Next-Gen Exploitation: Exploring The PS5 Security Landscape by Specter | hardwear.io USA 2023 hardwear.io 2023-07-17 | Abstract:---------------The PlayStation 5 (PS5) represents a significant leap in technological advancements, particularly in terms of its security measures, which have undergone substantial improvements compared to its predecessor, the PS4. Due to the lack of public documentation around its security hardening techniques, there exists some misunderstanding of the system's security infrastructure. This conference talk aims to shed light on the PS5's system architecture, focusing on Sony's efforts to impede reverse engineering and mitigate the impact of kernel memory corruption.This presentation will delve into the intricacies of the PS5's security mechanisms, analyzing the evolving attack surface and ushering in of modern mitigations such as Supervisor Mode Access Prevention (SMAP), Supervisor Mode Execution Protection (SMEP), kernel Control Flow Integrity (kCFI), and eXecute Only Memory (XOM). Furthermore, we'll investigate the internal workings of the PS5's hypervisor, and analyze it's role in safeguarding the system against high-privileged attackers. We'll also talk about some how these mitigations can be worked around and highlight some avenues and ideas for future research.#ps5 #hacking #hardwaresecurity #hardwear_io #hw_ioUSA2023---------------------------------------------------------------------------------------------------------Website: hardwear.ioTwitter: twitter.com/hardwear_ioLinkedIn: linkedin.com/company/hardwear.io-hardwaresecurityconferenceandtrainingFacebook: facebook.com/hardwear.io
Hardwear.io USA 2024: Exposing Critical Threats In Millions Of Connected Devices - Alexander; Sergey hardwear.io 2024-09-06 | -Follow us on : hardwear.ioX : https://x.com/hardwear_ioLinkedIn: nl.linkedin.com/company/hardwear-io-hardwaresecurityconferenceandtrainingFacebook: facebook.com/hardwear.io
Hardwear.io USA 2024: TPM 2.0 Attestable Firmware: Recovering Trust After Firmware Flaws hardwear.io 2024-08-04 | -Follow us on : hardwear.ioX : https://x.com/hardwear_ioLinkedIn: nl.linkedin.com/company/hardwear-io-hardwaresecurityconferenceandtrainingFacebook: facebook.com/hardwear.io
Hardwear.io USA 2024: Panel: A New Root Of Trust: Changing Computing With TEE hardwear.io 2024-08-03 | -Follow us on : hardwear.ioX : https://x.com/hardwear_ioLinkedIn: nl.linkedin.com/company/hardwear-io-hardwaresecurityconferenceandtrainingFacebook: facebook.com/hardwear.io
Hardwear.io USA 2024: SRAM Data Remanence In SoCs: Covert Storage And Exfiltration Risks In TEE hardwear.io 2024-08-03 | -Follow us on : hardwear.ioX : https://x.com/hardwear_ioLinkedIn: nl.linkedin.com/company/hardwear-io-hardwaresecurityconferenceandtrainingFacebook: facebook.com/hardwear.io
Hardwear.io USA 2024: Building A Silicon Analysis Toolkit - Hash Salehi hardwear.io 2024-07-31 | -Follow us on : hardwear.ioX : https://x.com/hardwear_ioLinkedIn: nl.linkedin.com/company/hardwear-io-hardwaresecurityconferenceandtrainingFacebook: facebook.com/hardwear.io
Hardwear.io USA24: Who Monitors The Monitors? Hacking The Monitor Control Command Set - Eugene Lim hardwear.io 2024-07-29 | -Follow us on : hardwear.ioX : https://x.com/hardwear_ioLinkedIn: nl.linkedin.com/company/hardwear-io-hardwaresecurityconferenceandtrainingFacebook: facebook.com/hardwear.io
Hardwear.io USA 2024: Panel: The Right To Secure; What, Who, How And Why! hardwear.io 2024-07-27 | -Follow us on : hardwear.ioX : https://x.com/hardwear_ioLinkedIn: nl.linkedin.com/company/hardwear-io-hardwaresecurityconferenceandtrainingFacebook: facebook.com/hardwear.io
Hardwear.io USA 2024: TPMs & The Linux Kernel: Unlocking A Better Path To Hardware Security - Ignat hardwear.io 2024-07-25 | -Follow us on : hardwear.ioX : https://x.com/hardwear_ioLinkedIn: nl.linkedin.com/company/hardwear-io-hardwaresecurityconferenceandtrainingFacebook: facebook.com/hardwear.io
Hardwear.io USA 2024: Breaking Into Chips By Reading The Datasheet - Mark Omo and James Rowley hardwear.io 2024-07-22 | -Follow us on : hardwear.ioX : https://x.com/hardwear_ioLinkedIn: nl.linkedin.com/company/hardwear-io-hardwaresecurityconferenceandtrainingFacebook: facebook.com/hardwear.io
Hardwear.io USA 2024: BarraCUDA: GPUs Do Leak DNN Weights - Peter Horvath hardwear.io 2024-07-17 | -Follow us on : hardwear.ioX : https://x.com/hardwear_ioLinkedIn: nl.linkedin.com/company/hardwear-io-hardwaresecurityconferenceandtrainingFacebook: facebook.com/hardwear.io
Hardwear.io USA 2024: Secrets Of Simos18: REng The Secure Boot Mechanism Of An ECU - Brian Ledbetter hardwear.io 2024-07-16 | -Follow us on : hardwear.ioX : https://x.com/hardwear_ioLinkedIn: nl.linkedin.com/company/hardwear-io-hardwaresecurityconferenceandtrainingFacebook: facebook.com/hardwear.io
Hardwear.io USA 2024: LeapFrog: The Rowhammer Instruction Skip Attack - Andrew, Caner and Berk hardwear.io 2024-07-15 | -Follow us on : hardwear.ioX : https://x.com/hardwear_ioLinkedIn: nl.linkedin.com/company/hardwear-io-hardwaresecurityconferenceandtrainingFacebook: facebook.com/hardwear.io
Hardwear.io USA 2024: Integrating AI With Retro Hardware:A Commodore 64 LLM Module - Konrad & Marek hardwear.io 2024-07-13 | -Follow us on : hardwear.ioX : https://x.com/hardwear_ioLinkedIn: nl.linkedin.com/company/hardwear-io-hardwaresecurityconferenceandtrainingFacebook: facebook.com/hardwear.io
Hardwear.io USA 2024 : My Car, My Keys: Obtaining CAN Bus SecOC Signing Keys - Willem & Greg hardwear.io 2024-07-10 | In this talk the speakers will explain how we broke the SecOC implementation of a 2021 Model Year vehicle by attacking the power steering ECU. They will give a short introduction on SecOC. Also explain how key management is implemented, and why observing a key update when replacing a part won’t allow extracting the key.Using a Fault Injection attack the firmware of the power steering was extracted and could be reverse engineered. They discovered that all AES cryptography is implemented in firmware, and not handled by an HSM. This means it’s possible to extract the keys from the ECUs data flash. However, the SecOC key is unique per vehicle, and it’s not feasible to perform a Fault Injection attack for each vehicle.#hw_ioUSA2024 #automotivesecurity #CANBus #security #ECU #Hacks Follow us on : hardwear.ioX : https://x.com/hardwear_ioLinkedIn: nl.linkedin.com/company/hardwear-io-hardwaresecurityconferenceandtrainingFacebook: facebook.com/hardwear.io
Hardwear.io USA 2024: State-of-the-Art Anti-Counterfeiting: Attacks And Countermeasures - Scott Best hardwear.io 2024-07-08 | In this presentation, Scott will discuss the move/countermove nature of anti-counterfeiting efforts in modern semiconductors – how new countermeasures require deployment as soon as new attack methodologies become commercially viable. The talk will discuss in detail the most effective options to both reverse-engineering efforts as well as “forward-engineering” efforts, including specific physical-attack techniques (e.g., invasive, non-invasive, etc.) and their countermeasures, but also meta-level attacks such as basic theft and remanufacturing (along with their state-of-the-art protection mechanisms).#hw_ioUSA2024 #Anti-counterfeiting #security #Keynote Follow us on : hardwear.ioX : https://x.com/hardwear_ioLinkedIn: nl.linkedin.com/company/hardwear-io-hardwaresecurityconferenceandtrainingFacebook: facebook.com/hardwear.io
