Dear viewer, these subtitles were generated by a machine via the service YouTube and therefore are (very) buggy. If you are capable, please help us to create good quality subtitles: https://c3subtitles.de/talk/3187 Thanks!
so the next talk is bringing the hack
back into the chaos by Daniel maslovski
um Daniel likes giving talks and
workshops in his free time uh he works
on free and open source software
especially operating systems and
distributions bring up an application
firm with a focus on tooling integration
on documentation they created feut the
firmware
editor while more and more hacker spaces
have been found in recent years there
are many different topics that are being
discussed at the same time AI 3D
printing Arduino social and political
questions and lots more where the hacks
though things are happening and with
this talk we want to talk about them and
call for
exchange hi I am Daniel and today I'm
going to talk about things we do in our
Hecker space and what we want to give
back to the community
so if you've seen or heard me talk
before you know that I'm working a lot
with hardware and today we want to talk
a bit more about specific tools that we
buil and needed for you know working
with Hardware let's have a quick look at
the agenda here I'm just going to give a
very brief introduction to you know get
some more context I'm going to talk a
bit about hacking on gadgets because
that is something we've been doing quite
a lot at chaos our hacker space in Essen
and then now we'll later go a bit deeper
into a specific topic because uh
coincidentally um we just uh you know
got to look a bit further into some
firware security issues and yeah that
will cover the last part
here so for the introduction so first
let's get some motivation because there
are a bunch of things we can do in you
know the hacker scene like you know like
in the movies like Hollywood hackers we
we could do fun stuff um but we actually
wanted to do something construct Ive as
well and I've looked around a bit and
I've seen that there are also not just
hackers interested in looking further at
devices nowadays but also certain
governments for example the EU there is
now a new act uh there is you know
movements to get rid of electronics and
as waste because you know a bunch of
electronics now exist all over the world
and we would like to cut down that waste
so one way of doing that of course is to
reuse older devices which is something
we will also elaborate on in a
bit now another thing is the Cyber
resilience act in the EU uh you might
have heard about it or abbreviated it's
just C uh that is a strategy by the EU
to gain some more sovereignty again
because that is something unfortunately
uh we lost quite a lot actually over the
last year so if you think about it for
example in the space of like uh
operating systems and also application
software there is a bunch that we
actually buy from other countries right
everybody knows Microsoft as a very
prominent example you know essentially
there is a bit of like I would say 90%
now of the machines used by the German
government institutions for example
which are all running Microsoft Windows
operating systems and that need not be
the case actually so yeah let's let's
see what that gets us and also of course
there is this call for more
transparency as a yeah not AR part but
the similar thing in the US is the
electronics Resurgence initiative also
talking about sovereignty you know in
that sense here it's about fabing own
chip so that is also something we're
looking into in the EU and especially in
Germany where you know we're thinking
about building up new Fabs and in fact
there is now some funding projects going
on albe it a bit complicated but the
general idea is
there and of course there is always this
idea of you know we need to to hack back
into other countries when they attack us
so that is something you might have seen
all over the news sometimes you know
populist politicians like to talk about
that because you know it is something um
that you can use to motivate people you
know like uh some people really you know
get pushed by politicians you know
talking that way like hey we need to act
we need to do something and so on
without even a specific plan or anything
so here is a Blog article from Rapid 7 a
very well-known security company you
know discussing the issue a bit I highly
recommend you to look into all those
links and as usual I will upload those
slides here later so that you can have a
closer look into
everything so what are we doing at chaos
part and Essen so there is a bunch of
people now you know who have met and uh
wanted to you know try out some things
or were just curious about things and so
we got to talk a bit of course that
takes a bit of time you know to build up
a certain Community to figure out what
each other's interests are and I would
now like to point out a few things that
we're actually doing to you know shout
out into the cybers so first up we have
something that we call pedu that is a
weekly session that we have on
Wednesdays in the evening well not not
every week actually but you know most or
some in some weeks we have these
sessions where you know we we get short
presentation sometimes we do a bit of a
Hands-On thing or some something you
know it's usually something like 10 or
maybe 15 minutes it you know it may also
exceed but um the general idea is you
know that we just quickly cover some
topic like you know it doesn't have to
go too deep doesn't have to be very
broad right so it's it's really about
very very specific ideas and sometimes
that actually leads us to surprising new
findings then we have the blog so at
chaos. dblog it's all written in German
but um you know good Google translate
might help if you don't speak German
otherwise you can read natively anyway
um this is uh essentially where we you
know write up where we've been like
projects we've worked on and stuff like
that yeah there is actually a bunch of
things going on so I highly encourage
you to have a look at that now well or
later actually um then there is now a
group of people who are interested in
something that is called Capture the
Flag which you might also have heard
about it's essentially you know a bit of
a gamification if you will of software
security issues or also Hardware
security issues sometimes even so yeah
if you've heard about things like you
know binary exploitation data
exfiltration you know that there is a
bunch of things that you can do uh web
applications are very prominent example
