00:00:00.458-->00:00:04.375 >>So, this talk is titled Untrustworthy Hardware and How to Fix It. But due to the 00:00:04.375-->00:00:09.417 destination of the project I think it would be better titled 'Seeking Hardware Transparency'. 00:00:09.417-->00:00:14.458 Uh, I'd like to thank the contributors that made this happen, so uh, some of the 00:00:14.458-->00:00:18.292 channels on Freedom were very helpful. Some of the people in the open risk community really 00:00:18.292-->00:00:23.000 helped make this happen as well as propeller guy who worked on the propeller, uh, IO interface 00:00:23.000-->00:00:28.333 that we have. Before get we started I'd like to speak a bit on what I do like in the, uh, 00:00:28.333-->00:00:33.958 computer community. Uh, that is the fact that we are not relying on closed source black box and 00:00:33.958-->00:00:40.250 known weak algorithms anymore. We have, uh, trusted free and open source, uh, crypto 00:00:40.250-->00:00:44.208 algorithms that are heavily scrutinized and readily available and widely deployed. 00:00:44.208-->00:00:48.792 So for this talk I'd like for you to forget about software for a bit - I don't want to think 00:00:48.792-->00:00:53.375 about any of these but I do want you to still think about security. So, where do we go 00:00:53.375-->00:00:58.250 from here? Uh, right below software, uh, this is drawn on just about every, uh, computer 00:00:58.250-->00:01:02.833 system we've got firmware and that sits below the software and interfaces with the hardware and 00:01:02.833-->00:01:08.292 firmware is almost exclusively closed sourced and controls almost all hardware devices and 00:01:08.292-->00:01:13.417 functions Uh, and due to its low level nature, uh, this firmware is persist across, uh, OS 00:01:13.417-->00:01:17.750 installations if, uh, we ever have, uh, we ever have malicious installations. There's a lot of 00:01:17.750-->00:01:21.583 research in this space and I'm not an expert on it but I encourage you to check out some 00:01:21.583-->00:01:26.458 of the Def Con talks on it because they really go into some of the details there. Uh, below 00:01:26.458-->00:01:30.125 that, uh, we have hardware and that is where we're going to be spending a lot of our time. Uh, 00:01:30.125-->00:01:35.250 hardware is almost always absolutely trusted because it's where you run your computations. 00:01:35.250-->00:01:39.583 Unfortunately though, groups like the NSA and other nation states have been caught 00:01:39.583-->00:01:45.625 attacking this space. So, we have seen, uh, the NSA attacking Cisco system. We have the DOD 00:01:45.625-->00:01:49.417 considered about rival nations states backdooring their hardware. Even Apple is 00:01:49.417-->00:01:52.458 suspecting that some of their server shipments now are backdoored so they're actually 00:01:52.458-->00:01:56.583 looking to get back into the server space. Uh, I think somebody's on the internet said 00:01:56.583-->00:02:01.208 it best 'if the their hardware is compromised their whole machine is compromised'. Now, 00:02:01.208-->00:02:05.750 just as an example, we've probably seen this slide a few times before, uh, the NSA is 00:02:05.750-->00:02:09.542 unpacking, uh, Cisco shipments and they're implanting them with, uhm, rogue hardware 00:02:09.542-->00:02:13.333 devices. So, hardware backdooring is very real and it is a concern that we need to 00:02:13.333-->00:02:18.875 look at going forward. One thing that really concerns me is, uh, Intel management engine. So, 00:02:18.875-->00:02:23.500 this technology is found on just about every Intel system in the last ten years - it's not a 00:02:23.500-->00:02:28.208 straight up back door but it does pose significant threats. So, management engine is 00:02:28.208-->00:02:33.375 actually a dedicated logic device that sits on your CPU or on your chip-set depending on 00:02:33.375-->00:02:39.167 what, uh, architecture you have. And controls a whole bunch, uh, special features on the system. 