static, constant property of the device ‣ Routing delay = dynamic, influenced my LUT placement
Thunderbolts and Lightning ⚡⚡⚡Very,Very FrighteningThunderbolts and Lightning ⚡⚡⚡Very,Very Frightening IT’S ALL ABOUT THE LOLS WTF IS AN FPGA? ‣ Application logic is described in an HDL; verilog or vhdl ‣ You can leave it all to the synthesis tool to infer logic, but it is important to understand how a LUT works ‣ Maximum frequency determined by “levels of logic” ‣ A level of logic is the combination of LUT delay and routing delay between two flip-flops ‣ LUT delay = static, constant property of the device ‣ Routing delay = dynamic, influenced my LUT placement ‣ Reduce levels of logic, place LUTs closer together = higher clock frequency
Thunderbolts and Lightning ⚡⚡⚡Very,Very FrighteningThunderbolts and Lightning ⚡⚡⚡Very,Very Frightening
Thunderbolts and Lightning ⚡⚡⚡Very,Very FrighteningThunderbolts and Lightning ⚡⚡⚡Very,Very Frightening ‣ Microblaze is a micro-controller that can be implemented in FPGA logic
Thunderbolts and Lightning ⚡⚡⚡Very,Very FrighteningThunderbolts and Lightning ⚡⚡⚡Very,Very Frightening ‣ Microblaze is a micro-controller that can be implemented in FPGA logic ‣ Interfaces with AXI bus ‣ Standard interface to easily memory map other custom or off-the-shelf IP blocks
Thunderbolts and Lightning ⚡⚡⚡Very,Very FrighteningThunderbolts and Lightning ⚡⚡⚡Very,Very Frightening ‣ Microblaze is a micro-controller that can be implemented in FPGA logic ‣ Interfaces with AXI bus ‣ Standard interface to easily memory map other custom or off-the-shelf IP blocks ‣ Code is written in C or C++, compiled with XSDK
Thunderbolts and Lightning ⚡⚡⚡Very,Very FrighteningThunderbolts and Lightning ⚡⚡⚡Very,Very Frightening ‣ Microblaze is a micro-controller that can be implemented in FPGA logic ‣ Interfaces with AXI bus ‣ Standard interface to easily memory map other custom or off-the-shelf IP blocks ‣ Code is written in C or C++, compiled with XSDK ‣ Really useful for writing control logic ‣ Previously you’d write large state machines in HDL ‣ Also means noobs (snare) can write code for it
Thunderbolts and Lightning ⚡⚡⚡Very,Very FrighteningThunderbolts and Lightning ⚡⚡⚡Very,Very Frightening ‣ Microblaze is a micro-controller that can be implemented in FPGA logic ‣ Interfaces with AXI bus ‣ Standard interface to easily memory map other custom or off-the-shelf IP blocks ‣ Code is written in C or C++, compiled with XSDK ‣ Really useful for writing control logic ‣ Previously you’d write large state machines in HDL ‣ Also means noobs (snare) can write code for it ‣ Connect it via serial and you can printf debug your logic!
Thunderbolts and Lightning ⚡⚡⚡Very,Very FrighteningThunderbolts and Lightning ⚡⚡⚡Very,Very Frightening BUTT, HOW DO WE DO PCIE? WTF IS AN FPGA?
Thunderbolts and Lightning ⚡⚡⚡Very,Very FrighteningThunderbolts and Lightning ⚡⚡⚡Very,Very Frightening BUTT, HOW DO WE DO PCIE? WTF IS AN FPGA? ‣ AXI PCIE core uses FPGA device specific features to implement PCIE
Thunderbolts and Lightning ⚡⚡⚡Very,Very FrighteningThunderbolts and Lightning ⚡⚡⚡Very,Very Frightening BUTT, HOW DO WE DO PCIE? WTF IS AN FPGA? ‣ AXI PCIE core uses FPGA device specific features to implement PCIE ‣ Memory mapped to MicroBlaze ‣ Read/write to memory mapped AXI core translates to PCIE read/write TLPs ‣ Read/write TLPs from PCIe translate to memory mapped AXI core read/write
Thunderbolts and Lightning ⚡⚡⚡Very,Very FrighteningThunderbolts and Lightning ⚡⚡⚡Very,Very Frightening FAKE IT TILL YOU BREAK IT OUR APPROACH ‣ Become bus master ‣ ??? ‣ Profit
Thunderbolts and Lightning ⚡⚡⚡Very,Very FrighteningThe Mathematics of Wonton Burrito Meals TARGET HOST MEMORY MCH PCI EXPRESS THUNDER BOLT THUNDERBOLT DMA MEMORY CAPTURE
Thunderbolts and Lightning ⚡⚡⚡Very,Very FrighteningThe Mathematics of Wonton Burrito Meals TARGET HOST MEMORY MCH PCI EXPRESS THUNDER BOLT THUNDERBOLT DMA MEMORY CAPTURE ANALYSIS DEVICE THUNDER BOLT FPGA PCI EXPRESS STORAGE
Thunderbolts and Lightning ⚡⚡⚡Very,Very FrighteningThe Mathematics of Wonton Burrito Meals TARGET HOST MEMORY MCH PCI EXPRESS THUNDER BOLT THUNDERBOLT DMA MEMORY CAPTURE ANALYSIS DEVICE THUNDER BOLT FPGA PCI EXPRESS STORAGE DMA read @ 0xDEADBEA7
Thunderbolts and Lightning ⚡⚡⚡Very,Very FrighteningThunderbolts and Lightning ⚡⚡⚡Very,Very Frightening FAKE IT TILL YOU BREAK IT OUR APPROACH TARGET HOST XILINX SP605 THUNDERBOLT PCIE AXI PCIE CORE MICROBLAZE BPLUS TH05 DSL2210 ANALYSIS HOST SERIAL AXI ‣ Board circuitry handles PCIE physical layer ‣ AXI PCIE core handles data link layer ‣ We write code for the MicroBlaze that reads and writes to the AXI core
Thunderbolts and Lightning ⚡⚡⚡Very,Very FrighteningThunderbolts and Lightning ⚡⚡⚡Very,Very Frightening OK, SO FPGA TALKS PCIe ATTACKING A MAC ‣ Phase 1 - write our own driver ‣ Make FPGA bus master ‣ Tell it what to do ! ‣ Phase 2 - imitate another device ‣ Change device id, vendor id in configuration space ‣ Trick the OS into loading an existing driver that will make us bus master
Thunderbolts and Lightning ⚡⚡⚡Very,Very FrighteningThunderbolts and Lightning ⚡⚡⚡Very,Very Frightening STUNT HACK?! ATTACKING A MAC ‣ PoC - patch auth handler to bypass login screen ‣ Return success? Nah return 1 bro ‣ Log in with any password
Thunderbolts and Lightning ⚡⚡⚡Very,Very Frightening
Thunderbolts and Lightning ⚡⚡⚡Very,Very Frightening FPGA development board
Thunderbolts and Lightning ⚡⚡⚡Very,Very Frightening FPGA development board FPGA
Thunderbolts and Lightning ⚡⚡⚡Very,Very Frightening Thunderbolt to PCIe board
Thunderbolts and Lightning ⚡⚡⚡Very,Very Frightening FPGA board PCIe connector
Thunderbolts and Lightning ⚡⚡⚡Very,Very Frightening Thunderbolt connector
Thunderbolts and Lightning ⚡⚡⚡Very,Very Frightening JTAG and UART connected to attacker
Thunderbolts and Lightning ⚡⚡⚡Very,Very Frightening Thunderbolt connected to victim
Thunderbolts and Lightning ⚡⚡⚡Very,Very FrighteningHairiest alpaca in the world
Thunderbolts and Lightning ⚡⚡⚡Very,Very FrighteningThunderbolts and Lightning ⚡⚡⚡Very,Very Frightening STUNT HACK?! ATTACKING A MAC ‣ PRE-DEMOVIDEO THINGY
Thunderbolts and Lightning ⚡⚡⚡Very,Very FrighteningThunderbolts and Lightning ⚡⚡⚡Very,Very Frightening STUNT HACK?! ATTACKING A MAC ‣ PRE-DEMOVIDEO THINGY
Thunderbolts and Lightning ⚡⚡⚡Very,Very FrighteningThunderbolts and Lightning ⚡⚡⚡Very,Very Frightening JUST IN CASE OUR STUPID DEMO DIDN’T WORK OTTERSTORM
Thunderbolts and Lightning ⚡⚡⚡Very,Very FrighteningThunderbolts and Lightning ⚡⚡⚡Very,Very Frightening IT’S OK, WE MADE A VIDEO
Thunderbolts and Lightning ⚡⚡⚡Very,Very FrighteningThunderbolts and Lightning ⚡⚡⚡Very,Very Frightening IT’S OK, WE MADE A VIDEO
Thunderbolts and Lightning ⚡⚡⚡Very,Very FrighteningThunderbolts and Lightning ⚡⚡⚡Very,Very Frightening YEP WAIT, THE DEMO WORKED?
Thunderbolts and Lightning ⚡⚡⚡Very,Very FrighteningThunderbolts and Lightning ⚡⚡⚡Very,Very Frightening Y’KNOW, IF YOU LIKE SECURITY AND STUFF THIS SEEMS BAD ‣ Intel realised this was not a good “feature” ‣ What to do about it? ‣Glue all the ports shut? ‣Voodoo curse? ‣Access controls on device I/O?
Thunderbolts and Lightning ⚡⚡⚡Very,Very FrighteningThunderbolts and Lightning ⚡⚡⚡Very,Very Frightening Y’KNOW, IF YOU LIKE SECURITY AND STUFF THIS SEEMS BAD ‣ Intel realised this was not a good “feature” ‣ What to do about it? ‣Glue all the ports shut? ‣Voodoo curse? ‣Access controls on device I/O?
Thunderbolts and Lightning ⚡⚡⚡Very,Very FrighteningThunderbolts and Lightning ⚡⚡⚡Very,Very Frightening Y’KNOW, IF YOU LIKE SECURITY AND STUFF THIS SEEMS BAD ‣ Intel realised this was not a good “feature” ‣ What to do about it? ‣Glue all the ports shut? ‣Voodoo curse? ‣Access controls on device I/O?
Thunderbolts and Lightning ⚡⚡⚡Very,Very FrighteningThunderbolts and Lightning ⚡⚡⚡Very,Very Frightening Y’KNOW, IF YOU LIKE SECURITY AND STUFF THIS SEEMS BAD ‣ Intel realised this was not a good “feature” ‣ What to do about it? ‣Glue all the ports shut? ‣Voodoo curse? ‣Access controls on device I/O? 👍
Thunderbolts and Lightning ⚡⚡⚡Very,Very FrighteningThunderbolts and Lightning ⚡⚡⚡Very,Very Frightening INTEL, YOU BASTARDS VT======D ‣ Virtualised I/O ‣ Hypervisor can now assign devices directly to guests ‣This is howVMDirectPath works ‣ DMA requests are remapped w/access controls ‣ Interrupts are remapped w/access controls
Thunderbolts and Lightning ⚡⚡⚡Very,Very FrighteningThunderbolts and Lightning ⚡⚡⚡Very,Very Frightening INTEL, YOU BASTARDS VT======D ‣ VT-d unit has “domains” ‣ There is at least one domain (the host’s domain) ‣ In order to assign a device to a guest, theVMM creates a domain for that guest ‣Assigns a device to it
Thunderbolts and Lightning ⚡⚡⚡Very,Very FrighteningThunderbolts and Lightning ⚡⚡⚡Very,Very Frightening A SECURITY FEATURE? VT-D ‣ OS X kernel configuresVT-d ‣Actually it’s the IOPCIFamily driver ‣All the devices are configured in a singleVT-d “domain” ‣ Drivers allocate DMA buffers ‣New kernel memory allocator tellsVT-d unit about regions ‣Now when DMA requests come in on the PCIe bus,VT-d says yea or nay ‣ If you are denied access, the kernel’sVT-d handler is called and you see this in your console: ‣vtd[0] fault: device 0:20:0 reason 0x5 W:0x64c000
Thunderbolts and Lightning ⚡⚡⚡Very,Very FrighteningThunderbolts and Lightning ⚡⚡⚡Very,Very Frightening INTEL, YOU BASTARDS VT-D P CPU/MCH PCIe DEVICE PCI EXPRESS BUS PCH VT-D ! MEMORY
Thunderbolts and Lightning ⚡⚡⚡Very,Very FrighteningThunderbolts and Lightning ⚡⚡⚡Very,Very Frightening INTEL, YOU BASTARDS VT-D ‣ On all >=2012 Macs (Ivy Bridge) ‣Requires OS config - supported in OS X since 10.8.2 ‣ Restricts PCIe device DMA access ‣This is balls ‣Means our trix don’t work on >=2012 machine running >10.8.2 ‣ Windows pre-8 (AFAIK) doesn’t configureVT-d ‣Pretty sure I remember reading that somewhere ‣ Linux does a much better job of configuringVT-d
Thunderbolts and Lightning ⚡⚡⚡Very,Very FrighteningThunderbolts and Lightning ⚡⚡⚡Very,Very Frightening PROBABLY NOT AM I OWNED? OWNED NOT OWNED :( OWNED OWNED <10.8.2 >=10.8.2 Pre-Ivy Bridge Ivy Bridge and later DUDE, WHAT THE HELL? UPGRADE YOUR SHIT
Thunderbolts and Lightning ⚡⚡⚡Very,Very FrighteningThunderbolts and Lightning ⚡⚡⚡Very,Very Frightening NEW TRIX WHAT’S NEXT? ‣ Maybe make the kit a little bit smaller ‣ BypassVT-d? ‣ See if we can do it without imitating a device? ‣ Full memory capture
Thunderbolts and Lightning ⚡⚡⚡Very,Very FrighteningThunderbolts and Lightning ⚡⚡⚡Very,Very Frightening REFERENCES ‣ Metlstorm - Hit by a Bus (Ruxcon 2006) ‣ http://www.security-assessment.com/files/presentations/ab_firewire_rux2k6-final.pdf ‣ Quinn the Eskimo - FireStarter (MacHack 2002) ‣ http://www.anarchistturtle.com/Quinn/WWW/Hacks.html ‣ Inception (FireWire DMA tool) ‣ http://www.breaknenter.org/projects/inception/ ‣ PCIe Base Specification (507 pages, great night time reading) ‣ http://read.pudn.com/downloads161/doc/729268/PCI_Express_Base_11.pdf ‣ Xilinx PCIe DMA Reference Design ‣ http://www.xilinx.com/support/documentation/application_notes/xapp1052.pdf
! ! ! ! ! ! greetz: vt, pipes, antic0de, quine, metlstorm, h1kar1, y011, radian ! special thanks to: thomas motherfuckin’ lim statler and waldorf (nagy and grugq) ! mad props to: barns. now let’s get grimy. KTHXBAI @snare snare@ho.ax http://ho.ax http://blog.azimuthsecurity.com @scollinsonz smc@affinity.net.nz http://affinity.net.nz

