Dear viewer, these subtitles were generated by a machine via the service Trint and therefore are (very) buggy. If you are capable, please help us to create good quality subtitles: https://c3subtitles.de/talk/701 Thanks!
We all know that when you have physical
access to a machine, that game
over, but
how much game over are we talking?
Actually, let's find out
how completely defenseless Intel
chipsets are when faced with
USB.
Here's the maximum Noriaki with tapping
into the core. Let's give them a big
round of applause.
OK, my name is
Moxham, Gretchen.
I'm a security
researcher.
It was a positive technology company.
Unfortunately, my author
couldn't be here.
His contribution to the work huge.
And please consider that we did
his work together.
So, uh,
I would like to go over the topic of
hardware, Georgeann, and, uh,
tell about, uh,
one of the modern Intel Sebu design
features that can be used for this
purpose.
It's direct connect interface.
OK.
Uh, as you can see from
the slide, we are going to, uh, to
review, uh,
uh, debugging interface
as a basis of, uh, such
Trudgen on the model until C.P.U,
we are going to review.
Uh, I do connect interface.
It's, uh, Geotech,
uh, like interface
and, uh, activation.
And, uh, then I'm going to talk about
several types, uh, that
can, uh, can you help to detect
such attack.
And so,
uh, I could have a Trojan
is a malicious alternation of hardware
that could under specific, um,
specific condition,
uh, result in functional changes on, uh,
to the system.
It can be inserted at, uh, at the time
of manufacture or shipment, uh,
and storage or use.
You can find information
on this type and, uh, general
technique of detection.
Instapaper wanted, uh,
commented on this on the slide.
Uh, I think there is no need
to emphasize the timelines
of this system.
Attack vector.
And, uh,
in the in the C catalog,
which recently became available to
public, uh, contains
information on, uh,
dedicated device for Dell servers
that in, uh, in fact, uh, classic
hardware, Trojan.
And, uh,
uh, what I've just said, logical
Larisa's the following question, how much
would it cost to implement such,
uh, a Trojan on modern systems
that the cost of the development and,
uh, embedding such,
uh, Trojans and Osos technique
available to people organization
who are not state security services.
All reports will show that,
unfortunately.
Yes.
And, uh,
uh, implementing such Trojan
may be impossible for anywhere who
who is willing to explore the
possibilities provided Geotech
on the modern Sipi use
and uh.
Oh, sorry, sorry, sorry.
It's it's INSEE.
Uh, let's step aside, uh,
a bit of usage, tech debugging
technique, uh, a little closer and
try to find it into LCP,
use geotech standards for joint,
uh, for Joint Action Group.
Uh, and you can find as
detailed, uh,
its description in
Tripoli, uh, with the details
available and the standards itself,
how you can see a reference
on the slide.
There is also video from,
uh, Triple C conference available on
YouTube, where the design is described
in close detail
and, uh,
but, um,
sometimes manufacture, uh,
um, uh,
but generally, uh,
geotag is good, not only
as a basis of Trudgen,
it can also be used for forensic.
For example, if you don't trust the
BIOS, uh, and would
like to read fine.
Uh, from wires knowledge from
Flesche without a programmer
or to detect a rootkit
and, uh, detection.
But, um, can also
be helpful in research
for analyzing undocumented,
uh, architecture technique,
uh, also mudguard or
system management.
Uh, and it also
may simplify, uh, simplify debugging
of, uh, hypervisor
and to drivers or,
uh, power consumption or
uh, you fi,
uh, models and uh,
some way, uh,
often manufacture extend the standard
stack by adding their own functionalities
uh and uh, install
uh do to uh,
detect in uh
into processor is described
as a poorly uh uh, some
information can be found, uh, in
the documentation I mentioned on the
slide and
um, uh,
how you can uh how you can see.
Until you have three types
of, uh, interface for
Detec, it's,
uh, direct connection through
Entel in Target, Propp extended
the port nitpicks ZIPPI
and, uh,
into its new technology,
into Direct Connect interface.
It's special transport, uh,
designed to enable
closer Cheesus debark through
any ORFEUS misreports
you can use geotag like,
uh, interface, uh,
through through use free.