00:02:39.167-->00:02:44.208 It's got system access at the lowest level it's got network access, it's actually got it's 00:02:44.208-->00:02:49.000 own IP address and MAC address to handle everything. Uh, it remains functional in the 00:02:49.000-->00:02:52.500 background even if the system is off. It actually runs on standby power - so, if any of you are 00:02:52.500-->00:02:58.042 familiar with lights out management on servers, it's like that but you can't control it 00:02:58.042-->00:03:03.792 and you can't disable it and you can't turn it off. Uh, this may sound like a server feature of 00:03:03.792-->00:03:09.583 course when I mention lights out management but as we can see in some of Intel's product slides 00:03:09.583-->00:03:14.375 this shows up on high-end desktops, it shows up on desktops; it shows up up in some 00:03:14.375-->00:03:20.125 of their 03:15 tablets but I can't confirm that. Before we go further though I think it would 00:03:20.125-->00:03:24.167 be good to cover what Intel management engine actually is. So, most of this information 00:03:24.167-->00:03:29.833 comes from poorly secured FTP servers. Uh, it runs through an x-real time operating system 00:03:29.833-->00:03:34.583 which you probably haven't heard of -it's closed source and proprietary of course. It has 00:03:34.583-->00:03:38.875 it's own MAC address and IP address for out of band features as I've mentioned. Uh, some of 00:03:38.875-->00:03:43.958 the code is found in, uh, inaccessible on chip ROMS so you'd have to decap them somehow 00:03:43.958-->00:03:49.625 to access them. Other, uh, parts of the firmware are found on the motherboard itself in the system 00:03:49.625-->00:03:54.875 firmware. That's what makes it hard to install libreboot on modern laptops. Uh, it uses 00:03:54.875-->00:04:00.125 compression and encoding to throat reverse engineering, uh, and it's found all sorts of 00:04:00.125-->00:04:04.542 system architectures so the actual management engine itself, uh, varies between platforms. 00:04:04.542-->00:04:08.125 IT's very hard to figure out exactly what's going on because Intel's very secretive about it. 00:04:08.125-->00:04:13.708 But it's, uh, been documented, uh, using arch which is very popular in embedded space. Uh, 00:04:13.708-->00:04:20.542 some of them use spark V8, why, why some celeron chips are in intel processors is beyond me. 00:04:20.542-->00:04:24.500 Uh, Hacker Day summarized it best - in short, Intel management engine is a reversed 00:04:24.500-->00:04:29.500 engineer's worst nightmare. Uh, I like this slide. [laughter] If it's not a backdoor already it's 00:04:33.458-->00:04:36.542 waiting to be a backdoor. And I think if you've paid attention to the, some of the hardware 00:04:36.542-->00:04:41.458 security space in the last year, uh, it's getting closer to that everyday. Uh, it is effectively 00:04:41.458-->00:04:47.000 the perfect hardware backdoor, in fact, because it's built for IT infrastructure to manage, uh, 00:04:47.000-->00:04:52.250 laptops and hardware in the field and do, uh, updates and repairs to systems without 00:04:52.250-->00:04:55.542 having to reinstall the operating system or work at the operating system level. As i 00:04:55.542-->00:05:00.375 mentioned earlier, it's found in all Intel systems from about 2008 to 2009 and the worst part 00:05:00.375-->00:05:06.417 is, even though you bought your CPU, you paid your money for it and it belongs to you. You don't 00:05:06.417-->00:05:11.375 control it - you can't disable this. It's like I have this hardware platform but I don't 00:05:11.375-->00:05:14.542 have control over it. And that was really one of the inspirations for this talk. I 00:05:14.542-->00:05:20.458 was tired of seeing hardware where I, I owned it and I was running my code, I was running 00:05:20.458-->00:05:26.167 my open source software on it but I couldn't control the system. Uh, some of you may be 00:05:26.167-->00:05:30.750 thinking about Intel's competitor AMD which has significantly less market share 00:05:30.750-->00:05:36.083 currently, unfortunately. They also have a similar technology called 'Trustzone' slash, uh 00:05:36.083-->00:05:41.000 'security platform processor.' But, uh, given that they haven't made CPUs recently until Zen, 00:05:41.000-->00:05:47.167 uh, this technology has not been well documented or researched. Before we go on to the solution 00:05:47.167-->00:05:51.958 though - it's always fun to go over some hypotheticals. So, we're gonna go do a little bit 00:05:51.958-->00:05:57.042 of speculation - what's the worst we can do to hardware? So, what about nation states? These 00:05:57.042-->00:06:01.250 people are always fun because they have tons and tons of money. Uh, hardware backdooring 00:06:01.250-->00:06:05.833 is viewed as a threat by nation states. They see other nation states as a threat so the DOD is 00:06:05.833-->00:06:10.458 actually looking at bringing, at bringing chip fabrication back to the US for some of their work 00:06:10.458-->00:06:15.750 because they wanna know that the chips that run their systems are secure. Uh, nation states of 00:06:15.750-->00:06:20.250 course could backdoor, uh, product manufacturing with switched additional components. 