NSC #2 - D3 01 - Thomas Braden - Exploitation of hardened MSP430-based device

Reverse&engineering*a*real*estate*lockbox*
Exploita)on+of+a+hardened++
MSP4307based+device+

Who+am+I+
Braden+Thomas+(@drspringﬁeld)+
•  Senior*Research*Scien5st,*Accuvant*
•  Primarily*focus:*embedded*devices,*reverse&engineering,*exploit*
development*
•  Previously*worked*at*Apple*Product*Security*
•  So#ware(background*

Agenda+
•  What*is*this*lockbox?*
•  Android*app*
•  Opening*the*device*
•  MSP430*Firmware*extrac5on:*techniques*used*and*tried*
•  Findings*
•  Demo*

Why+is+this+interes)ng?+
•  Devices*aKemp5ng*to*to*store*crypto*secrets*in*
general&purpose*microcontrollers*ﬂash*
•  Just*because*it’s*cheap*and*easy,*it’s*not*
necessarily*smart*
–  This*lockbox*is*a*case*study*of*why*
•  Hack*into*houses…*
–  Over*Bluetooth!*

•  Real*estate*physical*key*
container*
•  #1*in*market,*main*
compe55on*is*SentriLock*
Unnamed+real+estate+lockbox+
Lockbox* Lockbox*BT* Lockbox*BT*LE*

Keys+
•  Legacy*key*
•  Cell*radio*
•  eKey:*iOS/Android*
app*
•  Dongle/Keyfob*for*
Bluetooth/IR*

•  Focused*on*authen5ca5on*algorithm*
•  Each*eKey*has*a*serial*number*and*a*“syscode”*
–  Syscode*is*an*integer*corresponding*to*regional*market**
(e.g.*Atlanta)*
•  Serial*number/Syscode*are*required*at*ﬁrst*app*launch*
in*an*obfuscated*blob*
eKey+Android+app+

eKey+Android+app+
•  Serial*number/syscode*are*used*as*creden5al*to*speak*to*
back&end*web*service*
•  Web*service*provides*authen5ca5on*“cookies"*(binary*blobs*
of*data)*
•  App*transmits*cookies*to*the*Lockbox*over*Bluetooth/IR*
•  Must*provide*PIN*code*(associated*with*serial*number/
syscode)*to*open*the*lock*

Programmed+auth+ﬂow+
• Two*authen5ca5on*modes:*
– Programmed*and*deprogrammed*authen5ca5on*
• Programmed*authen5ca5on*used*exclusively*in*the*ﬁeld*
– Send*IDENTITY*cookie*
– Send*CONFIGURATION*cookie*
– Send*OBTAIN*KEY*message*
– Send*KEYAUTH*cookie*
– Send*DEVICE*OPEN*message*

Programmed+auth+
•  All*cookies*contain*AES*MACs*so*cannot*be*modiﬁed*
•  eKey*also*sends*“update*bytes”*which*change*daily*
–  Only*available*from*Manufacturer*server*(AES*MAC)*
•  eKey*can*generally*only*open*lockbox*in*same*syscode*

Must+access+ﬁrmware+
•  AKacker*doesn’t*have*a*valid*serial/syscode*
•  Even*if*obtained*one*(social*engineering),*don’t*have*
keyholder’s*PIN*
•  And*doesn’t*want*to*communicate*with*Manufacturer’s*
server*to*obtain*cookies*

Physical+access+
• Lockbox:*
– Cut*oﬀ*hard*plas5c*shell*
– Remove*hex*screws*
– Open*key*container**
•  Use*legi5mate*eKey*or*exploit*
• Lockbox*BT:*(above,*plus)*
– Cut*oﬀ*shackle*
– Must*pop*rivets*(big*pain!)*

Board+photos+
Lockbox* Lockbox*BT*

Internals+
Lockbox:+
•  MSP430F147*
•  TFBS4710*serial*IR*
transceiver*
•  24LC256*serial*
EEPROM*
Lockbox+BT:+
•  MSP430F248*
•  STMicroelectronics*
bluetooth*serial*module*
•  Atmel*EEPROM*

Reverse7engineering+steps+
•  Focus*on*Lockbox*
–  Board*easier*to*obtain*(no*annoying*rivets)*
–  Older*sooware*more*likely*to*be*insecure*
–  Keys*are*the*same*anyway!*
•  Map&out*the*test*pads*
•  Find*debugging*interfaces*
•  Perform*ﬁrmware*extrac5on*

MSP430+firmware+extrac)on+
•  JTAG+
–  4&wire*and*2&wire*
–  MSP430F147*only*supports*4&wire*
–  JTAG*security*fuse*is*blown,*prohibi5ng*JTAG*
•  BSL+