And, uh, there are two type
of design. Wasn't there for use in the
platform be requesting Dessaix.
And uh, this is because then Gachet
and
now, uh,
let's take a closer look at each
of them.
Intralytix DEPI, it's,
uh, requires a special board
and, uh,
special socket,
but, uh, it connects
directly to the CPU.
Uh, and, uh,
uh, uh, it, uh,
it is a capability with
our intel system studier.
You can download, uh,
channel version from one of your
websites and, uh,
his, uh, his,
uh, protocol protected by India
and, uh, and
makes a lot of noise and, uh, gets
hot
really.
Uh,
I check it, uh, starting
with Skylake into, uh,
introduced, uh, durcan
that interface technology.
And, uh, you can find Torres's,
uh, specifically description of it in
the, uh, documentation, the
diagram show to type,
uh, two types of connection
using a special device and
uh, um uh and
uh,
simple use USB
cable.
Uh, um,
hey, uh, I would like to know that,
uh, the target system is not, uh,
is this case does the, uh,
does not require any software or
hardware, um, uh, against,
uh, you
need only, uh,
uh, cable or
special device.
Uh, OK.
And, uh, this technology, uh,
unfortunately, uh is
uh is works out of
works or otherwise you
uh you Sirius's chipsets
and uh um
well let's take a closer look at each
of connection type.
OK, this is because they
say, uh
uh, it's uh it's
connection, uh,
required special special device,
uh, Entel Silicon View Technology,
Clausewitz's Cheesus adapter, also
known as a sweetie
s.E.C.
Or this has been provides access
to the fix feature,
uh, and, uh,
like Geotech and or uncontrol
through Eusebius reports on
Entel, uh,
and Direct Connect interface
enabled silicone and platforms.
It works through Eusebius for links,
but implements a private protocol
and makes it possible to manipulate
the target system, uh,
in deep sleep mode.
Unfortunately, um,
as of months ago,
uh, both DEPI and Sweetie
Adeptness, uh, might
be, uh, able
only after signing.
Indeed, it wasn't all
but is not a problem
because we have special
special device.
Uh, Eusebius, requesting the
CI is A commonly use B
uh uh, through the buckyball,
which work, uh, as an
G device.
That means that special device
appears on the court system, an
activation.
It's really through.
It's it's device, it's
it's, uh,
it's motherboard.
And comments are sent
to this device through a commonly used
interface, the device itself
is integrated into platform cantorial
hip hop and, uh,
it transforms the command into each
attack.
And it's geotag for pulse.
And small demo.
So one moment.
We are selecting a configuration
wait for connection to Target, both
for.
And.
Stopped.
Execution.
On the altar at.
From this device.
Current construction.
Special master.
And.
I'm sorry,
okay.
One step.
OK.
It's worth.
OK, demised.
How to activate this magic function?
Uh,
there are several ways to do that
through a unified human
interface infrastructure besiege strupp
and special hiden
to B device.
Now, let's review each of them in detail.
Activation where you fi human
interface, infrastructure, you fight
human interface. Infrastructure is a
special interface,
is a special interface
that allow creating a user
user forum in Newfie,
as well as persistent and manipulating
user input.
If we look at how
and what the Newfie bios, uh,
designed, if we can find a lot
of hiding options that are not
available to the user but process
protest by bios,
there is in fact the
basis of our first
technique.
Are you fire?
Human rights infrastructure
identifies default values for all
options, including the hidden,
uh, hidden ones.
And as soon as we find
the option connected to
the say, it can be activated
to set default.
Discernable special adoption.
Uh, and, uh,
uh, uh,
Newfie, uh, in defiance,
uh, default value for adoption.
And, uh,
we find the option connected with the
say it can be activated to set
defaults, then resetting
the buyers to default using standard,
uh, interface.
And, uh, we obtain
and we're going to say it's using
uh, um,
they did it in much is, uh,
programed into Flesche
by a programmer or through
the standard US, uh,
phone wire tool, if you have privileges.
Uh, and, uh, you
can, um, this little
sentence can be edited by only
a special only, uh, by its configuration
problem or program on
on the on the slide.