Hardwear.io NL 2023 | Understanding Physics To Break AES With Side-channel Hardware -Stephan & Roman hardwear.io 2024-01-02 | When it comes to implementing side channel measurement setups, very little information can be found online on what a good setup actually consists of. In this talk we will present all the physics at play and how to take them into account to design the ideal side channel measurement setup. Each point will be demonstrated with actual side channel attacks on the ESP32 AES engine, and new open source measurement hardware will be presented.#AES #hw_ioNL2023 #hardwaresecurity-------------------------------------------------------------------------------------------------------------------------------------------------------Website: hardwear.ioX : twitter.com/hardwear_ioLinkedIn: linkedin.com/company/hardwear.io-hardwaresecurityconferenceandtrainingFacebook: facebook.com/hardwear.io
HW.io NL 03 | Panel: A New Future For IoT Security: Better Solutions And What Did Not Work So Far hardwear.io 2023-12-29 | ...
Hardwear.io NL 2023 | Automated Fault Injection Attacks On Embedded Devices - Enrico Pozzobon & Nils hardwear.io 2023-12-23 | Electromagnetic fault injection (EMFI) is often used to exploit embedded devices, but it requires a precise selection of several parameters to be consistently successful. In our talk we will present our novel algorithm for automatically estimating position, intensity and timings parameters for EMFI attacks, as well as the exploits we could perform by applying it to different real world targets using different microcontroller architectures. We will show how these architectures react differently to fault injection and how it is possible to obtain code execution and JTAG uncensoring within an hour on a black-box target, doing minimal hardware reverse engineering.-------------------------------------------------------------------------------------------------------------------------------------------------------Website: hardwear.ioX : twitter.com/hardwear_ioLinkedIn: linkedin.com/company/hardwear.io-hardwaresecurityconferenceandtrainingFacebook: facebook.com/hardwear.io
Hardwear.io NL 2023 | Hacking A Smart Doorbell: An IoT Hacking Guide - Daniel Schwendner hardwear.io 2023-12-20 | Inexpensive wireless cameras and doorbells have gained widespread popularity due to their affordability. However, their cost-effectiveness often comes at the expense of robust security measures. This presentation dives into the IoT on the case study of a budget-friendly smart doorbell, revealing how potential attackers can exploit these weaknesses to not only infiltrate your WiFi network but also intercept the live video feed. Throughout this discourse, an exploration of various software and tools designed for the exploitation of IoT devices is undertaken, including techniques like Bluetooth Sniffing and extracting device firmware through physical access.#hw_ioNL2023 #IoT #hacking -------------------------------------------------------------------------------------------------------------------------------------------------------Website: hardwear.ioX : twitter.com/hardwear_ioLinkedIn: linkedin.com/company/hardwear.io-hardwaresecurityconferenceandtrainingFacebook: facebook.com/hardwear.io
Hardwear.io NL 2023 | Attacking Vehicle Fleet Management Systems - Yashin & Ramiro Pareja Veredas hardwear.io 2023-12-17 | The goal of the work we present here is to assess the current state of the connected vehicles security. Compared with other works already published where the researchers chose to attack a popular modern car, we focused in other automotive components and systems that security experts - and car designers - usually overlook and that could be abused to launch scalable and massive attacks. The analyzed devices like T-boxes, OBD2 dongles, 5G modems, MQTT servers and mobile apps. We aimed to get a broader picture of the automotive security and not a limited view based exclusively on the car security.Our research resulted in multiple vulnerability issues that can be exploited remotely to get full control of an entire fleet of vehicles, including cars, heavy-duty trucks and cranes. Although our work is limited to few devices - not enough to make an industry-wide conclusion - it indicates that these kind of security issues might be common and the security of connected automotive systems needs to be improved.#hw_ioNL2023 #cybersecurity #hardwear.io #Automotivesecurity -------------------------------------------------------------------------------------------------------------------------------------------------------Website: hardwear.ioX : twitter.com/hardwear_ioLinkedIn: linkedin.com/company/hardwear.io-hardwaresecurityconferenceandtrainingFacebook: facebook.com/hardwear.io
Hardwear.io NL 2023 | TEEzz: Fuzzing Trusted Applications On COTS Android Devices - Marcel Busch hardwear.io 2023-12-15 | TEEzz is the first TEE-aware fuzzing framework capable of effectively fuzzing TAs in situ on production smartphones, i.e., the TA runs in the encrypted and protected TEE and the fuzzer may only observe interactions with the TA but has no control over the TA’s code or data. Unlike traditional fuzzing techniques, which monitor the execution of a program being fuzzed and view its memory after a crash, TEEzz only requires a limited view of the target. TEEzz overcomes key limitations of TEE fuzzing (e.g., lack of visibility into the executed TAs, proprietary exchange formats, and value dependencies of interactions) by automatically attempting to infer the field types and message dependencies of the TA API through its interactions, designing state- and type-aware fuzzing mutators, and creating an in situ, on-device fuzzer.We found 13 previously unknown bugs in the latest versions of OPTEE TAs. We also ran TEEzz on popular phones and found 40 unique bugs for which one CVE was assigned so far.#hw_ioNL2023 #fuzzing #android #TEE -------------------------------------------------------------------------------------------------------------------------------------------------------Website: hardwear.ioX : twitter.com/hardwear_ioLinkedIn: linkedin.com/company/hardwear.io-hardwaresecurityconferenceandtrainingFacebook: facebook.com/hardwear.io
Hardwear.io NL2023 | Protect Your Screen From Eavesdropping: Don’t Forget Its Power Supply-Emmanuel hardwear.io 2023-12-12 | Electromagnetic eavesdropping, also named as TEMPEST threat, is nowadays widely known. The principle of this attack is to collect electromagnetic waves produced by electronic components or systems (e.g., screen, graphic card) and to process them in order to recover the processed data (e.g., the video stream). The advantage of this attack, from an attacker point of view, is to get access to sensitive data without any physical access nor physical or software implant. Furthermore, it is not possible to detect if an electromagnetic eavesdropping is currently running or not, because it is only based on receiving data, there is no interaction between the attacker and the target device.During the presentation, we propose to detail:* An explanation of the origin of electromagnetic leakages* An up-to-date synthesis on electromagnetic eavesdropping threat* How to protect entities from electromagnetic eavesdropping* A classical demo on aerial eavesdropping* A demo, never shown before, on conducted eavesdropping on power supply line Both demos will be based on Martin Marinov’s software TempestSDR. During the first demo, an interception of a computer screen based on the reception of radiated electronic waves due to the use of an unshielded video cable. Then, a second demo will be based on the interception of electromagnetic waves which leak along the power supply line and collected using a current clamp.#hw_ioNL2023 #cybersecurity #tempest #hardwear_io-------------------------------------------------------------------------------------------------------------------------------------------------------Website: hardwear.ioX : twitter.com/hardwear_ioLinkedIn: linkedin.com/company/hardwear.io-hardwaresecurityconferenceandtrainingFacebook: facebook.com/hardwear.io
