Bypassing Secure Boot using Fault Injection

1. Bypassing Secure Boot using Fault Injection Niek Timmers timmers@riscure.com (@tieknimmers) Albert Spruyt spruyt@riscure.com November 4, 2016

2. What are the contents of this talk? Keywords – fault injection, secure boot, bypasses, mitigations, practicalities, best practices, demo(s) ...

3. Who are we? Albert & Niek • (Senior) Security Analysts at Riscure • Security testing of different products and technologies Riscure • Services (Security Test Lab) • Hardware / Software / Crypto • Embedded systems / Smart cards • Tools • Side channel analysis (passive) • Fault injection (active) • Ofﬁces • Delft, The Netherlands / San Francisco, USA Combining services and tools for fun and proﬁt!

6. Fault Injection – A deﬁnition... ”Introducing faults in a target to alter its intended behavior.” ... if( key_is_correct ) <-- Glitch here! { open_door(); } else { keep_door_closed(); } ... How can we introduce these faults?

10. Fault injection techniques1 clock voltage e-magnetic laser Remark • All techniques introduce faults externally 1 The Sorcerers Apprentice Guide to Fault Attacks. – Bar-El et al., 2004

11. Fault injection techniques1 clock voltage e-magnetic laser Remark • All techniques introduce faults externally 1 The Sorcerers Apprentice Guide to Fault Attacks. – Bar-El et al., 2004

12. Voltage fault injection • Pull the voltage down at the right moment • Not ’too soft’ ; Not ’too hard’ Source: http://www.limited-entropy.com/fault-injection-techniques/

13. Fault models Faults that affect hardware • Registers • Buses Faults that affect hardware that does software2 3 4 • Instruction corruption • Data corruption The true fault model is hard to predict or prove! 2 Fault Model Analysis of Laser-Induced Faults in SRAM Memory Cells – Roscian et. al., 2015 3 High Precision Fault Injections on the Instruction Cache of ARMv7-M Architectures – Riviere et al., 2015 4 Formal veriﬁcation of a software countermeasure against instruction skip attacks – Moro et. al., 2014

17. Fault Models – ”Our” choice ... When presented with code: instruction corruption. Simple (MIPS) addi $t1, $t1, 8 00100001001010010000000000001000 addi $t1, $t1, 0 00100001001010010000000000000000 Complex (ARM) ldr w1, [sp, #0x8] 10111001010000000000101111100001 str w7, [sp, #0x20] 10111001000000000010001111100111 Remarks • Limited control over which bit(s) will be corrupted • May or may not be the true fault model • Other fault model behavior covered

24. Why is there Secure Boot? Remarks • Integrity and conﬁdentiality of ﬂash contents are not assured! • A mechanism is required for this assurance: secure boot

29. Secure Boot – Generic Design • Assures integrity (and conﬁdentiality) of ﬂash contents • The chain of trust is similar to PKI5 found in browsers • One root of trust composed of immutable code and key 5 Public Key Infrastructure

33. Secure Boot – In reality ... Source: http://community.arm.com/docs/DOC-9306

34. Secure Boot – In reality ... Source: http://community.arm.com/docs/DOC-9306

35. Why use a hardware attack? ”Logical issues exist in secure boot implementations!!?” Bootloader vulnerabilities • S5L8920 (iPhone)6 • Amlogic S9057 However • Small code base results in a small logical attack surface • Implementations without vulnerabililties likely exist Other attack(s) must be used when not logically ﬂawed! 6 https://www.theiphonewiki.com/wiki/0x24000_Segment_Overflow 7 http://www.fredericb.info/2016/10/amlogic-s905-soc-bypassing-not-so.html

42. Why (not) fault injection on secure boot? Cons • Invasive • Physical access • Expensive Pros • No logical vulnerability required • Typical targets not properly protected Especially relevant when assets are not available after boot!

46. Typical assets Secure code • Boot code (ROM8) Secrets • Keys (for boot code decryption) Secure hardware • Cryptographic engines 8 Read Only Memory

50. Fault Injection – Intermezzo

51. Fault Injection – Tooling Micah posted a very nice video using the ChipWhisperer-Lite9 By NewAE Technology Inc.10 9 https://www.youtube.com/watch?v=TeCQatNcF20 10 https://wiki.newae.com/CW1173_ChipWhisperer-Lite

52. Fault Injection – Tooling Micah posted a very nice video using the ChipWhisperer-Lite9 By NewAE Technology Inc.10 9 https://www.youtube.com/watch?v=TeCQatNcF20 10 https://wiki.newae.com/CW1173_ChipWhisperer-Lite

