Dear viewer, these subtitles were generated by a machine via the service Trint and therefore are (very) buggy. If you are capable, please help us to create good quality subtitles: https://c3subtitles.de/talk/912 Thanks!
Hello again, good evening.
For the last session on day three
of the Congress, I'm really happy
to see so many of you so
interested in such a particular topic.
But it might be really, really relevant
for money in assessing
our threat levels.
So we
will hear more about direct
memory attacks and how they're still
possible nowadays.
Again, and all Friskies here
to show you and to tell you
more about what you should know about it.
Thank you.
Tonight, we're going to talk about public
FPGA based direct memory access
DMA attacking my name is
Priscu and helping me with Vamoosed
today. I have yet to, Naureen.
I will start by briefly going through
some background and previous work to be
done in the area that will jump straight
into the actual DMA attacking.
I will try to do a live demo in which
we will transmit and receive
a section of their packets.
We will dump memory at speeds
up to 75 megabits per second.
That will have a look at the actual FPGA
design that I created.
After that, we will go into some more
advanced domain attacking.
We will attack a vulnerable vanilla Linux
system and a vulnerable a
if you manage to get into a fight,
you might also be able to compromise,
secure both and then you can also
compromise to not get booted operating
system such as a Windows
10 system running virtualization based
security.
And at the end, we will have a look at
some future hardware that I'm really
excited about.
My name is Bill Frist.
I'm employed in the financial sector
in Stockholm, Sweden.
I previously presented my work at this
conference in Stockholm and also at Def
Con in Las Vegas.
I'm the author of the Direct
Memory Access Attack Toolkit, and it's
just been, I hope, a project of mine
since the start.
And it's delays also
need to point out that I'm giving this
talk as an individual.
My employer is not involved in any
way whatsoever.
I'm here today to represent PCI,
FPGA, PCI, Leach
FPGA is the combination between
deciles SP six five
devlopment board coupled with a
forty six, a one USPI three.
Add on board the
express generation one one one-line
site goes into the target computer
or if you wish to call it the victim
computer, the USB
three side goes into the controller
computer or if you wish to call it the
attacker computer.
Once both sites are connected,
the controller computer is able to send
PC Express from section layer packets
over USPI onto the FPGA,
which will then put them on PC Express
of the target system.
We can also read PC Express
tailpiece this way from the target system
and they will be forwarded on to the
controller computer.
The whole hardware setup as such is
between five and six hundred dollars
in total and with it you will be
able to do DMA to both
32 bit memory.
Enter space below for JECT
and 64 bit memory
space above before objects.
You will be able to do DMA at around
75 megabits per second.
Everything that I created is totally
open source, but I'm using some
vendor proprietary blob's in there,
unfortunately.
So that's why the title of today's talk,
it's public and not open
if I compare DSP six so five
as FPGA solution with the
earlier hardware I use for DMA attacks,
the USB thirty three 8pm,
the USB thirty three eight was sold
out earlier this year and
the FPGA solution is
a little bit more expensive.
It's bulkier.
It's also slower as is at
the moment, but it's
much more stable and
you will be able to do 64 bit
DMA memory addressing as
well.
And that means that you're able to access
memory ABAB for Jig's as
well as memory below for gigs.
And this is a huge different
compared to the old hardware that we were
only able to access memory below for
GICs with
DMA attacks has been around since
pretty much forever.
I think you all heard of Inception.
Awesome FireWire Demaine attacking
Tool. If you haven't used it or heard
of it, please look it up
as a response to demon attacks.
That's also a slow response to the
growing need for virtualization of
devices.
CPU vendors introduce the IOM
amuse or die around
2008 and onwards.
And if the amendments are used
properly and by the Fermor
and operating systems, they should be
able to protect fully against DMA
attacks, as we'll see today.
That's not always that's not
always the case.
There's been lots of research in the day
in the demand attacking
space. I can't mention everyone here
today. I thought I should mention
the Camino's work, which is I
don't hide it from the academic
area.
Data used for his PhD thesis
and also snare and racing
did a really awesome thunderbolt,
attacking a DMA, attacking torque
back into. Some 14 actually
using the exact same hardware I'm using
here today, DSB six of five
and then just a couple of months
ago, Dimitri Alexiou released
what I know to be the first DMA
attack focused FPGA bitstream
into the public with his
Express Do-It-Yourself tracking tool kit.
Dimitri also supported my work with
the PC Leach, and it also shared
both at first binaries and
some source code with me.
And it really pushed me to actually get
DSP six of five from the start and get
going here.
So really huge. Thanks to Dimitri.
Without you, I wouldn't be here.
Thank you.
Pizza Express is based
on its package based, the packets
are called transaction layer packets,
or tailpiece.