Recommended

Radio Stuff Hacking - Linux Day 2018
Radio Stuff Hacking - Linux Day 2018Radio Stuff Hacking - Linux Day 2018
Radio Stuff Hacking - Linux Day 2018
Pasquale 'sid' Fiorillo
 
Bus Pirate Workshop Ruxcon Hardware Hacking 2017
Bus Pirate Workshop Ruxcon Hardware Hacking 2017Bus Pirate Workshop Ruxcon Hardware Hacking 2017
Bus Pirate Workshop Ruxcon Hardware Hacking 2017
Tim N
 
Functional MCU programming #0: Development environment
Functional MCU programming #0: Development environmentFunctional MCU programming #0: Development environment
Functional MCU programming #0: Development environment
Kiwamu Okabe
 
Uncommon MiTM in uncommon conditions
Uncommon MiTM in uncommon conditionsUncommon MiTM in uncommon conditions
Uncommon MiTM in uncommon conditions
HeadLightSecurity
 
More Mad Science for the Commodore 64 (ECCC 2015)
More Mad Science for the Commodore 64 (ECCC 2015)More Mad Science for the Commodore 64 (ECCC 2015)
More Mad Science for the Commodore 64 (ECCC 2015)
Leif Bloomquist
 
Уязвимости программного обеспечения телекоммуникационного оборудования Yota
Уязвимости программного обеспечения телекоммуникационного оборудования YotaУязвимости программного обеспечения телекоммуникационного оборудования Yota
Уязвимости программного обеспечения телекоммуникационного оборудования Yota
HeadLightSecurity
 
Gnu linux on arm for $50 - $100
Gnu linux on arm for $50 - $100Gnu linux on arm for $50 - $100
Gnu linux on arm for $50 - $100
Dobrica Pavlinušić
 
44CON London 2015 - Hunting Asynchronous Vulnerabilities
44CON London 2015 - Hunting Asynchronous Vulnerabilities44CON London 2015 - Hunting Asynchronous Vulnerabilities
44CON London 2015 - Hunting Asynchronous Vulnerabilities
44CON
 

Recommended

Radio Stuff Hacking - Linux Day 2018
Radio Stuff Hacking - Linux Day 2018Radio Stuff Hacking - Linux Day 2018
Radio Stuff Hacking - Linux Day 2018
Pasquale 'sid' Fiorillo
 
Bus Pirate Workshop Ruxcon Hardware Hacking 2017
Bus Pirate Workshop Ruxcon Hardware Hacking 2017Bus Pirate Workshop Ruxcon Hardware Hacking 2017
Bus Pirate Workshop Ruxcon Hardware Hacking 2017
Tim N
 