Hardwear.io NL 2023 | Dissecting The Modern Android Data Encryption Scheme - Maxime Bellom & Damiano hardwear.io 2023-12-10 | Following our research on the Titan M, the security chip made by Google for their Android smartphones, we received a request from someone who had broken their device and was asking how they could recover the data despite the main SoC being dead. This question aroused our curiosity, and gave us the opportunity to play the forensic role and investigate how we could attack user data encryption on Android. We ended up asking ourselves how strong this mechanism is, against attackers who have access to a wide range of software vulnerabilities. To answer that question, we exploited two powerful known vulnerabilities, one in the Boot ROM of a Mediatek SoC and one in the Titan M, to attack the two mechanisms behind credential validation and key derivation: Gatekeeper and Weaver.In this talk, we present the logic behind the generation and storage of the keys for Android's user data encryption, called File-Based Encryption. Referencing the implementation in the AOSP (Android Open Source Project), we follow the steps performed by the system to generate the final encryption keys. Analyzing this process, we describe how elements from the file system, TEE and Secure Element (when present) are combined with the user's credentials, which still remain essential in the derivation. In two scenarios, one relying on TrustZone (and the Gatekeeper TA), and one relying on a security chip (implementing Weaver), we show strategies on how they can be attacked. In this context we use two known software vulnerabilities to build a PoC on a Samsung A22 and on a Pixel 3a, to highlight the difficulties that one may face with this task.#hardwear_io #securechip -------------------------------------------------------------------------------------------------------------------------------------------------------Website: hardwear.ioX : twitter.com/hardwear_ioLinkedIn: linkedin.com/company/hardwear.io-hardwaresecurityconferenceandtrainingFacebook: facebook.com/hardwear.io
Hardwear.io NL 2023 | Basebanheimer: Now I Am Become Death, The Destroyer Of Chains -Daniel Komaromy hardwear.io 2023-12-07 | Talks about baseband vulnerabilities are certainly in fashion these days, mostly inspired by the trailblazing work of the likes of RPW, Nico Golde, Amat Cama, Marco Grassi, and Xingyu ‘Kira’ Chen (not to mention yours truly - a little self promotion never killed nobody).With the novelty of baseband-only vulns wearing off, is it time to take it up a notch? This talk will go after the goal of full chain exploitation and show baseband rce and baseband-to-android pivot vulnerabilities that could have been exploited by malicious actors to go from "zero click" to "zero barriers against stealing user data".I will talk about our custom-built static and dynamic analysis tools written for the newest iterations of Samsung and Mediatek chipsets, such as the nanoMIPS-based Dimensity, about remotely exploitable vulnerabilities in baseband attack surfaces that were passed over previously and finally about the vulnerabilities we found in Android, the Linux Kernel, and beyond to chain with baseband rce.-------------------------------------------------------------------------------------------------------------------------------------------------------Website: hardwear.ioX : twitter.com/hardwear_ioLinkedIn: linkedin.com/company/hardwear.io-hardwaresecurityconferenceandtrainingFacebook: facebook.com/hardwear.io
Hardwear.io NL 2023 | Breaking Secure Boot On The Silicon Labs Gecko Platform - Benoît & Sami hardwear.io 2023-12-04 | Our investigation led us to examine Silicon Labs' open-source SDK, specifically the Gecko SDK, which boasts a state-of-the-art of secure over-the-air (OTA) update capabilities. While looking at the code that is handling the parsing of the firmware update, we discovered a vulnerability which can be used in combination with a weakness in the update mechanism to gain persistent code execution on the device, bypassing Secure Boot enforcement and firmware signature verification.Our presentation will begin by delving into the inner workings of OTA firmware upgrades. We will subsequently delve into the specifics of the vulnerability we pinpointed, particularly outlining our discovery process employing fuzzing techniques. To conclude, we will delve further into the realm of exploiting embedded systems. We'll conclude this talk by looking to go deeper inside the exploit world on embeded systems, which mechanism make harder an exploitation and how we can handle this.Lastly, we will showcase our successful bypass of the Secure Boot mechanism.#hardwear_io #fuzzing #hw_ioNL2023 #infosec -------------------------------------------------------------------------------------------------------------------------------------------------------Website: hardwear.ioX : twitter.com/hardwear_ioLinkedIn: linkedin.com/company/hardwear.io-hardwaresecurityconferenceandtrainingFacebook: facebook.com/hardwear.io
Hardwear.io NL 2023 | CSI:Rowhammer - Cryptographic Security And Integrity Against Rowhammer - Jonas hardwear.io 2023-12-02 | The discovery of Rowhammer was almost a decade ago, and the problem is still unsolved. Actually, it is getting worse, with newer DDR generations being ever more vulnerable. Deployed defenses are repeatedly broken with new hammer methods or exploiting previously unknown effects in the DRAM. In this talk, I present CSI:Rowhammer, a principled hardware-software co-design Rowhammer mitigation with cryptographic security and integrity guarantees that does not focus on any specific properties of Rowhammer. Due to this generic design, CSI:Rowhammer protects against all Rowhammer attacks, even new ones that were unknown at the time of publication of the paper.CSI:Rowhammer uses a new memory error detection mechanism based on a low-latency cryptographic MAC and an exception mechanism initiating a software-level correction routine. The exception handler uses a novel instruction-set extension for the error correction and resumes execution afterward. In contrast to regular ECC-DRAM, which remains exploitable if more than 2 bits are flipped, CSI:Rowhammer maintains the security level of the cryptographic MAC. Under normal conditions, we see latency overheads below 0.75% and no memory overhead compared to off-the-shelf ECC-DRAM. CSI:Rowhammer can detect any number of bitflips with overwhelming probability and correct at least eight bitflips in practical time constraints.#rowhammer #hardware #security #talk -------------------------------------------------------------------------------------------------------------------------------------------------------Website: hardwear.ioX : twitter.com/hardwear_ioLinkedIn: linkedin.com/company/hardwear.io-hardwaresecurityconferenceandtrainingFacebook: facebook.com/hardwear.io
