FROM PRINTED FROM PRINTED CIRCUIT BOARDS TO CIRCUIT BOARDS TO - - PowerPoint PPT Presentation

▶
from printed from printed circuit boards to circuit
SMART_READER_LITE
LIVE PREVIEW

FROM PRINTED FROM PRINTED CIRCUIT BOARDS TO CIRCUIT BOARDS TO - - PowerPoint PPT Presentation

Jan 12, 2024 871 likes •1.73k views

FROM PRINTED FROM PRINTED CIRCUIT BOARDS TO CIRCUIT BOARDS TO EXPLOITS EXPLOITS (PWNING IOT DEVICES LIKE A BOSS) (PWNING IOT DEVICES LIKE A BOSS) @virtualabs | Hack in Paris '18 ABOUT ME ABOUT ME Head of Research @ Econocom Digital

slide-1
SLIDE 1

FROM PRINTED FROM PRINTED CIRCUIT BOARDS TO CIRCUIT BOARDS TO EXPLOITS EXPLOITS

(PWNING IOT DEVICES LIKE A BOSS) (PWNING IOT DEVICES LIKE A BOSS)

| Hack in Paris '18

@virtualabs
slide-2
SLIDE 2

ABOUT ME ABOUT ME

Head of Research @ Econocom Digital Security Hardware hacker (or at least pretending to be one) Speaker @ various conferences Special interest in Bluetooth Low Energy since 2 years

slide-3
SLIDE 3

A detailed reference guide on how to p0wn IoT devices A list of tools you may use to test devices

WHAT THIS TALK IS NOT WHAT THIS TALK IS NOT

slide-4
SLIDE 4

IT IS ALL ABOUT HOW TO THINK IT IS ALL ABOUT HOW TO THINK AND ANALYZE AND EXPLOIT AND ANALYZE AND EXPLOIT

LET'S DO IT THE HACKER WAY ! LET'S DO IT THE HACKER WAY !

slide-5
SLIDE 5

METHODOLOGY METHODOLOGY

slide-6
SLIDE 6

EXISTING METHODOLOGIES EXISTING METHODOLOGIES

Rapid7's methodology (7 basic steps) OWASP IoT Project (not really mature yet)

slide-7
SLIDE 7

PCB REVERSE-ENGINEERING PCB REVERSE-ENGINEERING

slide-8
SLIDE 8

COMPONENTS IDENTIFICATION COMPONENTS IDENTIFICATION

slide-9
SLIDE 9

MEMORY EXTRACTION MEMORY EXTRACTION

slide-10
SLIDE 10

SOFTWARE REVERSE-ENGINEEERING SOFTWARE REVERSE-ENGINEEERING

slide-11
SLIDE 11

SNIFFING WIRED COMMS. SNIFFING WIRED COMMS.

slide-12
SLIDE 12

SNIFFING WIRELESS COMMS. SNIFFING WIRELESS COMMS.

slide-13
SLIDE 13

FIND VULNS & ATTACK ! FIND VULNS & ATTACK !

slide-14
SLIDE 14

OUR VICTIM SMARTLOCK OUR VICTIM SMARTLOCK

slide-15
SLIDE 15

STEP #1: TEARDOWN STEP #1: TEARDOWN

slide-16
SLIDE 16

USE THE RIGHT TOOLS USE THE RIGHT TOOLS

slide-17
SLIDE 17
slide-18
SLIDE 18

KEEP CALM ! KEEP CALM !

slide-19
SLIDE 19

STEP #2: GLOBAL ANALYSIS STEP #2: GLOBAL ANALYSIS

slide-20
SLIDE 20

ELECTRONICS ENGINEERS ARE ELECTRONICS ENGINEERS ARE HUMANS TOO HUMANS TOO

Components position based on their global role Connectors and components producing heat placed near the edges

slide-21
SLIDE 21
slide-22
SLIDE 22

nRF52832 2.4 GHz Bluetooth Low Energy capable System-on-Chip

COMPONENTS IDENTIFICATION COMPONENTS IDENTIFICATION

DRV8848 Dual H-Bridge Motor driver

slide-23
SLIDE 23

FUNCTIONS VS. COMPONENTS FUNCTIONS VS. COMPONENTS

slide-24
SLIDE 24

STEP #3: RECOVER SCHEMATICS STEP #3: RECOVER SCHEMATICS

slide-25
SLIDE 25

PICTURES + SOFTWARE FTW PICTURES + SOFTWARE FTW

Using high-res pictures (or multimeter), follow tracks and vias Determine protocols used for Inter-IC communication Draw a simplified schematics

slide-26
SLIDE 26

FOLLOW TRACKS AND VIAS FOLLOW TRACKS AND VIAS

slide-27
SLIDE 27

DETERMINE PROTOCOLS USED DETERMINE PROTOCOLS USED

slide-28
SLIDE 28

SIMPLIFIED SCHEMATICS SIMPLIFIED SCHEMATICS

Use Inkscape, Adobe Illustrator, MS Visio, or whatever Draw only the interesting stuff, we do not want to counterfeit

slide-29
SLIDE 29
slide-30
SLIDE 30
slide-31
SLIDE 31

STEP #4: GET FIRMWARE STEP #4: GET FIRMWARE

slide-32
SLIDE 32

USE DEBUGGING INTERFACES ! USE DEBUGGING INTERFACES !