Functional MCU programming #0: Development environment
Functional MCU programming #0: Development environmentFunctional MCU programming #0: Development environment
Functional MCU programming #0: Development environment
Kiwamu Okabe
 
Uncommon MiTM in uncommon conditions
Uncommon MiTM in uncommon conditionsUncommon MiTM in uncommon conditions
Uncommon MiTM in uncommon conditions
HeadLightSecurity
 
More Mad Science for the Commodore 64 (ECCC 2015)
More Mad Science for the Commodore 64 (ECCC 2015)More Mad Science for the Commodore 64 (ECCC 2015)
More Mad Science for the Commodore 64 (ECCC 2015)
Leif Bloomquist
 
Уязвимости программного обеспечения телекоммуникационного оборудования Yota
Уязвимости программного обеспечения телекоммуникационного оборудования YotaУязвимости программного обеспечения телекоммуникационного оборудования Yota
Уязвимости программного обеспечения телекоммуникационного оборудования Yota
HeadLightSecurity
 
Gnu linux on arm for $50 - $100
Gnu linux on arm for $50 - $100Gnu linux on arm for $50 - $100
Gnu linux on arm for $50 - $100
Dobrica Pavlinušić
 
44CON London 2015 - Hunting Asynchronous Vulnerabilities
44CON London 2015 - Hunting Asynchronous Vulnerabilities44CON London 2015 - Hunting Asynchronous Vulnerabilities
44CON London 2015 - Hunting Asynchronous Vulnerabilities
44CON
 
Device inspection to remote root
Device inspection to remote rootDevice inspection to remote root
Device inspection to remote root
Tim N
 
ifwt remote (sydney ruxmon edition)
ifwt remote (sydney ruxmon edition)ifwt remote (sydney ruxmon edition)
ifwt remote (sydney ruxmon edition)
Tim N
 
Git Money
Git MoneyGit Money
Git Money
Tim N
 
OSb: OSv on BitVisor (2)
OSb: OSv on BitVisor (2)OSb: OSv on BitVisor (2)
OSb: OSv on BitVisor (2)
Yushi Omote
 
OSb: OSv on BitVisor
OSb: OSv on BitVisorOSb: OSv on BitVisor
OSb: OSv on BitVisor
Yushi Omote
 
Introduction to VeriFast @ Kyoto
Introduction to VeriFast @ KyotoIntroduction to VeriFast @ Kyoto
Introduction to VeriFast @ Kyoto
Kiwamu Okabe
 
OS*: OSv on *
OS*: OSv on *OS*: OSv on *
OS*: OSv on *
Yushi Omote
 
Linux on RISC-V with Open Hardware (ELC-E 2020)
Linux on RISC-V with Open Hardware (ELC-E 2020)Linux on RISC-V with Open Hardware (ELC-E 2020)
Linux on RISC-V with Open Hardware (ELC-E 2020)
Drew Fustini
 
May 2013 HUG: Building common denominator of Hadoop distributions with Bigtop
May 2013 HUG: Building common denominator of Hadoop distributions with BigtopMay 2013 HUG: Building common denominator of Hadoop distributions with Bigtop
May 2013 HUG: Building common denominator of Hadoop distributions with Bigtop
Yahoo Developer Network
 
IPv6 SenD
IPv6 SenDIPv6 SenD
IPv6 SenD
rabdoul
 
Simplest-Ownage-Human-Observed… - Routers
Simplest-Ownage-Human-Observed… - Routers Simplest-Ownage-Human-Observed… - Routers
Simplest-Ownage-Human-Observed… - Routers
Logicaltrust pl
 
Stm32 develop tool introduction
Stm32 develop tool introductionStm32 develop tool introduction
Stm32 develop tool introduction
冠宇 陳
 
Home Automation with Asterisk - Astricon 2015 - Alberto Sagredo Castro
Home Automation with Asterisk - Astricon 2015 - Alberto Sagredo CastroHome Automation with Asterisk - Astricon 2015 - Alberto Sagredo Castro
Home Automation with Asterisk - Astricon 2015 - Alberto Sagredo Castro
Alberto Sagredo Castro
 
What the Fax!?
What the Fax!?What the Fax!?
What the Fax!?
Priyanka Aash
 
Internet Technology for the Commodore 64
Internet Technology for the Commodore 64Internet Technology for the Commodore 64
Internet Technology for the Commodore 64
Leif Bloomquist
 
Keeping your rack cool
Keeping your rack cool Keeping your rack cool
Keeping your rack cool
Pavel Odintsov
 
Keeping your rack cool with one "/IP route rule"
Keeping your rack cool with one "/IP route rule"Keeping your rack cool with one "/IP route rule"
Keeping your rack cool with one "/IP route rule"
Faelix Ltd
 
Hands-on VeriFast with STM32 microcontroller
Hands-on VeriFast with STM32 microcontrollerHands-on VeriFast with STM32 microcontroller
Hands-on VeriFast with STM32 microcontroller
Kiwamu Okabe
 
1. hardware basics
1. hardware basics1. hardware basics
1. hardware basics
Marian Marinov
 
DEF CON 27 - PHILIPPE LAULHERET - introduction to hardware hacking extended v...
DEF CON 27 - PHILIPPE LAULHERET - introduction to hardware hacking extended v...DEF CON 27 - PHILIPPE LAULHERET - introduction to hardware hacking extended v...
DEF CON 27 - PHILIPPE LAULHERET - introduction to hardware hacking extended v...
Felipe Prado
 
Insecure Obsolete and Trivial - The Real IOT
Insecure Obsolete and Trivial - The Real IOTInsecure Obsolete and Trivial - The Real IOT
Insecure Obsolete and Trivial - The Real IOT
Price McDonald
 
HIS 2015: Prof. Ian Phillips - Stronger than its weakest link
HIS 2015: Prof. Ian Phillips - Stronger than its weakest linkHIS 2015: Prof. Ian Phillips - Stronger than its weakest link
HIS 2015: Prof. Ian Phillips - Stronger than its weakest link
AdaCore
 

More Related Content

What's hot

Git Money
Git MoneyGit Money
Git Money
Tim N
 
Linux on RISC-V with Open Hardware (ELC-E 2020)
Linux on RISC-V with Open Hardware (ELC-E 2020)Linux on RISC-V with Open Hardware (ELC-E 2020)
Linux on RISC-V with Open Hardware (ELC-E 2020)
Drew Fustini
 
May 2013 HUG: Building common denominator of Hadoop distributions with Bigtop
May 2013 HUG: Building common denominator of Hadoop distributions with BigtopMay 2013 HUG: Building common denominator of Hadoop distributions with Bigtop
May 2013 HUG: Building common denominator of Hadoop distributions with Bigtop
Yahoo Developer Network
 
Simplest-Ownage-Human-Observed… - Routers
Simplest-Ownage-Human-Observed… - Routers Simplest-Ownage-Human-Observed… - Routers
Simplest-Ownage-Human-Observed… - Routers
Logicaltrust pl
 

What's hot (13)

Device inspection to remote root
Device inspection to remote rootDevice inspection to remote root
Device inspection to remote root
 
ifwt remote (sydney ruxmon edition)
ifwt remote (sydney ruxmon edition)ifwt remote (sydney ruxmon edition)
ifwt remote (sydney ruxmon edition)
 
Git Money
Git MoneyGit Money
Git Money
 
OSb: OSv on BitVisor (2)
OSb: OSv on BitVisor (2)OSb: OSv on BitVisor (2)
OSb: OSv on BitVisor (2)
 
OSb: OSv on BitVisor
OSb: OSv on BitVisorOSb: OSv on BitVisor
OSb: OSv on BitVisor
 
Introduction to VeriFast @ Kyoto
Introduction to VeriFast @ KyotoIntroduction to VeriFast @ Kyoto
Introduction to VeriFast @ Kyoto
 
OS*: OSv on *
OS*: OSv on *OS*: OSv on *
OS*: OSv on *
 
Linux on RISC-V with Open Hardware (ELC-E 2020)
Linux on RISC-V with Open Hardware (ELC-E 2020)Linux on RISC-V with Open Hardware (ELC-E 2020)
Linux on RISC-V with Open Hardware (ELC-E 2020)
 
May 2013 HUG: Building common denominator of Hadoop distributions with Bigtop
May 2013 HUG: Building common denominator of Hadoop distributions with BigtopMay 2013 HUG: Building common denominator of Hadoop distributions with Bigtop
May 2013 HUG: Building common denominator of Hadoop distributions with Bigtop
 
IPv6 SenD
IPv6 SenDIPv6 SenD
IPv6 SenD
 
Simplest-Ownage-Human-Observed… - Routers
Simplest-Ownage-Human-Observed… - Routers Simplest-Ownage-Human-Observed… - Routers
Simplest-Ownage-Human-Observed… - Routers
 