HW.io NL 03 | How Deep Is The Rabbit Hole? A Deep Dive Into Exploitation Of A Smart Speaker - Sergei hardwear.io 2023-11-29 | In recent years, virtually every tech company has produced a variety of smart home and personal assistance devices. Russian tech giant Yandex is not an exception and their smart speaker Alisa is present in more than 3 million homes across dozens of countries. Unfortunately due to the closed source nature of most of the smart home devices, users generally have very little insight about the software running on these devices designed to hear you from any corner of your house and their security. In this presentation the path is shown from physical attacks on the device in order to get root by manipulating unauthenticated contents of the NAND flash all the way to getting persistence and recovering private keys for the Over-the-air updates. Additionally a common flaw in the protection of environment variables is shown and used to gain arbitrary code execution in early secure boot stages, decrypt later boot stages, and explore factory debug features.-------------------------------------------------------------------------------------------------------------------------------------------------------Website: hardwear.ioX : twitter.com/hardwear_ioLinkedIn: linkedin.com/company/hardwear.io-hardwaresecurityconferenceandtrainingFacebook: facebook.com/hardwear.io
Hardwear.io NL 2023 | Triple Exploit Chain With Laser Fault Injection On A Secure Element - Olivier hardwear.io 2023-11-27 | We identified a new vulnerability allowing an attacker to extract internal EEPROM masking keys using a very long laser pulse while the circuit is running. The knowledge of those keys leverage two new attacks that we also identified during this work, which are authentication and session key derivation hijacking. To achieve this, EEPROM data readout by the processor is overridden using laser illumination. By chaining all three attacks, we were able to access a protected secret key. This was applied to a real device, a hardware wallet for which we managed to extract the seed, but this chip is also widely used in many IoT applications. This attack may be applicable to the previous revisions as well.This work was conducted in a black box approach, with background experience of previous attacks on less secure devices from this family. Due to the very high number of faults required to retrieve the secret key, it is to this day the most complex multiple laser fault injection attack ever presented.Finally, to prove that we were able to perform this attack, the hardware wallet manufacturer using this secure element sent us three devices to break as a challenge. Sample preparation was risky, and we broke two wallets when trying to desolder the circuits or decapsulate the packages to access the silicon. We will, in addition to the laser attack, present hints and tricks we developed to overcome these practical difficulties, resulting in the successful wallet seed recovery of the last remaining challenge wallet !#hw_ioNL2023 #faultinjection #IoT -------------------------------------------------------------------------------------------------------------------------------------------------------Website: hardwear.ioX : twitter.com/hardwear_ioLinkedIn: linkedin.com/company/hardwear.io-hardwaresecurityconferenceandtrainingFacebook: facebook.com/hardwear.io
Hardwear.io NL 2023 | Blue2thprinting: Answering The Question Of WTF Am I Even Looking At?! - Xeno hardwear.io 2023-11-23 | If one wants to know (for attack or defense) whether a Bluetooth (BT) device is vulnerable to unauthenticated remote over-the-air exploits, one needs to be able to query what firmware or OS the target is running. Unfortunately there is no universally-available method to get this information across all BT devices. There is also no past work that attempts to rigorously obtain this information. Therefore we have created the "Blue2thprint" project to begin to collect "toothprints" (2thprints) of BT devices, and bring the exciting world of forensic odontology to you!This research will present a new state-of-the-art when it comes to exposing the known, the unknown, and the under-known of BT device identification. And it will show what work remains, before we can approach 100% identification for any random device that shows up in a BT scan.#hw_ioNL2023 #bluetooth #security ------------------------------------------------------------------------------------------------------------------------------Website: hardwear.ioX: twitter.com/hardwear_ioLinkedIn: linkedin.com/company/hardwear.io-hardwaresecurityconferenceandtrainingFacebook: facebook.com/hardwear.io
Hardwear.io USA 2023 : Panel: Hardware Security For Cloud Storage Providers hardwear.io 2023-11-21 | -------------------------------------------------------------------------------------------------------------------------------------------------------Website: hardwear.ioX : twitter.com/hardwear_ioLinkedIn: linkedin.com/company/hardwear.io-hardwaresecurityconferenceandtrainingFacebook: facebook.com/hardwear.io
Hardwear.io NL 2023 | Hacking With AI: Our Journey Through The Perils & Promises - Dhinesh Manoharan hardwear.io 2023-11-20 | ------------------------------------------------------------------------------------------------------------------------------Website: hardwear.ioX : twitter.com/hardwear_ioLinkedIn: linkedin.com/company/hardwear.io-hardwaresecurityconferenceandtrainingFacebook: facebook.com/hardwear.io
Hardwear.io USA 2023 | Building A Modern Bluetooth Sniffer - Mike Ryan hardwear.io 2023-11-14 | ICE9 Bluetooth Sniffer is a brand new Bluetooth sniffer for SDRs. Unlike other open source sniffers, it can sniff BLE connections that have already been established. During this talk we plan to unveil new features that allow users to have complete visibility over all Bluetooth connections occurring around them. This talk explains the practical architecture of the sniffer (light-to-medium on SDR theory) and how it integrates with Wireshark.The talk begins with an introduction to RF and SDRs, and how they're similar to audio and microphones. We then move on to discussing Bluetooth, how it appears at the RF level, and how to translate the raw IQ signals captured from an SDR into a stream of bits we can parse into packets. After explaining the intuitive way of doing this, we cover how to do it efficiently at scale using a polyphase channelizer. Finally, we wrap with our latest feature: the ability to observe all of Bluetooth with a BladeRF 2.0. If you have a HackRF, BladeRF, or USRP you will want to see this talk.-------------------------------------------------------------------------------------------------------------------------------------------------------Website: hardwear.ioX : twitter.com/hardwear_ioLinkedIn: linkedin.com/company/hardwear.io-hardwaresecurityconferenceandtrainingFacebook: facebook.com/hardwear.io