Offers a proper way to access Flash memory Found in > 50% of devices we have tested Requires the right adapter to connect to

slide-33
SLIDE 33

DUMPING FIRMWARE WITH DUMPING FIRMWARE WITH OPENOCD OPENOCD

$ openocd -f interface/stlink-v2.cfg

  • f target/nrf5x.cfg -c init -c halt
  • c "dump_image /tmp/firmware.bin 0x0 0x80000"
slide-34
SLIDE 34

WHEN DEBUGGING IS NOT WHEN DEBUGGING IS NOT ENABLED, ABUSE ENABLED, ABUSE OTA OTA ! !

slide-35
SLIDE 35

OVER-THE-AIR UPDATES OVER-THE-AIR UPDATES

slide-36
SLIDE 36

OR DUMP EVERY AVAILABLE OR DUMP EVERY AVAILABLE STORAGE DEVICE 😏 STORAGE DEVICE 😏

slide-37
SLIDE 37
slide-38
SLIDE 38

FIRMWARE DUMPED ! FIRMWARE DUMPED !

slide-39
SLIDE 39

SPARE AREA IS EVIL SPARE AREA IS EVIL

slide-40
SLIDE 40

REMOVE OOB DATA ! REMOVE OOB DATA !

(AND USE ECC TO FIX ERRORS) (AND USE ECC TO FIX ERRORS)

slide-41
SLIDE 41

STEP #5: DETERMINE TARGET STEP #5: DETERMINE TARGET ARCHITECTURE ARCHITECTURE

slide-42
SLIDE 42

ANSWER THE BASIC QUESTIONS ANSWER THE BASIC QUESTIONS

What architecture is this ? Does it run an OS ? Does it use a FS ?

slide-43
SLIDE 43

WHAT ARCHITECTURE IS IT ? WHAT ARCHITECTURE IS IT ?

ARM CORTEX-M0 (ARMV7-M) ARM CORTEX-M0 (ARMV7-M)

slide-44
SLIDE 44

DOES IT RUN AN OS ? DOES IT RUN AN OS ? NOPE. NOPE.

slide-45
SLIDE 45

DOES IT USE A FS ? DOES IT USE A FS ? NOPE. NOPE.

slide-46
SLIDE 46

NRF51 SOFTDEVICE NRF51 SOFTDEVICE

slide-47
SLIDE 47

SOFTDEVICE VERSION ? SOFTDEVICE VERSION ? EASY-PEASY EASY-PEASY ! !

$ strings firmware-original.bin | grep sdk /home/benoit/workspace/nrf51/firmware/sdk/sdk13.0/components/l /home/benoit/workspace/nrf51/firmware/sdk/sdk13.0/components/s /home/benoit/workspace/nrf51/firmware/sdk/sdk13.0/components/s /home/benoit/workspace/nrf51/firmware/sdk/sdk13.0/components/l /home/benoit/workspace/nrf51/firmware/sdk/sdk13.0/components/l /home/benoit/workspace/nrf51/firmware/sdk/sdk13.0/components/l /home/benoit/workspace/nrf51/firmware/sdk/sdk13.0/components/s

slide-48
SLIDE 48

QUICK REMINDER QUICK REMINDER

It runs an OS or use a known FS: You'd better drop binaries in IDA Pro It uses no FS and looks like a crappy blob of data: You'd better figure out the architecture and memory layout.

slide-49
SLIDE 49

STEP #6: DISASSEMBLE ! STEP #6: DISASSEMBLE !

slide-50
SLIDE 50

SPECIFY TARGET ARCHITECTURE AND SPECIFY TARGET ARCHITECTURE AND LAYOUT LAYOUT

Configure CPU accordingly Configure memory layout if required Perform a quick sanity check (strings xrefs, ...)

