Pwning ARM Debug Components for Sec-Related Stuff (HardBlare project)

Size: px

Start display at page:

Download "Pwning ARM Debug Components for Sec-Related Stuff (HardBlare project)"

Ernest Jacobs
5 years ago
Views:

1 Pwning ARM Debug Components for Sec-Related Stuff (HardBlare project) HITB COMMSEC Muhammad Abdul WAHAB, Pascal COTRET April 14, 2017 CentraleSupélec

Who am I? 2 nd year PhD Student at CentraleSuplec E-mail: muhammadabdul.wahab@centralesupelec.

2 Who am I? 2 nd year PhD Student at CentraleSuplec muhammadabdul.wahab@centralesupelec.fr HardBlare project 1 funded by CominLabs and Brittany region 1 0

3 Outline

4 Outline Motivation ARM CoreSight components Software Security Conclusion 1

5 Motivation

6 Software Security SoC = Hardcore CPU + FPGA (+ Peripherals) Figure 1: Zynq SoC Source: Xilinx 2

7 Software Security SoC = Hardcore CPU + FPGA (+ Peripherals) Figure 1: Zynq SoC Source: Xilinx 2

8 Dynamic Information Flow Tracking (DIFT) Information flow Information flow is the transfer of information from an information container c 1 to c 2 in a given process P. c 1 P c 2 3

9 Dynamic Information Flow Tracking (DIFT) Information flow Information flow is the transfer of information from an information container c 1 to c 2 in a given process P. c 1 P c 2 Example int a, b, w, x; a = 11; b = 5; w = a * 2; x = b + 1; 3

10 DIFT: Dynamic Information Flow Tracking Principle We attach labels called tags to such containers and specify an information flow policy, i.e. relations between tags At runtime, we propagate tags to reflect information flows that occur and detect any policy violation 4

11 DIFT: Dynamic Information Flow Tracking Principle We attach labels called tags to such containers and specify an information flow policy, i.e. relations between tags At runtime, we propagate tags to reflect information flows that occur and detect any policy violation 4

12 DIFT Example: Memory corruption Attacker overwrites return address and takes control int idx = tainted_input; //stdin (> BUFFER SIZE) buffer[idx] = x; // buffer overflow set r1 &tainted input load r2 M[r1] add r4 r2 + r3 store M[r4] r5 T Data r1:&input r2:idx=input T Data Return Address r3:&buffer r4:&buffer+idx int buffer[size] r5:x 5

13 DIFT Example: Memory corruption Attacker overwrites return address and takes control int idx = tainted_input; //stdin (> BUFFER SIZE) buffer[idx] = x; // buffer overflow set r1 &tainted input load r2 M[r1] add r4 r2 + r3 store M[r4] r5 T Data r1:&input r2:idx=input T Data Return Address r3:&buffer r4:&buffer+idx int buffer[size] r5:x 5

14 DIFT Example: Memory corruption Attacker overwrites return address and takes control int idx = tainted_input; //stdin (> BUFFER SIZE) buffer[idx] = x; // buffer overflow set r1 &tainted input load r2 M[r1] add r4 r2 + r3 store M[r4] r5 T Data r1:&input r2:idx=input T Data Return Address r3:&buffer r4:&buffer+idx int buffer[size] r5:x 5

15 DIFT Example: Memory corruption Attacker overwrites return address and takes control int idx = tainted_input; //stdin (> BUFFER SIZE) buffer[idx] = x; // buffer overflow set r1 &tainted input load r2 M[r1] add r4 r2 + r3 store M[r4] r5 T Data r1:&input r2:idx=input T Data Return Address r3:&buffer r4:&buffer+idx int buffer[size] r5:x 5

16 DIFT Example: Memory corruption Attacker overwrites return address and takes control int idx = tainted_input; //stdin (> BUFFER SIZE) buffer[idx] = x; // buffer overflow set r1 &tainted input load r2 M[r1] add r4 r2 + r3 store M[r4] r5 T Data r1:&input r2:idx=input T Data Return Address r3:&buffer r4:&buffer+idx int buffer[size] r5:x 5