Is it
it's free.
You can you can download
uh from the website
and um
uh but uh,
if, uh, Woodgate is running,
uh, this, uh,
this technique, uh,
don't work because, uh,
the system will not vote,
uh, since this to change, it
changes a unified model.
Uh, but
you can.
Activation where strupp.
Uh,
this decision
can also be activated by configuration
specific bit on the besieged
configuration is a
MONALI, uh, they
are located in the
descriptor region or by
using flash of flash image tool.
That is a special tool
for, uh,
for Crede, uh,
from wire, uh, bills, because,
uh, this technique works.
Even if woodcutters activated,
it's good and
it's for and finally,
you can try to activate
it directly through Peteris be
device.
You can find a special index,
uh, and register in documents
for different PC generation.
Uh, right.
It's sixth generation
and uh, left
from seven generation
and uh, um,
uh, use those
data for this activation on the fly
if Beuse has not logged
certain changes.
Okay. Right.
Uh, we know some motherboard
where it's work
and uh, so leads
to the question, how can we protect
ourselves from such Trojan's.
And we propose activating Mudguard in
order to make the modification the
scripted, uh, in
in the first uh
and uh then you can check
the discernable beat and debugging
disable and register through,
uh, special debug interface
MSR in uh in
this case, uh, the C may be
enabled, but execution cannot
be stopped.
Uh, and uh, as
a result, it's impossible to get access
to memory and register
and.
You can, uh,
see documentation
the least significant bit, uh,
this register makes it possible to
restrict Sibiu debugging.
So we need to set to
zero and to log the register
itself, recording, uh,
which one into
special fields and, uh.
And, uh, can you help us to project
to you your platform,
your laptops and.
But DSB, you can
find or
make special device, which,
um, uh,
which, uh,
uh, uh, transmits commands
from USB or wi fi
and use it
to, uh,
implemented Back-Door in servers,
in a laptop or, uh,
servers or another,
uh, another
motherboard or
computer and
modules.
I suppose.
I also using debugging tools which they
hope to uh use be
available to numerous platforms
there is to make it possible to control
a system totally making the
technology interactive, not
only for debugging and research, but also
for deploying hardware.
Trojan and
please check your
Skylake laptops
and.
Thank you for your attention and, uh,
maybe we, uh,
we published a special tool on
our own, get some of
our company, uh, which
can help you to check
your motherboard.
Thank you for your attention.
It's possible, Maxine, so questions
do we have any any questions from Axium
about geotag over
USPI?
See one already here in the front?
Thanks for a great talk.
Um, two questions.
First of all, um, could you share
which motherboards,
uh, allow enabling such
debugging features?
We know only one wonders because,
uh, but, uh, we
don't, um, search
in other windows and we
don't know, uh,
how much it
suspenders.
OK, uh,
why.
Um, available
to use as a function of functionality.
Second question, um,
is it possible to
send debugging data not via
USB but when
network itself.
Why not.
You have my instrument engine
processor.
Scary things.
OK, we have a question from the Internet.
Hello. OK, um, the Internet wants
to know if you have tried reverse
engineering the protocol
the USB box uses.
Yeah,
but it's, uh,
uh, next serious.
OK, here in the front.
So have you contacted Intel and if.
Yes, what they said, yes.
They, uh, don't
said anything
in the back by the camera.
So the the the debugging
features can be disabled by the bios.
Right.
Sorry. What the debugging features
can be disabled depending on your vendor
by the bios. Right.
Uh, Dessaix unfortunately
sometimes no.
Because uh
uh you can um.
Uh, because, uh,
configuration of, uh, they say,
uh, in a, uh, enable, uh,
is enabling, uh, to
besiege strip and if, uh,
in besieged strip, uh, or on,
uh, platform hub
or is activated by us,
uh, can't, uh,
disable it.
And if you, uh, if you have, uh,
DEA, you always,
uh, enable, uh,
any features, uh, because
you can, uh, you can stop
on the asset vector.
Sorry.
So, uh, so any idea how widespread this
is?
The question was, do you have any idea
how widespread this problem is?
I, I don't know.