slide-51
SLIDE 51
slide-52
SLIDE 52
slide-53
SLIDE 53

AUTOMATED SDK FUNCTIONS AUTOMATED SDK FUNCTIONS DETECTION AND RENAMING DETECTION AND RENAMING

We developed our own tool to ease SoDevice- based firmware reverse-engineering It helps detecting SoDevice version and automatically rename SDK exported functions

slide-54
SLIDE 54

0:00 / 2:36

slide-55
SLIDE 55

NRF5X-TOOLS AVAILABLE ON GITHUB NRF5X-TOOLS AVAILABLE ON GITHUB

https://github.com/DigitalSecurity/nrf5x-tools

slide-56
SLIDE 56

MOBILE APPS TOO MOBILE APPS TOO

slide-57
SLIDE 57

STEP #7: SNIFF ALL THE THINGS STEP #7: SNIFF ALL THE THINGS

slide-58
SLIDE 58

SNIFF/INTERCEPT SNIFF/INTERCEPT COMMUNICATIONS COMMUNICATIONS

May require various hardware: SPI, I2C, WiFi, BLE, nRF24, Sigfox, LoRa, ... PCAP compatible tools are great Beware the cost (a lot of $$$) !

slide-59
SLIDE 59

BLUETOOTH LOW ENERGY MITM BLUETOOTH LOW ENERGY MITM

https://github.com/DigitalSecurity/btlejuice

slide-60
SLIDE 60

HOW OUR SMARTLOCK WORKS HOW OUR SMARTLOCK WORKS

(BASED ON A MITM ATTACK) (BASED ON A MITM ATTACK)

  • 1. App retrieves a Nonce from the lock
  • 2. App encrypts a token and send it to the lock
  • 3. Lock decrypts token and react accordingly
slide-61
SLIDE 61

BY THE WAY ... BY THE WAY ...

The mobile app authenticates the smartlock only by its exposed service UUID:

slide-62
SLIDE 62

STEP #8: FIND BUGS & VULNS STEP #8: FIND BUGS & VULNS

slide-63
SLIDE 63

SEARCH BUGS & VULNS SEARCH BUGS & VULNS

Default password/key Escape shell Buffer overflow Misconfiguration ...

slide-64
SLIDE 64

SMARTLOCK SECURITY SMARTLOCK SECURITY FEATURES FEATURES

Relies on a Nonce generated by the smartlock to avoid replay attacks True AES-based encryption used, cannot break it Resisted to fuzzing, we did not managed to force

  • pen the lock
slide-65
SLIDE 65

BUT ... BUT ...

slide-66
SLIDE 66

... IS IT «RANDOM» ? ... IS IT «RANDOM» ?

slide-67
SLIDE 67

I'VE ALREADY SEEN THAT ... I'VE ALREADY SEEN THAT ...

(SOURCE: XKCD) (SOURCE: XKCD)

slide-68
SLIDE 68

SECURITY ISSUES SECURITY ISSUES

Spoofing: App does not authenticate the smartlock it connects to Random Nonce is not random at all !

slide-69
SLIDE 69

SO WHAT ? SO WHAT ?

An attacker may spoof the smartlock to force the App to send an encrypted token He/she may be able to replay a valid token as the nonce is always the same

slide-70
SLIDE 70
slide-71
SLIDE 71

STEP #9: EXPLOIT ! STEP #9: EXPLOIT !

slide-72
SLIDE 72

SPOOF SMARTLOCK SPOOF SMARTLOCK

Use NodeJS with Bleno FTW Exploit based on our Mockle library https://github.com/DigitalSecurity/mockle

slide-73
SLIDE 73

SPOOFING SMARTLOCK SPOOFING SMARTLOCK

$ sudo node capture-token.js [setup] creating mock for device XXXXXXX (xx:xx:xx:6b:fc:88) [setup] services registered [ mock] accepted connection from address: 5e:74:79:1e:5f:a9 > Register callback for service 6e4...ca9e:6e4...ca9e > Read Random, provide default value 1. > End of transmission [i] Token written to `token.json`

slide-74
SLIDE 74

REPLAY TOKEN REPLAY TOKEN

$ sudo node replay-token.js BTLE interface up and running, starting scanning ... [i] Target found, replaying token ... done

slide-75
SLIDE 75

0:00 / 1:23

slide-76
SLIDE 76

BUG IS NOW FIXED BUG IS NOW FIXED

slide-77
SLIDE 77

CONCLUSION CONCLUSION

slide-78
SLIDE 78

TO BE IMPROVED TO BE IMPROVED

We have been using this methodology intensively since the last two years There is space for improvements, obviously Vendor fixed (some) of the vulnerabilities we demonstrated

slide-79
SLIDE 79

PRO TIPS PRO TIPS

Take your time and document all the things Read datasheets carefully Learn how to master Inkscape, it helps a lot Start from the bottom (PCB) and go up !

slide-80
SLIDE 80

PRO TIPS (CONT'D) PRO TIPS (CONT'D)

As usual, know your tools and how to use them Share and learn from others (many cool tricks to discover)

slide-81
SLIDE 81
slide-82
SLIDE 82

PRACTICE ! PRACTICE !

Soldering (tiny wires) Desoldering with hot air gun Use the scope Use the scope again Code on embedded devices ...

slide-83
SLIDE 83

CONTACT CONTACT

QUESTIONS ? QUESTIONS ?

 @virtualabs  damien.cauquil@digital.security