Successfully reported this slideshow.
We use your LinkedIn profile and activity data to personalize ads and to show you more relevant ads. You can change your ad preferences anytime.
Tapping into the C ore
Maxim Goryachy
Mark Ermolov
Chaos Computer Club (33C 3), Hamburg, 2016
Intel® Direct C onnect Interface as a bas is for hardware Trojans
Maxim Goryachy
Mark Ermolov
Positive Research Center
mgo...
mgoryachy@ptsecurity.com
mermolov@ptsecurity.com
Agenda 3
• Definition of a Hardware Trojan
• Debugging features as a basi...
Hardware Trojan is malicious alteration of hardware that could, under specific
conditions, result in functional changes of...
mgoryachy@ptsecurity.com
mermolov@ptsecurity.com
Hardware Trojan (E xample) 5
What If You Are a White Hat
Use the JTAG, Luke!
mgoryachy@ptsecurity.com
mermolov@ptsecurity.com
6
What Is JTAG?
Joint Test Action Group IEEE 1149.1
• https://en.wikipedia.org/wiki/JTAG
• IEEE Standard 1149.1
https://stan...
Uses of JTAG
• Forensics (Dump Flash, rootkit detection)
• Research (Cache as RAM, Secure Boot, Boot Guard, SMM)
• Low-lev...
JTAG in Intel C PUs
• JTAG 101 IEEE 1149.x and Software Debug
http://www.intel.com/content/dam/www/public/us/en/documents/...
C onnection Types
• Intel In-Target Probe eXtended Debug Port (ITP-XDP)
• Intel Direct Connect Interface (DCI): transport ...
Intel ITP-XDP
https://designintools.intel.com
 Direct connection to CPU debugging interface
 Price $3,000
 Special boar...
Intel® Direct C onnect Interface (DC I)
Intel® 100 Series and Intel® C230 Series Chipset Family Platform Controller Hub (P...
BSSB Hos ting DC I
https://designintools.intel.com
Intel® Silicon View Technology Closed Chassis Adapter (also known as SV...
USB3 Hos ting DC I
http://www.datapro.net/
 No extra hardware required (standard USB 3.0 cable)
 OTG device, “magic” por...
USB3 Hos ting DC I Device
mgoryachy@ptsecurity.com
mermolov@ptsecurity.com
15
What Is Simple USB-cable Able to Do…
mgoryachy@ptsecurity.com
mermolov@ptsecurity.com
http://www.datapro.net/
16
DEMO
ptsecurity.com
17
17
How to Activate DC I?
• UEFI Human Interface Infrastructure (UEFI HII)
• PCH Strap (Intel Flash Image Tool)
• P2SB device
...
Activation via UEFI HII
• UEFI Human Interface Infrastructure
http://www.uefi.org/sites/default/files/resources/UEFI%20Spe...
Activation via UEFI HII
mgoryachy@ptsecurity.com
mermolov@ptsecurity.com
20
Activation via PC H Strap
• Intel® Flash Image Tool
http://www.win-raid.com/t596f39-Intel-Management-Engine-Drivers-Firmwa...
Manually via P2SB Device
mgoryachy@ptsecurity.com
mermolov@ptsecurity.com
22
How to Fight Back?
• BootGuard
• Direct Connect Interface Enable bit check
• MSR IA32_DEBUG_INTERFACE
mgoryachy@ptsecurity...
IA32_DE BUG_INTE RFAC E
mgoryachy@ptsecurity.com
mermolov@ptsecurity.com
24
New Age of BadUSB?
http://www.extremetech.com/wp-content/uploads/2014/07/chipsbank_usb_drives.jpg
mgoryachy@ptsecurity.com...
Summary
• Modern CPU (Skylake+) design allows using JTAG-like interface through USB
which gives total control over the sys...
Thank you!
Questions?
mgoryachiy@ptsecurity.com
mermolov@ptsecurity.com
github.com/ptresearch
27
Upcoming SlideShare
Loading in …5
×