00:06:20.250-->00:06:26.333 They actually attack, generally, the shipping stage of, uh, delivering the product but they 00:06:26.333-->00:06:31.292 could also attack them at the manufacturing depending on the situation. Uh, as I mentioned, 00:06:31.292-->00:06:37.125 CPUs chipsets, uh, you know, face cards, ROMS - they could all be backdoored if they 00:06:37.125-->00:06:43.417 wanted. I think what highlights this best is there's a piece of hardware that the NSA created 00:06:43.417-->00:06:49.833 that's called 'Flux bab' that is built for one specific server that is implanted while in 00:06:49.833-->00:06:56.583 shipment. If the NSA is willing to make a custom chip to attack hardware - why aren't they 00:06:56.583-->00:07:01.000 attacking the fabrication centre? So, you may think - oh but it's too hard! Well it's 00:07:01.000-->00:07:06.792 not, uh, university of Michigan in their paper, uh, 'A2 analog malicious hardware' have 00:07:06.792-->00:07:12.083 documented it's all too easy for a single employee to backdoor a chip in the fabrication centre. 00:07:12.083-->00:07:16.250 So there's a slide from them talking about their A2 trigger that that cause all kinds of 00:07:16.250-->00:07:19.958 security concerns if implanted. Uh, there's some great articles on that, uh, paper if you're 00:07:19.958-->00:07:23.958 interested in more. So, it's, I believe it's entirely possible for a nation state to 00:07:23.958-->00:07:28.750 accomplishment lead to widespread, uh, total compromise with, while being virtually 00:07:28.750-->00:07:34.750 undetectable. If you can't trust the manufacturer what are you gonna do? So, I was looking at 00:07:34.750-->00:07:39.458 all this It was actually, uh, it was before the Intel management exploits that happened this 00:07:39.458-->00:07:42.292 year. I believe it was a Hacker Day article where they were summarizing Intel management 00:07:42.292-->00:07:46.208 engine and I didn't like the statement. Of course they were saying, you know, it was very 00:07:46.208-->00:07:51.500 nasty. But the end of the article, uh, was this is in every desktop you've got in your 00:07:51.500-->00:07:55.500 system and you're screwed because you can't do anything about it and I didn't think that 00:07:55.500-->00:08:00.417 was very fun. I wanted to do something else so I started looking around. So, of course 00:08:00.417-->00:08:03.708 when you start looking at open source hardware, well, you're gonna see, open source hardware; 00:08:03.708-->00:08:08.125 you're gonna see libreboot; uh, you're gonna see stuff like the Novena hacker laptop, which are 00:08:08.125-->00:08:12.750 very cool. But a lot of these systems still require blobs - so these are precompiled pieces of 00:08:12.750-->00:08:18.042 code that you can't inspect. They're basically closed source software - they run on system 00:08:18.042-->00:08:22.708 and off course these, all these platforms still require you to use closed source silicon so you 00:08:22.708-->00:08:28.167 don't know what's under that little plastic package still. As I said this still lead to users 00:08:28.167-->00:08:34.167 trusting the chips. So I really like all these projects. They're really cool. Uhm, I wanted to 00:08:34.167-->00:08:39.375 look into a hacker laptop but their expensive. Uh, but I wanted to see what could be done 00:08:39.375-->00:08:43.250 for a piece of my private computation for critical situations and what could be 00:08:43.250-->00:08:48.250 done for downright paranoid users like me. What can I do in this situation? Uhm, can I build 00:08:52.000-->00:08:57.000 a cost effective low-level solution that offers maximum transparency. So, on our system, 00:09:01.417-->00:09:07.292 I, uh, I have Linux running on an FPGA along with some other chips so I know exactly what my 00:09:07.292-->00:09:13.042 CPU is doing. Which, so, so