Upload File

hardware exploitation - exploit.courses

26
1 Hardware Exploitation

Upload: others

Post on 06-Jan-2022

1 views

Category:

Documents


0 download

Report

TRANSCRIPT

Page 1: Hardware Exploitation - exploit.courses

1

Hardware Exploitation

Page 2: Hardware Exploitation - exploit.courses

2

Page 3: Hardware Exploitation - exploit.courses

3

Ring -1, -2, -3

Page 4: Hardware Exploitation - exploit.courses

4

“Replace Your Exploit-Ridden Firmware with Linux - Ronald Minnich, Google”

Exploiting Ring <0

Page 5: Hardware Exploitation - exploit.courses

5

▪ Ring -1: Hypervisor

▪ ESX, HyperV, Xen etc

▪ Makes it possible to run multiple kernels (VM’s) at the same time

▪ Ring -2: SMM

▪ System Management Mode

▪ 16 bit mode

▪ Handling of interrupts

▪ Ring -3: Intel ME

▪ Management Engine

▪ Separate Microprocessor (!)

▪ Works if your computer is off

▪ Has TCP/IP stack

▪ Minix OS

▪ Access to Screen (KVM)

▪ Intel AMT

Ring -1, -2, -3

Page 6: Hardware Exploitation - exploit.courses

6

https://blog.trendmicro.com/trendlabs-security-intelligence/mitigating-cve-2017-5689-intel-management-engine-vulnerability/

Intel ME

Page 7: Hardware Exploitation - exploit.courses

7

Using a web-based control panel, accessible from port 16992 and 16993, which

comes pre-installed on the chipset, an administrator can remotely manage a

system.

The Intel AMT Web Interface works even when the system is turned off, as long as

the platform is connected to a line power and a network cable, as it operates

independently of the operating system.

To exploit this logical flaw in Intel AMT Web Interface, all an unauthorized

attacker needs to do is send nothing (null) into user_response to the server.

Intel ME / AMT Bug

Page 8: Hardware Exploitation - exploit.courses

8

Non Intel/AMD/ARM

Embedded Systems

Page 9: Hardware Exploitation - exploit.courses

9

▪ Non Linux/Windows Systems

▪ ESP8266, ROTS, ESP32, Zephyr, Fuchsia OS (Google), …

▪ Reference:

▪ Jos Wetzels

▪ http://samvartaka.github.io/work

Embedded Systems

http://samvartaka.github.io/work
Page 10: Hardware Exploitation - exploit.courses

10

https://hardwear.io/document/rtos-exploit-mitigation-blues-hardwear-io.pdf

Page 11: Hardware Exploitation - exploit.courses

11

Embedded Systems

The Industrial Internet of Sitting Ducks, Jos Wetzels, Swiss Cyberstorm 2017

https://hardwear.io/document/rtos-exploit-mitigation-blues-hardwear-io.pdf

Page 12: Hardware Exploitation - exploit.courses

12

▪ Have their own CPU implementation, instruction set

▪ May or may not have Exploit Mitigation

▪ DEP (CPU+OS)

▪ ASLR (OS)

▪ Stack Canaries (compiler)

▪ May or may not enable them by default

▪ May or may not have to create your own ROP technique (JOP, SOP,…)

▪ Have to create your own shellcode

Embedded Systems

Page 13: Hardware Exploitation - exploit.courses

13

https://googleprojectzero.blogspot.ch/2017/04/over-air-exploiting-broadcoms-wi-fi_4.html

Exploiting Broadcom’s Wi-Fi Stack

https://googleprojectzero.blogspot.ch/2017/04/over-air-exploiting-broadcoms-wi-fi_4.html
Page 14: Hardware Exploitation - exploit.courses

14

https://googleprojectzero.blogspot.ch/2017/04/over-air-exploiting-broadcoms-wi-fi_4.html

▪ Exploit for WiFi Chip Broadcom (Nexus 5, 6, 6P, Samsung, iPhones, …)

▪ Via WiFi frames

▪ Heap overflow (heap massage)

▪ After RCE: Escalate to Host OS

We’ve seen that while the firmware

implementation on the Wi-Fi SoC

is incredibly complex, it still

lags behind in terms of security.

Specifically, it lacks all basic

exploit mitigations – including

stack cookies, safe unlinking and

access permission protection

Exploiting Broadcom’s Wi-Fi Stack

https://googleprojectzero.blogspot.ch/2017/04/over-air-exploiting-broadcoms-wi-fi_4.html
Page 15: Hardware Exploitation - exploit.courses

15

ESP8266, ESP32

▪ No real OS (no processes, filesystem)

▪ One single process. TCP/IP, drivers etc. as library

▪ Wifi, bluetooth, ...

▪ Stack is (by hardware) not executable

▪ https://def.camp/wp-content/uploads/dc2017/Day%201_Carel%20&%20Philip_xtensa_exploitation_DRAFT.PDF

Microcontrollers

https://def.camp/wp-content/uploads/dc2017/Day%201_Carel%20&%20Philip_xtensa_exploitation_DRAFT.PDF
Page 16: Hardware Exploitation - exploit.courses

16

https://www.youtube.com/watch?v=eDyxBgIUaR8

What about ASA (Cisco)

Page 17: Hardware Exploitation - exploit.courses

17

Attacking Hardware

Page 18: Hardware Exploitation - exploit.courses

18

RAM Attack: Rowhammer

Row hammer is an unintended side effect in (DRAM) that causes memory cells to

leak their charges and interact electrically between themselves, possibly

altering the contents of nearby memory rows that were not addressed in the

original memory access.

The row hammer effect has been used in some privilege escalation computer

security exploits

▪ Write into other memory cells in RAM (bypass OS/CPU protection)

▪ Integrity of data not guaranteed

▪ Who is affected? Everyone!

