00:00:00.100-->00:00:05.205 >>Good morning. Thanks for coming out on the first talk of Sunday. I am Josh. This is 00:00:05.205-->00:00:10.844 Chris. Somewhere in the audience is Krill, he's our plant. So, um, just be careful about that 00:00:10.844-->00:00:15.916 guy. Alright. We're talking about breaking bitcoin hardware wallets. All the links will be 00:00:15.916-->00:00:20.320 up on our website basically slash breaking bitcoin, the Github links, support files. 00:00:20.320-->00:00:25.993 Everything... not everything is up there now, but, after the presentation we'll have most of 00:00:25.993-->00:00:31.498 the stuff. Okay, so, we're talking about bitcoin hardware wallets. Well what is a bitcoin 00:00:31.498-->00:00:35.235 hardware wallet? So, what you need to know for this talk is that bitcoin is a 00:00:35.235-->00:00:40.240 cryptocurrency. And I am going to start my timer. So bitcoin is a cryptocurrency. The security 00:00:42.843-->00:00:46.914 of bitcoin base and all other cryptocurrencies comes down to the security of your private 00:00:46.914-->00:00:52.286 key. So it uses a asymmetric, um, public private key pair system. If I know your private 00:00:52.286-->00:00:58.458 key i can send transactions, um, so transactions just like a block in the, in the bitcoin 00:00:58.458-->00:01:02.996 system. Basically i can send money, is what you need to know about that. And since we all 00:01:02.996-->00:01:08.535 know that software is insecure, the best way to store your bitcoin private key is with a 00:01:08.535-->00:01:12.639 hardware wallet. And so a hardware wallet is uh, so wallet's just the name in 00:01:12.639-->00:01:17.644 bitcoin for the thing that stores your private keys. A hardware wallet is a dedicated 00:01:17.644-->00:01:22.716 embedded device. Um, there is a few manufacturers of them. The two kind of big ones are the 00:01:22.716-->00:01:28.322 Trezor hardware wallet, which is what you see on the slide. The other one is a Ledger. They're 00:01:28.322-->00:01:33.827 essentially dedicated embedded devices that connect to your computer over USB and when you 00:01:33.827-->00:01:39.299 want to send money, uh, so when you want to sign a transaction, you plug in the hardware wallet 00:01:39.299-->00:01:43.036 and it goes... and your computer will talk to the hardware wallet and say "Please sign this for 00:01:43.036-->00:01:48.942 me," and your private key never gets onto your computer which maybe you use for other things, 00:01:48.942-->00:01:55.482 um, that you may not want to keep lots of money on. Okay, so, the other thing that we're gonna 00:01:55.482-->00:02:00.687 be talking about today is Fault Attacks. So, what is a fault attack? Well, a fault attack is 00:02:00.687-->00:02:07.060 an attack which applies an external stress on an electronic system. And the "attack" part 00:02:07.060-->00:02:12.199 here means that it generates a security failure. There's two parts to a fault attack: there's 00:02:12.199-->00:02:18.138 the fault injection and the fault exploitation. Just like, if you have a, um, stack 00:02:18.138-->00:02:23.243 overflow vulnerability, you know, there is, a stack, um, overflow is the vulnerability 00:02:23.243-->00:02:28.281 but getting the shell code in there, that's the exploit. Same idea with a fault attack, two 00:02:28.281-->00:02:33.253 parts. We looked at two different ways of injecting faults. We looked at, uh, 00:02:33.253-->00:02:38.158 voltage glitching, or Vcc glitching. Essentially this is just dropping the voltage of the 00:02:38.158-->00:02:43.663 running micro controller to get it to do things that it shouldn't. So, specifically what 00:02:43.663-->00:02:48.735 it seems to do is that when you read and write from memory that doesn't seem to work like it 00:02:48.735-->00:02:53.573 should when you just kind of drop the voltage at very specific times. The other attack 00:02:53.573-->00:02:57.577 we looked at, or the other injection rather, is Clock glitching. Clock glitching is 00:02:57.577-->00:03:03.150 getting the clock signals, so it's a very digital clock