Stm32 develop tool introduction
Stm32 develop tool introductionStm32 develop tool introduction
Stm32 develop tool introduction
 
Home Automation with Asterisk - Astricon 2015 - Alberto Sagredo Castro
Home Automation with Asterisk - Astricon 2015 - Alberto Sagredo CastroHome Automation with Asterisk - Astricon 2015 - Alberto Sagredo Castro
Home Automation with Asterisk - Astricon 2015 - Alberto Sagredo Castro
 

Similar to Thunderbolts and Lightning: Very Very Frightening

What the Fax!?
What the Fax!?What the Fax!?
What the Fax!?
Priyanka Aash
 
HIS 2015: Prof. Ian Phillips - Stronger than its weakest link
HIS 2015: Prof. Ian Phillips - Stronger than its weakest linkHIS 2015: Prof. Ian Phillips - Stronger than its weakest link
HIS 2015: Prof. Ian Phillips - Stronger than its weakest link
AdaCore
 
Stronger than its Weakest Link
Stronger than its Weakest LinkStronger than its Weakest Link
Stronger than its Weakest Link
Ian Phillips
 
44CON 2014 - Stupid PCIe Tricks, Joe Fitzpatrick
44CON 2014 - Stupid PCIe Tricks, Joe Fitzpatrick44CON 2014 - Stupid PCIe Tricks, Joe Fitzpatrick
44CON 2014 - Stupid PCIe Tricks, Joe Fitzpatrick
44CON
 
Filip palian mateuszkocielski. simplest ownage human observed… routers
Filip palian mateuszkocielski. simplest ownage human observed… routersFilip palian mateuszkocielski. simplest ownage human observed… routers
Filip palian mateuszkocielski. simplest ownage human observed… routers
Yury Chemerkin
 

Similar to Thunderbolts and Lightning: Very Very Frightening (20)

What the Fax!?
What the Fax!?What the Fax!?
What the Fax!?
 
Internet Technology for the Commodore 64
Internet Technology for the Commodore 64Internet Technology for the Commodore 64
Internet Technology for the Commodore 64
 
Keeping your rack cool
Keeping your rack cool Keeping your rack cool
Keeping your rack cool
 
Keeping your rack cool with one "/IP route rule"
Keeping your rack cool with one "/IP route rule"Keeping your rack cool with one "/IP route rule"
Keeping your rack cool with one "/IP route rule"
 
Hands-on VeriFast with STM32 microcontroller
Hands-on VeriFast with STM32 microcontrollerHands-on VeriFast with STM32 microcontroller
Hands-on VeriFast with STM32 microcontroller
 
1. hardware basics
1. hardware basics1. hardware basics
1. hardware basics
 
DEF CON 27 - PHILIPPE LAULHERET - introduction to hardware hacking extended v...
DEF CON 27 - PHILIPPE LAULHERET - introduction to hardware hacking extended v...DEF CON 27 - PHILIPPE LAULHERET - introduction to hardware hacking extended v...
DEF CON 27 - PHILIPPE LAULHERET - introduction to hardware hacking extended v...
 
Insecure Obsolete and Trivial - The Real IOT
Insecure Obsolete and Trivial - The Real IOTInsecure Obsolete and Trivial - The Real IOT
Insecure Obsolete and Trivial - The Real IOT
 
HIS 2015: Prof. Ian Phillips - Stronger than its weakest link
HIS 2015: Prof. Ian Phillips - Stronger than its weakest linkHIS 2015: Prof. Ian Phillips - Stronger than its weakest link
HIS 2015: Prof. Ian Phillips - Stronger than its weakest link
 
Experiences building a distributed shared log on RADOS - Noah Watkins
Experiences building a distributed shared log on RADOS - Noah WatkinsExperiences building a distributed shared log on RADOS - Noah Watkins
Experiences building a distributed shared log on RADOS - Noah Watkins
 
Stronger than its Weakest Link
Stronger than its Weakest LinkStronger than its Weakest Link
Stronger than its Weakest Link
 
Hands-on VeriFast with STM32 microcontroller @ Osaka
Hands-on VeriFast with STM32 microcontroller @ OsakaHands-on VeriFast with STM32 microcontroller @ Osaka
Hands-on VeriFast with STM32 microcontroller @ Osaka
 
44CON 2014 - Stupid PCIe Tricks, Joe Fitzpatrick
44CON 2014 - Stupid PCIe Tricks, Joe Fitzpatrick44CON 2014 - Stupid PCIe Tricks, Joe Fitzpatrick
44CON 2014 - Stupid PCIe Tricks, Joe Fitzpatrick
 
VYOS & RPKI at the BGP as edge
VYOS & RPKI at the BGP as edgeVYOS & RPKI at the BGP as edge
VYOS & RPKI at the BGP as edge
 
TCP/IP For Engineers
TCP/IP For EngineersTCP/IP For Engineers
TCP/IP For Engineers
 
Functional IoT: Hardware and Platform
Functional IoT: Hardware and PlatformFunctional IoT: Hardware and Platform
Functional IoT: Hardware and Platform
 
When DevOps and Networking Intersect by Brent Salisbury of socketplane.io
When DevOps and Networking Intersect by Brent Salisbury of socketplane.ioWhen DevOps and Networking Intersect by Brent Salisbury of socketplane.io
When DevOps and Networking Intersect by Brent Salisbury of socketplane.io
 
Filip palian mateuszkocielski. simplest ownage human observed… routers
Filip palian mateuszkocielski. simplest ownage human observed… routersFilip palian mateuszkocielski. simplest ownage human observed… routers
Filip palian mateuszkocielski. simplest ownage human observed… routers
 
Bare Metal Club ATX: Networking Discussion
Bare Metal Club ATX: Networking DiscussionBare Metal Club ATX: Networking Discussion
Bare Metal Club ATX: Networking Discussion
 
Don't Tell Joanna the Virtualized Rootkit is Dead (Blackhat 2007)
Don't Tell Joanna the Virtualized Rootkit is Dead (Blackhat 2007)Don't Tell Joanna the Virtualized Rootkit is Dead (Blackhat 2007)
Don't Tell Joanna the Virtualized Rootkit is Dead (Blackhat 2007)
 

Recently uploaded

Web Form Automation for Bonterra Impact Management (fka Social Solutions Apri...
Web Form Automation for Bonterra Impact Management (fka Social Solutions Apri...Web Form Automation for Bonterra Impact Management (fka Social Solutions Apri...
Web Form Automation for Bonterra Impact Management (fka Social Solutions Apri...
Jeffrey Haguewood
 
Cloud Frontiers: A Deep Dive into Serverless Spatial Data and FME
Cloud Frontiers: A Deep Dive into Serverless Spatial Data and FMECloud Frontiers: A Deep Dive into Serverless Spatial Data and FME
Cloud Frontiers: A Deep Dive into Serverless Spatial Data and FME
Safe Software
 
Rising Above_ Dubai Floods and the Fortitude of Dubai International Airport.pdf
Rising Above_ Dubai Floods and the Fortitude of Dubai International Airport.pdfRising Above_ Dubai Floods and the Fortitude of Dubai International Airport.pdf
Rising Above_ Dubai Floods and the Fortitude of Dubai International Airport.pdf
Orbitshub
 
Cloud Frontiers: A Deep Dive into Serverless Spatial Data and FME
Cloud Frontiers: A Deep Dive into Serverless Spatial Data and FMECloud Frontiers: A Deep Dive into Serverless Spatial Data and FME
Cloud Frontiers: A Deep Dive into Serverless Spatial Data and FME
Safe Software
 
TrustArc Webinar - Unlock the Power of AI-Driven Data Discovery
TrustArc Webinar - Unlock the Power of AI-Driven Data DiscoveryTrustArc Webinar - Unlock the Power of AI-Driven Data Discovery
TrustArc Webinar - Unlock the Power of AI-Driven Data Discovery
TrustArc
 
Architecting Cloud Native Applications
Architecting Cloud Native ApplicationsArchitecting Cloud Native Applications
Architecting Cloud Native Applications
WSO2
 
Strategize a Smooth Tenant-to-tenant Migration and Copilot Takeoff
Strategize a Smooth Tenant-to-tenant Migration and Copilot TakeoffStrategize a Smooth Tenant-to-tenant Migration and Copilot Takeoff
Strategize a Smooth Tenant-to-tenant Migration and Copilot Takeoff
sammart93
 

Recently uploaded (20)

Vector Search -An Introduction in Oracle Database 23ai.pptx
Vector Search -An Introduction in Oracle Database 23ai.pptxVector Search -An Introduction in Oracle Database 23ai.pptx
Vector Search -An Introduction in Oracle Database 23ai.pptx
 
Spring Boot vs Quarkus the ultimate battle - DevoxxUK
Spring Boot vs Quarkus the ultimate battle - DevoxxUKSpring Boot vs Quarkus the ultimate battle - DevoxxUK
Spring Boot vs Quarkus the ultimate battle - DevoxxUK
 
Artificial Intelligence Chap.5 : Uncertainty
Artificial Intelligence Chap.5 : UncertaintyArtificial Intelligence Chap.5 : Uncertainty
Artificial Intelligence Chap.5 : Uncertainty
 
Web Form Automation for Bonterra Impact Management (fka Social Solutions Apri...
Web Form Automation for Bonterra Impact Management (fka Social Solutions Apri...Web Form Automation for Bonterra Impact Management (fka Social Solutions Apri...
Web Form Automation for Bonterra Impact Management (fka Social Solutions Apri...
 