that you know people set up you know on
purpose that are a bit more vulnerable
than usual um you know to point out
certain issues that you need to be aware
of so yeah um if you are interested in
that sort of stuff if you are around our
space so definitely come by have a look
uh you know look at that blog article on
the website and of course visit us if
you like and otherwise you might also
find a local group actually doing this
there is even uh large competitions
going on both nationally but also
internationally you will definitely find
something in your area I
think and then finally we have a podcast
well it's um it has its own Cadence in a
way let's say uh but you know there
there is a bunch of things that we've
already talked about also all in German
at this point I'm sorry if you don't
speak the language uh but yeah for
German speakers it's definitely very
very interesting um for example we just
had an episode recently uh where uh one
of our guys enrio uh talked about a
setop box that he hacked on and we will
also look at that in a
bit now let's talk a bit about the
gadget hacking that we're doing so first
up
we've been to other places before right
there is a bunch of these congresses
that we have and you know like mrm CD
for example is a smaller congress not
not as large as the chaos communication
Congress but there is still a good few
thousand people there or maybe just a
thousand I'm not too sure but yeah we uh
presented there and uh we talked about
things that we actually hack on
ourselves so yeah we brought a few
gadgets you know we played around with
them and gave some live demos for
example
um we made a proposal so uh the idea was
to create a tool for visualizing device
trees that is something that is commonly
being used for firmware and also
operating systems in order to enumerate
devices in your
hardware and then we get also give a
shout out so we actually want more
people to do this or well we want to
encourage people to you know look closer
at their devices especially you know
when when you have some let's say some
special Gadget or something and you
might have some idea like okay I should
be able to do this and that with that
thing but I'm not too sure how you know
let's see if we can get something going
and exchange about it just share
whatever you figure
out and you know that's also what we did
so what you see here is the main board
it's essentially like a single board
computer if you know the Raspberry Pi
it's just a slightly different form
factor and well it originally it has a
case so this is now unboxed if you will
uh so you see the be board and this is
something that we presented and I put
some notes in the Linux sunci Wiki uh
that is a Wiki allaround chips by the
company called all winner and well guess
what happened after I had this article
in there for a while somebody else found
it and you know continued hacking on the
stuff and then actually wrote me an
email we started exchanging a bit and
now there is a bit more work in progress
there so the first thing we did on this
device here was you know just to you
know execute a bit bit of our own code
which is somewhat easy because for all
winner chips there are already very
great tools from the community for doing
that um at this person already figured
out you know how to actually use a uh
stock Linux kernel like a Mainline
kernel and then uh you know read out the
Nan fles that you see here on this board
and then you know we can also work with
that a bit more so yeah what we had just
done was essentially just write to the
console and do a bit of networking you
know now we have a big storage part
part so coming back to the device tree
visualization we actually did that so I
started a new project at the platform
system interface Pro uh organization on
GitHub uh you might have heard me talk
about this before um so that is like a
larger umbrella project let's say all
around you know Hardware essentially
Hardware platforms and interfaces to
operating systems so yeah the general
idea here is to get some visual
representation of what is usually just
giant text file so of course this here
is not yet very perfect uh well at least
you know we could quickly draft
something that could render us the tree
and also distribute all the nodes in the
tree in a way such they such that they
are well aligned you know so the
challenge really here is if if you can
read this here uh this is almost a
thousand nodes in this just one tree uh
this year being from laptop manufactured
by Apple and you know there is so much
stuff in there it's it's really hard to
work with if you know you have no idea
of what's going on in there and this
might give you a very quick overview of
course it's a bit hard to navigate such
a large tree uh we might work on that
and give some more help but yeah it's a
it's a very good start now and people
actually already played around with that
so yeah feel free to uh there is a
deployment online here on GitHub so you
can uh go to platform system interface
the GitHub .io DTV that's the device
tree visualizer and you can load your
own device tree blob into this and then
have it visualize almost immediately the
code for parsing that data is written in
rest so if you are a rest developer or
you wanted to look into r at some point
you're very welcome to also work on that
a bit more because currently we we do
actually have all the data in there this
is just a rough uh implementation here
and of course we would like to extend
that over time so yeah you're welcome to
file your pro
requests yeah speaking of the platform
system interface project that is
something I talked about last year at
the fire Shong stage and it's as I said
a very large umbrella project actually
so yeah you you will find it on GitHub
at the platform system interface
organization and I started writing down
something that I call PS I spec like a
specification I would like to have a
general idea of what Hardware platforms
Alik cuz there are like quite some
difference actually between like all the
different vendors and all the different
chips and instruction sets and all of
that stuff but at the same time there
are some general ideas which always hold
in a way you know with minor
implementation details which differ a
bit but in in general those are very
very
similar so yeah I talked about this as I
said and here you find the link to uh my
website where I always upload all the
slides and well you're welcome to look
at that again or maybe do a recup of
last year's talk you can find it at
media.