for those of you who aren't familiar with FPGAs - these are very 00:09:13.042-->00:09:18.250 special pieces of silicon. They're used by companies to make new chips. They are 00:09:18.250-->00:09:25.167 effectively blank slates of logic - so, if I write, uh, software in a hard description 00:09:25.167-->00:09:29.208 language which is what you program these in and then I synthesize them with a bitstream 00:09:29.208-->00:09:33.958 generator I get a very special piece of code that I can load onto this board which configures 00:09:33.958-->00:09:39.292 one specific type of chip and very specific way so that emulates the hardware device 00:09:39.292-->00:09:43.167 that I have designed.The hardware description language is the easiest to program these 00:09:43.167-->00:09:49.458 FPGAs are also what most companies use for actual chip fabrication nowadays. Uh, as 00:09:49.458-->00:09:54.000 I've mentioned earlier they're, right now, these FPGAs are used for the chip prototype but 00:09:54.000-->00:09:58.333 sometimes the're also used in special hardware applications where it's just not economic to 00:09:58.333-->00:10:03.333 fabricate chips themselves. So, we offer a lot of, uh, opportunities for hobbyists who 00:10:03.333-->00:10:07.875 want to design their own chips and they also offer people like me the opportunity to build a 00:10:07.875-->00:10:13.458 system where I know everything that's going on. Because I effectively have a processor 00:10:13.458-->00:10:20.292 running on there that acts just like true silicon at a reduced clock rate of course. But I can 00:10:20.292-->00:10:26.042 do all my computation there so our, our, our alternative is built on a cryptographic use 00:10:26.042-->00:10:30.250 case because that's about all I can do with this system. It runs good in Linux as I mentioned 00:10:30.250-->00:10:36.458 earlier. Uh, you can see the, the block diagram of that, uh, board over there. That's the DEO 00:10:36.458-->00:10:41.792 nano that we're using to run the software right now. Uh, it's fully open-sourced hardware and 00:10:41.792-->00:10:45.125 software - right down to the chip designs that both major components. Although the board 00:10:45.125-->00:10:49.458 is not actually open-source hardware on the DEO nano side, I'm just talking about the chip 00:10:49.458-->00:10:54.250 there. Uh, we're using the parallax propeller for IO so the parallax propeller acts as a 00:10:54.250-->00:10:59.250 terminal emulator similar to, uh, an older serial terminal. Uh, and the we have the OpenRisc 00:11:02.250-->00:11:09.208 CPU design - the MOR1KX 68 with CPU running on it, FPGA, uh, running the OS, uh, operating 00:11:09.208-->00:11:13.000 system. So, we took the open ware CPU standard we built a system around it so it's go 00:11:13.000-->00:11:18.750 Jtag, it's got UR, it's got an SDram but, it's a fully functional processor. We've got 00:11:18.750-->00:11:23.750 a block diagram to explain this. So, we've got the open risk MOR1KX open source CPU that's 00:11:26.583-->00:11:33.500 hooked up to FPGA ROM and then it's got the Jtag interface there. We're gonna add a 00:11:33.500-->00:11:39.125 paralyzed propeller over 1 1 5 200 bot serial and that's hooked up to the propeller ROM where it 00:11:39.125-->00:11:42.917 stores the spin code so that's it's native language that the propeller understands. You may 00:11:42.917-->00:11:47.917 be familiar with the propeller actually because that was used on any of the Def Con badges in 00:11:47.917-->00:11:51.583 previous years. I believe the Def Con 20 and the Def Con 22 badge both used the parallax 00:11:51.583-->00:11:56.833 propeller. And then to actually interact with the system where you have the keyboard over PS2, 00:11:56.833-->00:12:01.833 uh and a TFT LCD over SPI. [cough] So, Linux is, uh, image is built with most tool chains 00:12:04.625-->00:12:09.708 available for open risk. Uh, openADK actually makes the really nice because you can 00:12:09.708-->00:12:14.542 download it and run make menuconfig and it's basically a smorgasbord where you can choose 00:12:14.542-->00:12:19.500 all your Linux tools and, uh, pick your architecture and it just builds the Linux image for 00:12:19.500-->00:12:23.250 you very nicely. You can even do some compression with it. Uh, we're loading it with open on 00:12:23.250-->00:12:29.042 chip debugger