Maybe, um, I, uh, I
think that, um,
uh, Encho, uh,
implemented special, uh,
special technique which, uh,
connection with cryptography.
Uh, but I don't,
uh, don't use it, use it now.
And I
think that, uh, maybe in next generation
activated it.
We have another question from the
Internet.
Uh, the Internet wants to know if it's
possible to use this to, um, do
something to bypass, uh,
some kind of signature check or
something.
So if you can, like, modify what's
being executed basically
now, because
Strupp is not a signatory
and, uh, you can, uh,
override it, uh,
for, um,
uh, for
for buyers and, uh, Bogot
on another technology.
Don't don't see, uh,
I don't see it.
Is there a follow up question from the
Internet. Uh, yeah, that's the different
question. That is, um, uh people
want to know if and
where they can get your slides and read
more about your research.
Sorry.
They want to know if and where they
can get the slides and read more about
your research in my email.
OK, Britney, I,
I asked about
I tell about it.
OK, in the back.
Yeah. Thanks for the talk.
And did you do any research on platforms
prior to Skylake, let's say Hatswell
or something like that.
Has a Haswell.
Um, Hurtsville,
uh, has, uh,
the same technique.
But unfortunately, uh,
they say it's, uh,
the technique in Huntsville,
it's software technique.
And sometimes, uh, and,
uh, I, uh, I didn't see,
uh, um, special special
fin wire, which can, uh,
use this, uh, uh,
this, uh, detect like
interface.
It's, uh, it's technology.
Uh, SVT adapter
works from Hussle,
but, uh, only
after, uh, signing
Indie's.
So a Haswell doesn't work with a simple
USB device.
No, no, no.
Only like on this
x ray
in the f shirt.
Are you familiar with, uh, antivirus
products that also use the Intel Dybbuk
states like Checkpoint Sandblast, for
example? And how is this similar
or does it interfere with the hardware?
It's difficult because it's very, uh,
not stable works.
So so does does that technique interfere,
like with the checkpoint sandblast
detect this or, uh, the checkpoint?
Uh, it's
mainly because, um,
this technique have some
troubles.
For example, um,
uh,
they, uh, it, it use
a hardware register,
uh, and, uh,
you can read, uh,
um, address
addresses and uh
you can read, uh, modify,
uh, of memory, which uh
uh doing this uh svt
or use b uh geotag
like uh device.
Uh and uh
it's detect formulae uh
uh for wires and
uh maybe you can use
it but uh.
Uh.
And not not good sometimes.
You have time for about three more.
Did you have a follow up?
No.
OK, then in the front, is
is it tracing capabilities
in a possible
duel? Is it possible to trace code
and maybe read Mamoru?
Yes, well, of course.
Yes, yes. Yes.
OK, so you could you can read all
the procedures and you can.
You can.
You can actually.
Can you use this technique to at the
moment where you can
use hardware breakpoint for
special register on the
on the right in this
breakpoints and uh
I don't um able
to look to WLOX,
uh, as a memory
which, uh,
which use to
system, for example.
And it we're doing
we're doing it.
Yeah.
OK, in the back right
now, um, the protocol
that is protected and.
Yeah. Are you aware of any like open
research on this.
Yes, it's open research.
OK, another thing, if you
would like following the normal USPI
protocol or do you really need some
special electrical properties for
a sweetie special adapter?
It's proper protocol which,
um, using,
uh, as a signal orfeus be
free, but it's it's not used three.
And this cable, it's,
uh, simple USB three
protocol.
And uh, yes,
you can write program, which,
uh, for example,
uh, can trace your
target target system.
Yeah.
OK. And last one in the back.
Um, it's it like Chatur compatible
in such a way that it has a scansion and
stuff or is this some internal invention.
D.C.I protocol
does say, uh, I know,
uh, I think that this
is a special device which I
retranslated, uh, the comments
from USB, uh,
to JÄ�taka chain
tech types. Yeah, right.
So it's like, uh, toggling the
signals. Yeah.
Yeah, yes. So that's what happens.
Wow. And is there any chance to
put this support into open OCD?
You are such open source software
and maybe in the future.
Thanks.
OK, let's put our hands together for
Maxine one more time.