BSL+Overview+
•  “Bootstrap*loader”*
•  Serial*interface*
•  Permits*read/write*access*to*ﬂash*memory*
•  Implemented*with*code*stored*in*special*ﬂash*region*
•  Nearly*all*acccess*is*restricted*with*password*
–  Interrupt*vector*table*is*used:*inherently*unique*and*secret*
–  Only*mass&erase*can*be*performed*without*password*

Exis)ng+BSL+aWacks+
•  Travis*Goodspeed:*“Prac5cal*AKacks*Against*the*MSP430*
BSL”*in*2008*
–  Voltage*glitching*aKack*
–  BSL*password*comparison*5ming*aKack*

Voltage+glitching+
aWack+
•  Used*GoodFET22*with*ADG1634*+*DAC*
for*glitching*during*authen5ca5on*
check*
•  Remove*the*chip*from*the*board*to*
avoid*interference*
•  Step*down*voltage*on*all*lines*using*
resistors*
•  Only*feasible*on*BSL*1.x*to*avoid*mass&
erase*on*incorrect*password*
–  MSP430F147*has*BSL*1.1*

Results+of+voltage+glitching+
•  Failed*to*reproduce*
•  Device*con5nued*running*undeterred*or*died*altogether*
•  GoodFET's*MSP430*is*too*slow*to*glitch*another*MSP430*
–  BSL*runs*at*1Mhz,*and*GoodFET*(MSP430F2618)*can*be*clocked*up*
to*16Mhz*

BSL+)ming+aWack+
•  Password*byte*comparison*has*a*single*clock&cycle*5ming*diﬀerence*
between*the*"correct"*and*"incorrect"*paths*
•  Send*each*byte*([0x00&0xﬀ]*x*32)*and*measure*#*of*clock*cycles*to*
determine*byte*makeup*of*password*
BSL*1.10*

Timing+aWack+problems+
•  1*start*bit,*8*data*bits,*parity*bit,*1*stop*bit*
•  Bit&banged*
•  Between*bytes,*will*wait*for*start*bit*to*go*low*when*receiving*
•  If*this*loop*executes*>*1*5me,*you*have*destroyed*all*prior*5ming*
informa5on*
•  Device*will*check*that*RX*line*aoer*stop*bit*is*high,*or*cause*an*error*

Byte*N&1**
stop*bit*
Byte*N**
start*bit*
Device*checks*
here*
Timing*info**
destroyed*here*if*not*low*
Tinterbyte*

•  Ideal*Tinterbyte*=*number*of*instruc5ons***clock*speed*
–  Clock*speed*is*highly*inconsistent*
•  BSL*uses*DCOCLK*(sooware*clock),*cannot*force*crystal*
–  Number*of*instruc5ons*varies*
•  Due*to*5ming*vulnerability*
•  Any*mistakes*are*mul5plied*34x*(since*34*post&header*bytes*
per*auth)*

Stop*
Timing*info*destroyed*
(produces(bad(data)(
Tinterbyte*too+large++
Stop*bit*s5ll*low*
(causes(NAK)(
Miss*start*bit*
(produces(bad(data)(
Tinterbyte*too+small++
and/or*
Stop*
Start*
Start*

•  If*5ming*is*bad,*you*will*receive*a*NAK*response*
•  Since*password*is*inherently*wrong,*you*will*receive*a*NAK**
response*
•  No*good*way*to*diﬀeren5ate*between*the*NAKs!*

Timing+aWack+game+plan+
•  Test*with*same&model*chip*(with*known*BSL*password)*to*
ﬁnd*ideal*5ming*
•  Use*external*crystal*on*GoodFET*to*eliminate*aKacker&side*
clock*problems*
•  Slowly*decrease*Tinterbyte*un5l*correct*password*is*no*longer*
ACKed*
–  Find*the*run*with*the*lowest*overall*total*5me*
–  You*have*found*ideal*Tinterbyte*
–  Re&use*on*target*chip*

Timing+aWack+results+
Total*5me*vs*decrease*in*Tinterbyte*
ideal*Tinterbyte*

Timing+aWack+results+
•  Looks*good*at*macro*level*
•  Wildly*inconsistent*at*micro*level*
•  Overall*total*5mes*will*vary*by*thousands*of*aKacker*clock*
cycles*
•  Tried*modifying*BSL*to*expose*bit*read*5me*on*a*line*
•  Tried*just*focusing*on*last*byte:*only*need*to*get*three*
Tinterbyte*correct*
–  last*byte*+*checksum*