Securing The Unseen: Vulnerability Research In Confidential Computing by Josh Eads and Cfir Cohen hardwear.io 2023-08-13 | Kindly note: Watch this talk without your headset for better audio experience as the audio had to be repaired due to some technical issues! Abstract:--------------There is an increasing demand for moving sensitive workloads into the cloud; however, the confidentiality and integrity of these workloads in the presence of a malicious or compromised hosting provider can’t be strongly guaranteed with existing commodity hardware. To address this issue, CPU vendors have started to introduce hardware and firmware additions that provide VM-scale hardware-attested and isolated trusted execution environments – generally termed Confidential Compute.Before introducing Confidential Compute solutions to Google Cloud, we conducted in-depth security reviews driven by a unique collaboration between the Google Cloud Security & Project Zero teams and each vendors’ architecture & security teams. We recently published the results of our research into AMD SEV-SNP and Intel TDX: these provide the community with a better understanding of the security guarantees (and limitations) for each technology and provide a jumping off point for future security research.In this presentation, we will discuss how Google’s security teams approached these large-scale security reviews of new hardware features, some of the interesting vulnerabilities that were discovered, and areas where additional research is needed. We’ll discuss bugs in crypto, IOMMUs, ACMs, and plain old C++ – there’s a little bit of everything here!#Intel #AMD #hardwaresecurity #hardwear_io #hw_ioUSA2023-------------------------------------------------------------------------------------------------------------------Website: hardwear.ioTwitter: twitter.com/hardwear_ioLinkedIn: linkedin.com/company/hardwear.io-hardwaresecurityconferenceandtrainingFacebook: facebook.com/hardwear.io
Red Team Vs. Blue Team by Endres Puschner & Steffen Becker | hardwear.io USA 2023 hardwear.io 2023-07-31 | Abstract:--------------Verifying the absence of maliciously inserted Trojans in Integrated Circuits (ICs) is a crucial task - especially for security-enabled products. Assuming that the original IC layout is benign and free of backdoors, the primary security threats are usually identified as the outsourced manufacturing and transportation. To ensure the absence of Trojans in commissioned chips, one straightforward solution is to compare the received semiconductor devices to the design files that were initially submitted to the foundry. Clearly, conducting such a comparison requires advanced laboratory equipment and qualified experts. Nevertheless, the fundamental techniques to detect Trojans which require evident changes to the silicon layout are nowadays well-understood. Despite this, there is a glaring lack of public case studies describing the process in its entirety while making the underlying data sets publicly available. In this talk, we present a public and open hardware Trojan detection case study based on four different digital ICs using a Red Team vs. Blue Team approach. Our results spark optimism for the Trojan seekers and answer common questions about the efficiency of such techniques for relevant IC sizes. Further, they allow to draw conclusions about the impact of technology scaling on the detection performance.#hardwaretrojan #trojans #integratedcircuit #hardwaresecurity #hardwear_io #hw_ioUSA2023-------------------------------------------------------------------------------------------------------------------------------------------------------Website: hardwear.ioTwitter: twitter.com/hardwear_ioLinkedIn: linkedin.com/company/hardwear.io-hardwaresecurityconferenceandtrainingFacebook: facebook.com/hardwear.io
Exploring chip decaping techniques for silicon die inspection and reverse engineering hardwear.io 2023-07-30 | Abstract:---------------Integrated circuits have kept their secrets for far too long. Mounted in ceramic carrier at best, or encapsulated in epoxy for worst, recovering a clean silicon die for study can present challenges of varying difficulties. This step is however instrumental in order to study the circuitry for reverse engineering or ROM decoding, and identify manufacturing process and security measures implemented at the silicon level. Establishing a large catalog of silicon die photos is also instrumental in identifying an unknown chip without markings or enigmatic embedded microprocessor architecture by comparison with a reference collection. Here is a glimpse from the workshop which aimed at exploring the various techniques that can be used to remove chip packaging, such as hot air, rosin/DMSO, nitric/sulphuric acid and fiber laser. Participants of the workshop were able to try their hand at using the hot air technique which provide excellent results with inexpensive tools and no chemical hazard.#chipdecapping #silicon #hardwaresecurity #hardwear_io #hw_ioUSA2023-----------------------------------------------------------------------------------------------------------------------Website: hardwear.ioTwitter: twitter.com/hardwear_ioLinkedIn: linkedin.com/company/hardwear.io-hardwaresecurityconferenceandtrainingFacebook: facebook.com/hardwear.io
Affordable EMFI Attacks Against Modern IoT Chips by Davide Toldo hardwear.io 2023-07-28 | Abstract:----------------As modern devices become more secure, hardware based fault injection methods including Electromagnetic Fault Injection (EMFI) are gaining traction. They become an important tool to bypass modern security mechanisms and perform further security research like firmware reverse engineering. However, hardware hacking setups are often expensive and inaccessible due to the limited amount of open-source hardware, software and available information. There have been efforts towards improving this, but so far, no publication presented a complete solution. In this talk, we present an accessible EMFI setup based on open-source hardware and software and prove its effectiveness against modern IoT targets. We describe the whole setup, the design considerations that went into it, release circuit diagrams and code, as well as presenting the first successful instruction skips on the latest ultra-low-power Espressif ESP32-C3 IoT System-On-Chip (SoC), which could be applied against its secure boot implementation, firmware encryption or hardware flag checks.Connect with Davide on below links:----------------------------------------------------------Mastodon: @unixb0y@chaos.social Twitter: @unixb0yGitHub: github.com/unixb0y/EMFI-Resources #EMFI #faultinjection #hardwaresecurity #hardwear_io #hw_ioUSA2023-------------------------------------------------------------------------------------------------------------------Website: hardwear.ioTwitter: twitter.com/hardwear_ioLinkedIn: linkedin.com/company/hardwear.io-hardwaresecurityconferenceandtrainingFacebook: facebook.com/hardwear.io