kind of pulse and you drop the 00:03:03.150-->00:03:09.556 voltage at very specific times. The end effect is that you end up skipping instructions. Uh, 00:03:09.556-->00:03:13.693 how that happens, is there's some instruction pipelining going on that we won't have time 00:03:13.693-->00:03:17.230 to get into the theory, but that, that is the end effect. And then the exploitation is 00:03:17.230-->00:03:21.635 just you get the fault, um, you know that it makes the effect and then you time it at the 00:03:21.635-->00:03:28.208 right spot and that's what leads to the exploit. Okay, the last kind of background is, what is 00:03:28.208-->00:03:33.080 the ChipWhisperer? So we use the ChipWhisperer to do this, uh, talk. Uh, so this is what a 00:03:33.080-->00:03:38.051 ChipWhisperer looks like. It's essentially an FPGA, um, with some other hardware on there 00:03:38.051-->00:03:43.290 meant to do these Fault Attacks. It also does side channel analysis. This is like power 00:03:43.290-->00:03:48.895 analysis, differential power analysis. We didn't do that. We focused on Fault Attacks, um, 00:03:48.895-->00:03:53.500 so, you don't have to know too much about it for now. Um, there's a lot of information on 00:03:53.500-->00:03:57.471 the wiki, on the ChipWhisperer wiki. All you need to know is that that's the tool that we 00:03:57.471-->00:04:02.409 used to insert the Faults onto the hardware wallets. Okay, and so, this talk is basically the 00:04:05.045-->00:04:10.050 combination of those 3 things. So we wanted to look at, uh, 3 questions specifically. You 00:04:12.085-->00:04:16.756 know, um, we looked at the Trezor hardware wallet which is based on the micro controller, 00:04:16.756-->00:04:22.629 Trezor and all clones I should say. The STM part, um, the F205. Is this vulnerable to fault 00:04:22.629-->00:04:27.601 injection? Can we exploit it via a fault? And how do we raise awareness for these kind of 00:04:27.601-->00:04:32.906 attacks? So the first thing we did is, uh, you know, I get the, I get a KeepKey. First thing I 00:04:32.906-->00:04:37.310 do, like any normal person, is take it apart. Start looking at things. I look up on GitHub and 00:04:37.310-->00:04:42.082 there's this 2 year old bug sitting on GitHub when they forked it from Trezor, um, that 00:04:42.082-->00:04:46.853 they didn't, uh, hadn't fixed yet. So, um, string compare, all you need to know about this is 00:04:46.853-->00:04:51.992 that string compare, uh, is, was being used to check the pin. The pin is what is the primary 00:04:51.992-->00:04:57.030 authentication mechanism to allow you to send funds on the device. And the string compare 00:04:57.030-->00:05:01.501 also has this problem that it fails on the first wrong character. So if you measure it 00:05:01.501-->00:05:07.107 with an oscilloscope, the first, if the first character is wrong, uh, that'll fail in about 1 00:05:07.107-->00:05:10.744 hundred nanoseconds on the device. If the 4th character was wrong that's 11 hundred 00:05:10.744-->00:05:15.982 nanoseconds. And so if you just measure the time and can guess the pin, you can basically see 00:05:15.982-->00:05:20.353 if your guesses are working. It really doesn't work in practice because there's this back-off 00:05:20.353-->00:05:25.458 timer that they implement that makes you wait to enter the next pin. The first time it's wrong 00:05:25.458-->00:05:28.762 you have to wait a couple seconds but by the time, like, the eighth time it's wrong, you 00:05:28.762-->00:05:35.535 have to wait, like, a day. So we clearly needed another way to get around this pin. >>Alright, 00:05:35.535-->00:05:41.241 so how hard could it be? You know, you dig out your ChipWhisperer from the box. Kick 00:05:41.241-->00:05:46.012 starter items that you haven't played with. Uh, and you set it up, you get your environment 00:05:46.012-->00:05:50.517 going and you start running through the tutorials. Within the first few tutorials you're 00:05:50.517-->00:05:56.957 actually, uh, scripting the ChipWhisperer to drop out the password from an XMEGA Target 