17 DIFT: Dynamic Information Flow Tracking DIFT principle 1. DIFT taints data from untrusted sources Extra tag bit per word marks if untrusted 2. Propagate taint during program execution Operations with tainted data produce tainted results 3. Check for unsafe uses of tainted data 6

18 DIFT: Dynamic Information Flow Tracking DIFT principle 1. DIFT taints data from untrusted sources Extra tag bit per word marks if untrusted 2. Propagate taint during program execution Operations with tainted data produce tainted results 3. Check for unsafe uses of tainted data Motivation Protection from low-level and high-level threats Program understanding Software testing and debugging 6

19 DIFT - overview Constraints Zedboard : Zynq SoC ARM Cortex-A9 dual core CPU Programmable Logic Linux OS Main Goal: DIFT implementation How to recover information about each CPU instruction? 7

20 ARM CoreSight components

21 Coresight components A set of IP blocks providing HW-assisted system tracing Figure 2: ARM Coresight components in Zynq SoC 8

22 Coresight components A set of IP blocks providing HW-assisted system tracing Figure 2: ARM Coresight components in Zynq SoC Source: ARM CoreSight components TRM 8

23 Coresight components Features Trace Filter (all code or regions of code) ELF Header Program header table Section 1 Section Section n Section header table 9

24 Coresight components Features Trace Filter (all code or regions of code) Branch Broadcast (i) MOV PC, LR (ii) ADD R1, R2, R3 (iii) B 0x8084 9

25 Coresight components Features Trace Filter (all code or regions of code) Branch Broadcast Context ID comparator CycleAccurate tracing Timestamping (i) MOV PC, LR (ii) ADD R1, R2, R3 (iii) B 0x8084 9

26 Trace generation Address Instruction Trace, if any, with explanation 0x1000 MOV - 0x1004 ADD - 0x1008 B 0x1100 Direct branch taken. E atom generated. 10

27 Trace generation Address Instruction Trace, if any, with explanation 0x1000 MOV - 0x1004 ADD - 0x1008 B 0x1100 Direct branch taken. E atom generated. 0x1104 LDR - 0x110C CMP - 0x1110 BNE 0x1104 Direct branch taken. E atom generated. 10

28 Trace generation Address Instruction Trace, if any, with explanation 0x1000 MOV - 0x1004 ADD - 0x1008 B 0x1100 Direct branch taken. E atom generated. 0x1104 LDR - 0x110C CMP - 0x1110 BNE 0x1104 Direct branch taken. E atom generated. 0x1104 LDR - 0x1108 ADD - 0x110C CMP - 0x1110 BNE 0x1444 Direct branch not taken. N atom generated. 10

29 Configuration of CoreSight components Fun fact: Unlocking CoreSight components Write 0xC5ACCE55 to Lock Access Register LeetSpeak of CSACCESS (CoreSight Access)! 11

30 Configuration of CoreSight components 1 echo 0 > / s y s / d e v i c e s / system / cpu / cpu1 / o n l i n e 2 cd / s y s / bus / c o r e s i g h t / d e v i c e s / f889c000. ptm0/ 3 # C o n f i g u r e PTM components 4 echo 20 > mode 5 echo 1 > a d d r i d x 6 echo 0 > a d d r a c c t y p e 7 echo 0 > a d d r i d x 8 echo 0 > a d d r a c c t y p e 9 echo > a d d r r a n g e 10 # Enable Sink (ETB or TPIU ) 11 echo 1 > f t p i u / e n a b l e s i n k 12 #echo 1 > f etb / e n a b l e s i n k 13 # Enable Source 14 echo 1 > f889c000. ptm0/ e n a b l e s o u r c e 15 # Launch Program 16. / a p p l i c a t i o n. e l f 17 # Recover t r a c e 18. / r e c o v e r t r a c e f p g a. e l f 19 #dd i f =/dev / f etb o f=t r a c e. b i n 11