Tapping into the core

31,205 views

Published on

Intel® Direct Connect Interface as a basis for hardware Trojans

Published in: Technology
  • Follow the link, new dating source: ❤❤❤ http://bit.ly/2Q98JRS ❤❤❤
       Reply 
    Are you sure you want to  Yes  No
    Your message goes here
  • Sex in your area is here: ❶❶❶ http://bit.ly/2Q98JRS ❶❶❶
       Reply 
    Are you sure you want to  Yes  No
    Your message goes here

Tapping into the core

  1. 1. Tapping into the C ore Maxim Goryachy Mark Ermolov Chaos Computer Club (33C 3), Hamburg, 2016
  2. 2. Intel® Direct C onnect Interface as a bas is for hardware Trojans Maxim Goryachy Mark Ermolov Positive Research Center mgoryachiy@ptsecurity.com mermolov@ptsecurity.com
  3. 3. mgoryachy@ptsecurity.com mermolov@ptsecurity.com Agenda 3 • Definition of a Hardware Trojan • Debugging features as a basis of a Hardware Trojan • An overview of the debugging features in modern Intel CPUs • Activating debugging • Detecting enabled debugging
  4. 4. Hardware Trojan is malicious alteration of hardware that could, under specific conditions, result in functional changes of the system. Hardware Trojan can be inserted at the stage of production, shipment, storage, or use.  Rajat Subhra Chakraborty, Seetharam Narasimhan, and Swarup Bhunia Hardware Trojan: Threats and Emerging Solutions, IEEE HLDVT 2009  Xiaoxiao Wang and Mohammad Tehranipoor Detecting Malicious Inclusions in Secure Hardware: Challenges and Solutions, IEEE HOST 2008 http://spywareremovers.com/ mgoryachy@ptsecurity.com mermolov@ptsecurity.com Hardware Trojan 4
  5. 5. mgoryachy@ptsecurity.com mermolov@ptsecurity.com Hardware Trojan (E xample) 5
  6. 6. What If You Are a White Hat Use the JTAG, Luke! mgoryachy@ptsecurity.com mermolov@ptsecurity.com 6
  7. 7. What Is JTAG? Joint Test Action Group IEEE 1149.1 • https://en.wikipedia.org/wiki/JTAG • IEEE Standard 1149.1 https://standards.ieee.org/findstds/standard/1149.1-2013.html • Blackbox JTAG Reverse Engineering [26C3] https://www.youtube.com/watch?v=Up0697E5DGc https://www.xjtag.com mgoryachy@ptsecurity.com mermolov@ptsecurity.com 7
  8. 8. Uses of JTAG • Forensics (Dump Flash, rootkit detection) • Research (Cache as RAM, Secure Boot, Boot Guard, SMM) • Low-level debugging (UEFI DXE/PEI, drivers, hypervisor) • Performance analysis mgoryachy@ptsecurity.com mermolov@ptsecurity.com http://partsolutions.com/ 8
  9. 9. JTAG in Intel C PUs • JTAG 101 IEEE 1149.x and Software Debug http://www.intel.com/content/dam/www/public/us/en/documents/white-papers/jtag-101- ieee-1149x-paper.pdf • Debug Port Design Guide for UP/DP Systems http://download.intel.com/support/processors/pentium4/sb/31337301.pdf https://upload.wikimedia.org mgoryachy@ptsecurity.com mermolov@ptsecurity.com 9
  10. 10. C onnection Types • Intel In-Target Probe eXtended Debug Port (ITP-XDP) • Intel Direct Connect Interface (DCI): transport technology designed to enable closed chassis debug through any of USB3 ports out from Intel silicon. There are two types of DCI hosting interfaces in the platform:  USB3 Hosting DCI (USB Debug cable)  BSSB Hosting DCI (Intel SVT Closed Chassis Adapter) mgoryachy@ptsecurity.com mermolov@ptsecurity.com 10
  11. 11. Intel ITP-XDP https://designintools.intel.com  Direct connection to CPU debugging interface  Price $3,000  Special board socket is required  Supported by Intel System Studio trial version  Protocol covered by NDA mgoryachy@ptsecurity.com mermolov@ptsecurity.com 11