cccd now let's talk about some actual
devices that you know we just recently
had in our hands what you see here is
something commonly called a TV box if
you search for a TV box on your favorite
store be it Amazon or you know eBay or
you just go to like an actual bricket
mortar store you will find boxes like
this one this year being something uh by
a vendor called trans speed but you know
you will find many many different others
because it's essentially a giant white
label uh business there so this year is
based on a chip by the company mlogic
it's um you know if if you know all
winner and mlogic um they they're sort
of in the same space so all winner also
makes these kind of chips for TV boxes
you know and then they have like in
general very similar applications also
found on single board computers for
example yeah so if you have uh one from
regra for example they use some M logic
chips for some I think uh and also yeah
some some others you you might have won
already and what we did here was this
this is a box that you can uh you know
just buy off the shelf right so usually
it's like it's its own product in a way
the idea was never that you would really
run your own software on it but why not
so we did and we successfully ran our
own kernel that we built from the
Android open source project so if you
look for AOSP or the Android open source
project you know they have their own
copy of the Linux kernel with their own
like variants and extensions so there
are some things which will not land
Upstream uh at kernel.org you would
usually find the L kernel you know
sometimes because of like vendor
specifics you know maybe they needed to
push something out like in this case for
example actually you will find if you
look at there a kernel here that is the
arm 64 kernel that we run on this
machine because it's Arm based um there
is actually a bunch of code in there
which is definitely not uh you know made
for pushing to cor.org
essentially there is a config you know
which goes all around the code base and
you know but it might actually be
interesting to carve out some of that
stuff and you know push that Upstream so
that we can also work with this box
here and if you would like to have a
quick look at you know what it was like
to bring this up uh here is a link to
the gist I put on
GitHub so yeah but let's talk a bit more
about the slcs that mlogic makes or
systems on chips so the vendor is assess
said you know in a very competitive
market right so the thing is if you
wanted to use some tools to work with
their chips you wouldn't actually really
find much except there is actually
something uh there is some vendor tools
they're not too great you will find them
on GitHub usually in binary form they're
you know closed Source they're not
disclosing how their chips work so that
is a bit of a problem for us if we want
to work with those because you know it's
it's really hard to figure out how to
use them and there are some things which
already just you know not provided by
those tools like you know what I would
like to do for example is I would like
to load some code into memory and then
just run it you know to make a simple
Blinky demo for example right so I would
like to attach some LEDs to my board and
then you know have those LEDs blink I
don't want to you know write a whole
operating system for it or you know
already use an off the shelf system I
would like to have something very very
simple to work with
well fortunately somebody already
created a python tool for that it's to
be honest it's a bit messy uh you you
will find it on github.com at support
qu9 and/ paml boot so it's you know
written in Python they have documented
their findings in the protocol so that
is essentially the same thing that the
uh vendors tool would also do um but
they have Rewritten that in Python they
documented quite quite a lot of that
stuff not too perfectly but it was a
very very good start for us but there
were still some features missing there
you know which we wanted to extend now
the thing is I don't really know much
python I can read it a bit but um yeah
for me it's a bit hard to work with and
also you know there were a bunch of
files scattered around um not to blame
here but yeah it wasn't really uh you
know what we could work with at that
point so what I suggested was hey um I
know R right so let's rewrite this tool
in and extend it and so we did it's now
on my GitHub at orang CMS amlor boot so
that's what we call the
tool no we actually found out that we
can't reuse the tool for the TV box I
just showed you earlier because that is
one of the newer so's by
mlogic they made a different tool for it
so that is from the vendor again it's
called adnl and well we also had a
closer look at that one and we quickly
figured out that it's it's actually a
fork of what is called Fast boot if
you've worked with Android devices you
might know the fast boot tool because
it's something that you know talks to
like a very early boot loader in the
Android space is usually what you use
also to flash your own custom RS for
example or you know if you need to
unlock the device like there are unlock
commands and stuff like that very OEM
specific though well and in adnl by you
know taking a closer look uh we actually
even found some hidden commands so
usually they would just have something
to flash to the device so you know you
could only write something um to the
storage like to a nand flash or
something but we wanted to you know just
run some code or maybe look at the
memory and so on and that is actually
what the commands could do that we
figured out there um it's not yet uh
written up fully in AML boot but yeah we
will do that and you know then also be
able to work with those devices now the
thing is how do you really figure out
the traffic that goes over USB you know
how that really works and so on so if
you try to understand that from the
binary you would need to follow the code
flow and see what payloads are being
constructed and so on that is a bit
tedious so what I figured out was uh
well or somebody actually told me a
chaos but you can use wire sharp for
that so I had some ideas and one idea
was well we could just use fake USB
device is also to test out the vendor
tool and see what it would send you know
without actually affecting a real device
like there are some commands for example
which we don't really want to run on the
device so we could use a fake USB device
that uh you know we could create through