00:05:56.957-->00:06:01.561 that it comes with. Um, and if... that's perfect because that's exactly what we want to 00:06:01.561-->00:06:07.067 do with the pin, right? On the KeepKey? So you run through some more tutorials and you start 00:06:07.067-->00:06:11.938 doing glitches on the XMEGA and you're glitching over while loops which is exactly what we 00:06:11.938-->00:06:18.645 wanna do with the back-off timer. So, you know, plug in the KeepKey, press the glitch 00:06:18.645-->00:06:23.650 button, receive bitcoin, right? Well it's not that easy. Um, so as you can see my setup here at 00:06:25.685-->00:06:31.992 the, towards the end, kind of looks like surgery. And a lot like surgery, we only had one 00:06:31.992-->00:06:36.997 mistake to make. We had one KeepKey to work with. Our timing was really bad. Uh, bitcoin was 00:06:39.699-->00:06:44.704 doing, uh, new highs every day. It was over $2600. We saw somebody pay $500 for a Trezor 00:06:47.107-->00:06:52.112 wallet, uh, somewhere online which is crazy. So, uh, you couldn't even find the STM32F205 00:06:54.648-->00:07:00.987 part, um, on DigiKey and other websites so, it was really, we had, uh, very small margin for 00:07:00.987-->00:07:05.992 error here. Um, so, you know, once you start attacking real hardware you get into a lot of 00:07:08.828-->00:07:15.068 technical hurdles. Um... Like, Josh said you talk to the Trezor and the KeepKey over USB. Uh, so 00:07:15.068-->00:07:21.541 you're sending your pin, you're uploading firmware, everything that you're doing to communicate 00:07:21.541-->00:07:28.381 with those devices is over USB. Well when you glitch, uh, the device it's going to effect the 00:07:28.381-->00:07:34.754 USB very, uh, very strongly. And, uh, your host machine is not going to like it very well. 00:07:34.754-->00:07:41.428 Um, so, some of these are intended but some of them are unintended. One of the intended, 00:07:41.428-->00:07:47.500 um, hurdles is this, uh, sign firmware check. So if you upload your own firmware to make it 00:07:47.500-->00:07:53.640 easier to attack the device, they still check to see if it's signed by KeepKey and they make 00:07:53.640-->00:07:56.943 you press a button. So you've got all these flywires in your way, you're trying to press the 00:07:56.943-->00:08:03.850 button. It's really complicated and annoying. And, um, I don't know if you've ever worked with 00:08:03.850-->00:08:10.123 an arduino at different voltages as well. The KeepKey is running at 2.8 volts. The ChipWhisperer 00:08:10.123-->00:08:15.962 is running at 3.3. You can't just plug them in and get the, get them to talk together. So, 00:08:15.962-->00:08:20.967 um, and I don't really have a slide to show you of just how tedious it is to, um, fault 00:08:24.337-->00:08:29.309 attack with a ChipWhisperer. It's a lot of trial and error. You're constantly resetting the 00:08:29.309-->00:08:34.447 device because it's not always working. You're trying to find the variables to actually 00:08:34.447-->00:08:39.452 exploit the device. So, it was a big pain in the butt. >>Okay, so we clearly needed something 00:08:43.390-->00:08:48.795 simpler. Um, tried to go right for the main device, that wasn't working. We needed to just start 00:08:48.795-->00:08:53.767 small and build up from there. We wanted a simple proof of concept, um, so we can just have 00:08:53.767-->00:09:00.106 confidence that we can do the glitch attack. And what we made is a, a Trezor clone. And we are 00:09:00.106-->00:09:04.811 releasing this clone. We have, uh, some of the boards with us that we're gonna hand out. Um, 00:09:04.811-->00:09:08.415 all the design files are gonna be up on the website. Completely open source hardware or open 00:09:08.415-->00:09:13.686 source firmware. Uh, you can make your own Trezor. You can, it's in this weird rectangle 00:09:13.686-->00:09:17.590 format because it meants, it sits on top of the ChipWhisperer. Uh, so that's why 00:09:17.590-->00:09:22.629 it looks like that, with all the pins. Um, it's a full Trezor clone so it'll both run 00:09:22.629-->00:09:27.434 