How to Troubleshoot Apps for the Modern Connected Worker
How to Troubleshoot Apps for the Modern Connected WorkerHow to Troubleshoot Apps for the Modern Connected Worker
How to Troubleshoot Apps for the Modern Connected Worker
 
ICT role in 21st century education and its challenges
ICT role in 21st century education and its challengesICT role in 21st century education and its challenges
ICT role in 21st century education and its challenges
 
Cloud Frontiers: A Deep Dive into Serverless Spatial Data and FME
Cloud Frontiers: A Deep Dive into Serverless Spatial Data and FMECloud Frontiers: A Deep Dive into Serverless Spatial Data and FME
Cloud Frontiers: A Deep Dive into Serverless Spatial Data and FME
 
Apidays New York 2024 - The value of a flexible API Management solution for O...
Apidays New York 2024 - The value of a flexible API Management solution for O...Apidays New York 2024 - The value of a flexible API Management solution for O...
Apidays New York 2024 - The value of a flexible API Management solution for O...
 
Apidays New York 2024 - Accelerating FinTech Innovation by Vasa Krishnan, Fin...
Apidays New York 2024 - Accelerating FinTech Innovation by Vasa Krishnan, Fin...Apidays New York 2024 - Accelerating FinTech Innovation by Vasa Krishnan, Fin...
Apidays New York 2024 - Accelerating FinTech Innovation by Vasa Krishnan, Fin...
 
Rising Above_ Dubai Floods and the Fortitude of Dubai International Airport.pdf
Rising Above_ Dubai Floods and the Fortitude of Dubai International Airport.pdfRising Above_ Dubai Floods and the Fortitude of Dubai International Airport.pdf
Rising Above_ Dubai Floods and the Fortitude of Dubai International Airport.pdf
 
Six Myths about Ontologies: The Basics of Formal Ontology
Six Myths about Ontologies: The Basics of Formal OntologySix Myths about Ontologies: The Basics of Formal Ontology
Six Myths about Ontologies: The Basics of Formal Ontology
 
Introduction to use of FHIR Documents in ABDM
Introduction to use of FHIR Documents in ABDMIntroduction to use of FHIR Documents in ABDM
Introduction to use of FHIR Documents in ABDM
 
Cloud Frontiers: A Deep Dive into Serverless Spatial Data and FME
Cloud Frontiers: A Deep Dive into Serverless Spatial Data and FMECloud Frontiers: A Deep Dive into Serverless Spatial Data and FME
Cloud Frontiers: A Deep Dive into Serverless Spatial Data and FME
 
TrustArc Webinar - Unlock the Power of AI-Driven Data Discovery
TrustArc Webinar - Unlock the Power of AI-Driven Data DiscoveryTrustArc Webinar - Unlock the Power of AI-Driven Data Discovery
TrustArc Webinar - Unlock the Power of AI-Driven Data Discovery
 
FWD Group - Insurer Innovation Award 2024
FWD Group - Insurer Innovation Award 2024FWD Group - Insurer Innovation Award 2024
FWD Group - Insurer Innovation Award 2024
 
Polkadot JAM Slides - Token2049 - By Dr. Gavin Wood
Polkadot JAM Slides - Token2049 - By Dr. Gavin WoodPolkadot JAM Slides - Token2049 - By Dr. Gavin Wood
Polkadot JAM Slides - Token2049 - By Dr. Gavin Wood
 
AI+A11Y 11MAY2024 HYDERBAD GAAD 2024 - HelloA11Y (11 May 2024)
AI+A11Y 11MAY2024 HYDERBAD GAAD 2024 - HelloA11Y (11 May 2024)AI+A11Y 11MAY2024 HYDERBAD GAAD 2024 - HelloA11Y (11 May 2024)
AI+A11Y 11MAY2024 HYDERBAD GAAD 2024 - HelloA11Y (11 May 2024)
 
Strategies for Landing an Oracle DBA Job as a Fresher
Strategies for Landing an Oracle DBA Job as a FresherStrategies for Landing an Oracle DBA Job as a Fresher
Strategies for Landing an Oracle DBA Job as a Fresher
 
Architecting Cloud Native Applications
Architecting Cloud Native ApplicationsArchitecting Cloud Native Applications
Architecting Cloud Native Applications
 
Strategize a Smooth Tenant-to-tenant Migration and Copilot Takeoff
Strategize a Smooth Tenant-to-tenant Migration and Copilot TakeoffStrategize a Smooth Tenant-to-tenant Migration and Copilot Takeoff
Strategize a Smooth Tenant-to-tenant Migration and Copilot Takeoff
 