How To Hack Shannon Baseband (from A Phone) by Natalie Silvanovich | hardwear hardwear.io 2023-07-26 | Abstract:-----------------Samsung baseband modems provide mobile network functionality to a variety of devices. Project Zero reviewed the Samsung 'Shannon' Exynos 5300 modem used by the Google Pixel 7, discovering and reporting several vulnerabilities. While many of these could only be exploited using a local base-station or compromised mobile network, some could be accessed remotely cross-carrier, requiring only a rooted mobile phone to perform the attack. This presentation will explore fully-remote baseband vulnerabilities.It will start with an overview of the attack surface of the Exynos 5300 modem, and describe the bugs we found, then explain how to test such vulnerabilities on a remote target using a rooted Samsung phone. This talk will then discuss how to exploit such bugs, as well as ways an attacker could make use of a modem compromise#shannon #baseband #hardwaresecurity #hardwear_io #hw_ioUSA2023---------------------------------------------------------------------------------------------------------------------Website: hardwear.ioTwitter: twitter.com/hardwear_ioLinkedIn: linkedin.com/company/hardwear.io-hardwaresecurityconferenceandtrainingFacebook: facebook.com/hardwear.io0:00 Introduction0:15 Baseband Hackathon7:52 P2P Attack Surface9:28 Dumping baseband9:51 Analysis10:59 Crashdumps12:42 Code review13:40 Filtering18:59 QEMU emulator20:47 CVE-2022-2649722:30 CVE-2022-29090 (SIP)23:20 Testing P2P bugs24:41 Exploitation25:37 95300 security features27:15 Shannon heap28:55 Heap 630:23 First Attempt33:37 Overwrite35:28 Code exec from heap36:17 Shellcode37:45 Now what? (for real)41:48 Questions
BreakMi: Reversing, Exploiting & Fixing Fitness Tracking Ecosystems by M. Casagrande & D. Antonioli hardwear.io 2023-07-24 | Abstract:---------------Xiaomi is the leading company in the fitness tracking industry. Successful attacks on its fitness tracking ecosystem would result in severe consequences, including the loss of sensitive health and personal data. Despite these relevant risks, we know very little about the security mechanisms adopted by Xiaomi. In this work, we uncover them and show that they are insecure. In particular, Xiaomi protects its fitness tracking ecosystem with custom application-layer protocols spoken over insecure Bluetooth Low-Energy (BLE) connections (ignoring standard BLE security mechanisms already supported by their devices) and TLS connections. We identify severe vulnerabilities affecting such proprietary protocols, including unilateral and replayable authentication.Those issues are critical as they affect all Xiaomi trackers released since 2016 and up-to-date Xiaomi companion apps for Android and iOS. We show in practice how to exploit the identified vulnerabilities by presenting six impactful attacks. Four attacks enable to wirelessly impersonate any Xiaomi fitness tracker and companion app, man-in-the-middle (MitM) them, and eavesdrop on their communication. The other two attacks leverage a malicious Android application to remotely eavesdrop on data from a tracker and impersonate a Xiaomi fitness app.Overall, the attacks have a high impact as they can be used to exfiltrate and inject sensitive data from any Xiaomi tracker and compatible app. We propose five practical and low-overhead countermeasures to mitigate the presented vulnerabilities. Moreover, we present BreakMi, a modular toolkit that we developed to automate our reverse-engineering process and attacks. breakmi understands Xiaomi application-layer proprietary protocols, reimplements Xiaomi security mechanisms, and automatically performs our attacks. We demonstrate that our toolkit can be generalized by extending it to be compatible with the Fitbit ecosystem. We will open-source BreakMi.#miwatch #hardwaresecurity #mitm #hardwear_io #hw_ioUSA2023------------------------------------------------------------------------------------------------------Website: hardwear.ioTwitter: twitter.com/hardwear_ioLinkedIn: linkedin.com/company/hardwear.io-hardwaresecurityconferenceandtrainingFacebook: facebook.com/hardwear.io
Inside Apples Lightning: JTAGging The IPhone For Fuzzing And Profit by Thomas Roth hardwear.io 2023-07-21 | Abstract:----------------If you've been around the iPhone hacking scene you probably heard about the mysterious cables named after different monkeys: Kanzi Cable, Kong Cable, Bonobo Cable - all these cables allow you to get JTAG debugging capabilities on the iPhone, however they are also very difficult to get on the regular market. Last year we released the first open-source iPhone JTAG cable: The Tamarin Cable, a firmware for the Raspberry Pi Pico that allows building a $10 iPhone JTAG adapter.Since then, we've worked on utilizing Tamarin and Lightning to automate certain tasks for low-level fuzzing of the iPhone.In this talk we will:-----------------------------Dive into the hardware (Tristar) and protocol (SDQ/IDBUS) details of Lighting Show how we implemented our own SDQ/IDBUS adapter Demonstrate our Lightning-Fuzzer: A fuzzer to find new Lightning commands Dive into implementing SWD for the iPhone and how to use with checkm8ble devicesAfter this, we will look at using Lightning to implement a low-level fuzzer for the iPhone:Thanks to some undocumented Lightning commands we can utilize Lightning to quickly (and automatically) reset the iPhone - and get it into DFU mode. This allowed us to build low-level fuzzers for parts of the iPhone that so far very only very difficult to test. Our fuzzers will be made public with this presentation#iphonesecurity #jtag #fuzzing #hardwaresecurity #hardwear_io #hw_ioUSA2023-----------------------------------------------------------------------------------------------------------------------------------Website: hardwear.ioTwitter: twitter.com/hardwear_ioLinkedIn: linkedin.com/company/hardwear.io-hardwaresecurityconferenceandtrainingFacebook: facebook.com/hardwear.io
Cryo-Mechanical RAM Content Extraction: A DIY Cold Boot Robot For A Thousand Bucks by Ang Cui hardwear.io 2023-07-19 | Abstract:---------------Embedded hardware is getting harder and harder to reverse. Leading manufacturers are getting better at disabling JTAG and UART. BGA chips, integrated packages, and encrypted firmware (both in updates and at rest) are making it harder to peek under the hood and see how these systems are built. Reverse engineering cannot begin without decrypted firmware.This talk presents a Cryo-Mechanical RAM Content Extraction Robot we built to grab decrypted RAM contents off of DDR1|2|3 memory modules. It will talk through the challenges faced building the robot, as well as how we designed and built a robot that keeps RAM cool at -50 Celcius without breaking PCBs, shorting the board, or risking bodily harm. Finally, it will discuss the practical nuts and bolts of building such a robot within a thousand-dollar hardware budget.#coldboot #hardwaresecurity #embeddedsecurity #RAM #hardwear_io #hw_ioUSA2023-------------------------------------------------------------------------------------------------------------------Website: hardwear.ioTwitter: twitter.com/hardwear_ioLinkedIn: linkedin.com/company/hardwear.io-hardwaresecurityconferenceandtrainingFacebook: facebook.com/hardwear.io