31 Configuration of CoreSight components 1 echo 0 > / s y s / d e v i c e s / system / cpu / cpu1 / o n l i n e 2 cd / s y s / bus / c o r e s i g h t / d e v i c e s / f889c000. ptm0/ 3 # C o n f i g u r e PTM components 4 echo 20 > mode 5 echo 1 > a d d r i d x 6 echo 0 > a d d r a c c t y p e 7 echo 0 > a d d r i d x 8 echo 0 > a d d r a c c t y p e 9 echo > a d d r r a n g e 10 # Enable Sink (ETB or TPIU ) 11 echo 1 > f t p i u / e n a b l e s i n k 12 #echo 1 > f etb / e n a b l e s i n k 13 # Enable Source 14 echo 1 > f889c000. ptm0/ e n a b l e s o u r c e 15 # Launch Program 16. / a p p l i c a t i o n. e l f 17 # Recover t r a c e 18. / r e c o v e r t r a c e f p g a. e l f 19 #dd i f =/dev / f etb o f=t r a c e. b i n 11

32 Configuration of CoreSight components 1 echo 0 > / s y s / d e v i c e s / system / cpu / cpu1 / o n l i n e 2 cd / s y s / bus / c o r e s i g h t / d e v i c e s / f889c000. ptm0/ 3 # C o n f i g u r e PTM components 4 echo 20 > mode 5 echo 1 > a d d r i d x 6 echo 0 > a d d r a c c t y p e 7 echo 0 > a d d r i d x 8 echo 0 > a d d r a c c t y p e 9 echo > a d d r r a n g e 10 # Enable Sink (ETB or TPIU ) 11 echo 1 > f t p i u / e n a b l e s i n k 12 #echo 1 > f etb / e n a b l e s i n k 13 # Enable Source 14 echo 1 > f889c000. ptm0/ e n a b l e s o u r c e 15 # Launch Program 16. / a p p l i c a t i o n. e l f 17 # Recover t r a c e 18. / r e c o v e r t r a c e f p g a. e l f 19 #dd i f =/dev / f etb o f=t r a c e. b i n 11

33 Configuration of CoreSight components 1 echo 0 > / s y s / d e v i c e s / system / cpu / cpu1 / o n l i n e 2 cd / s y s / bus / c o r e s i g h t / d e v i c e s / f889c000. ptm0/ 3 # C o n f i g u r e PTM components 4 echo 20 > mode 5 echo 1 > a d d r i d x 6 echo 0 > a d d r a c c t y p e 7 echo 0 > a d d r i d x 8 echo 0 > a d d r a c c t y p e 9 echo > a d d r r a n g e 10 # Enable Sink (ETB or TPIU ) 11 echo 1 > f t p i u / e n a b l e s i n k 12 #echo 1 > f etb / e n a b l e s i n k 13 # Enable Source 14 echo 1 > f889c000. ptm0/ e n a b l e s o u r c e 15 # Launch Program 16. / a p p l i c a t i o n. e l f 17 # Recover t r a c e 18. / r e c o v e r t r a c e f p g a. e l f 19 #dd i f =/dev / f etb o f=t r a c e. b i n 11

34 Configuration of CoreSight components 1 echo 0 > / s y s / d e v i c e s / system / cpu / cpu1 / o n l i n e 2 cd / s y s / bus / c o r e s i g h t / d e v i c e s / f889c000. ptm0/ 3 # C o n f i g u r e PTM components 4 echo 20 > mode 5 echo 1 > a d d r i d x 6 echo 0 > a d d r a c c t y p e 7 echo 0 > a d d r i d x 8 echo 0 > a d d r a c c t y p e 9 echo > a d d r r a n g e 10 # Enable Sink (ETB or TPIU ) 11 echo 1 > f t p i u / e n a b l e s i n k 12 #echo 1 > f etb / e n a b l e s i n k 13 # Enable Source 14 echo 1 > f889c000. ptm0/ e n a b l e s o u r c e 15 # Launch Program 16. / a p p l i c a t i o n. e l f 17 # Recover t r a c e 18. / r e c o v e r t r a c e f p g a. e l f 19 #dd i f =/dev / f etb o f=t r a c e. b i n 11

35 Example Trace Code Source 1 i n t i ; 2 f o r ( i = 0 ; i < 1 0 ; i ++) 12

36 Example Trace Code Source 1 i n t i ; 2 f o r ( i = 0 ; i < 1 0 ; i ++) Assembly 8638 for loop:... b 8654: c: bcc

37 Example Trace Code Source 1 i n t i ; 2 f o r ( i = 0 ; i < 1 0 ; i ++) Assembly 8638 for loop:... b 8654: c: bcc 8654 Trace a 2a 2a 2a 2a 2a 2a 2a 2a 2a