the Linux chel that is definitely a
capability or we could also use some
extra Hardware there are for example
some very very cheap and affordable uh
USB microcontrollers that you can take
today you know which would just uh let
you set set your own USB vendor ID and
USB device ID that or product ID that is
essentially how those devices are being
identified and then you would need to
declare like uh you know what
capabilities you have so you can
literally just take that from the vendor
if you connect the device and then you
know rewrite that well and then now you
have a simulation
Target anyway so up until now as I said
we have this AML boot tool and and
here's a short exerpt from its help teex
so if you run this uh we have used the
um library in in Rust that is called
clap the command line argument parser um
that allows you to very easily declare
your command line tool so you can you
know you can say there is a bunch of
commands and they have their arguments
and so on you can provide some help it
it's not complete here yet but you know
at least we have something for a start
actually the tool is already quite Rich
compared to the vendor tool so you can
read out a bunch of information from the
chips but you can also read out memory
directly for example you can write some
memory you can you know use the dumb
command to You Know download a larger
chunk of memory it's some 64 kilobyte
blocks that you can get per step from
the mlogic uh devices but you know we uh
coded something up that you could also
use to you know get more and more chunks
out of it so yeah you can just say hey
give me I don't know 4 megabytes from
this and this address on and so on
and of course you can do it in both
directions so that is what we uh provide
the right command for and of course if
you want to run something there is the
exact command where you could just jump
to an address and execute code or you
can uh use the Run command directly yeah
with with some constraints but yeah
definitely have a look at that tool if
you're working with mlogic s
so's now we also created a command that
is called Blinky which for a handful of
well-known boards that we already have
you know just does a little blinky demo
on it so essentially you can just say
like in this example here Amore boot
Blinky and then the device name this
here being one from Liber computer uh
the lc- s905 D3 CC it's a board that uh
I actually got at a conference uh just
recently some months ago and well as you
can see we got the LEDs to
shine
okay let's uh talk about some more boxes
so there is something very very similar
to those TV boxes which is called set
toop boxes or stbs for short it's
essentially the same idea but usually
that would be something that is provided
by uh your ISP like your internet
service provider uh you know they would
give you like some extra Services uh
things they call like I TV for example
like Internet Protocol based television
Vision so it's a bit like TV in a sense
but you know so you you have some sort
of controlled environment with only you
know a certain program they offer and so
on there is some on demand streaming in
there and stuff but yeah it's a it's not
a general purpose thing once again now
the thing is over time those devices may
actually become obsolete because the you
know provider may choose to cut down or
completely shut down their services or
say hey this Hardware is now deprecated
if you want to use our server still you
would need a newer box and so on I'm
very sure everybody here you know knows
a story like that one so yeah what what
do you what do you do with that obsolete
Hardware of course why not just reuse it
for something else those are just
perfectly fine boxes they have their
connectors like HDMI they have USB
connectors networking obviously because
it's you know for video streaming so
essentially it's like a computer like
just like every other computer why not
use it as
one so yeah that is what enrio did and
uh you know he tried to um you know get
into the film war first uh it was
unfortunately password protected um but
yeah he was a bit lucky with some
findings he tried a bunch of things uh
you you can uh hear that in our podcast
episode from just recently uh go
definitely check that out um anyway at
some point he was in so he was now able
to load his
code now the the thing was there was a
Linux col running on this um but we
didn't have the sources so we looked a
bit and I actually found a website at
some point and he said hey Daniel you're
a genius uh except that the download on
the website was actually gone so you
know you couldn't actually download
anything that was a bummer uh but still
we knew the kernel version and so on and
well what he then did was well just
keeping the stock colel and he crafted a
custom loader for Elf binary so elf
being the executable and linkable format
that is used in most Unix system or many
Unix systems and also in Linux so yeah
here on this screenshot you're seeing
some console output from that loader
which you know just put something in
memory and executed it and well in the
end you see a little Hello message from
the module that uh he was then building
so the thing was you know this box being
perfectly fine uh his idea was to
actually re it as a little gaming
console or something like that right so
yeah after some work eventually um that
was working so he could just play video
games on it like you know an SNES
emulator and stuff like
that and yeah if you want to listen to
that podcast episode definitely go check
out that link
here all right so now that we've talked
about a lot of hacking stuff um let's
actually talk about security because
that is something being very very
important nowadays because we are
exposing our devices to this giant
Network that we call the internet and
all of our devices are actually running
firware and you know that can lead us to
certain
issues so but let's uh let's talk about
what kind of form we mean here because
it's a term that is being very very
Broad and you know people have different
ideas of what phone might be
so first little predicament here um
there are some people who think of
something that was called the BIOS that
is something from like the 80s or
something right so you know that was
essentially like you know where you
could have some uh setup you know you
could change some settings on your
computer and you know that you could
have something very simple for the
operating system to interact with that