▪ What is the fix?

▪ …

Local Kernel Exploits - Hardware - Rowhammer

Page 19: Hardware Exploitation - exploit.courses

19

▪ Meltdown / Spectre

▪ Read memory of kernel, of other userspace processes, of other vm's, …

▪ Confidentially of “protected” memory pages not guaranteed

▪ Stealing encryption keys

▪ Bypass kASLR

▪ Can be exploited via Browser (JavaScript) (need code execution first)

▪ Who is affected? Everyone! (Intel, ~AMD, ARM, …)

Local Kernel Exploits - Hardware - Meltdown/Spectre

Page 20: Hardware Exploitation - exploit.courses

20

Page 21: Hardware Exploitation - exploit.courses

21

As expected, there's more! - RIDL/Fallout

Page 22: Hardware Exploitation - exploit.courses

22

As expected, there's more! - RIDL/Fallout

Page 23: Hardware Exploitation - exploit.courses

23

Conclusion

Page 24: Hardware Exploitation - exploit.courses

24

▪ X86 hardware has layers we cannot control, and which are insecure

▪ Most embedded platforms are very insecure

▪ Our hardware itself is insecure

▪ Nothing can be trusted

Hardware Attacks - Conclusion

Page 25: Hardware Exploitation - exploit.courses

25

Area41 2014: Halvar Flake: Keynote

Trusting our computers

Page 26: Hardware Exploitation - exploit.courses

26

Area41 2014: Halvar Flake: Keynote

Trusting our computers


Animal Exploitation

High Performance Programming with IBM XL Compilers and ...spscicomp.org/wordpress/wp-content/uploads/2011/05/gao-Perform… · –Exploitation and tuning for latest hardware implementations

Overexploitation Tokyo Tuna Market. Types of Overexploitation Commercial exploitation Subsistence exploitation Recreational exploitation Incidental exploitation

JMIC02 OSINT EXPLOITATION OF THE INTERNET EXPLOITATION OF THE INTERNET Searching

Consumer exploitation

Exploration and Exploitation in Organizational Learning1991.pdf · Exploration and Exploitation in Organizational Learning ... EXPLORATION AND EXPLOITATION IN ORGANIZATIONAL LEARNING

The Geohazards Exploitation Platform (GEP) - ESA SEOMseom.esa.int/fringe2015/files/presentation361.pdf · The Geohazards Exploitation Platform (GEP) ... The Geohazards Exploitation

Post Exploitation

SmashClean: A Hardware level mitigation to stack smashing ... · OpenRISC ISA Processor. SEAL CSAW ESC SmashClean 4 / 18. Introduction Objective Exploitation Methods Memory Allocation

Bypassing the Maginot Line: Remotely Exploit the Hardware ... · •Reverse Engineering •Vulnerability and Exploitation. Mitigation Table Mitigation Status Heap ASLR N Heap Cookie

Hydro Exploitation

Exploitation 102

Exploitation d'Uranium

Shellcode - exploit.courses · © Compass Security Schweiz AG Slide 2 Content Intel Architecture Shellcode Buffer Overflow BoF Exploit Debugging Memory Layout Remote Exploit

Climatic responses to anthropogenic groundwater exploitation…€¦ ·  · 2013-11-25Climatic responses to anthropogenic groundwater exploitation: ... pogenic groundwater exploitation

ANNUAL INDEX PHOTOGRAPHIC EXPLOITATION … index photographic exploitation products january-december 1985 subject: annual index photographic exploitation products january-december

Kernel Exploitation - exploit.courses · Kernel Exploitation - Content. compass-security.com 3 Kernel Basics Kernel Exploitation. ... (post breach persistence / hiding) Backdoors

Financial Exploitation

COBOL V5.2 Was Announced! What's New? - Confex · COBOL V5.2 Was Announced! What's New? • Agenda – New hardware exploitation: z13 – Continuous improvement! – Announcing access

Hostel Exploitation

Javascript Exploitation

MONTHLY INDEX PHOTOGRAPHIC EXPLOITATION PRODUCTS … · title: monthly index photographic exploitation products july 1987 subject: monthly index photographic exploitation products

Exploitation - CanSecWest

MONTHLY INDEX PHOTOGRAPHIC EXPLOITATION PRODUCTS DECEMBER … · Title: MONTHLY INDEX PHOTOGRAPHIC EXPLOITATION PRODUCTS DECEMBER 1984 Subject: MONTHLY INDEX PHOTOGRAPHIC EXPLOITATION

1 Chapter 2: ILP and Its Exploitation Review simple static pipeline ILP Overview Dynamic branch prediction Dynamic scheduling, out-of-order execution Hardware-based

Concurrency in JDK 5.0 CIT Concurrency · CIT Concurrency Java Implicit Concurrency (3) •J DK 5.0 – java.util.concurrent – JVM-level changes (exploitation of hardware level

Elliptic Curve Factorization Method : Towards Better ... · 21 SHARCS ’07 Workshop Record Elliptic Curve Factorization Method : Towards Better Exploitation of Recongurable Hardware

Network Exploitation

Child Exploitation - EduCare Exploitation.… · Child exploitation refers to a child or young person being used for someone else’s gain. Child exploitation is a form of abuse which

VRE Exploitation

Exploit Mitigations - exploit.courses Mitigations Best Exploit Mitigation: (Security relevant-) Bugs should not exist at all Write secure code! Use secure libraries

Groundwater Exploitation

TwoYearsof ERS-1 Data Exploitation - ESA data exploitation TwoYearsof ERS-1 Data Exploitation M.Albani, V.Beruti & S.D'Elia ERS Exploitation Division, ESRIN, Frascati, Italy TheERS-1mission

SOFTWARE EXPLOITATION

Exploitation Read