Benchmarking The Static Power Vulnerability Of Four CMOS Generations by Thorben Moos | hardwear.io hardwear.io 2023-07-14 | Abstract:---------------The down scaling of semiconductor technology throughout the past decades has led to the emergence of non-negligible leakage currents in Integrated Circuits (ICs). These currents cause an undesired power consumption in computing hardware even in the absence of computation, for example during idle or standby times. Worse yet, leakage currents act as a side channel and reveal sensitive information to adversaries who have physical access to security devices and wish to extract internally processed secrets. Previous works have shown that it is indeed possible to exploit this side channel for key recovery attacks against cryptographic hardware manufactured in nanometer CMOS technologies. In this work we report the results of a long-term study on the subject spanning over multiple years and involving a sizable amount of resources and engineering effort. In particular, we designed, taped-out and analyzed custom ICs in four different nanometer CMOS technologies, namely 90nm, 65nm, 40nm and 28nm, and benchmarked the vulnerability of identical AES co-processors on the four chips to static power attacks. Our results show clearly that the susceptibility of the AES implementations depends directly on the feature size of the underlying IC technology, with attacks on the 28nm node being most powerful. These results show an evolution of the static power side channel which is undesirable at best, highly dangerous at worst for designers of security critical hardware in modern technology generations. Hence, we argue that leakage currents cannot be neglected anymore when certifying the security of embedded devices against physical adversaries.#sidechannelattack #hardwaresecurity #cmos #hw_ioUSA2023------------------------------------------------------------------------------------------------------Website: hardwear.ioTwitter: twitter.com/hardwear_ioLinkedIn: linkedin.com/company/hardwear.io-hardwaresecurityconferenceandtrainingFacebook: facebook.com/hardwear.io
The Misuse Of Secure Components In Hardware Wallets by Michael Mouchous & Karim Abdellatif hardwear.io 2023-07-12 | Abstract:---------------The Hardware Crypto Wallet industry witnessed a remarkable growth during the last years, after the market expansion of cryptocurrencies in 2017. Users’ demand for self-custody hardware wallets to store and protect their private keys needed to access blockchain-based digital assets. The user’s seed is the top-most asset from which all these keys are derived. Protecting it efficiently is a big challenge to undertake. In order to achieve this objective, many vendors have chosen to embed other secure components into the architecture to resist hardware attacks. However, the choice of weak components, their misuse, and their bad configuration may lead to critical vulnerabilities.This presentation deals with the hardware security analysis of the OneKey wallet, which uses an STM32F405 as MicroController Unit (MCU) coupled with an ATECC608 as secure memory. By evaluating the security level of this architecture, we discovered a combination of weaknesses in the usage of the MCU and the secure element configuration.First, the pairing key used to protect the user's private key (user’s seed) is stored in the OTP of the MCU which has been attacked by a homemade electromagnetic fault injection (EMFI) setup. Second, the pairing key is the only element needed to read out the user’s seed, due to a misconfiguration of the PIN authentication process. Third, this pairing key is also stored in the secure memory, which is known to be vulnerable to laser fault injection (LFI) attacks. Finally, we discovered that the vendor was mistaken in configuring the random number generator (RNG) of the secure element. As a result, all the OneKey wallets in the market have the same paring key to protect the user’s seed.The discovered vulnerabilities are unfixable and all the users of OneKey are exposed to an actual threat.#hardwaresecurity #hardwarewallet #hardwear_io #hw_ioUSA2023---------------------------------------------------------------------------------------------------------------------Website: hardwear.ioTwitter: twitter.com/hardwear_ioLinkedIn: linkedin.com/company/hardwear.io-hardwaresecurityconferenceandtrainingFacebook: facebook.com/hardwear.io
Back To The Future With Platform Security by Enrique Nissim, Joseph Tartaro and Krzysztof Okupski hardwear.io 2023-07-11 | Abstract:---------------In the last decade the industry has seen a large amount of research released around Intel platform security. Since the release of CHIPSEC, the industry has had a tool to quickly analyze their Intel platform against a secure baseline for misconfigurations. As a result of this, it has become more difficult to find misconfigured Intel platforms from major OEMs.As we dove into the platform security realm ourselves, we noticed a complete lack of focus and analysis of AMD platforms. This was a surprise to us due to the popularity and significantly growing market share of AMD.In this presentation we start with an overview of how secure boot works under the hood and showcase various vulnerabilities and implementation mistakes our team has found. We will then dive into interesting architectural differences across Intel and AMD that make up for the security of the platform. Additionally, we’re going to present details and proof of concepts for several vulnerabilities found in the targeted platforms. These include unlocked SMRAM regions, SPI flash misconfigurations, as well as memory corruption and race conditions issues in SMM modules.All these details have been flushed into a tool that we developed which can be used by end users to quickly verify that their systems are free from common misconfigurations.#secureboot #hardwaresecurity #hardwear_io ----------------------------------------------------------------------------------------------------------------------Website: hardwear.ioTwitter: twitter.com/hardwear_ioLinkedIn: linkedin.com/company/hardwear.io-hardwaresecurityconferenceandtrainingFacebook: facebook.com/hardwear.io0:00 Introduction0:36 Outline1:58 Lack of Documentation3:21 SMM in a Nutshell4:48 SMRAM Protection6:07 Unlocked TSEG on Acer Swift 36:41 SMM Unlock Key?7:16 SMM Key Backdoor7:44 SMM Callout Protections9:06 SPI Flash Basics9:25 ROM Protected Range10:57 SPI Restricted Commands11:44 SPI Controller Programming12:35 SPI Read Demo14:11 The Case of Asus Strix G513QR.33015:46 The Story of a Dangerous SMI Handler16:57 The Interesting Code17:55 The Disabled SMI Interface19:07 Exploiting the Bug20:57 SMRAM Analysis22:37 ROM Armor in a Nutshell23:11 The Whitelisted SPI Regions24:13 AmdPspRomArmor3Smm Flow25:25 Host PSP Communication27:35 Late Deregistration31:08 Finding the PSB Configuration32:28 PSB Fuse Register33:11 Example of a good configuration36:47 What is an SMM Supervisor?38:36 SmmSupervisorBinRelease41:40 Example of a Demoted SMI Handler42:14 Legacy Supervisor Syscalls43:15 Protection via Paging43:38 Attack Surface44:03 SmmSupvBin Format45:07 Project Mu is a fork()45:59 SMM Supervisor Policy Analysis49:10 Conclusions (2/3)
