Eloi Sanfélix y Javier Moreno - Hardware hacking on your couch [RootedCON 2012]
2 likes1,624 views
The document discusses hardware hacking, focusing on embedded systems and techniques for information gathering, firmware dumping, and debugging via JTAG interfaces. It highlights both the challenges faced by attackers and defenders, and provides a shopping list of essential tools for hacking embedded systems. Additionally, it offers a range of resources and examples of devices to explore for hardware hacking.
![HW Hacking resources
• Hack a day – www.hackaday.com
• /dev/ttyS0 – www.devttys0.com
• Bunnie’s blog – www.bunniestudios.com
• Debugmo.de – debugmo.de
• Pagetable – www.pagetable.com
• HW vendors’ forums: SeedStudio, Sparkfun ,
adafruit.com, Dangerous Prototypes , ...
• Fritzing – www.fritzing.org
• [... The list goes on ...]](https://image.slidesharecdn.com/esanfelix-jmoreno-120324094426-phpapp02/85/Eloi-Sanfelix-y-Javier-Moreno-Hardware-hacking-on-your-couch-RootedCON-2012-41-320.jpg)
Eloi Sanfélix y Javier Moreno - Hardware hacking on your couch [RootedCON 2012]
- 1. Hardware hacking on your coach Intro to affordable embedded hacking Eloi Sanfelix <eloi@riscure.com> Javi Moreno <javi.moreno@nruns.com> #rootedHW
- 2. The life of a software security guy during the day
- 3. The life of a software security guy during the night
- 4. Hardware = FUN Source: http://www.flickr.com/photos/neimod/
- 5. This is NOT about....
- 6. ... but more ... Source: http://dontstuffbeansupyournose.com
- 7. Overview
- 10. Mapping of the device 10
- 11. Open Source Info Gathering • Search the web – Part # / Chip model Datasheets – Similar models – Exploits for similar devices – ...
- 13. Interesting interfaces Interface Typical uses RS232 Shells , debug output Debug output, peripheral management, i2c / SPI serial EEPROM, ... JTAG Testing and debugging USB / Ethernet / SATA / Etc Same as your PC ;-)
- 15. Bus Pirate v3.x
- 17. DEMO: Interfacing & sniffing
- 18. Dumping Firmware
- 19. How to obtain firmware? • Online firmware updates • Flash dumping – SPI for serial ROMs – Via debug access (e.g JTAG) – Desoldering + external flash readers • Commercial readers • Microcontroller-based dumpers
- 20. Placa ROMs
- 23. Debugging
- 24. JTAG interface
- 25. Debugging with JTAG • Boundary Scan only: – Reading / Modifying memory – Checking control lines (inputs/outputs) • Using additional aids: – Private instructions – Debugging logic • ARM: EmbeddedICE • MIPS: EJTAG • Motorola: BDM
- 26. Debugging with JTAG (2) • Provides: – Hardware breakpoints – Hardware watchpoints – Register access • Example: EJTAG
- 27. DEMO: Meet the BUS BLASTER
- 28. Locating JTAG A B D C
- 33. BGA (2) • Drilling through the PCB Balls on CPU: Balls through PCB:
- 34. Can’t debug? Emulate! • You still can use emulators – Qemu – GXEmul – Skyeye – ...
- 37. Key security features Feature Description Internal boot code / core must assure Secure boot integrity of loaded firmware Security subsystem must assure integrity Runtime integrity of running code Debug interfaces must either be disabled Interface protection or (securely) protected Sensitive keys must be stored within the Key storage chipset and not readable to the application Content stored in external memory (RAM) during runtime must be protected External memory protection from attackers. (scrambling and maybe authentiaction) Need to withstand SCA/FI attacks in Protected crypto cores order to properly protect keys.
- 38. Conclusion • Embedded hacking = FUN • Attacker’s challenges – Info gathering often difficult – Interfacing trickier than with software • Defender’s challenges – Device running under hostile environment
- 39. Shopping list Item Price Arduino / Other dev boards 20-60€ each / 20 to 300€ Bus Pirate 25€ Bus Blaster / GoodFET 30€ / DIY Openbench Logic Sniffer / Saleae Logic Analyzer 40€ / 120€ Cables, solder, screwdrivers, probes, ... - DSO Oscilloscope Nano / Quad 70€ / 150€ USB Microscope ~20 € OpenVizsla (when available) 100 – 200 EUR
- 40. Some things to look at • Routers, modems, STBs, MFPs ... • Gaming consoles, modern TVs • PC parts • (Smart)phones • Smart meters, alarms, SCADA/PLCs... • Car or vehicle electronics • Home appliances, domotics • Gadgets
- 41. HW Hacking resources • Hack a day – www.hackaday.com • /dev/ttyS0 – www.devttys0.com • Bunnie’s blog – www.bunniestudios.com • Debugmo.de – debugmo.de • Pagetable – www.pagetable.com • HW vendors’ forums: SeedStudio, Sparkfun , adafruit.com, Dangerous Prototypes , ... • Fritzing – www.fritzing.org • [... The list goes on ...]
- 42. Thanks! Eloi Sanfelix (@esanfelix) Javi Moreno (@vierito5) eloi@riscure.com javi.moreno@nruns.com