is some sort of firmware and that is
also something that I look into quite a
lot these days now that is different
from platform to platform so if you're
not on a PC like you know a good old IBM
PC or some compatible device it might be
that your firware is actually quite
different and there is even people
thinking of whole operating systems when
they say firmware like the Android
operating system for example that you
have on your phone some people consider
that to be the firmware even though it's
actually a full-blown operating system
already with like coming with
applications even right so if you
install a very uh simple stock Android
operating system you already have a
bunch of apps in there including a web
browser you know calendar and all of
that stuff well essentially that is what
you need on a phone anyway in you know
most cases of course there are like
feature phones but you know we're
talking about these so like very fancy
phones
nowadays oh and of course there is like
you know different groups of people
referring to the term so there is like
like in marketing for example people
might have a different idea of firmware
um Cal speech as I said people have very
very different ideas different vendors
different products have their own labels
and so on sometimes they include
something in firmware maybe more than
actually necessary you know and that is
where it becomes a bit
interesting you might also know about
these services that are sometimes fun in
firmware and that's what we're going to
talk about in a
bit so yeah but the very very gist of
fmer is usually just to bring up a
Computing platform so really just do
some initialization so that an operating
system can run uh in uh many cases that
just involves bringing up a memory
controller and then you know loading the
kernel into the memory that then becomes
usable so you would need to configure
the memory controller you would would
need to you know tell it like um what
parts to work with give it timing
parameters and so on you know memory
chips can be very very different there
are now different generations of what we
are call DRM you know maybe the terms
DDR like DDR 1 2 3 4 we're now at DDR 5
even I'm not even sure if six is already
in the makings you know things just
develop over time anyway those still
need their parameters in a way sometimes
they can be Sol training and so on but
still before you can actually run an
operating system you would need to bring
those up well and then after that you
can run your operating system or some
bar metal application some hypervisor
and so on which is then using all of
that memory so that is always something
that the operating system cannot do by
itself okay now let's talk a bit about
phunware interfaces and services so you
know that there are a bunch of devices
being exposed to the internet that can
be for example cameras like you know
security cameras uh that can be like
toys of various kinds you know also
adult toys for example um but but still
we we know that when things are
connected to the internet we need to be
very careful with them like your a
security camera for example if it's
purpose is to monitor your house for you
know
burglar then you want to be sure that
you are the only one actually being able
to look at that because if somebody
could just see your camera from the
internet because it's exposed to
everyone in the public
now you're actually exposing like the
inside of your house to the potential
burglar which is exactly the opposite of
what you intended right so we need to be
very careful that uh you know the
equipment that we buy is not
accidentally exposed to unknown
people now the thing is these interfaces
or services that we have are actually
always considered as like part of a
device or you know a platform that can
be a cloud platform for example where a
vendor says hey we provide the security
gear you can log into this and the space
somewhere you know they they would give
you some URL or they would provide you
with an app and then it would still be
connected through some cloud or
something um that is a very very
dangerous thing but it can also be just
your local machine so in modern uh
machines you would find some interfaces
that you know are actually talking to
the operating system and vice
versa now you need to be a bit careful
with that because firware is not usually
often upgraded so that is something
we're trying to push for from the open
source firmer and also the security uh
communities because we know that such a
giant at Tech surface and you know you
be need to be very very careful and the
most important thing is you need to be
able to upgrade the
firmware otherwise you know every
finding that we have in the security
community every vulnerability that we
discover and could technically mitigate
would never actually get mitigated
right so there is a company for example
doing research in that space named binor
um you will find the uh advisories that
they have on their website so yeah I
give you the URL here and well as I said
the firware interfaces provide such a
giant attack surface they already have
uh numerous findings here more than 200
if you come those here um many of which
actually have a very high severity so
you see the scoring here there is
something called CVSs that is like a a
scoring system essentially telling you
like you know how harmful a
vulnerability can be and then
corresponding to that is the so-called
cwe that is the common weaknesses
enumeration uh which is coming from a
larger organization called miter
m.org is their website definitely have a
look at that if you're interested in
security and you know not very deep in
that topic yet so they essentially gave
a number like an identifier for you know
each weakness that a device can have and
in fact I just recently discovered they
even have one which is just for being
able to upgrade firware on your device
if you don't have that you know then
that is a weakness of your
device okay so um before we continue I
would like to do a small recap uh
because I created a tool that would
allow you to investigate your firmware
now this year it's called fetka is
mostly for firware that you would find
in your laptops nowadays or your server
platforms or you know other kinds of
main boards like desktop computers for
example or you know these um small thin
clients that many people have in their
offices maybe the uh current feature set
is already quite Rich so we can analyze
those for more images we can visualize