38 Example Trace Code Source 1 i n t i ; 2 f o r ( i = 0 ; i < 1 0 ; i ++) Assembly 8638 for loop:... b 8654: c: bcc 8654 Trace a 2a 2a 2a 2a 2a 2a 2a 2a 2a Decoded Trace A-sync Address , (I-sync Context , IB 21) Address , Branch Address packet (x 10) 12

39 Example Trace Decoded Trace A-sync Address , (I-sync Context , IB 21) Address , Branch Address packet (x 10) Figure 3: Control Flow Graph 13

40 CoreSight components - Performance overhead Average execution time (in µs) 2,000 1, , , ,339 2,340 1,057 1,053 1,160 1, choleski crc dft fir lu matrixnbody radix wht trace disabled trace enabled 14

41 CoreSight components - Summary Brief overview Trace.text section 15

42 CoreSight components - Summary Brief overview Trace.text section Recover all branch addresses 15

43 CoreSight components - Summary Brief overview Trace.text section Recover all branch addresses Reconstruct CFG of the application 15

44 CoreSight components - Summary Brief overview Trace.text section Recover all branch addresses Reconstruct CFG of the application PTM Non-intrusive 15

45 Software Security

46 DIFT How to recover information about each CPU instruction? CFG reconstruction on the FPGA 16

47 DIFT How to recover information about each CPU instruction? CFG reconstruction on the FPGA What happens inside each basic block? 16

48 DIFT How to recover information about each CPU instruction? CFG reconstruction on the FPGA What happens inside each basic block? Static code analysis Example Instructions sub r0, r1, r2 mov r3, r0 str r1, [PC, #4] Output of static analysis r0 = r1 + r2 r3 = = r1 16

49 Overall architecture Processing System (PS) EMIO interface Programmable Logic (PL) CoreSight Components PFT Decoder AXI BRAM ARM Cortex-A9 CPU 0 AXI GP Config interrupt DIFT Coprocessor TRF DDR Memory (used by Linux OS) Tag dependencies Tag space 64 MB 32 MB Heap and Stack (DIFT coproc.) 32 MB 17

50 DIFT example: Data Leakage Prevention (DLP) char buffer[20]; FILE *fs; if(geteuid()!= 0){ // user fs = fopen("welcome", "r"); //public if(!fs) exit (1); } else { // root fs = fopen("passwd", "r"); //secret if(!fs) exit(1); } fread(buffer, 1, sizeof(buffer), fs); fclose(fs); printf("buffer Value: %s \n", buffer); 18

51 DIFT example 1 root@zedboard h a r d b l a r e : c a t welcome 2 WELCOME 3 root@zedboard h a r d b l a r e : c a t passwd 4 MDP 5 root@zedboard h a r d b l a r e :. / u s e c a s e 6 B u f f e r Value : MDP 7 root@zedboard h a r d b l a r e : sudo u n o r m a l u s e r. / u s e c a s e 8 B u f f e r Value : WELCOME 19

52 DIFT example 1 root@zedboard h a r d b l a r e : c a t welcome 2 WELCOME 3 root@zedboard h a r d b l a r e : c a t passwd 4 MDP 5 root@zedboard h a r d b l a r e :. / u s e c a s e 6 B u f f e r Value : MDP 7 root@zedboard h a r d b l a r e : sudo u n o r m a l u s e r. / u s e c a s e 8 B u f f e r Value : WELCOME 19

53 DIFT example 1 root@zedboard h a r d b l a r e : c a t welcome 2 WELCOME 3 root@zedboard h a r d b l a r e : c a t passwd 4 MDP 5 root@zedboard h a r d b l a r e :. / u s e c a s e 6 B u f f e r Value : MDP 7 root@zedboard h a r d b l a r e : sudo u n o r m a l u s e r. / u s e c a s e 8 B u f f e r Value : WELCOME 19