legitimate firmware, if you want, but if you don't set the fuses and you don't, uh, put the 00:09:27.434-->00:09:32.872 Trezor keys in there it'll run illegitimate firmware, uh, which is more fun. Um, so that screen 00:09:32.872-->00:09:36.943 is actually the screen where we hacked our own bootloader. Um, so if you own the bootloader, 00:09:36.943-->00:09:42.549 you kinda own the device. So, that's more fun. Uh, and then we have dedicated on, um, kind of 00:09:42.549-->00:09:48.488 the, a special glitch hardware on the board so you can glitch without the ChipWhisperer. So 00:09:48.488-->00:09:53.460 this is an example you see in the middle of an arduino uno. You don't need a ChipWhisperer 00:09:53.460-->00:09:57.330 to do this attack, you can do it with other hardware. Though a little bit tricky to get the 00:09:57.330-->00:10:02.335 voltage and the timing just right, but you definitely don't need a ChipWhisperer to insert 00:10:02.335-->00:10:07.340 glitches. >>Alright, so thanks to Krill and, uh, his hard work we got our breaking bitcoin 00:10:10.577-->00:10:15.582 boards pretty quickly. I was able to get a much cleaner setup as you can see here. Um, I've 00:10:18.017-->00:10:22.789 got the ChipWhisperer, the UFO board in the red, and our breaking bitcoin board. Um, No 00:10:22.789-->00:10:29.028 flywires or any of that stuff. I also didn't have to be as careful, uh, so you know, I 00:10:29.028-->00:10:34.033 could, uh, turn the glitching up to 11, as you say. And in fact I did. I burned, burned up one of 00:10:36.135-->00:10:42.142 our boards and actually damaged one of our ChipWhisperers. So, you can actually do some damage 00:10:42.142-->00:10:48.648 with that thing. Alright, so, if attacking, you know, starting out attacking the KeepKey or the 00:10:48.648-->00:10:53.653 Trezor is kind of like attacking a final boss on level 1 in a video game, right? Um, so we 00:10:56.556-->00:11:00.793 made our own hardware to give ourselves a better platform for these attacks. Well now we're 00:11:00.793-->00:11:07.367 gonna, I'm gonna show you the proof of concept or "get the f**k out" examples of glitching 00:11:07.367-->00:11:12.372 on our breaking bitcoin board. So this first one here is basically the "Hello World." You 00:11:14.774-->00:11:21.047 should print out A, you should wait at line 8 and you should never see 1, 2, 3, 4 print out 00:11:21.047-->00:11:26.052 on the uart. And so, um, I'll just run through real quick what you're seeing here. Uh, this is 00:11:29.088-->00:11:34.894 the chipwhisperer analyzer software. Uh, top right, the red line that looks fuzzy, is your 00:11:34.894-->00:11:40.166 voltage. Um, It's kind of like an oscilloscope. You've got your glitch settings in the top left 00:11:40.166-->00:11:44.704 and now we have a serial output in the bottom right here. As you can see at the very bottom, 00:11:44.704-->00:11:50.577 where I've highlighted the text, it printed out Hello, new line A and then 1,2,3,4. So we were 00:11:50.577-->00:11:55.582 able to get out of that loop and actually, um, print out 1,2,3,4. Alright so this next example is 00:11:59.118-->00:12:05.158 like level 2. And this one's interesting because this is, um, structured similar to the 00:12:05.158-->00:12:11.064 back-off timer in the Trezor KeepKey. It's in nested loops. This one doesn't do anything but 00:12:11.064-->00:12:17.870 print out your variables for sanity checking. But as you can see, um, this is a good example 00:12:17.870-->00:12:24.210 in the top right of the glitch. So you see the voltage drops all the way to the ground for a very 00:12:24.210-->00:12:31.084 small amount of time and comes back up. If you see in the serial output, uh, we've got a, 00:12:31.084-->00:12:35.989 you know, the first variable is actually lower so I don't know if we, did we actually go 00:12:35.989-->00:12:41.761 through the loop faster? Or did we just modify memory on the running device? Um, modify the 00:12:41.761-->00:12:47.900 stack variable? The, the point is that we caused behavior that was unintended in a security 