how much of the firmware image is used
we we call flash usage because usually
it you know comes from a flash port on
your mainboard and you can explore the
file systems therein uh namely those
being defined by ufi the unified
ex tensible firware interface sorry uh
then the AMD PSP that is their platform
security processor also has its own
firware and then cor booot cor booot
also has a false system
and if somebody wanted to work on that
we would also be uh grateful if you know
we could support the Intel management
engine definitely check out the website
it's called it's feta
app well now if you analyze your
firmware you know you you might want to
get an idea of like okay what is the
security state of my platform actually
so we're working on some extra features
now uh one is something I already talked
about uh in uhe at previous conferences
a software bill of materials that you
know would essentially you know give you
an idea of what actually came into that
formare where it came from and so on
that is something that is currently
being developed by the firmware industry
including the ufi Forum but also the
corbo project already has support for
that I'm not sure about the uboot
project for example but yeah that is
something that many people have been
talking about I think it's also covered
in the uh EU cyber resilience Act the
SI now the other feature is there is a
bunch of key material actually also in
your firmware and also maybe fused into
your chips uh Intel as a prominent
example has a feature that is called
boot guard and that would prevent you
from executing custom firmware but also
an attacker firmware hopefully unless
you know sometimes it happens that um
keys that ban have used uh might end up
in the public by accident or you know
because somebody attacked their
infrastructure and found those and
extracted those keys and so on so yeah
uh we uh started drafting a feature well
um while we were talking about secure
boot so the idea of secure boot is that
you secure your boot process from the
start on and boot guard would be the
initial feature on Intel platforms
providing that everything coming later
on is worth nothing if your boot guard
is compromised
so what we're doing here is uh we want
to give you an alert if we find some
already known to be exposed or outdated
boot guard keys so you know Keys expire
either by you know ending up in the
public but we're talking about the
private key that is used for signing
here right or people you know people
might actually have some old Keys which
are like reach their end of life
so that depends a it it's not
necessarily applicable here I'm not to
sure
uh but there is definitely um you know
different key infrastructures and you
know some might have expiry dates for
example so yeah if you have a key
somewhere that is already expired you
know that might keep you from booting a
machine for example depending on the
specific
scenario okay and uh the last point we
want to cover here today is something
that came out just very very recently uh
also finding by finally uh they
published something you might have seen
it in the news it was actually quite big
uh they called it logo fail and well
what logo fail is about is many vendors
allow you to have your own custom splash
screen when you turn on your computer
and you know then you know usually you
would you would see something like Dell
or Lenovo and so on right um but you
know they provide you with tools to have
your own custom screen the that might be
you know funny for uh some companies for
example which would like to apply some
branding or you know some end users
would actually you know also like to
have their own images like I would
actually like to do that it's something
uh that made me look into the corot
project back in the days CU I found the
idea very appealing and cool that I
could have my own splash screen right so
yeah it's a very good when the vendor
has a tool for that and so on but of
course there can be problems with that
because you need to be very very careful
when processing user input so yeah if if
you're not careful then this might
happen this here is from an actual
device we looked into it's a Lenovo
ThinkPad
x270 and we tried to reproduce the logo
fil findings and uh guess what we could
actually reproduce a bunch of the issues
so the password that are being used to
parse images here they're actually not
too robust and sophisticated so for
example they might as in this case here
they might read out of their bounds so
usually you know when when you parse
binary data you would check first like
how much data am I going to process like
you know what what kind of format do I
have here and now depending on the
format you might need to you know read
and copy data around or you know walk
through certain structures like it can
be tables for example actually I just
saw another video today um from
uh I forget his name um I think it was
life overflow who found it uh yeah and
he was talking about a similar thing in
uh you know very many systems and web
browsers uh which was about the web P
image passer yeah definitely also check
that out uh this year now was a bitmap
passer so if you know bitmaps then you
know there there is a header in the
beginning which tells you the image
dimensions and then after that you know
comes some more information like you
know the bits per pixel that we have and
then just comes a lot of data which
essentially describes the pixels and
then you know depending on that previous
data you would need to like allocate a
buffer of a certain size and then you
can step by step copy into that buffer
um but you know what happened here was
actually lied about those image
Dimensions I said the image was much
larger than then what I actually
provided so uh this one here was 120 by
120 pixels that was the original image
but I said hey it's like I don't know
some thousand pixels and then the parsel
just kept reading and reading and
reading beyond the actual image data
that I provided and now what you see
here reflected by you know those fancy
colors and then you see you know these
black gaps in between and so on that is
actually the memory that you see
visualized here so if you know how to
interpret this stuff then you can get an
idea of what the memory structure is
like and you know in the worst case you
would be able to even execute your own
code through such a
vulnerability now that is something we
have not yet reproduced but we're
definitely looking into that and you
