BSides Indy 2017 - Hardware Hacking - Abusing the Things

BSides Indy 2017 - Hardware Hacking - Abusing the Things

• 1.
  “HACK MODE” ENABLED HARDWAREHACKING ON A BUDGET BSIDES INDY 2017 PRICE MCDONALD
• 2.
  ABOUT:ME
• 3.
  O’RLY?
• 4.
  OK, SO HARDWARE SECURITY SUCKS… BUTWHY FOCUS ON THE HARDWARE?
• 5.
  METHODOLOGY
• 6.
  WHERE DO WEGET THE THINGS? • Beta Programs • https://www.betabound.com/tp-link-router- private-beta/ • https://beta.linksys.com/ • https://www.beta.netgear.com/signup/ • Flea Markets • Ebay • Craigslist • Garage Sales
• 7.
  DISASSEMBLY “VOIDING THEWARRANTY”
• 8.
  TAMPER RESISTANCE/DETECTION/ALERTING They meandifferent things, but may not matter either way.
• 9.
  COMPONENT IDENTIFICATION What doyou see?
• 10.
  COMPONENT IDENTIFICATION(2) • EOL802.11G router SoC (System on Chip) • 200 Mhz MIPS32 core • Supports Serial or Parallel Flash • One JTAG and two UART Ports • 336 ball FBGA (Fine-pitch Ball Grid Array) • 32M-BIT Parallel NOR Flash Memory • 3V only • 48-pin TSOP (Thin Small Outline Package) • CMOS DDR400 RAM • 66-pin TSOP II
• 11.
  COMPONENT IDENTIFICATION TIPAND TRICKS The image part with relationship ID rId5 was not found in the file.
• 12.
  ARTS AND CRAFTSTIME
• 13.
  FINDING GROUND • Usingthe MultiMeter we can figure out which of the pins on our headers connect to ground and which have voltage. GroundVoltage Specifically 3.3v • Got Ground?
• 14.
  PHYSICAL COUNTER MEASURES
• 15.
  COMMON INTERFACE TYPES •UART - Universal Asynchronous Receiver/Transmitter • SPI – Serial Peripheral Interface • I2C – Inter Integrated Circuit • JTAG – Joint Test Action Group – Hardware Debugging Interface • CAN – Controller Area Network (Cars/ATM/etc) • RS232- Serial Interface used on many legacy devices
• 16.
  PINOUT REVERSING • SALEAELOGIC ANALYZER • ~100 BUCKS ON THE LOW END @ HTTPS://WWW.SALEAE.COM • ALSO, EDU DISCOUNTS AVAILABLE UP TO 50% DEPENDING ON MODEL. • KEEP IN MIND THAT LOGIC ANALYZERS ARE SAMPLING WHICH CAN CAUSE ARTIFICIAL DATA DEPENDING ON THE SAMPLING RATE AND THRESHOLDS. • WORKS FOR I2C, UART, SPI, JTAG, CAN, ETC, ETC
• 17.
  SALEAE LOGIC UI •Using the Saleae logic analyzer we can watch the pins during boot to check for voltage spikes during. This is a good indication of either a UART, I2C or SPI connection. System Boot Likely the boot log being transmitted over
• 18.
  SALEAE LOGIC -DECODERS GIVEN that we SUSPECT Async Serial (UART) we will select that analyzer
• 19.
  SALEAE LOGIC -DECODING Among small embedded devices 115200 is a very common bit rate so it is an easy guess. But we will also cover a more automated way of determining bit
• 20.
  SALEAE LOGIC –DECODING(2) We must also ensure we are configuring the device to analyze the appropriate channel (which are color coded as long as you connect them
• 21.
  SALEAE LOGIC –OUTPUT As you can see we are successfully decoding the output from the UART serial connection on our Broadcom chip.
• 22.
  OR, HAVE YOUHEARD OF THE JTAGULATOR? • Created by Joe Grand @ http://www.grandideastudio.com • ~180-200 Bucks
• 23.
  CONNECTING TO INTERFACES •Bus Pirate • Less of a learning curve • Slower transfer speeds • Supports UART, SPI, I2C and JTAG • Shikra • No UI but faster transfer speeds as a result • Supports UART, SPI, I2C and JTAG • TIAO USB Multiprotocol Adapter • No UI but faster transfer speeds as a result • Supports UART, SPI, I2C, JTAG, RS-232 • Supports multiple connections from same device • Slightly less reliable in my experience
• 24.
  USING THE SHIKRA http://int3.cc/products/the-shikra
• 25.
  CONNECTING TO UART Thecommand used to connect to a UART serial adapter will vary by device and OS but will generally be similar to the command below. sudo screen /dev/[device id] baud rate Or the the case of the Device ID below for the Shikra: sudo screen /dev/ttyUSB0 115200
• 26.
  WE NOW HAVESHELL! HOPEFULLY But now what?
• 27.
  NO TECH HACKING
• 28.
  NO TECH HACKING(2)
• 29.
  FILE SYSTEM FIDDLING Whyis my root a mtdblock? But wait, what is an mtdblock? • MTD is a "Memory Technology Device. • Unix traditionally only knew block devices and character devices. Character devices were things like keyboards or mice, that you could read current data from, but couldn't be seek-ed and didn't have a size. Block devices had a fixed size and could be seek-ed. • A mtdblock is a block device emulated over an mtd device. Source: Wikipedia
• 30.
  FILE SYSTEM FIDDLING(2) Oftentimes embedded device manufacturers leave important file systems unmounted. Another good Resource: http://wiki.in-circuit.de/index.php5?title=Flashfilesystem_
• 31.
  PILFERING FILE SYSTEMS But,How do we get the file system off of the target device?
• 32.
  SSH WHOOPS?
• 33.
  Ultra quick JTAGprimer • JTAG stands for (Joint Test Action Group) which was formed in 1985. • The following pins are required for JTAG use: • TDI (Test Data In) • TDO (Test Data Out) • TCK (Test Clock) • TMS (Test Mode Select) • The TCK Pin (Test Clock) is what keeps the clock for the state machine. • THE TMS Pin (Test Mode Select) is what determines when and how the State Machine advances depending on it’s relative position during each clock cycle. Source: Wikipedia
• 34.
  OPTIONS FOR CONNECTINGTO JTAG Good Better Best $45 $60-$600 $5000- $20000
• 35.
  JTAGULATOR
• 36.
  HOW TO CONNECTWITH OPENOCD The command to initiate openocd is : openocd –f interface – f target But now what? There are errors and stuff!!!!! #openocd on
• 37.
  HOW TO CONNECTWITH OPENOCD(2) Silly openocd! That’s more like it J
• 38.
  USING OPENOCD
• 39.
  MY PET PROJECT== CEREAL
• 40.
  REVERSE ENGINEERING • BinaryNinja • Free version available • Limited Architecture Support • Learn one IL to reverse them all • Ida Pro • Paid Version required for disassembly • ARM decompiler available but $$$$ • Also very good debugger • Radare2 • Free multiplatform support • No decompiler available
• 41.
  RADARE2
• 42.
  IDA PRO
• 43.
  OTHER NICE TOHAVES
• 44.
  • http://www.grandideastudio.com/hardware-hacking-training/ • http://www.xipiter.com/training.html •https://www.eevblog.com • http://www.embedded.com/electronics-blogs/beginner-s-corner/
• 45.
  THANK YOU!!!! ANY MOREQUESTIONS?
• 46.
  CONTACT INFORMATION TWITTER: @PRICEMCDONALD LINKEDIN:LINKEDIN.COM/PRICEMCDONALD EMAIL: [email protected]