00:12:47.900-->00:12:54.407 device. Uh, some more examples here, you can really start to get some garbage to print out. 00:12:54.407-->00:12:59.712 And this thing is still running at this point. But, uh, yea you're really, uh, 00:12:59.712-->00:13:05.385 "Cronenberging" it up here. >>Yeah, so just, the reason that's significant is 'cause 00:13:05.385-->00:13:11.190 we're modifying how a security device is, is running by an external event. So, um, even 00:13:11.190-->00:13:14.827 that example... where we're just seeing the stack variable change, this is the security 00:13:14.827-->00:13:20.133 device. We're not using anything, um, on the device to change it except for changing 00:13:20.133-->00:13:26.706 the voltage. So, um, our board is basically, it is the same microcontroller as the Trezor. 00:13:26.706-->00:13:30.209 Um, so that's what we're kind of using to do this example. So then this last level is 00:13:30.209-->00:13:35.381 basically "Can we skip over a pin?" So if I can skip the pin on your Trezor and you don't set 00:13:35.381-->00:13:40.720 a passphrase then I'd be able to, uh, do a transaction so... How did this one go? So 00:13:40.720-->00:13:46.626 basically you see there, um, the password here is "touch" in line 2. It gets the password in as 00:13:46.626-->00:13:52.865 input. If it's denied... "imprint denied" goes to a while loop. If it succeeds, "Welcome" 00:13:52.865-->00:13:57.136 and there's just code at the bottom to show that the LED turns green if you get past 00:13:57.136-->00:14:03.009 that. And we insert the glitch. And you can kinda see in that uart screen if you look at the 00:14:03.009-->00:14:07.547 bottom we typed in the wrong password so it was a J instead of an H. And in that picture 00:14:07.547-->00:14:13.419 you're seeing the LED, uh, a green LED, which means we entered the wrong password, 00:14:13.419-->00:14:17.990 glitched and then jumped out of the failed password and essentially skipped over. So we 00:14:17.990-->00:14:23.596 don't know the password but we... doesn't matter 'cause we just skipped over it. Okay, so, 00:14:23.596-->00:14:30.103 we were only able to do this on our board. Which is essentially a Trezor clone. So we are 00:14:30.103-->00:14:35.308 confident in saying that the F205 definitely is vulnerable to fault injections. We showed here 00:14:35.308-->00:14:39.512 voltage glitching, uh, which does affect the microcontroller. We also had success with clock 00:14:39.512-->00:14:45.017 glitching. Um, so i'll talk about that vulnerability on the next slide. Is the Trezor 00:14:45.017-->00:14:49.789 firmware exploitable via a fault? Inconclusive, right? So this is where we came up a 00:14:49.789-->00:14:56.329 little short. Um, we couldn't, we could not glitch an unmodified device. But, um, part 00:14:56.329-->00:15:00.066 of the thing and raising awareness for this talk is releasing the board, giving this 00:15:00.066-->00:15:04.771 talk, releasing our tools. Uh, there's probably smarter people than us who can get the glitch 00:15:04.771-->00:15:10.276 parameters exactly right, um, to do this, to do the talk on the live device. And the 00:15:10.276-->00:15:15.181 significance here is that once you kind of do this once, it becomes this break once run 00:15:15.181-->00:15:19.352 everywhere attack, right? So if you can learn how to do the glitch parameters you don't need 00:15:19.352-->00:15:23.756 a ChipWhisperer anymore. You make a custom device and you could maybe like put that over a 00:15:23.756-->00:15:30.263 Trezor or something kind of like a pay TV on Looper. Okay so the summary of the vulnerabilities 00:15:30.263-->00:15:35.201 we found and these were all disclosed to treasure... Trezor in KeepKey. Uh, the F205 is 00:15:35.201-->00:15:40.706 definitely susceptible. Uh, KeepKey had that timing analysis bug on PIN verification. Uh, 00:15:40.706-->00:15:45.945 Trezor and all clones had, they did not turn on this feature called "clock system security" 00:15:45.945-->00:15:50.616 which basically would tell when the external clock failed while it was