Modiﬁed+aWack+results+
Guessed*byte*vs*overall*5me*

Timing+aWack+conclusions+
•  AKack*was*a*failure*
•  Likely*due*to*DCOCLK*inconsistencies*during*the*tare*
rou5ne,*which*produces*vic5m*chip’s*5ming*for*serial*
communica5on*(length*of*“sleep”s)*
•  If*this*tare*rou5ne*value*is*inconsistent,*the*5ming*used*for*
every(serial(bit*will*diﬀer,*mul5plying*errors*
•  Doesn’t*appear*to*average*out*in*the*short*term*

“Paparazzi”+aWack+
•  Firmware*extrac5on*technique*
–  Goodspeed*told*me*about*this*
–  Permits*bypassing*JTAG*security*fuse*
–  Most*likely*due*to*photoelectric*eﬀect*

MSP430+JTAG+security+
•  MSP430F1xx/2xx/4xx:*physical*fuse*
–  Once*blown*(“programmed”),*it’s*blown*
•  MSP430F5xx/6xx:*electronic*fuse*mechanism*
–  Can*be*unprogrammed*by*erasing*0x17fc*
–  Not*successful*at*aKacking*these*

MSP430+1/2/4xx+fuse+
•  Fuse*check*is*performed*by*toggling*TMS*line*twice*with*
TDI*high*
•  Current*is*measured*from*TDI*across*the*fuse*
Chip(logic(remembers(the(result(

•  Decap*the*chip*
–  Ensure*bonding*wires*remain*intact*
•  Jet*etching*may*be*required*
–  <$100*outsourced*to*lab*
•  Run*a*5ght*JTAG*loop*on*reset&
tap*+*fuse&check*
•  Every*~200*itera5ons*aKempt*
authen5cated*ac5on*
–  Read*ﬁrst*address*in*BSL*memory*space*

Expose*the*die**
and*hit*with**
camera*ﬂash*

•  When*valid*data*returned,*success!*
•  Do*not*power*the*chip*down,*or*ﬂip*reset*line*
–  Requires*GoodFET*sooware*modiﬁca5on*
•  Be*sure*to*power*the*chip*externally*during*aKack*
•  Don’t*expect*chip*to*be*in*normal*state*
–  I*usually*just*read*BSL*password*then*reset*

•  JTAG*fuse*check*works*by*measuring*current*across*fuse*
–  Photoelectric*eﬀect*causes*transistor*to*release*electrons*when*
struck*with*photons*
–  Causes*current*to*appear*to*pass*across*the*fuse*
–  Alterna5ve*theory*is*UV*erasing*memory*cell*where*JTAG*state*
stored*(e.g.*bunnie’s*aKack*on*PIC*microcontroller),*but*digital*
camera*ﬂash*produces*minimal*UV*and*aKack*is*instant*
“Paparazzi”+aWack:+Why?+

MSP430+ﬁrmware+reversing+
•  Calling*conven5on*
–  R12*
–  R14*
–  Remaining*arguments*pushed*to*stack*
–  Return:*R12*
•  Occasionally*R13*is*also*used,*if*32&bit*return*

MSP430+firmware+reversing+
•  Only*unique*thing*was*“sparse*index”*switch*statement*construc5on*
•  Used*a*common*helper*func5on*that*reads*func5on*return*address*off*
the*stack,*then*parses*data*structure*aoer*call*to*find*out*jump*
des5na5on*

IrDA+
•  Surprisingly*large*(~25%)*amount*of*ﬁrmware*dedicated*to*IrDA*
•  Bit&banged*serial&ish*with*short*pulse*width*
•  Can*be*sniﬀed*from*test*pad*on*board*and*decoded*with*custom*Logic*
plugin*
•  Export*from*Logic,*post&process*with*python*into*pcap,*and*Wireshark*
does*the*rest*

Firmware+reversing+ﬁnds+
1. How*Manufacturer’s*crypto*really*works*
2. Actually*three*authen5ca5on*modes*
3. Hardware*backdoor!*
4. Memory*read/write*command*permits*reading/
wri5ng*ﬂash*using*hidden*mode*

Manufacturer’s+crypto+architecture+
•  All*crypto*keys*used*are*derived*from*or*encrypted*with*two*keys*(AES128)*
•  Device+Key+
–  Rarely*used*in*the*ﬁeld,*used*to*get*high*authen5ca5on*level*(i.e.*for*
“deprogramming”*a*device*to*use*it*in*another*syscode*region)*
•  Syscode+Key+
–  Root*of*trust*for*all*normal*opera5ons*(e.g.*opening*the*key*container)*
–  Shared*by*en5re*geographical*region*
•  Neither(are(ever(accessible(to(the(eKey(app(or(readable(via(remote(
commands(
1+