Thunderbolts and Lightning: Very Very Frightening

  • 1. SNARE & RZN @ SYSCAN APRIL 2014 THUNDERBOLTS AND LIGHTNING VERY, VERY FRIGHTENING
  • 2. Thunderbolts and Lightning ⚡⚡⚡Very,Very FrighteningThunderbolts and Lightning ⚡⚡⚡Very,Very Frightening WHO ARE THESE IDIOTS? OBLIGATORY INTRO SLIDE ‣ rzn aka Sam ‣PhD student at UoA ‣research into ray-tracing on FPGAs ‣extensive collection of name tags and hair nets ‣ snare aka Loukas ‣computer guy at Azimuth Security ‣did some OS X kernel and UEFI firmware stuff one time ‣world’s strongest millionaire ‣internet-famous feet
  • 3. Thunderbolts and Lightning ⚡⚡⚡Very,Very FrighteningThunderbolts and Lightning ⚡⚡⚡Very,Very Frightening WHAT IS THIS TALK ABOUT? ‣ Apparently Thunderbolt DMA attacks are totally a thing ‣ But we haven’t seen a PoC yet ‣ And it sounded like fun ‣ It’s not actually about Lightning (the iDevice connector) ‣Sorry Stefan
  • 4. Thunderbolts and Lightning ⚡⚡⚡Very,Very FrighteningThunderbolts and Lightning ⚡⚡⚡Very,Very Frightening THINGS WHAT WE IS GOING TO TALK ABOUT AGENDA ‣ FireWire DMA attacks ‣ Thunderbolt ‣ How is PCIe formed? ‣ What the fuck is an FPGA? ‣ Our approach to attacking Thunderbolt ‣ Sweet stunt hack demo and stuff ‣ Defence
  • 5. Thunderbolts and Lightning ⚡⚡⚡Very,Very FrighteningThunderbolts and Lightning ⚡⚡⚡Very,Very Frightening FIREWIRE DMA ATTACKS HIT BY THE SHORT BUS ‣ See Metlstorm’s “Hit By A Bus” circa 2006 (Ruxcon) ‣ First done by Quinn the Eskimo (Apple awesome dude) ‣ Won MacHack 2002 by drawing a screensaver over FireWire! ‣ See also Inception - a FireWire DMA tool ‣ How does it work? ‣ Using SBP-2 ‣ Firewire chipset does DMA R/W on PCIe bus ‣ Stream data out FW interface
  • 6. Thunderbolts and Lightning ⚡⚡⚡Very,Very FrighteningThunderbolts and Lightning ⚡⚡⚡Very,Very Frightening FIREWIRE DMA ATTACKS HIT BY THE SHORT BUS
  • 7. Thunderbolts and Lightning ⚡⚡⚡Very,Very FrighteningThunderbolts and Lightning ⚡⚡⚡Very,Very Frightening FIREWIRE DMA ATTACKS HIT BY THE SHORT BUS TARGET HOST MEMORY MCH FIREWIRE PCI EXPRESS
  • 8. Thunderbolts and Lightning ⚡⚡⚡Very,Very FrighteningThunderbolts and Lightning ⚡⚡⚡Very,Very Frightening FIREWIRE DMA ATTACKS HIT BY THE SHORT BUS TARGET HOST MEMORY MCH FIREWIRE PCI EXPRESS ANALYSIS HOST FIREWIRE PCI EXPRESS STORAGE
  • 9. Thunderbolts and Lightning ⚡⚡⚡Very,Very FrighteningThunderbolts and Lightning ⚡⚡⚡Very,Very Frightening FIREWIRE DMA ATTACKS HIT BY THE SHORT BUS TARGET HOST MEMORY MCH FIREWIRE PCI EXPRESS ANALYSIS HOST FIREWIRE PCI EXPRESS STORAGEbro, read data at 0xDEADBEA7
  • 10. Thunderbolts and Lightning ⚡⚡⚡Very,Very FrighteningThunderbolts and Lightning ⚡⚡⚡Very,Very Frightening FIREWIRE DMA ATTACKS HIT BY THE SHORT BUS TARGET HOST MEMORY MCH FIREWIRE PCI EXPRESS ANALYSIS HOST FIREWIRE PCI EXPRESS STORAGEDMA read 0xDEADBEA7
  • 11. Thunderbolts and Lightning ⚡⚡⚡Very,Very FrighteningThunderbolts and Lightning ⚡⚡⚡Very,Very Frightening FIREWIRE DMA ATTACKS HIT BY THE SHORT BUS TARGET HOST MEMORY MCH FIREWIRE PCI EXPRESS ANALYSIS HOST FIREWIRE PCI EXPRESS STORAGEhere ya go pal
  • 12. Thunderbolts and Lightning ⚡⚡⚡Very,Very FrighteningThunderbolts and Lightning ⚡⚡⚡Very,Very Frightening LIMITATIONS HIT BY THE SHORT BUS ‣ Obviously requires that there be a FireWire interface ‣ 32-bit addressing = only lower 4GB of RAM ‣ On OS X FireWire DMA is disabled when the screen is locked & FileVault is enabled ‣ Kernel tells FW chipset not to do DMA any more ‣ #sadface
  • 13. Thunderbolts and Lightning ⚡⚡⚡Very,Very FrighteningThunderbolts and Lightning ⚡⚡⚡Very,Very Frightening EH? ‣ Thunderbolt == PCIe + DisplayPort + pixie dust ! ! ! ! ! ! ! ‣ Send DMA requests directly over PCIe? WHAT’S A THUNDERBOLT?
  • 14. Thunderbolts and Lightning ⚡⚡⚡Very,Very FrighteningThunderbolts and Lightning ⚡⚡⚡Very,Very Frightening EH? ‣ Thunderbolt == PCIe + DisplayPort + pixie dust ! ! ! ! ! ! ! ‣ Send DMA requests directly over PCIe? WHAT’S A THUNDERBOLT? PIXIE DUST
  • 15. Thunderbolts and Lightning ⚡⚡⚡Very,Very Frightening PICS OR GTFO WHAT’S A THUNDERBOLT? Slightly more useful diagram
  • 16. Thunderbolts and Lightning ⚡⚡⚡Very,Very FrighteningThunderbolts and Lightning ⚡⚡⚡Very,Very Frightening CHEATING WITH FIREWIRE THUNDERBOLT DMA THUS FAR ‣ “Thunderbolt DMA” ‣ Connect Thunderbolt to FireWire adapter ‣ ??? ‣ Profit ‣ Subject to the same limitations as regular FireWire
  • 17. Thunderbolts and Lightning ⚡⚡⚡Very,Very FrighteningThunderbolts and Lightning ⚡⚡⚡Very,Very Frightening WHEN PCI AND PCI-X LOVE EACH OTHER VERY MUCH HOW IS PCIE FORMED? ‣ Serial point-to-point interconnect
  • 18. Thunderbolts and Lightning ⚡⚡⚡Very,Very FrighteningThunderbolts and Lightning ⚡⚡⚡Very,Very Frightening WHEN PCI AND PCI-X LOVE EACH OTHER VERY MUCH HOW IS PCIE FORMED? ‣ Serial point-to-point interconnect ‣ A lane consists of a tx and rx differential pair 
 (4 wires per lane)
  • 19. Thunderbolts and Lightning ⚡⚡⚡Very,Very FrighteningThunderbolts and Lightning ⚡⚡⚡Very,Very Frightening WHEN PCI AND PCI-X LOVE EACH OTHER VERY MUCH HOW IS PCIE FORMED? ‣ Serial point-to-point interconnect ‣ A lane consists of a tx and rx differential pair 
 (4 wires per lane) ‣ Scalable number of lanes, negotiated at link setup
  • 20. Thunderbolts and Lightning ⚡⚡⚡Very,Very FrighteningThunderbolts and Lightning ⚡⚡⚡Very,Very Frightening WHEN PCI AND PCI-X LOVE EACH OTHER VERY MUCH HOW IS PCIE FORMED? ‣ Serial point-to-point interconnect ‣ A lane consists of a tx and rx differential pair 
 (4 wires per lane) ‣ Scalable number of lanes, negotiated at link setup ‣ Layered, packet based, transaction protocol ‣ Physical layer ‣ Data link layer ‣ Transaction layer
  • 21. Thunderbolts and Lightning ⚡⚡⚡Very,Very FrighteningThunderbolts and Lightning ⚡⚡⚡Very,Very Frightening WHEN PCI AND PCI-X LOVE EACH OTHER VERY MUCH HOW IS PCIE FORMED? ‣ Serial point-to-point interconnect ‣ A lane consists of a tx and rx differential pair 
 (4 wires per lane) ‣ Scalable number of lanes, negotiated at link setup ‣ Layered, packet based, transaction protocol ‣ Physical layer ‣ Data link layer ‣ Transaction layer ‣ Level sensitive or message signaled interrupts
  • 22. Thunderbolts and Lightning ⚡⚡⚡Very,Very FrighteningThunderbolts and Lightning ⚡⚡⚡Very,Very Frightening DMA HOW IS PCIE FORMED? ‣ Four transaction types ‣ I/O read/write ‣ Configuration read/write ‣ Memory read/write ‣ Messaging ‣ DMA: ‣ Configuration write to grant device “bus master” ‣ Write target address and command to device ‣ Device interrupts when finished
  • 23. Thunderbolts and Lightning ⚡⚡⚡Very,Very FrighteningThunderbolts and Lightning ⚡⚡⚡Very,Very Frightening [1] WIKIPEDIA WTF IS AN FPGA? ‣ Field Programmable Gatorade Gate Array
  • 24. Thunderbolts and Lightning ⚡⚡⚡Very,Very FrighteningThunderbolts and Lightning ⚡⚡⚡Very,Very Frightening [1] WIKIPEDIA WTF IS AN FPGA? ‣ Field Programmable Gatorade Gate Array ‣ Matrix of configurable logic blocks, each containing ‘slices’
  • 25. Thunderbolts and Lightning ⚡⚡⚡Very,Very FrighteningThunderbolts and Lightning ⚡⚡⚡Very,Very Frightening [1] WIKIPEDIA WTF IS AN FPGA? ‣ Field Programmable Gatorade Gate Array ‣ Matrix of configurable logic blocks, each containing ‘slices’ ‣ Slice contents are the core of FPGA functionality ‣ Look up tables (LUTs) ‣ Flip-flops ‣ Carry chain ‣ Muxes