54 DIFT example 1 root@zedboard h a r d b l a r e :. / r e c o v e r t r a c e 2 CPU1 : shutdown 3 c o r e s i g h t t p i u f t p i u : TPIU e n a b l e d 4 c o r e s i g h t r e p l i c a t o r : REPLICATOR e n a b l e d 5 c o r e s i g h t f u n n e l : FUNNEL i n p o r t 0 e n a b l e d 6 c o r e s i g h t etm3x f889c000. ptm : ETM t r a c i n g e n a b l e d 7 B u f f e r Value : MDP 8 c o r e s i g h t etm3x f889c000. ptm : ETM t r a c i n g d i s a b l e d 9 c o r e s i g h t f u n n e l : FUNNEL i n p o r t 0 d i s a b l e d 10 c o r e s i g h t r e p l i c a t o r : REPLICATOR d i s a b l e d 11 c o r e s i g h t t p i u f t p i u : TPIU d i s a b l e d 20

55 DIFT example 1 root@zedboard h a r d b l a r e :. / r e c o v e r t r a c e 2 CPU1 : shutdown 3 c o r e s i g h t t p i u f t p i u : TPIU e n a b l e d 4 c o r e s i g h t r e p l i c a t o r : REPLICATOR e n a b l e d 5 c o r e s i g h t f u n n e l : FUNNEL i n p o r t 0 e n a b l e d 6 c o r e s i g h t etm3x f889c000. ptm : ETM t r a c i n g e n a b l e d 7 B u f f e r Value : MDP 8 c o r e s i g h t etm3x f889c000. ptm : ETM t r a c i n g d i s a b l e d 9 c o r e s i g h t f u n n e l : FUNNEL i n p o r t 0 d i s a b l e d 10 c o r e s i g h t r e p l i c a t o r : REPLICATOR d i s a b l e d 11 c o r e s i g h t t p i u f t p i u : TPIU d i s a b l e d 20

56 DIFT example 1 root@zedboard h a r d b l a r e :. / r e c o v e r t r a c e 2 CPU1 : shutdown 3 c o r e s i g h t t p i u f t p i u : TPIU e n a b l e d 4 c o r e s i g h t r e p l i c a t o r : REPLICATOR e n a b l e d 5 c o r e s i g h t f u n n e l : FUNNEL i n p o r t 0 e n a b l e d 6 c o r e s i g h t etm3x f889c000. ptm : ETM t r a c i n g e n a b l e d 7 B u f f e r Value : MDP 8 c o r e s i g h t etm3x f889c000. ptm : ETM t r a c i n g d i s a b l e d 9 c o r e s i g h t f u n n e l : FUNNEL i n p o r t 0 d i s a b l e d 10 c o r e s i g h t r e p l i c a t o r : REPLICATOR d i s a b l e d 11 c o r e s i g h t t p i u f t p i u : TPIU d i s a b l e d 20

57 DIFT example 1 root@zedboard h a r d b l a r e :. / r e c o v e r t r a c e 2 CPU1 : shutdown 3 c o r e s i g h t t p i u f t p i u : TPIU e n a b l e d 4 c o r e s i g h t r e p l i c a t o r : REPLICATOR e n a b l e d 5 c o r e s i g h t f u n n e l : FUNNEL i n p o r t 0 e n a b l e d 6 c o r e s i g h t etm3x f889c000. ptm : ETM t r a c i n g e n a b l e d 7 B u f f e r Value : MDP 8 c o r e s i g h t etm3x f889c000. ptm : ETM t r a c i n g d i s a b l e d 9 c o r e s i g h t f u n n e l : FUNNEL i n p o r t 0 d i s a b l e d 10 c o r e s i g h t r e p l i c a t o r : REPLICATOR d i s a b l e d 11 c o r e s i g h t t p i u f t p i u : TPIU d i s a b l e d 20

58 DIFT example 1 root@zedboard h a r d b l a r e :. / r e c o v e r t r a c e 2 CPU1 : shutdown 3 c o r e s i g h t t p i u f t p i u : TPIU e n a b l e d 4 c o r e s i g h t r e p l i c a t o r : REPLICATOR e n a b l e d 5 c o r e s i g h t f u n n e l : FUNNEL i n p o r t 0 e n a b l e d 6 c o r e s i g h t etm3x f889c000. ptm : ETM t r a c i n g e n a b l e d 7 B u f f e r Value : MDP 8 c o r e s i g h t etm3x f889c000. ptm : ETM t r a c i n g d i s a b l e d 9 c o r e s i g h t f u n n e l : FUNNEL i n p o r t 0 d i s a b l e d 10 c o r e s i g h t r e p l i c a t o r : REPLICATOR d i s a b l e d 11 c o r e s i g h t t p i u f t p i u : TPIU d i s a b l e d 20