Un-fare Advantage” - Hacking The MBTA CharlieCard From 2008 To Present by Bobby Rauch | hardwear.io hardwear.io 2023-07-07 | Abstract:---------------The CharlieCard is a contactless smart card used for transportation fare payment in the Boston area. It is the primary payment method for the Massachusetts Bay Transportation Authority (aka MBTA or the T) and several regional public transport systems in the U.S. state of Massachusetts. Nearly 15 years after a group of MIT students first publicly disclosed security vulnerabilities in the CharlieCard, I am publicly disclosing at a major conference for the first time that it is possible using only an Android phone to: Repeatedly refill your own CharlieCard an unlimited number of times, without paying Have replacement CharlieCards delivered to a listed address, without paying Provision yourself new CharlieCards with funds, without paying Steal anyone’s CharlieCard with a single physical tap of the card against an Android phone in a matter of seconds.This talk will tell the complete, detailed story publicly of how I went about proving this set of vulnerabilities with the new Flipper Zero and an Android phone, how I leveraged this set of vulnerabilities into a proof of concept and actually took a free ride on the T (legal risk ensues), and how I worked with Harvard Law School’s Cyber Law Clinic to represent me in disclosing this to the MBTA and the subsequent public disclosure in the Boston Globe. Having now worked with the MBTA on a set of detection measures and limited public legal disclosure in the Boston Globe and on my personal blog, I now feel comfortable publicly diving into some of the more fun “hacker” details that this audience would care about - talking about my behind the scenes journey of securing legal safe harbor from the MBTA, the concerns that followed, and how I navigated this whirlwind of a process.This talk will be more than just about a set of vulnerabilities and will discuss complex system design, how vulnerability likelihood and severity can change with rapid changes in technology, the importance of OSINT (Open-Source Intelligence) monitoring and threat intelligence, and the process of responsible vulnerability disclosure to a government agency without a Vulnerability Disclosure Program.#hacking #mbtacharliecard #flipperzero #hardwaresecurity #hardwear_io ----------------------------------------------------------------------------------------------------------------------Website: hardwear.ioTwitter: twitter.com/hardwear_ioLinkedIn: linkedin.com/company/hardwear.io-hardwaresecurityconferenceandtrainingFacebook: facebook.com/hardwear.io
Keynote |The Microarchitectures That I Saw And The Ones That I Hope To One Day See by Rodrigo Branco hardwear.io 2023-07-05 | About the Speaker:------------------------------Rodrigo Rubira Branco (BSDaemon) is a Vulnerability Researcher and Exploit writer. Rodrigo led CPU and microarchitecture security research at Google and also worked as a Senior Principal Engineer at Amazon Web Services (AWS) and before that, was the Chief Security Researcher of Intel Corporation founding/leading the STORM (STrategic Offensive Research & Mitigations) team. At Intel, Rodrigo also led the Core Client and BIOS Teams. He is the Founder of the Dissect || PE Malware Analysis Project. Rodrigo also held positions as Director of Vulnerability & Malware Research at Qualys and as Chief Security Research at Check Point where he founded the Vulnerability Discovery Team (VDT) and released dozens of vulnerabilities in many important software. In 2011 he was honored as one of the top contributors of Adobe. Previous to that, he worked as Senior Vulnerability Researcher in COSEINC, as Principal Security Researcher at Scanit and as Staff Software Engineer in the IBM Advanced Linux Response Team (ALRT) also working in the IBM Toolchain (Debugging) Team for the PowerPC Architecture. He is a member of the RISE Security Group and is one of the organizers of Hackers to Hackers Conference (H2HC), the oldest security research conference in Latin America. He is an active contributor to open-source projects (like ebizzy, linux kernel, others). Accepted speaker in lots of security and open-source related events as Black Hat, Hack in The Box, XCon, OLS, Defcon, Hackito, Zero Nights, PhDays, Troopers, Andsec, Ekoparty and many others. Rodrigo is (and was) also part of the technical committee for many security conferences, such as Offensive Con, Langsec, Black Hat, Enigma and others.#hardwaresecurity #Keynote #microarchitecture #hardwear_io #hw_ioNL2023------------------------------------------------------------------------------------------------------------------------------Website: hardwear.ioTwitter: twitter.com/hardwear_ioLinkedIn: linkedin.com/company/hardwear.io-hardwaresecurityconferenceandtrainingFacebook: facebook.com/hardwear.io
An Overview Of The Security Of Some Hardware FIDO(2) Tokens by Victor Lomne hardwear.io 2022-12-07 | Abstract:---------------We will first present the basics of the FIDO(2) protocol and the concept of hardware FIDO tokens, summarize their attack surface as well as enumerate related certification schemes. Then we will have a look on several (families of) hardware FIDO tokens, with for each one partial teardown, analysis of the cryptographic chip used, its known certification details (and possibly) its known vulnerabilities. Finally we will explore the future of HW FIDO tokens.#fido2 #MFA #hardwaresecurity #hw_ioNL2022 #hardwear_io ------------------------------------------------------------------------------------------------------------Website: hardwear.ioTwitter: twitter.com/hardwear_ioLinkedIn: linkedin.com/company/hardwear.io-hardwaresecurityconferenceandtrainingFacebook: facebook.com/hardwear.io
Security Pitfall Of Hand-geometry recognition-based Access Control Systems by Luca Bongiorni hardwear.io 2022-12-05 | Abstract:-----------------Biometrics applied to PACS (Physical Access Control Systems) has been an hot-topic for a few years now. The spread of fingerprint or face recognition based access control and time attendance systems among corporate, industrial and military environments has surged. And with it, also the number of potential attack vectors has increased. In this talk, after a brief overview of the state of art available PACS utilizing biometrics to authenticate and authorize users, we will investigate one technology among others (usually perceived less-invasive) that has been widely used in some specific fields (e.g. industrial plants, airports, food industry, etc.): the handpunch access control and time attendance systems. The handpunch PACS are based on the hand-geometry recognition. In this presentation we will have a look how this tech works and, in particular, we will focus our attention on reviewing some of existing handpunch devices: from a physical security POV until reversing the communication protocol. Moreover, during the presentation will be demonstrated how to remotely push a new super-admin user into it (i.e. persistent backdoor), how to dump existing users credentials and will be also released an opensource tool-suite: HandScan & HandPwner.Eventually, thanks the cooperation with Shodan’s creator, it has been confirmed that more than 1800 of these vulnerable devices were found exposed on the Internet. Finally, we will conclude the talk with practical and actionable countermeasures to prevent these attacks and how to harden these devices.#physicalaccesscontrol #hardwaresecurity #hardwear_io --------------------------------------------------------------------------------------------Website: hardwear.ioTwitter: twitter.com/hardwear_ioLinkedIn: linkedin.com/company/hardwear.io-hardwaresecurityconferenceandtrainingFacebook: facebook.com/hardwear.io