  12. 12. Intel® Direct C onnect Interface (DC I) Intel® 100 Series and Intel® C230 Series Chipset Family Platform Controller Hub (PCH) Works with U series out-of-box chipsets only mgoryachy@ptsecurity.com mermolov@ptsecurity.com 12
  13. 13. BSSB Hos ting DC I https://designintools.intel.com Intel® Silicon View Technology Closed Chassis Adapter (also known as SVTCCA or BSSB) provides access to DFx features, like JTAG and run control, through USB3 ports on Intel® Direct Connect Interface (DCI) enabled silicon and platforms.  Supported by Intel System Studio trial version  Price $390  Private protocol using physical USB links mgoryachy@ptsecurity.com mermolov@ptsecurity.com 13
  14. 14. USB3 Hos ting DC I http://www.datapro.net/  No extra hardware required (standard USB 3.0 cable)  OTG device, “magic” port needs to be found  Deep Sleep mode not supported  Supported by Intel System Studio trial version  Run through the device integrated to the target platform  Standard USB protocol used mgoryachy@ptsecurity.com mermolov@ptsecurity.com 14
  15. 15. USB3 Hos ting DC I Device mgoryachy@ptsecurity.com mermolov@ptsecurity.com 15
  16. 16. What Is Simple USB-cable Able to Do… mgoryachy@ptsecurity.com mermolov@ptsecurity.com http://www.datapro.net/ 16
  17. 17. DEMO ptsecurity.com 17 17
  18. 18. How to Activate DC I? • UEFI Human Interface Infrastructure (UEFI HII) • PCH Strap (Intel Flash Image Tool) • P2SB device mgoryachy@ptsecurity.com mermolov@ptsecurity.com 18
  19. 19. Activation via UEFI HII • UEFI Human Interface Infrastructure http://www.uefi.org/sites/default/files/resources/UEFI%20Spec%202_5_Errata_A.PDF • AMI BIOS Configuration Program 5.0 https://ami.com/products/bios-uefi-tools-and-utilities/bios-uefi-utilities/ • It is possible to reprogram BIOS by programmer or through SPI controller (if privileges allow), but the target platform could shut down with an error if Boot Guard is running. http://www.dediprog.com/ mgoryachy@ptsecurity.com mermolov@ptsecurity.com 19
  20. 20. Activation via UEFI HII mgoryachy@ptsecurity.com mermolov@ptsecurity.com 20
  21. 21. Activation via PC H Strap • Intel® Flash Image Tool http://www.win-raid.com/t596f39-Intel-Management-Engine-Drivers-Firmware-amp- System-Tools.html • Manually (Flash Descriptor, PCH Strap): reprogram BIOS by programmer or through SPI controller (if privileges allow) mgoryachy@ptsecurity.com mermolov@ptsecurity.com 21
  22. 22. Manually via P2SB Device mgoryachy@ptsecurity.com mermolov@ptsecurity.com 22
  23. 23. How to Fight Back? • BootGuard • Direct Connect Interface Enable bit check • MSR IA32_DEBUG_INTERFACE mgoryachy@ptsecurity.com mermolov@ptsecurity.com 23
  24. 24. IA32_DE BUG_INTE RFAC E mgoryachy@ptsecurity.com mermolov@ptsecurity.com 24
  25. 25. New Age of BadUSB? http://www.extremetech.com/wp-content/uploads/2014/07/chipsbank_usb_drives.jpg mgoryachy@ptsecurity.com mermolov@ptsecurity.com 25
  26. 26. Summary • Modern CPU (Skylake+) design allows using JTAG-like interface through USB which gives total control over the system; • Being a low cost and non-NDA technology, JTAG provides new opportunities for researchers; • Big vendor of motherboard vendor (we aren’t disclose); • Ensure that your Skylake laptop has DCI disabled. mgoryachy@ptsecurity.com mermolov@ptsecurity.com 26
  27. 27. Thank you! Questions? mgoryachiy@ptsecurity.com mermolov@ptsecurity.com github.com/ptresearch 27

×