and gnu debugger. That propeller is programmed spin and it's using prop-loader 00:12:29.042-->00:12:35.333 of course to load it which is an open source tool and running open spin. And then the FPGA is 00:12:35.333-->00:12:41.292 programmed with the 'dot SOF' open risk image which generated using fuse SOC and that's loaded 00:12:41.292-->00:12:47.750 onto the board using Intel Core, Intel acquired Altera a while back. So, now on to the results, 00:12:47.750-->00:12:52.333 the results are a bit complicated - so we have the final product here. Uh, in the 00:12:52.333-->00:12:57.250 upper right kind of middle of the, uh, first picture there. You can see the DEO nano under 00:12:57.250-->00:13:01.167 those two fans. We have the parallax propeller, the fans are providing some down draft 00:13:01.167-->00:13:07.000 airflow to cool the thing off. So, they look cool, I like fans. Uh, and I've got two batteries 00:13:07.000-->00:13:10.333 in there to power the thing that are a but overkill they use those to also get fun through 00:13:10.333-->00:13:15.333 TSA. This device does not look suspicious at all. [laughter] We've got, uh, two power 00:13:18.333-->00:13:22.333 controllers there so that's making sure the batteries don't blow up which is very important. 00:13:22.333-->00:13:27.125 On the picture on the right there you can see some of the cabling so that's actually the 00:13:27.125-->00:13:33.500 wiring for the TFT LCD and uh, little wire at the top is the, uhm, serial output of the, uh, 00:13:33.500-->00:13:38.500 DEO nano board. So, this is where it gets a bit weird. So, it worked great but it actually 00:13:41.125-->00:13:47.625 does work now. Right before Def Con this was the morning before I flew out the board all of a 00:13:47.625-->00:13:52.750 sudden was giving me a, some sort of strange error code. Error code 87 - can't scan Jtag 00:13:52.750-->00:13:59.333 chains. That doesn't look good. Let's go to Intel, uh, let's see. They want me to buy a new 00:13:59.333-->00:14:05.375 USB blaster cable, if you look back here, uh, the USB blaster is actually on the board so 00:14:05.375-->00:14:10.875 they're asking me to buy another board. Turns out when you're flying out that morning you 00:14:10.875-->00:14:15.875 can't exactly get a DEO nano FPGA board. But I had a backup video. So, on this if it's going 00:14:18.458-->00:14:23.458 to play properly. Come on! My bad... We have me holding a camera, looking at a screen, 00:14:26.208-->00:14:31.417 looking at the terminal output. This is a serial output running into xterm of the processor and 00:14:31.417-->00:14:34.875 it's gonna boot to a busybox console in a moment here. So we'll actually get to see the 00:14:34.875-->00:14:41.375 system running. It runs on the TFT LCD but for visibility I had it running back into my laptop. 00:14:41.375-->00:14:47.500 So, should get the busybox shell here and I'm now going to with one hand tie, catch prox CPU 00:14:47.500-->00:14:52.500 info so... Just give me time. It's, it's harder than it looks. [laughter] There we go - so you 00:14:55.125-->00:15:00.125 can see the open source CPU there and I'm just gonna halt the system. Good. Done. So, 00:15:04.417-->00:15:10.333 FPGAs are no fun - turns out. Uh, the tools are massive - they are like six gigabytes, uh, 00:15:10.333-->00:15:15.292 compressed to download. Uh, and they're not, no fun to work with because there's a whole lot of 00:15:15.292-->00:15:20.000 stuff you need to mess around with just to get the board up and running. So, uh, as a result 00:15:20.000-->00:15:23.167 of this project I put together a thing called 'Build Script' - I'm probably gonna change that 00:15:23.167-->00:15:28.167 name. Uh, that takes the suck out of FPGAs hopefully. So it downloads everything for you, 00:15:30.458-->00:15:36.667 hopefully. It loads the bit stream to the DEO nano after you've built it so it has a fuze 00:15:36.667-->00:15:41.667 SOC integration so it can use fuze SOC to, uh, build that image, uh, it can write gnu 00:15:44.333-->00:15:51.042 Linux to memory. So, you don't have to deal with openOCD or, uh, connecting over Telnet. Uh, 00:15:51.042-->00:15:55.333 it can program the propeller and it's gonna have a harder setup guide in a bit because there's 00:15:55.333-->00:15:59.917 actually very hard to find documentation of where the serial output was