Recommended
More Related Content
Similar to Movie-Style Hardware Hacking
Similar to Movie-Style Hardware Hacking (20)
Recently uploaded
Recently uploaded (20)
Movie-Style Hardware Hacking
- 2. In hardware gigs, one of the things we want to know is: What happens if we interrupt the boot process?
- 3. You’ve probably seen this before
- 4. Well, this is what it looks like from an electrical point of view
- 5. And if we tamper with that data signal at just the right time…
- 6. For instance, with a grounded probe.
- 7. Or be like Loren. He made a cool button to do it.
- 8. A…
- 10. Anyway, it’s a pretty well- known attack
- 11. In fact, it’s documented in a whitepaper from 2020 https://labs.f-secure.com/assets/BlogFiles/ 2020-05-u-booting-securely-wp- fi nal.pdf
- 12. So why are we talking about this?
- 13. Because I’m a nerd and decided to automate it
- 14. But before we get into it… https://www.riverloopsecurity.com/blog/ 2021/09/introducing- fl ash-bash/ 🤬 We are now enemies.
- 16. My primary lab equipment runs the bootloader I’m interested in: U-Boot Let’s attack it!
- 17. :( (I didn’t even get a photo)
- 18. Luckily, a re fl ash fi xed it :)
- 19. Bonus: I learned that this thing is way more pleasant to use with the back cover removed
- 20. But back the attack I really wanted better control over the timing of the short
- 21. I have a ChipWhisperer I had been wanting to learn to use…
- 22. Two weeks later…
- 23. ChipWhisperer Attacks - Reset target - Delay - Perform glitch - Parse terminal output - Adjust delay - Repeat
- 24. The CW provides a lot of the features I need, all controllable from python
- 25. But it’s not really the right tool for the job: Overclock: Same FPGA Glitch: overkill
- 27. So… YOLO?
- 28. Welllll…
- 29. Let’s prove this out on something a little cheaper fi rst :)
- 30. Target Simulation Attack - Boot - Start a timer - Wait for GPIO signal - Output - Too early - Too late - Success - Reset target - Delay - Send GPIO signal - Parse terminal output - Adjust delay - Repeat until success - Binary search My concept
- 31. Microseconds? There’s no way this will work… 2 minutes later ->
- 32. I was not expecting that.
- 33. Welp. So now we attack the Rigol?
- 34. Well, sending a GPIO signal != a short
- 35. It turns out, U- Boot can run on a Raspberry Pi And I have one in a box
- 36. And it costs a lot less than $1500
- 37. Okay, so people have run U-Boot on a Raspberry Pi
- 38. Two weeks later…
- 39. It boots!
- 40. Now we can build our attack circuit
- 41. Conections We Need - Reset target - Perform short - Parse terminal output - Control terminal after short
- 42. This is nice
- 45. Reset point
- 46. Data lead
- 47. As I mentioned, GPIO signal != a short
- 48. We’ll use a relay
- 49. GPIO signal = press button
- 54. Awesome!
- 55. Questions?
- 56. Bye!