being glitched. Uh, they 00:15:50.616-->00:15:55.188 would get an interrupt and they could do something like erase the PIN or take self defense 00:15:55.188-->00:15:59.192 mechanisms. Um, they did not do that. And so that was actually one of our biggest 00:15:59.192-->00:16:03.462 recommendations is that, uh, with either the clock glitching or, uh, through voltage 00:16:03.462-->00:16:07.600 glitching they would be getting these hard faults. It would trigger the interrupt service 00:16:07.600-->00:16:12.972 routine, they could detect that and then, you know, shut down the Trezor wipe the... wipe the 00:16:12.972-->00:16:17.476 PIN and prevent people from experimenting with the glitch attack on it. So as far as I 00:16:17.476-->00:16:22.949 know that's the change that they are making. If you are a wallet user, like, just like normal 00:16:22.949-->00:16:27.019 don't lose physical control of your wallet. But you really want to set a PIN plus passphrase 00:16:27.019-->00:16:30.857 because even though we couldn't glitch over the PIN on the device, if you set the 00:16:30.857-->00:16:37.096 passphrase it also encrypts your private key in two sectors so that is the strongest way to use 00:16:37.096-->00:16:41.267 it, um, and we recommend you do that. If you are a hardware designer, either have wallets 00:16:41.267-->00:16:46.305 or, um, any other IOT device you're going to be glitched. So take that into consideration. 00:16:46.305-->00:16:50.376 Um, defenses from faults we're not going to have time to go into this but there's some 00:16:50.376-->00:16:54.480 really good papers on our website that we linked to of how to write functions that are 00:16:54.480-->00:16:59.385 resilient to these kind of attacks. And we want to now show you a live demo, if I can switch 00:16:59.385-->00:17:04.323 the video. Okay, I pressed the magic button over here. Okay, sweet. Okay. So, Chris has got 00:17:15.301-->00:17:20.439 the ChipWhisperer up on stage. We've got our board, which again is a Trezor clone. Uh, he is 00:17:20.439-->00:17:24.610 loading up the ChipWhisperer software which is in the top left. Uh, the top right you'll 00:17:24.610-->00:17:29.482 see a display of the scrolling output once he turns on the target. And we, we did all the 00:17:29.482-->00:17:34.520 hard work. We know what the glitch parameters are so we're just gonna press the magic 00:17:34.520-->00:17:39.692 button. And, okay! So there was the glitch. And if we stop it, he'll highlight that loop there, 00:17:39.692-->00:17:44.130 he'll highlight where the glitch happened. And the code in the bottom left is this nested while 00:17:44.130-->00:17:48.768 loop. We inserted the glitch and we, well what we think happened is we busted out of that one 00:17:48.768-->00:17:53.372 while loop, got back to that other while loop and then it kept going. And Chris can modify 00:17:53.372-->00:17:58.244 some parameters and make it not work. Make it do different things. We'll do some live 00:17:58.244-->00:18:03.215 glitching here. Um, okay, so then it resets when you see "Hello". Okay that one just 00:18:03.215-->00:18:07.553 reset the board, right, so resets aren't necessarily that interesting. Um, they can be. 00:18:07.553-->00:18:12.558 There are reset attacks like on the XBox. Um, he'll change some parameters... sometimes it 00:18:12.558-->00:18:16.195 doesn't work. So this is the trial and error part that we were talking about that's really 00:18:16.195-->00:18:22.001 painful. But, uh, yea. Voltage glitching does work on this microcontroller. [applause] 00:18:22.001-->00:18:27.006 Thank you! [applause continues] And I think that's gonna wrap it up for us. We did also do some 00:18:32.178-->00:18:36.949 other stuff which will be on the slides. We made an OpenCV PIN descrambler so if you, there's a 00:18:36.949-->00:18:42.388 little thing, you can now bypass that with OpenCV. And we decapped, uh, the STM32 and 00:18:42.388-->00:18:47.393 we'll post the silicon slides, um, pictures of the MC up there, but, thank you! >>Thank you! 00:18:50.963-->00:18:51.564 [applause]