  • 26. Thunderbolts and Lightning ⚡⚡⚡Very,Very FrighteningThunderbolts and Lightning ⚡⚡⚡Very,Very Frightening [1] WIKIPEDIA WTF IS AN FPGA? ‣ Field Programmable Gatorade Gate Array ‣ Matrix of configurable logic blocks, each containing ‘slices’ ‣ Slice contents are the core of FPGA functionality ‣ Look up tables (LUTs) ‣ Flip-flops ‣ Carry chain ‣ Muxes ‣ Additional general features: blockRAMs, FIFOs, DSP blocks, clocking resources (PLLs, DCMs)
  • 27. Thunderbolts and Lightning ⚡⚡⚡Very,Very FrighteningThunderbolts and Lightning ⚡⚡⚡Very,Very Frightening [1] WIKIPEDIA WTF IS AN FPGA? ‣ Field Programmable Gatorade Gate Array ‣ Matrix of configurable logic blocks, each containing ‘slices’ ‣ Slice contents are the core of FPGA functionality ‣ Look up tables (LUTs) ‣ Flip-flops ‣ Carry chain ‣ Muxes ‣ Additional general features: blockRAMs, FIFOs, DSP blocks, clocking resources (PLLs, DCMs) ‣ Device specific features: PCIe, Ethernet, DDR2/3
  • 28. Thunderbolts and Lightning ⚡⚡⚡Very,Very FrighteningThunderbolts and Lightning ⚡⚡⚡Very,Very Frightening [1] WIKIPEDIA WTF IS AN FPGA? ‣ Field Programmable Gatorade Gate Array ‣ Matrix of configurable logic blocks, each containing ‘slices’ ‣ Slice contents are the core of FPGA functionality ‣ Look up tables (LUTs) ‣ Flip-flops ‣ Carry chain ‣ Muxes ‣ Additional general features: blockRAMs, FIFOs, DSP blocks, clocking resources (PLLs, DCMs) ‣ Device specific features: PCIe, Ethernet, DDR2/3 ‣ Reprogrammable
  • 29. Thunderbolts and Lightning ⚡⚡⚡Very,Very FrighteningThunderbolts and Lightning ⚡⚡⚡Very,Very Frightening LUTS LUTS LUTS WTF IS AN FPGA? ‣ logic ➤ truth table ➤ LUT ! ! ! ! ! ! ! ! ‣ A LUT is essentially a 6-input memory, containing the desired output for each set of inputs (addresses) ‣ It doesn’t matter how simple or complex the function, it is only limited by the inputs S1 S0 D C B A F 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 1 0 0 0 0 0 0 1 1 1 ⚡ ⚡ ⚡ ⚡ ⚡ ⚡ ⚡ 1 1 1 1 0 0 1 1 1 1 1 0 1 0 1 1 1 1 1 0 1 1 1 1 1 1 1 0 LUT I0 I1 I2 I3 I4 O INIT=11110F0F0303 A B C D S0 F S0 S1 F A B C D
  • 30. Thunderbolts and Lightning ⚡⚡⚡Very,Very FrighteningThunderbolts and Lightning ⚡⚡⚡Very,Very Frightening IT’S ALL ABOUT THE LOLS WTF IS AN FPGA? ‣ Application logic is described in an HDL; verilog or vhdl
  • 31. Thunderbolts and Lightning ⚡⚡⚡Very,Very FrighteningThunderbolts and Lightning ⚡⚡⚡Very,Very Frightening IT’S ALL ABOUT THE LOLS WTF IS AN FPGA? ‣ Application logic is described in an HDL; verilog or vhdl ‣ You can leave it all to the synthesis tool to infer logic, but it is important to understand how a LUT works
  • 32. Thunderbolts and Lightning ⚡⚡⚡Very,Very FrighteningThunderbolts and Lightning ⚡⚡⚡Very,Very Frightening IT’S ALL ABOUT THE LOLS WTF IS AN FPGA? ‣ Application logic is described in an HDL; verilog or vhdl ‣ You can leave it all to the synthesis tool to infer logic, but it is important to understand how a LUT works ‣ Maximum frequency determined by “levels of logic” ‣ A level of logic is the combination of LUT delay and routing delay between two flip-flops ‣ LUT delay = static, constant property of the device ‣ Routing delay = dynamic, influenced my LUT placement
  • 33. Thunderbolts and Lightning ⚡⚡⚡Very,Very FrighteningThunderbolts and Lightning ⚡⚡⚡Very,Very Frightening IT’S ALL ABOUT THE LOLS WTF IS AN FPGA? ‣ Application logic is described in an HDL; verilog or vhdl ‣ You can leave it all to the synthesis tool to infer logic, but it is important to understand how a LUT works ‣ Maximum frequency determined by “levels of logic” ‣ A level of logic is the combination of LUT delay and routing delay between two flip-flops ‣ LUT delay = static, constant property of the device ‣ Routing delay = dynamic, influenced my LUT placement ‣ Reduce levels of logic, place LUTs closer together = higher clock frequency
  • 34. Thunderbolts and Lightning ⚡⚡⚡Very,Very FrighteningThunderbolts and Lightning ⚡⚡⚡Very,Very Frightening
  • 35. Thunderbolts and Lightning ⚡⚡⚡Very,Very FrighteningThunderbolts and Lightning ⚡⚡⚡Very,Very Frightening ‣ Microblaze is a micro-controller that can be implemented in FPGA logic
  • 36. Thunderbolts and Lightning ⚡⚡⚡Very,Very FrighteningThunderbolts and Lightning ⚡⚡⚡Very,Very Frightening ‣ Microblaze is a micro-controller that can be implemented in FPGA logic ‣ Interfaces with AXI bus ‣ Standard interface to easily memory map other custom or off-the-shelf IP blocks
  • 37. Thunderbolts and Lightning ⚡⚡⚡Very,Very FrighteningThunderbolts and Lightning ⚡⚡⚡Very,Very Frightening ‣ Microblaze is a micro-controller that can be implemented in FPGA logic ‣ Interfaces with AXI bus ‣ Standard interface to easily memory map other custom or off-the-shelf IP blocks ‣ Code is written in C or C++, compiled with XSDK
  • 38. Thunderbolts and Lightning ⚡⚡⚡Very,Very FrighteningThunderbolts and Lightning ⚡⚡⚡Very,Very Frightening ‣ Microblaze is a micro-controller that can be implemented in FPGA logic ‣ Interfaces with AXI bus ‣ Standard interface to easily memory map other custom or off-the-shelf IP blocks ‣ Code is written in C or C++, compiled with XSDK ‣ Really useful for writing control logic ‣ Previously you’d write large state machines in HDL ‣ Also means noobs (snare) can write code for it
  • 39. Thunderbolts and Lightning ⚡⚡⚡Very,Very FrighteningThunderbolts and Lightning ⚡⚡⚡Very,Very Frightening ‣ Microblaze is a micro-controller that can be implemented in FPGA logic ‣ Interfaces with AXI bus ‣ Standard interface to easily memory map other custom or off-the-shelf IP blocks ‣ Code is written in C or C++, compiled with XSDK ‣ Really useful for writing control logic ‣ Previously you’d write large state machines in HDL ‣ Also means noobs (snare) can write code for it ‣ Connect it via serial and you can printf debug your logic!
  • 40. Thunderbolts and Lightning ⚡⚡⚡Very,Very FrighteningThunderbolts and Lightning ⚡⚡⚡Very,Very Frightening BUTT, HOW DO WE DO PCIE? WTF IS AN FPGA?
  • 41. Thunderbolts and Lightning ⚡⚡⚡Very,Very FrighteningThunderbolts and Lightning ⚡⚡⚡Very,Very Frightening BUTT, HOW DO WE DO PCIE? WTF IS AN FPGA? ‣ AXI PCIE core uses FPGA device specific features to implement PCIE
  • 42. Thunderbolts and Lightning ⚡⚡⚡Very,Very FrighteningThunderbolts and Lightning ⚡⚡⚡Very,Very Frightening BUTT, HOW DO WE DO PCIE? WTF IS AN FPGA? ‣ AXI PCIE core uses FPGA device specific features to implement PCIE ‣ Memory mapped to MicroBlaze ‣ Read/write to memory mapped AXI core translates to PCIE read/write TLPs ‣ Read/write TLPs from PCIe translate to memory mapped AXI core read/write
  • 43. Thunderbolts and Lightning ⚡⚡⚡Very,Very FrighteningThunderbolts and Lightning ⚡⚡⚡Very,Very Frightening FAKE IT TILL YOU BREAK IT OUR APPROACH ‣ Become bus master ‣ ??? ‣ Profit
  • 44. Thunderbolts and Lightning ⚡⚡⚡Very,Very FrighteningThe Mathematics of Wonton Burrito Meals TARGET HOST MEMORY MCH PCI EXPRESS THUNDER BOLT THUNDERBOLT DMA MEMORY CAPTURE
  • 45. Thunderbolts and Lightning ⚡⚡⚡Very,Very FrighteningThe Mathematics of Wonton Burrito Meals TARGET HOST MEMORY MCH PCI EXPRESS THUNDER BOLT THUNDERBOLT DMA MEMORY CAPTURE ANALYSIS DEVICE THUNDER BOLT FPGA PCI EXPRESS STORAGE
  • 46. Thunderbolts and Lightning ⚡⚡⚡Very,Very FrighteningThe Mathematics of Wonton Burrito Meals TARGET HOST MEMORY MCH PCI EXPRESS THUNDER BOLT THUNDERBOLT DMA MEMORY CAPTURE ANALYSIS DEVICE THUNDER BOLT FPGA PCI EXPRESS STORAGE DMA read @ 0xDEADBEA7