53. Fault Injection – Setup Target • Digilent Zybo (Xilinx Zynq-7010 System-on-Chip) • ARM Cortex-A9 (AArch32)

54. Fault Injection – Setup Target • Digilent Zybo (Xilinx Zynq-7010 System-on-Chip) • ARM Cortex-A9 (AArch32)

55. Fault Injection – Setup

56. Characterization – Test application11 asm volatile ( ... "add r1, r1, #1;" "add r1, r1, #1;" < repeat > <-- glitch here "add r1, r1, #1;" "add r1, r1, #1;" ... ); Remarks • Full control over the target • Increasing a counter using ADD instructions • Send counter back using the serial interface 11 Implemented as an U-Boot command

57. Characterization – Possible responses Expected: ’too soft’ counter = 00010000 Mute: ’too hard’ counter = Success: ’$$$’ counter = 00009999 counter = 00010015 counter = 00008687 Remarks • Glitching ’too hard’ may damage the target permanently

62. DEMO 1 PARAMETER SEARCH Glitch parameters • Randomize glitch delay within the attack window • Randomize the glitch voltage • Randomize the glitch length

66. That was the introduction ... ... let’s bypass secure boot: The Classics!

67. That was the introduction ... ... let’s bypass secure boot: The Classics!

68. Classic Bypass 00: Hash comparison • Applicable to all secure boot implementations • Bypass of authentication if( memcmp( p, hash, hashlen ) != 0 ) return( MBEDTLS_ERR_RSA_VERIFY_FAILED ); p += hashlen; if( p != end ) return( MBEDTLS_ERR_RSA_VERIFY_FAILED ); return( 0 ); Source: https://tls.mbed.org/

71. Classic Bypass 00: Hash comparison Multiple locations bypass the check with a single fault!

76. Classic Bypass 01: Signature check call /* glitch here */ if(mbedtls_pk_verify(&k, SHA256, h, hs, s, ss)) { /* do not boot up the image */ no_boot(); } else { /* boot up the image */ boot(); } Remarks • Bypasses can happen on all levels • Inside functions, inside the calling functions, etc.

79. Classic Bypass 02: Infinite loop • What to do when the signature verification fails? • Enter an infinite loop! /* glitch here */ if(mbedtls_pk_verify(&k, SHA256, h, hs, s, ss)) { /* do not boot up the image */ while(1); } else { /* boot up the image */ boot(); }

83. Classic Bypass 02: Inﬁnite loop Remarks • Timing is not an issue! • Classic smart card attack 12 • Better to reset or wipe keys 12 https://en.wikipedia.org/wiki/Unlooper

88. Classic Bypass 03: Secure boot enable • Secure boot often enabled/disabled based on OTP13 bit • No secure boot during development; secure boot in the ﬁeld • Typically just after the CPU comes out of reset 13 One-Time-Programmable memory

89. Fault Injection – Mitigations Hardware countermeasures 14 15 • Detect the glitch or fault Software countermeasures 16 • Lower the probability of a successful fault • Do not address the root cause You can lower the probability but not rule it out! 14 The Sorcerers Apprentice Guide to Fault Attacks – Bar-El et al., 2004 15 The Fault Attack Jungle - A Classiﬁcation Model to Guide You – Verbauwhede et al., 2011 16 Secure Application Programming in the Presence of Side Channel Attacks – Witteman

95. Compiler optimizations Why? • ROM memory size is limited • Compiler optimizations decrease code size Compiler optimizes out intended code!

98. Compiler ’optimization’ – Double check Example of a double check unsigned int compare(char * input, int len) { if(memcmp(password, input, len) == 0) <-- 1st { if(memcmp(password, input, len) == 0) <-- 2nd { return TRUE; } } return FALSE; }

99. Compiler ’optimization’ – Double check Compiled without optimizations

100. Compiler ’optimization’ – Double check Compiled with optimizations

101. Compiler ’optimizations’ – Best practices • Your compiler is smarter than you • Use ’volatile’ to prevent compiler problems • Read the output of the compiler!

105. Compiler ’optimization’ – Pointer setup Example of a double check using ’volatile’ int checkSecureBoot( ){ volatile int * otp_secure_boot = OTP_SECURE_BOOT; if( (*otp_secure_boot >> 7) & 0x1 ){ <-- 1st return 0; }else{ if( (*otp_secure_boot >> 7) & 0x1 ){ <-- 2nd return 0; }else{ return 1; } } }

106. Compiler ’optimization’ – Pointer setup Compiled with optimizations

107. Compiler ’optimization’ – Pointer setup Compiled with optimizations

108. Combined Attacks Those were the classics and their mitigations .. ... the attack surface is larger!17 17 All attacks have been performed successfully on multiple targets!

109. Combined Attacks Those were the classics and their mitigations .. ... the attack surface is larger!17 17 All attacks have been performed successfully on multiple targets!