know we might actually find something
very soon so yeah what B did was they
were fuzzing uh you know just all the
image passes from all the vendors
essentially and found all of them to be
vulnerable so now the thing is um you
know when you find such a thing you you
still need to have some tools to work
with that right so the idea is the
following here now if if we were able to
put something somewhere in memory that
was actually not intended like that or
you know we we could read or or write
across the boundaries that should be
there you know we would like to check on
that later on and the thing is because
that is uh happening now in firware and
then you know usually our operating
system would be loaded now we need a
tool to scan the memory and see what
happened there so I started working on a
little tool to scan your
dram well I just called it find me for
the time being you know uh to keep it
very simple and the find me tool just
gets a few parameters you give it a file
to search in this scenario here we using
the def M device from the L chal which
exposes all the memory to you and you
know if you provide the right settings
to the L Kel you can really just read
all the memory usually that would be
protected so you could just read
arbitrarily everything like the colal
memory for example uh and also the
firware memory should not be readable
but yeah of course we wanted to you know
check on something so I turn of those
options in my custom kernel here um then
we can provide a size for you know a
step size to scan so if if you uh if you
think of your memory let's say this
machine for example has 8 gabt of memory
right and if you want to scan all of
that like at at every bite off set that
you can imagine that takes a very very
long time so what we do instead is we
just jump a specific number of bytes and
in this case here we using eight bytes
per step now we can provide an Offset
you know in this case here I provided
something which is you know actually
quite far in memory already and then we
can also give it a limit so you know
that it only uh scans as much and then
returns all the information and yeah you
can already see it's printing out
something here so we already filled
quite a bit to you know figure all of
this out uh I actually put a bunch of
axes in the Custom Image that I provided
uh you know the thing that you saw being
very well colorful earlier and you know
like could just search for the AES here
in the memory and well I also put a
little message in in the file so that
was something I could definitely
recognize right so the AES could be
false positives but yeah I wanted to
have a good indicator and lo and behold
we actually found that message again uh
we wrote something like chaos PO says
hello uifi is awesome um you know just
for uh the fun of it and you might even
see my nickname here in the memory dump
now this already being quite interesting
uh we would actually like to reproduce
or reconstruct the memory as the phw saw
it earlier so I figured that there are
some data structures defined in a
project called edk2 that is the
reference project for ufi platform
firmware and if you look at that they're
like you know some some headers you
don't see them in in this screenshot
here uh but yeah they are are definitely
in that memory so we want to write tools
for that as well and then publish
them well and we actually also talked
about that in one of our petty FS so
that was about parsing binary data um I
you know found some examples where I
wanted to Simply showcase like okay this
is what data can look like uh we looked
at uh some image formats for example but
but also some binary data that we find
in
firmware so yeah uh here here is the uh
link to the slide that you can look the
slides that you can look
into and what what we essentially do is
we just Define our data structures that
we're looking for in our favorite
language well rest in in this instance
and then we would need to construct
objects from you know the buffers that
we read so you you know you would read
some some file or some slides from
memory or something and then you would
need to construct something from it and
then you have like very nicely readable
data structures in the um rust language
itself for example in the standard in
cor libraries there is already a very
very rich tools for dumping your binary
data then in you know your
representation so if if you define your
structures and so on in um in Rust you
can just say uh variable Name colon
question mark and then you know it would
print out a very very nice data
structure for you so yeah if you if you
know uh inter language is uh that is
something you might be used to in in the
C language that is usually not the case
you would either need some library for
that you know or make your own custom
format for
it and well that's actually the very
same thing we're doing in the feta
project you know and then we just
visualize the data in a bit of a
different way we don't just want to
print it out but we want to have an you
know a nice look at that um yeah if
you've worked with fatka before you
might already know what I'm talking
about otherwise definitely go check out
the tool and of course if we come up
with something nice here for the firor
you know data structures we might also
be able to visualize that in a very very
nice way uh for example I can imagine
that you know because uh we're talking
about memory uh for example um we might
actually draw a tree of that memory like
in uh memory management there is
something that is called page tables uh
that is a concept where you know you
would
you would divide your memory into these
different pages and then you would have
tables that are you know looking at the
uh different pages you know you have
like something like pointers and so on
and the thing is if you want to
interpret the data it helps you to get
some visualization first so that you can
see if it looks right so of course you
can just you know print it out like you
know just the uh like the numbers for
example in HEX representation and so one
um but yeah maybe we can also do
something a bit nicer and that might
even help you with developing operating
systems because it's essentially the
same thing that you're doing there when
managing
memory well and with that I would like
to thank you a lot uh I would highly
welcome if you wanted to follow me just
go ahead you will find me on GitHub at
Orange TMS you would find me on Twitter
or whatever they call it today x uh I
