SHARING THE LOAD: BUILDING A BETTER HW COMMUNITY HARDWEAR.IO - - PowerPoint PPT Presentation

▶
sharing the load
SMART_READER_LITE
LIVE PREVIEW

SHARING THE LOAD: BUILDING A BETTER HW COMMUNITY HARDWEAR.IO - - PowerPoint PPT Presentation

Jul 06, 2023 300 likes •759 views

SHARING THE LOAD: BUILDING A BETTER HW COMMUNITY HARDWEAR.IO OPENING KEYNOTE KATE TEMKIN /@ktemkin THE STATE OF HARDWARE SECURITY KINDA SUCKS. Linux version 2.6.31 (root@dnixm-compiler1) # whoami root # HORIZON-NX SOFTWARE STACK

slide-1
SLIDE 1

SHARING THE LOAD:

HARDWEAR.IO OPENING KEYNOTE

BUILDING A BETTER HW COMMUNITY

KATE TEMKIN /@ktemkin

slide-2
SLIDE 2
slide-3
SLIDE 3

KINDA SUCKS.

THE STATE OF HARDWARE SECURITY…

slide-4
SLIDE 4

Linux version 2.6.31 (root@dnixm-compiler1) # whoami root #

slide-5
SLIDE 5
slide-6
SLIDE 6
slide-7
SLIDE 7

HORIZON-NX SOFTWARE STACK

  • Hardened, custom security microkernel
  • Ultra-minimal custom TrustZone monitor
  • Tegra X1 SoC
slide-8
SLIDE 8

HORIZON-NX SOFTWARE STACK

  • Hardened, custom security microkernel
  • Ultra-minimal custom TrustZone monitor
  • Tegra X1 SoC
slide-9
SLIDE 9

Tegra X1 SoC

  • h, yeah, that’ll do it
slide-10
SLIDE 10
slide-11
SLIDE 11
slide-12
SLIDE 12
slide-13
SLIDE 13

HOW DID WE WIND UP HERE?

SO,

slide-14
SLIDE 14

SO, WHO REALLY ARE YOU?

  • founder, Insomnia Security
  • Nintendo Switch inspector
  • glitch witch & open-source-tool-builder
  • educational (reverse) engineer
  • occasional engineering streamer

Katherine/Kate Temkin (@ktemkin):

slide-15
SLIDE 15

EECE CS

slide-16
SLIDE 16

EECE CS EE CE

slide-17
SLIDE 17

EECE CS EE CE

ELECTRICAL ENG Felt they didn’t have to touch code… COMPUTER ENG Felt they’d never wind up holding a soldering iron. COMPUTER SCI Felt things like microcontrollers were “too hardware”.

slide-18
SLIDE 18

EECE CS EE CE

ALL MAJORS Tended to think they were there to apply techniques created by ‘heroic inventors’.

slide-19
SLIDE 19

FAST FORWARD N YEARS

slide-20
SLIDE 20
slide-21
SLIDE 21

HORIZON-NX SOFTWARE STACK

  • Extremely difficult to attack on the software front
  • But that software is built – and runs – atop hardware.
slide-22
SLIDE 22
slide-23
SLIDE 23

BOOTROM LOCKOUT

  • Prevents any software running on the X1 from

accessing bootROM code.

slide-24
SLIDE 24
slide-25
SLIDE 25

BOOT CONFIGURATION ENTRIES

  • As documented in NVIDIA’s open-source cboot bootloader

(src/t210/nvboot_sdram_param_t210.h). LIVE MEMORY PATCHING

  • This gives us a way to dump the bootROM on a non-

production device (like an Jetson TX1 dev board).

slide-26
SLIDE 26

ctrl_transfer(STANDARD_REQUEST_DEVICE_TO_HOST_TO_ENDPOINT, GET_STATUS, 0, 0, 4096)

USB tools at: https://github.com/ktemkin/Facedancer

slide-27
SLIDE 27

THE FATAL FLAW?

  • A minor mistake in some USB logic resulted in a memcpy of

user-controlled length…

  • … and or long enough reads, user-controlled content!
slide-28
SLIDE 28

CVE-2018-6242 (“Fusée Gelée” / ”shofEL2”)

  • Easy to apply locally, easy to discover, and simple in mechanism.
  • Completely compromises all root-of-trust technology on relevant processors.
  • Wait, which processors?
slide-29
SLIDE 29

TEGRA PROCESSOR SERIES

  • Tegra APX: affected
  • Tegra 2:

affected

  • Tegra 3:

affected

  • Tegra 4:

affected

  • Tegra K1:

affected

  • Tegra X1:

affected

  • Tegra X2:

not affected

phew

slide-30
SLIDE 30

CVE-2018-6242 (“Fusée Gelée” / ”shofEL2”)

  • Easy to apply locally, easy to discover, and simple in mechanism.
  • Completely compromises all root-of-trust technology on most Tegras.

So: how the heck did this stick around for so long?

slide-31
SLIDE 31

SO WHAT DO WE DO NOW?

OKAY:

slide-32
SLIDE 32

WELL, THEY DON’T CALL IT

EASY-WARE.

— @securelyfitz

Show hardware hacking as approachable, rather than as deep wizardry.

slide-33
SLIDE 33

WELL, THEY DON’T CALL IT

EASY-WARE.

— @securelyfitz

Fill in the artificial divide between hardware and software engineers.

slide-34
SLIDE 34

SOMETIMES,

WE HAVE TO KILL OUR HEROES.

Celebrate those who lift others up. Fewer rockstars, more teachers.

slide-35
SLIDE 35

OPEN A DOOR,

TEAR DOWN A BARRIER.

Produce more entry-level materials, and build more open, inexpensive tools.

slide-36
SLIDE 36

CHIPWHISPERER LITE GLITCHING & SIDE-CHANNEL BOARD

https://newae.com/tools/chipwhisperer/ https://github.com/newaetech/chipwhisperer

slide-37
SLIDE 37

OPEN A DOOR,

TEAR DOWN A BARRIER.

Don’t let educational spaces develop additional barriers.

slide-38
SLIDE 38

DON’T TOLERATE RACISM / SEXISM / ABLEISM / *PHOBIA IN YOUR COMMUNITIES.

slide-39
SLIDE 39

OPEN A DOOR,

TEAR DOWN A BARRIER.

Don’t let educational spaces develop additional barriers.

slide-40
SLIDE 40

AND FOR GOODNESS SAKE,

STOP HIDING MY STUFF.

Vendors: hardware isn’t just an implementation detail.

slide-41
SLIDE 41

SO, WHY BRING THIS UP NOW?

ONE MORE THING:

slide-42
SLIDE 42
slide-43
SLIDE 43

THANKS FOR LISTENING!

QUESTIONS?

slide-44
SLIDE 44

IMAGE CREDITS

  • slide 6: nintendo switch icon by Sweet Farm from the Noun Project