They are dewormed based, 32 bit
based. They usually consists of
a header that are between three and
four Devadas long and
detailed piece kind of different types.
For example, read memory, write memory,
IO, configuration messages,
completions and so on.
That's focused on the DNA types here
today. A memory read and write tailpiece.
The 64 bit write
is down on the left.
It starts with which type of packet
it is in the first debug.
And then you also have the length of the
data that you wish to write
in number of these works.
The second word contains the requester
ID, which is the best number and device
number of the actual device,
something this
packet. And then since we are doing
a 64 bit.
Right, that means that are writing to 64
bit memory address space.
We need to represent that address into
debauch. And then they have the data
at the end.
When we do have right.
We post this message on to PC
Express and we will trust that it will
get rid of them.
We won't get any acknowledgment back
that it was successful or not.
When we are doing our read, it looks
pretty much the same.
The packets, except it's a different
type, of course, since we are doing it
right here, we are doing a 32
bit memory read and
that wants to submit that one.
You need to wait a short while
and you will receive one or more
completion piece back containing
the actual data that you read.
So let's do a demo, let's transmit
the recipe transaction letter packets,
let's enumerate the memory and let's dump
the memory.
If we switch over the image to the
hardware here,
the FPGA book and
I have a victim system here, so
let's insert our express card
to a press adapter
in the target computer and power
on the FPGA.
It's connected to my present our computer
with USB here.
If you switch back to my presentation.
And here we have it from a slightly
different angle, the harbor here
we are trying to
read something.
We are going to read one word from
64 bit address space.
They are going to read from the address
for Jig's, this address
here.
See what happens.
Here we stand the retail
people and we get a completion copy
back and the completion of
the first three works are
the and they have the actual data that's
already here.
So let's do it right as well.
Let's
do a 64 bit memory right
to the same address.
Let's do a two
to three word long, right to
the very same address
with this item
and see if we can overwrite that previous
data with that.
And since we are doing it right, we won't
get an answer back.
No completions or anything like that.
But we can try to read
the memory back to see what happens
if the project was successful.
Let's try to read 30 DB works
this time from the very
same address.
Here we see that we get the completions
back in two different completions
and if you check in the beginning
is that you see that the previous red
data is now our return with our
new data here.
We can also enumerate the memory
of the target system.
Since we don't know how much memory it's
in this computer, we need to check it out
and we can do this by reading
a tiny portion of every page
that we are able to read and
see how much memory there is in this
computer and
physical memory address.
Space in a modern day computer is not
one big contiguous chunk of memory.
You have physical memory in there and
you also have like holes in memory in
which there are nothing.
You have memory devices.
You can have unreadable memory, such as
system management memories.
Well, here we see that the red
dots seems to be failing after slightly
more than a jigsaw here.
It's probably not a good system.
So let's try to dump the memory.
Dumping memory takes a while.
So let's go back to the presentation.
These are all expressive form
factors.
You have the standard PC Express card,
I see it all now to the lower left, you
have the mini Pizza Express that goes
pretty much behind the back of
the laptop. You have the express card
that I use here today.
Thunderbolt also carries to express
Thunderbolt three is most often combined
with the USB connector nowadays.
And then you have the different M2 key
form factors. For example, M2 Khiyam
is really common for MBM.
It drives.
Here is the actual FPGA design that I
created, it's rather simplistic.
You have a block that
receives and transmit data over
a 32 bit data connection from the USB
33 and the USB
56, a one hardware.
And then you have the
silence press corps on the
other side that handles the actual
piece to express communication.
Everything in yellow here or Xilinx
IP blocks or IP course, and they
are not like open source, so it's
a bunch of proprietary stuff and
everything in green here is stuff that
I created there. So it's totally open
source and it's found on my GitHub
where we received some data from
over the USB connector, the connection
from the controller computer,
and then they actually received some data
and some metadata because we
know we need to know what kind of
data we are receiving, if the data is
a part of a transaction layer packet
until they put it on the first
out first queue.
And if I took you for your piece,
if it's some other kind of data, for
example, internal loop back the back
data, we put it on an internal
loop back FIFA, for example.
If you do some put the
data of the tail piece on the top, FIFA,
we transmitted to deep sailing's
press corps and that one will take care
of everything practicals.
We receive data every
piece from this tilings
piece press corps as well.
And since we have different
five position that we wish to read data
from as well, we need some much logic
here. So much it into a stream that we
can send back to the controller
computer and actually everything
like like formatting of the tailpiece.
It's actually done in software on the
controller computer.
So this is a rather simplistic design,
but it works.
So let's jump into some more advanced
Diamanti.
Let's do a demo on that vulnerable
vanilla Linux system that's locate
and patch into the Linux kernel.
And since the Linux
kernel version for print it, I believe
the kernel is fully randomized
in physical memory address space,
which means that it's very likely that it
will end up above the four
limit.