  • 47. Thunderbolts and Lightning ⚡⚡⚡Very,Very FrighteningThunderbolts and Lightning ⚡⚡⚡Very,Very Frightening FAKE IT TILL YOU BREAK IT OUR APPROACH TARGET HOST XILINX SP605 THUNDERBOLT PCIE AXI PCIE CORE MICROBLAZE BPLUS TH05 DSL2210 ANALYSIS HOST SERIAL AXI ‣ Board circuitry handles PCIE physical layer ‣ AXI PCIE core handles data link layer ‣ We write code for the MicroBlaze that reads and writes to the AXI core
  • 48. Thunderbolts and Lightning ⚡⚡⚡Very,Very FrighteningThunderbolts and Lightning ⚡⚡⚡Very,Very Frightening OK, SO FPGA TALKS PCIe ATTACKING A MAC ‣ Phase 1 - write our own driver ‣ Make FPGA bus master ‣ Tell it what to do ! ‣ Phase 2 - imitate another device ‣ Change device id, vendor id in configuration space ‣ Trick the OS into loading an existing driver that will make us bus master
  • 49. Thunderbolts and Lightning ⚡⚡⚡Very,Very FrighteningThunderbolts and Lightning ⚡⚡⚡Very,Very Frightening STUNT HACK?! ATTACKING A MAC ‣ PoC - patch auth handler to bypass login screen ‣ Return success? Nah return 1 bro ‣ Log in with any password
  • 50. Thunderbolts and Lightning ⚡⚡⚡Very,Very Frightening
  • 51. Thunderbolts and Lightning ⚡⚡⚡Very,Very Frightening FPGA development board
  • 52. Thunderbolts and Lightning ⚡⚡⚡Very,Very Frightening FPGA development board FPGA
  • 53. Thunderbolts and Lightning ⚡⚡⚡Very,Very Frightening Thunderbolt to PCIe board
  • 54. Thunderbolts and Lightning ⚡⚡⚡Very,Very Frightening FPGA board PCIe connector
  • 55. Thunderbolts and Lightning ⚡⚡⚡Very,Very Frightening Thunderbolt connector
  • 56. Thunderbolts and Lightning ⚡⚡⚡Very,Very Frightening JTAG and UART connected to attacker
  • 57. Thunderbolts and Lightning ⚡⚡⚡Very,Very Frightening Thunderbolt connected to victim
  • 58. Thunderbolts and Lightning ⚡⚡⚡Very,Very FrighteningHairiest alpaca in the world
  • 59. Thunderbolts and Lightning ⚡⚡⚡Very,Very FrighteningThunderbolts and Lightning ⚡⚡⚡Very,Very Frightening STUNT HACK?! ATTACKING A MAC ‣ PRE-DEMOVIDEO THINGY
  • 60. Thunderbolts and Lightning ⚡⚡⚡Very,Very FrighteningThunderbolts and Lightning ⚡⚡⚡Very,Very Frightening STUNT HACK?! ATTACKING A MAC ‣ PRE-DEMOVIDEO THINGY
  • 61. Thunderbolts and Lightning ⚡⚡⚡Very,Very FrighteningThunderbolts and Lightning ⚡⚡⚡Very,Very Frightening JUST IN CASE OUR STUPID DEMO DIDN’T WORK OTTERSTORM
  • 62. Thunderbolts and Lightning ⚡⚡⚡Very,Very FrighteningThunderbolts and Lightning ⚡⚡⚡Very,Very Frightening IT’S OK, WE MADE A VIDEO
  • 63. Thunderbolts and Lightning ⚡⚡⚡Very,Very FrighteningThunderbolts and Lightning ⚡⚡⚡Very,Very Frightening IT’S OK, WE MADE A VIDEO
  • 64. Thunderbolts and Lightning ⚡⚡⚡Very,Very FrighteningThunderbolts and Lightning ⚡⚡⚡Very,Very Frightening YEP WAIT, THE DEMO WORKED?
  • 65. Thunderbolts and Lightning ⚡⚡⚡Very,Very FrighteningThunderbolts and Lightning ⚡⚡⚡Very,Very Frightening Y’KNOW, IF YOU LIKE SECURITY AND STUFF THIS SEEMS BAD ‣ Intel realised this was not a good “feature” ‣ What to do about it? ‣Glue all the ports shut? ‣Voodoo curse? ‣Access controls on device I/O?
  • 66. Thunderbolts and Lightning ⚡⚡⚡Very,Very FrighteningThunderbolts and Lightning ⚡⚡⚡Very,Very Frightening Y’KNOW, IF YOU LIKE SECURITY AND STUFF THIS SEEMS BAD ‣ Intel realised this was not a good “feature” ‣ What to do about it? ‣Glue all the ports shut? ‣Voodoo curse? ‣Access controls on device I/O?
  • 67. Thunderbolts and Lightning ⚡⚡⚡Very,Very FrighteningThunderbolts and Lightning ⚡⚡⚡Very,Very Frightening Y’KNOW, IF YOU LIKE SECURITY AND STUFF THIS SEEMS BAD ‣ Intel realised this was not a good “feature” ‣ What to do about it? ‣Glue all the ports shut? ‣Voodoo curse? ‣Access controls on device I/O?
  • 68. Thunderbolts and Lightning ⚡⚡⚡Very,Very FrighteningThunderbolts and Lightning ⚡⚡⚡Very,Very Frightening Y’KNOW, IF YOU LIKE SECURITY AND STUFF THIS SEEMS BAD ‣ Intel realised this was not a good “feature” ‣ What to do about it? ‣Glue all the ports shut? ‣Voodoo curse? ‣Access controls on device I/O? 👍
  • 69. Thunderbolts and Lightning ⚡⚡⚡Very,Very FrighteningThunderbolts and Lightning ⚡⚡⚡Very,Very Frightening INTEL, YOU BASTARDS VT======D ‣ Virtualised I/O ‣ Hypervisor can now assign devices directly to guests ‣This is howVMDirectPath works ‣ DMA requests are remapped w/access controls ‣ Interrupts are remapped w/access controls
  • 70. Thunderbolts and Lightning ⚡⚡⚡Very,Very FrighteningThunderbolts and Lightning ⚡⚡⚡Very,Very Frightening INTEL, YOU BASTARDS VT======D ‣ VT-d unit has “domains” ‣ There is at least one domain (the host’s domain) ‣ In order to assign a device to a guest, theVMM creates a domain for that guest ‣Assigns a device to it
  • 71. Thunderbolts and Lightning ⚡⚡⚡Very,Very FrighteningThunderbolts and Lightning ⚡⚡⚡Very,Very Frightening A SECURITY FEATURE? VT-D ‣ OS X kernel configuresVT-d ‣Actually it’s the IOPCIFamily driver ‣All the devices are configured in a singleVT-d “domain” ‣ Drivers allocate DMA buffers ‣New kernel memory allocator tellsVT-d unit about regions ‣Now when DMA requests come in on the PCIe bus,VT-d says yea or nay ‣ If you are denied access, the kernel’sVT-d handler is called and you see this in your console: ‣vtd[0] fault: device 0:20:0 reason 0x5 W:0x64c000
  • 72. Thunderbolts and Lightning ⚡⚡⚡Very,Very FrighteningThunderbolts and Lightning ⚡⚡⚡Very,Very Frightening INTEL, YOU BASTARDS VT-D P CPU/MCH PCIe DEVICE PCI EXPRESS BUS PCH VT-D ! MEMORY
  • 73. Thunderbolts and Lightning ⚡⚡⚡Very,Very FrighteningThunderbolts and Lightning ⚡⚡⚡Very,Very Frightening INTEL, YOU BASTARDS VT-D ‣ On all >=2012 Macs (Ivy Bridge) ‣Requires OS config - supported in OS X since 10.8.2 ‣ Restricts PCIe device DMA access ‣This is balls ‣Means our trix don’t work on >=2012 machine running >10.8.2 ‣ Windows pre-8 (AFAIK) doesn’t configureVT-d ‣Pretty sure I remember reading that somewhere ‣ Linux does a much better job of configuringVT-d
  • 74. Thunderbolts and Lightning ⚡⚡⚡Very,Very FrighteningThunderbolts and Lightning ⚡⚡⚡Very,Very Frightening PROBABLY NOT AM I OWNED? OWNED NOT OWNED :( OWNED OWNED <10.8.2 >=10.8.2 Pre-Ivy Bridge Ivy Bridge and later DUDE, WHAT THE HELL? UPGRADE YOUR SHIT
  • 75. Thunderbolts and Lightning ⚡⚡⚡Very,Very FrighteningThunderbolts and Lightning ⚡⚡⚡Very,Very Frightening NEW TRIX WHAT’S NEXT? ‣ Maybe make the kit a little bit smaller ‣ BypassVT-d? ‣ See if we can do it without imitating a device? ‣ Full memory capture
  • 76. Thunderbolts and Lightning ⚡⚡⚡Very,Very FrighteningThunderbolts and Lightning ⚡⚡⚡Very,Very Frightening REFERENCES ‣ Metlstorm - Hit by a Bus (Ruxcon 2006) ‣ http://www.security-assessment.com/files/presentations/ab_firewire_rux2k6-final.pdf ‣ Quinn the Eskimo - FireStarter (MacHack 2002) ‣ http://www.anarchistturtle.com/Quinn/WWW/Hacks.html ‣ Inception (FireWire DMA tool) ‣ http://www.breaknenter.org/projects/inception/ ‣ PCIe Base Specification (507 pages, great night time reading) ‣ http://read.pudn.com/downloads161/doc/729268/PCI_Express_Base_11.pdf ‣ Xilinx PCIe DMA Reference Design ‣ http://www.xilinx.com/support/documentation/application_notes/xapp1052.pdf
  • 77. ! ! ! ! ! ! greetz: vt, pipes, antic0de, quine, metlstorm, h1kar1, y011, radian ! special thanks to: thomas motherfuckin’ lim statler and waldorf (nagy and grugq) ! mad props to: barns. now let’s get grimy. KTHXBAI @snare snare@ho.ax http://ho.ax http://blog.azimuthsecurity.com @scollinsonz smc@affinity.net.nz http://affinity.net.nz