when you 00:15:59.917-->00:16:05.708 loaded the thing up properly. Uh, it's a fully interactive piece of software. All code of 00:16:05.708-->00:16:10.292 course; 3D models, uh, guides will be available shortly at that link which you can 00:16:10.292-->00:16:16.042 download, uh, from the Def Con torrent server with this talk. So, I don't think I got to this 00:16:16.042-->00:16:20.500 earlier but this is the actual physical device that I built for myself. So you can see 00:16:20.500-->00:16:24.208 everything on the back there - it's got nice blinky lights cause that's of course what's 00:16:24.208-->00:16:29.667 important. We all know that's what you're after. Uhm, and if I had a keyboard with me I would 00:16:29.667-->00:16:34.667 be able to plug into this thing and, and run it. Before we go - one more things - kind of broad 00:16:39.292-->00:16:45.792 headed there. AMD on Reddit recently has publicly stated they're strongly considering 00:16:45.792-->00:16:49.917 open sourcing their IME equivalent, uh, which is platform security processor 00:16:49.917-->00:16:54.042 slash trust zone. But unfortunately, and that was about three months ago and they 00:16:54.042-->00:16:57.458 haven't done anything since. But if they find it economically viable that would be really 00:16:57.458-->00:17:03.042 really nice. This is an ongoing project - this system is not the final state. This was built, uh, 00:17:03.042-->00:17:08.833 after school was over and about two months before Def Con. I wanna add some RF side channel 00:17:08.833-->00:17:13.292 hardening. Uh, the thing is already battery powered because there's, uh, if any of you are 00:17:13.292-->00:17:18.042 familiar with power based side power analysis for, uh, crypto attacks, they're very, very, 00:17:18.042-->00:17:23.958 very effective against FPGAs due to the design of the chip. So, I already addressed that by adding 00:17:23.958-->00:17:28.333 battery, battery power to this thing. So it's not running off the AC but I would also like to 00:17:28.333-->00:17:33.542 have it running off of a, or running with a RSA channel hardening as some sort of cage. 00:17:33.542-->00:17:36.583 Uhm, also look at increased system independency - you don't have to deal with all that 00:17:36.583-->00:17:41.250 programming stuff. You can, I wanna add Uboot but I haven't gotten there yet. Uh, if you're 00:17:41.250-->00:17:46.042 interested in this space, uh, you should check out some of this stuff. So I'm not expecting 00:17:46.042-->00:17:49.458 you to copy download links of course. As I said, go to the Def Con torrent server and get this 00:17:49.458-->00:17:55.167 talk. [sneeze] I've got stuff in here about firmware, uh, NSA shipment hijacking, uh, there's 00:17:55.167-->00:18:00.500 some stuff that came out last year with Windows golden keys where, uh, it kind undermines 00:18:00.500-->00:18:05.333 secure boot when they, when those keys got leaked. Uh, there's a lot of articles about 00:18:05.333-->00:18:08.417 Intel management engine and there's a lot of good information out there if you're 00:18:08.417-->00:18:13.333 interested in what's running inside your system. Uh, that's all documented here along with 00:18:13.333-->00:18:17.417 that link to the A2, A2 analog malicious hardware paper. If you're interested in getting 00:18:17.417-->00:18:22.208 into open risk or any of the open source processor stuff that is on their, uhm, homepage - 00:18:22.208-->00:18:28.625 'open risk dot i o'. Along with the, uh, other resources. Uh, before we go though I would like 00:18:28.625-->00:18:33.458 to make some comments that this device is not meant to be a silver bullet for all hardware 00:18:33.458-->00:18:38.583 concerns. This was a, uh, project I had built for myself because I didn't like the state 00:18:38.583-->00:18:42.292 of hardware. What I want you to get out of this talk is that there are some problems with 00:18:42.292-->00:18:46.875 hardware, uh, there are some problems that people aren't addressing. Uh, I would like 00:18:46.875-->00:18:50.208 more control over my processor and I think there are other people who would like that too. 00:18:50.208-->00:18:54.792 And I think if we start talking about this maybe we could push this for more open source 00:18:54.792-->00:18:59.792 hardware and more system transparency. Thank you. [applause] [cheering]