110. Combined attack – Copy • Introducing logical vulnerabilities using fault injection • Build your own buffer overﬂow! • Easy approach: change memcpy the size argument Before corruption memcpy(dst, src, 0x1000); After corruption memcpy(dst, src, 0xCEE5); Remark • Works when dedicated hardware is used (e.g. DMA18 engines) 18 Direct Memory Access

115. Combined attack – Copy Remark • Targetting the copy function arguments

121. Combined attack - Controlling PC on ARM20 • Exploits an ARM32 characteristic • PC19 register is directly accessible by most instructions Multi-word copy LDMIA r1!, {r3 - r10} STMIA r0!, {r3 - r10} Controlling PC using LDMIA LDMIA r1!,{r3-r10} 11101000101100010000011111111000 LDMIA r1!,{r3-r10,PC} 11101000101100011000011111111000 • Variations possible on other architectures; code dependent 19 Program Counter 20 Controlling PC on ARM using Fault Injection – Timmers et al., 2016

125. Combined attack - Controlling PC on ARM Remark • Targetting the copy function arguments

128. Combined attacks - Wild jungle jump21 • Start glitching while/after loading the image but before decryption • Lots of ’magic’ pointers around, which point close to the code • Get them from: stack, register, memory • The more magic pointers, the higher the probability 21 Proving the wild jungle jump – Gratchoff, 2015

133. Combined attack(s) – Summary • Bypass of both authentication and decryption • Typically little software exploitation mitigation during boot • Fault injection mitigations in software may not be effective

137. There are some practicalities ... ... which we must overcome!

138. There are some practicalities ... ... which we must overcome!

139. Secure Boot – Demo Design Remark • Stage 2 is invalided by changing the printed string • Stage 1 enters an inﬁnite loop when the signature is invalid

142. When to glitch? • Not possible to use a signal originating from target • Only reference point is power-on reset moment • Use side-channels to obtain more information • Compare behavior between valid image and an invalid image

149. Boot proﬁling – Reset Valid image Invalid image Remark • No difference between a valid and invalid image • Attack window spreads across the entire trace (˜400 ms)

152. Boot proﬁling – Flash activity Valid image Invalid image Remarks • Flash activity 3 not present for the invalid image • Attack window between ﬂash activity 2 and 3 (˜10 ms)

155. Boot proﬁling – Power consumption Remark • Measuring electromagnetic emissions using a probe22 22 https://www.langer-emv.de/en/product/rf-passive-30-mhz-3-ghz/35/ rf1-set-near-field-probes-30-mhz-up-to-3-ghz/270

156. Boot proﬁling – Power consumption Remark • Measuring electromagnetic emissions using a probe22 22 https://www.langer-emv.de/en/product/rf-passive-30-mhz-3-ghz/35/ rf1-set-near-field-probes-30-mhz-up-to-3-ghz/270

157. Boot profiling – Power consumption Valid image Invalid image Remarks • Significant difference in the electromagnetic emissions • Attack window reduced significantly (< 1 ms) • Power profile at black arrow is flat: infinite loop

162. Jitter Remark • Jitter during boot prevents effective timing (˜150 µs)

165. How to minimize jitter during boot? • Power-on reset is too early • Use a signal close to the ’glitch moment’ Remark • Using ﬂash activity 2 as a trigger to minimize jitter

170. Glitch Timing – Power consumption Remarks • Jitter minimized using ﬂash activity as a trigger

171. Glitch Timing – Power consumption Remarks • Jitter minimized using ﬂash activity as a trigger

172. DEMO 2 BYPASSING SECURE BOOT Glitch parameter search • Fixed the glitch delay to 300 ms • Fixed the glitch voltage to -2 V • Randomize the glitch length

176. DEMO 2 BYPASSING SECURE BOOT

177. Secure Boot – Manufacturer Best practices Minimize attack surface • Authenticate all code and data • Limit functionality in ROM code • Disable memory when not required Lower the probability • Implement fault injection countermeasures • Implement software exploitation mitigations Robustness can only be determined using testing!

186. Conclusion / Sound Bytes • Today’s standard technology not resistant to fault attacks • Implementers of secure boot should address fault risks • Hardware fault injection countermeasures are needed • Fault injection testing provides assurance on product security

191. Niek Timmers Senior Security Analyst timmers@riscure.com (@tieknimmers) Albert Spruyt Senior Security Analyst spruyt@riscure.com www.riscure.com/careers inforequest@riscure.com

Bypassing Secure Boot using Fault Injection

More Related Content

What's hot (20)

Similar to Bypassing Secure Boot using Fault Injection (20)

More from Riscure (17)

Recently uploaded (20)

Bypassing Secure Boot using Fault Injection