59 DIFT example 1 / dev /mem opened. 2 Memory mapped at a d d r e s s 0 x b 6 f f c c c a4 21

60 DIFT example Processing System (PS) EMIO interface Programmable Logic (PL) CoreSight Components PFT Decoder AXI BRAM ARM Cortex-A9 CPU 0 AXI GP Config interrupt DIFT Coprocessor TRF DDR Memory (used by Linux OS) Tag dependencies Tag space 64 MB 32 MB Heap and Stack (DIFT coproc.) 32 MB 22

61 DIFT example 1 root@zedboard h a r d b l a r e : 2 t r a c e = t r a c e = t r a c e = t r a c e = 1057 c 6 7 tag ( r0 ) = 0 8 tag ( r1 ) = 1 9 tag ( r2 ) = 0 10 tag ( r3 ) =

62 DIFT example 1 root@zedboard h a r d b l a r e : 2 t r a c e = t r a c e = t r a c e = t r a c e = 1057 c 6 7 tag ( r0 ) = 0 8 tag ( r1 ) = 1 9 tag ( r2 ) = 0 10 tag ( r3 ) =

DIFT example 1 root@zedboard h a r d b l a r e : 2 t r a c e = 10508 3 t r a c e = 10554 4 t r a c e =

63 DIFT example 1 root@zedboard h a r d b l a r e : 2 t r a c e = t r a c e = t r a c e = t r a c e = 1057 c 6 7 tag ( r0 ) = 0 8 tag ( r1 ) = 1 9 tag ( r2 ) = 0 10 tag ( r3 ) =

64 Preventing ROP attacks 2 On each function call, copy the return address into a special stack (called shadow stack) Obtained with decoded trace 2 Yongje Lee et al. Towards a Practical Solution to Detect Code Reuse Attacks on ARM Mobile Devices. In: HASP

65 Preventing ROP attacks 2 On each function call, copy the return address into a special stack (called shadow stack) On each function return, compare LR register value with one stored in shadow stack Obtained with decoded trace Dedicated component on FPGA 2 Yongje Lee et al. Towards a Practical Solution to Detect Code Reuse Attacks on ARM Mobile Devices. In: HASP

66 Software security - Summary Brief overview Dynamic Information Flow Tracking (DIFT) Overflows Data Leakage Prevention SQL injection 25

67 Software security - Summary Brief overview Dynamic Information Flow Tracking (DIFT) Overflows Data Leakage Prevention SQL injection Code Reuse Attacks ROP JOP 25

68 Conclusion

69 Conclusion Take away CoreSight PTM allows to obtain runtime information (Program Flow) Non-intrusive tracing Negligible performance overhead Improve software security 26

70 Conclusion Take away CoreSight PTM allows to obtain runtime information (Program Flow) Non-intrusive tracing Negligible performance overhead Improve software security Future perspectives Possible to take use of other debug components for security Intel Processor Trace STM (TI) 26

71 Acknowledgments Thanks to CominLabs 3 and Brittany Region Pascal COTRET Mounir NASR ALLAH My PhD supervisors

72 Thank you! Any questions? 27

73 Bibliography Secure Program Execution via DIFT, Suh et Al. RAKSHA, Dalton et Al. FlexiTaint, Venkataramani et Al. Off-core RAKSHA, Kannan et Al. FlexCore, Deng et Al. HARMONI, Deng et Al. PAU, Heo et Al

ELECTROMAGNETIC FAULT INJECTION: TOWARDS A FAULT MODEL ON A 32-BIT MICROCONTROLLER

ELECTROMAGNETIC FAULT INJECTION: TOWARDS A FAULT MODEL ON A 32-BIT MICROCONTROLLER Nicolas Moro 1,3, Amine Dehbaoui 2, Karine Heydemann 3, Bruno Robisson 1, Emmanuelle Encrenaz 3 1 CEA Commissariat à l