And here FPGA hardware really
shines compared to the older
attack hardware that I used.
So let's try to find an external
patch into it that's mount the file
system and unlock the computer.
So here we have the Linux computer
and see that the memory dump was
successful. Here it's a little bit slower
here today since I'm going to add USB
hub, unfortunately,
but the memory dump seems to have worked.
We switched to the FPGA
here image.
OK.
Yeah, let's try to log onto
this computer, try to log on
with the password of Cingular here.
And it's the wrong password, it cannot
get into the computer.
So if we switch back
to the presentation, we
can insert a kernel module into
the running Linux kernel.
We try to locate the Linux kernel
and the.
As we can see here
today, it's actually fallen below
four degrees, it's happened to be around
the ice in that position.
So but it seems to be
working anyway.
Let's mount the light filesystem.
Using the kernel module address here.
And once the file system is mounted,
we can just click into it.
Actually, we have mounted a live memory,
uh, library as well.
Like, you can go into the ATC folder
and locate the shadow file, which
contains the password hashes of
the users.
You can edit it in our favorite favorite
editor here and here.
We have lots of user accounts with
no hashes and they have the user
account that's been around a very long
password hash here.
And of course, if you know the password
hash, you can try to crack it or
something like that. But that's no fun.
It's much easier to just delete it and
replace it with something
else and then would save.
Let's see if we can log on, if you switch
back to the.
Try this single password of.
Thank you.
And so let's go
back to the presentation.
If they go through the other computer
here and we need
to, uh,
if we can switch the camera to the other,
that it was like filming already and
you can also attack a fight
and you find some way,
if I may protect themselves against DMA
attacks, Mouse Dewa, if I don't
if you are able to get into a fight,
you might even compromise.
Secure Booth.
And let's try to get into
a fight here today.
Let's backdoor the exit booth services
function that is called by the
operating system loader at
once you wish to take control of the
target system.
Let's retrieve the memory map of
the EFI memory map and let's also
patch the not yet booted
Windows kernel that is loaded
at this stage.
And actually what I'm doing here today,
Dimitri has done some really awesome work
in this area as well.
So if you haven't checked out this stuff,
I would like you to
do that at.
So if you switch to the album, maybe
we can have this here and
so here we have another system.
I need to
switch around the PDA here, I think
cabling.
So what we are doing, we are inserting
the FPGA here
in the not get booted computer
and if we
started.
We switch back to the presentation.
To connect to the device.
Let's try to do it again.
Yeah, works better this time, probably
a bad connection.
The computer is starting and
now the operating system loader called
in to the exit, but services function,
which we hooked with our
code, we
tracked it there.
We retrieved Wi-Fi memory map or the EFI
memory map.
And once we are in this stage, these
Windows kernel is already in the memory,
the normal Anthos kernel, the hypervisor
is already in the memory and the secure
control is already in the memory.
But the Windows operating system is not
yet bolted, so it cannot protect itself
against the AMAI attacks yet.
So here we can actually patch into the
Windows kernel.
And if you look at Windows virtualization
based security, it
has something that we can enable that
protects kernel code integrity with
the help of the hypervisor and secure
kernel which regards to
evil devices that are trying to do
damage, access to the memory, the
hypervisor and the secure kernel
memory.
We have no access to that memory at all.
Normal, executable pages in the normal
windows space and
normal userspace normal kernel space are
marked as read only with regards to DMA
from evil devices.
So we cannot patch the memory directly
there and normal non executable pages
are pretty much as usual read right.
And as I said, the
kernel code integrity features are not
yet enabled in this stage.
We are now, since the Windows operating
system is not yet rebooted.
So let's try to
insert some code there and
spottiness system shall.
Here we located we communicated
with our UA five module.
We located the Windows terminal
and we locate some
code caves in there to put our code in
there.
And now Windows is booting,
enabling virtualization based security.
We cannot edit the kernel anymore,
but our eval code is already in
there.
So we should be able to try to log
on to this computer if we switch
to the FPGA.
Here we have the witness computer
tried to log on to that one, using no
password at all, and
that's you can see we couldn't log on if
we switched back to the presentation.
Let's change
that, let's spawn
a system, shall.
Every are system.
And of course, if your system,
we can remove
the password off the user account.
And they switch back to the FPGA.
We can try to log on.
And Maureen.
If you switch back to the presentation.
We can also dump the memory of the
Windows system here, we see that we
get lots of pictures when we are dumping
the memory. It's pages that are marked
as not readable via the
menu, the ability that Windows
protects. It's primarily the hypervisor
and secure kernel pages in memory.
We cannot read those, but everything else
pretty much we can.
Basically, FPGA is
open source pretty much, at least
the parts I coded, it's
found on GitHub
and I tried to make it as easy to use
as possible.