Syscode+Key+
•  Provisioned*during*unknown*process*at*local*MLS*oﬃce*
–  Device*must*be*in*deprogrammed*mode*
–  They*must*have*some*authen5cated*channel*to*obtain*the*syscode*key*for*
their*region*
•  A*MAC*key*and*an*Encryp5on*key*are*derived*from*syscode*key,*and*
used*to*validate*cookie*integrity*and*decrypt*other*ephemeral*keys*
•  Compromising*this*key*permits*aKacker*to*generate*fake*
“authen5ca5on*cookies”*
–  Can*open*any*lock*in*geographical*region*without*leaving*a*trace*
2+

Third+authen)ca)on+mode+
•  Permits*access*to*visitor*log*in*EEPROM*
–  Useful*if*the*lock*has*been*unlocked*before*
•  Requires*no*authen5ca5on*cookies*for*access*
•  Visitor*log*contains*the*serial*number/syscode*of*
connec5ng*eKeys*
–  This*solves*one*of*our*earlier*problems,*but*s5ll*need*PIN*to*use*
2+

Brute+Force+
•  PIN*only*4*digits*
•  However*device*has*PIN*brute&force*protec5on*
–  eKey*will*get*"locked*out"*and*cannot*communicate*for*10m*
–  Exhaus5ve*PIN*brute*force*would*take*about*1*week*wai5ng*for*
lockouts*
–  However,*lockout*counter*stored*in*EEPROM*and*can*be*erased*
with*physical*access*
3+

Hardware+backdoor+
•  Deprogrammed*authen5ca5on*
–  Android*app*only*uses*this*method*when*device*is*deprogrammed*
•  Can*actually*be*used*when*device*is*programmed*if*you*
know*the*Device*Key*
–  Highest*access*mode,*permits*overwri5ng*keys*
–  Likely*used*by*MLS*oﬃce,*they*must*have*a*secure*channel*to*get*
Device*Keys*for*their*devices*
•  Implementa5on*contains*hardware*backdoor*
3+

Hardware+backdoor+
•  P3.1*goes*high*
•  Immediately*test*P3.2*
•  If*low,*backdoor*is*in*eﬀect*
3+

Hardware+backdoor+
•  P3.1*and*P3.2*are*connected*
to*each*other*(through*a*
resistor)*
•  Desolder*the*resistor*and*you*
can*bypass*per&device*
authen5ca5on*
•  Destroy*the*resistor*with*a*
single*drill*hole*in*back*of*
closed*lockbox*and*you*can*
open*it*up*with*
deprogrammed*auth*
3+

Flash+write+erase+aWack+
•  Way*to*extract*Syscode*Key*without*decapping?*
•  Keys*are*in*“Informa5on*Memory”*which*is*erased*by*BSL*mass&erase*
•  Generally,*must*erase*flash*between*writes*
•  Lockbox*has*Memory*Write*command*that*permits*wri5ng*to*same*
informa5on*memory*segment*where*keys*are*stored*
–  En5re*segment*is*copied*to*stack*buffer,*Flash*segment*is*erased,*modified,*
and*then*wriKen*back*
–  Stack*is*in*RAM…*which*is*not*erased*by*BSL*mass&erase*
4+

•  First*use*hardware*backdoor*to*“authen5cate”*
•  Ini5ate*a*Memory*Write*command*to*informa5on*page*(at*an*
unused*loca5on)*
•  Informa5on*page*will*be*copied*to*stack*buffer,*modified,*and*
wriKen*back*to*flash*
•  Quickly*reset*device*and*perform*mass&erase*of*flash*via*BSL*
•  Read*RAM*using*BSL*(using*default*password)*
4+

•  Great+success!+
•  Special*GoodFet*applica5on*that*counts*clock*cycles*
–  Run*applica5on*right*before*sending*Memory*Write*
command*
–  Send*Memory*Write*command*
–  Applica5on*will*reset*chip*and*put*into*BSL*mode*
–  Subsequently*can*mass&erase*and*read*RAM*
–  AKack*can*only*be*performed*once,*but*Syscode*Key*is*
obtained*
4+

Conclusions/solu)ons+
•  Manufacturer*
–  Discussed*issues*with*them*in*June*
–  Very*recep5ve,*started*working*on*ﬁxes*
•  Other*applica5ons:*
–  Avoid*storing*cryptographic*secrets*in*general*purpose*
microcontrollers*ﬂash*memory*
•  Hack*all*the*devices!*

Greetz+
•  Hardware*socket*by*Aaron*Kobayashi*
•  Thanks*to*Nathan*Keltner*and*Kevin*Finisterre*
•  Thanks*to*Travis*Goodspeed*for*prior*work*

NSC #2 - D3 01 - Thomas Braden - Exploitation of hardened MSP430-based device

More Related Content

More from NoSuchCon (16)

Recently uploaded (20)

NSC #2 - D3 01 - Thomas Braden - Exploitation of hardened MSP430-based device