have done a bunch of live streams that I
would then do on Twitch usually um they
are gone after a week but I put them up
again on uh YouTube and on Twitch and
YouTube you find me as
covol and the slides we just looked at
here you can find the mment hp.org just
follow that link here and eventually I
would like to invite you also to have a
look at our hacker space so come visit
us at chaos. that is our website and if
you know know you're in a different area
we also have channels in Matrix for
remote communication so you can chat
with us or maybe if you would like to
just you know get to know us a bit you
know and you're a bit shy or something
just welcome to the channel and have a
look and now with that thank you very
very much and I'm happy to answer your
questions if you have
any hello and welcome to the Q&A for
bringing the hack back into the ch
uh I've got Daniel maslovski here with
me right now to answer some of your
questions first of all do you have any
other projects that you would like to
mention yes so yeah I already presented
a bunch um but of course we do a bit
more um so uh one person in our hacker
space uh his nickname is Mo ax uh he uh
at some point brought um you know one of
these um like uh fiber to Network thing
is that you you know I'm I'm not a
networking person you you would put them
in switches and stuff like that um and
well he wanted to uh also customize the
firmware and that a bit actually just
change your serial number for for a
friend of his um and so we uh found a
tool for that on GitHub uh it is called
UF instant mod or well that is mostly a
write up and stuff um and then we also
found some other tool and the thing was
um that that tool wasn't really working
uh with that version that he had or with
that Hardware revision or whatever um
because it was expecting some so the
tool was expecting some things but you
know that device was actually a bit
different so we just did that by hand
and you know we looked at how that thing
works extracted the formor we took it
apart a bit and essentially there was
just um a file system that we know it's
called J ffs2 and so what we then
contributed back was all of our findings
there so if you look at that repository
nowadays uh you will find that in
there now um we also did a few things uh
with open wrt so you know that many
people put that on their home routers or
you know it's also used by the fun
project um and you can actually find a
also a good handful of gadgets which are
running some shape or form of openwrt or
maybe uh something in enly custom or a
semi custom then you would like to have
some Upstream openwrt on it um I for
example I have a portable router which
is essentially you know a giant battery
pack and then uh some uh very small PCB
at the top and that is um by default
just running a very very old kernal it's
probably vulnerable in like 100 places
and stuff um so I thought okay let's
just put open wrrt onto it uh it is
equipped with a very wellknown on chip
that is for the mediate Tech Mt
something I'm not sure about the exact
number now and I contributed uh that
back to the Wei so yeah it's it's in the
work in progress section uh but you can
already find it
there uh yeah the manufacturer name is
wumi Wu D U Mii if you search for that
in the week will find
it um how are you proceeding with logo
fail yeah so that is a very good
question so uh in the live sessions that
I did and also what I just said here in
the presentation I I only came to uh
that point where you know we could just
poke around a bit essentially uh we now
have a USB drive that we can just use to
put custom images on Lenovo devices so
essentially everybody can use that um I
I even talked about that in one of the
live sessions I didn't really mention it
I think um and so but uh we now started
developing this tool that would scan
through the memory that is used by EFI
well it would actually scan the entire
memory and then you would use it to find
the EFI memory and I just brought it to
a point where we also understand the EFI
memory structures to some degree um so
you will find that on GitHub now at the
platform system interface project uh and
it's just called Ems for EFI memory
scanner um and we're going to extend the
tool a bit more um I'm not too sure
where it will take us so far um but yeah
that that is definitely one part and the
other part is so we still don't really
have like a good environment for
developing an exploit so one idea is to
uh you know just dump the uh binaries
from the fer that are you know parsing
the image um I already started looking
at that in gidra but we would also like
to just throw that into an emulation
environment so that we can you know try
out a bunch of things in the emulation
environment um and then you know we we
can control that environment much much
better than on the actual laptop then we
when we have find found something well
we're essentially looking for a buffer
overflow here um then we would be able
to you know create a fullprof concept
thing that we could also then share on
GitHub for like research and teaching
and so
on that sounds that sounds awesome so
you just basically building up on that
that whole analysis side uh to to try
and figure out how to develop it and to
allow other people to build up on it
yeah so essentially that is if you uh if
you come from a software engineering
standpoint um we're using the same
methods that you would also use for
developing software like when you test
software you do the very same thing
right so you set up your environment for
test testing then you make small changes
and then you check on the result
afterwards and see if that is actually
what you wanted so yeah we want to have
you know that same kind of setup where
we can you know get to conclusions very
quickly without you know being in the
dark like okay did we actually trigger
this here or did this and that happen
because it can get very very complicated
easily yeah yeah and I guess the fact
that you're dealing with with an EFI
environment means that in the worst case
you have to deal with a hardware machine
having to completely reset before you
can test your hypothesis doesn't it yeah
exactly so that is a ton easier in a
virtual environment
yep um I think that that's it for today
thank you very much for your talk uh
shining some light on what's Happening
and bringing the hack back into the
chaos uh thank you for your talk yeah
thank you and thank you for having me
enjoy the rest
bye