You don't need any prior FPGA knowledge
at all. You should just be able to
flash it on this hardware and start
DMA attacking, unfortunately,
its windows only at the moment on the
attacker PC. I have some Linux
driver problems with the hardware I'm
using here. I hope to resolve that
quite soon.
And what's even more exciting is
that there seems to be coming lots of
devices quite soon
be able to do DNA attacks,
for example.
There will be.
Lots of yeah, some
devices will be really inexpensive, while
some others will
be a little bit more pricey, but still
less pricey than the specifics of
our solution.
One such example is a new
hardware, the express screamer.
It's a new hardware by key to Rampino
mean.
It's going to be easier to use.
It's going to be a lower price tag
than DSB six of five solution.
It's going to be more capable.
PC Express Generation two.
And I plan to add support
for this one sometime early 2018
here. So it's going to be really,
really early next year, hopefully
in the coming months.
To sum everything up, affordable FPGA
dman attacking is the reality of today.
Physical access is still an issue.
All my meals are Derinda hardware
since forever, but it might not
always be used.
And I hope I showed you today that I
believe there is more research to be done
in this area and hopefully my
tools will be useful
to everyone that is interested.
Thank you.
Thank you so much.
So everybody just saw that you
should keep your devices always
on the person and we have questions.
Microphone one, please.
So one question I have is
right now you're dumping memory and
doing edits and memory and
patching the call.
Did you have the idea of, say,
taking the writing
and driver for, say, a virtual machine,
which is mapping another machine's
memory into that virtual machine so
that you can kind of say stop the process
or the attack machine, use
a virtual processor to do operations
on the memory of the machine
where you can see what the program is
doing in the emulator.
I haven't gone into, like,
attacking with, like, virtual machines,
the nasty stuff as well.
But it's an interesting idea.
And to be able to go into
it that I do have kernel access
at the moment. So it should be possible.
But this is like a hobby project of mine.
My timing is a little bit limited here.
It would be this stuff is out there, so
it would be awesome.
If someone can actually look into this,
I think it might be quite useful
the way of a lot of questions here.
Also from the signal angel.
It's actually not that many just to
what prevents you from implementing
the PCI device without any proprietary
stuff? And is the controller
limited to Windows because of that
proprietary stuff?
And to us, the Windows
question, it's I believe I get it working
on Linux quite soon and
it's just a driver issue.
I just haven't had the time to actually
actually code it for Linux yet.
Yeah, I had a little bit of a problem
with that driver, but it shouldn't be a
problem, really. I just need to find the
time to actually do it.
And the other
question with regards to produce
the I'm quite new to FPGA actually,
so I just use the default
to start the sailing's
tool kit provides.
It should be possible to replace
some elements with the more open
elements in this design as well.
But I'm really FPGA new,
so it's just it was my first
attempt at an FPGA, so it should be
possible to do this as well.
So you should talk to each other further.
So, um, microphone
two, please.
Uh, so I wonder if
you can access, uh,
memory used by me that
you made, which is not accessible by.
You know, this is out of
limits from this.
It's going to be mapped away in the
platform controller hub.
So it's, uh, I should be able to
access it. And I cannot access system
management node memory either.
Okay. Thank you.
And the last question from microphone
three, you're
using think pets as I've seen,
do any bios settings
of those. I think pets interfere
with your DMA attack, for example,
that's disabling the express
lot. Really help.
I said trust more disabling
trusted power lines something and
disabling the express card slot will
help. Then I can't get into the express
card slot, but usually on
laptops if you I'm screwed the back
cover. There are something like
a biffy card or something like that in
there that's probably going to be PC
Express as well and that
maybe it's harder to disable that
one.
If I may, the
question before the last one, I can
answer that you can't replace
some of the exiling scores, for example,
the PCI Express one, because that
so-called hot item that's really
on FPGA non
changeable stuff.
So it's just.
Yeah, yeah.
Hardware, it's hardware.
And yeah. But you
should be able probably.
Thank you.
Thank you. On microphone two,
did you wanted to say something still OK?
No. So thanks again.
Thank you all first.
And somebody showed up for
the Microsoft phone one.
Yeah. So.
So regarding the heart episode,
what these Heart OPIS normally implement
is, uh, the physical interface
to the Pizza Express, which is doing
these transactionally packets, but
the actual DMA is usually done
using Epicor,
which you load into the thing.
So usually it's the IP core
which is proprietary and
running on the hard IP for the
PCI physical layer.
So you would probably
need an open DM, our IP
core.
OK, yeah.
Thank you.
OK, so now we're done with
all the questions.
I guess you will have a lot of people
surrounding you after the talk
to not speaking to microphones
and yeah. I wish you a great evening
and thanks again, officer.