1
00:00:00,000 --> 00:00:01,860
I have pushed the button.

2
00:00:02,000 --> 00:00:04,520
Now we're waiting on it to kick over.

3
00:00:06,900 --> 00:00:18,220
And see, I learned I have to actually refresh this thing, because for some reason sometimes the stream will just continue playing whatever source it was playing.

4
00:00:19,100 --> 00:00:20,940
And now it's music.

5
00:00:24,520 --> 00:00:26,260
It's still music.

6
00:00:34,010 --> 00:00:35,010
Let's do it.

7
00:00:35,010 --> 00:00:37,770
Oh, oh, oh, oh, that's looking good.

8
00:00:37,890 --> 00:00:40,170
Hey, there's a bunch of faces.

9
00:00:40,670 --> 00:00:41,990
All right.

10
00:00:41,990 --> 00:00:43,770
Hello, DEF CON.

11
00:00:43,930 --> 00:00:47,950
Welcome to your early morning Sunday content.

12
00:00:48,250 --> 00:00:50,150
My name is Fallible.

13
00:00:50,150 --> 00:00:52,010
We have got Jethro here.

14
00:00:52,010 --> 00:01:02,530
Joining us from the speaker side is Mickey and Jesse with the Q&A portion for their talk of Bytes in Disguise.

15
00:01:05,390 --> 00:01:06,630
Oh, hold on.

16
00:01:06,630 --> 00:01:10,050
Before I do this, I have one more button I have to push on my side.

17
00:01:10,110 --> 00:01:10,630
Okay.

18
00:01:11,030 --> 00:01:27,790
So before we get going here, I guess I'd like for the two of you to tell us a little bit about yourselves and your DEF CON history, because I know that neither of you are strangers to the hanging out in the desert with a bunch of geeks for a weekend.

19
00:01:27,790 --> 00:01:30,830
So tell us a little about yourselves.

20
00:01:33,050 --> 00:01:34,370
Go ahead, Jesse.

21
00:01:34,810 --> 00:01:36,910
Okay, I can start that.

22
00:01:37,230 --> 00:01:48,590
So I first started coming to DEF CON in 2003 when I was still back at the Alexis Park and was playing CTF back then and ended up winning a couple black badges.

23
00:01:48,590 --> 00:01:58,670
So I've been coming to DEF CON every year since 2003 and enjoying myself a lot and having a lot of fun and ended up starting giving talks a few years ago.

24
00:01:58,670 --> 00:02:02,590
So I think this is number five, maybe.

25
00:02:02,590 --> 00:02:05,990
I need to go count how many talks we've actually given, but I've had a lot of fun here.

26
00:02:06,270 --> 00:02:08,990
Casual drop in there, a couple black badges.

27
00:02:11,150 --> 00:02:16,150
Yeah, I'm not as acquainted with DEF CON as Jesse is.

28
00:02:16,470 --> 00:02:26,350
I started coming to DEF CON since DEF CON 19 and been speaking since 20, except 21, I think.

29
00:02:27,530 --> 00:02:29,010
I didn't get a black badge.

30
00:02:29,010 --> 00:02:30,430
I had to make my own.

31
00:02:32,530 --> 00:02:34,630
Give a talk about that, too.

32
00:02:35,570 --> 00:02:40,410
Yeah, I love the vibe, love the community.

33
00:02:41,230 --> 00:02:44,450
Great experiences, horrible stories.

34
00:02:45,310 --> 00:02:47,270
Yeah, it sounds about right.

35
00:02:47,270 --> 00:02:48,210
Well, excellent.

36
00:02:49,710 --> 00:02:55,690
I know that Jethro over here has a lot of interesting things to say about your talk.

37
00:02:55,690 --> 00:03:03,610
I have some interesting things to say about your talk, but I'm not into the niche that you occupy.

38
00:03:03,610 --> 00:03:14,810
So I will be watching for some of the questions that come in and maybe we'll have my fellow goon ask our initial question while I watch channels.

39
00:03:15,970 --> 00:03:16,490
Sure.

40
00:03:16,490 --> 00:03:16,790
Yeah.

41
00:03:16,790 --> 00:03:24,590
So for me, I watched the talk and I thought it was kind of cool, just the number of different places that you could actually hide information.

42
00:03:24,910 --> 00:03:36,730
And the joke I was saying is like, you've literally covered everything from like, hey, you need to wear a wrist strap when you go into this to, you know, Google hacking, like just run these searches and get this information to, you know, here's how to write random chips and,

43
00:03:36,730 --> 00:03:37,610
you know, code release.

44
00:03:37,950 --> 00:03:42,410
I guess like so quick 30 seconds, like what I guess what's the someone hadn't seen the talk yet?

45
00:03:42,410 --> 00:03:44,570
How would you recap everything for them?

46
00:03:44,570 --> 00:03:45,830
What are the high points?

47
00:03:47,590 --> 00:03:49,430
Not wearing a wrist strap.

48
00:03:50,570 --> 00:03:53,670
Let's, let's, let's do a 30 second recap for an hour talk.

49
00:03:55,910 --> 00:03:57,730
What's the best part they should look out for?

50
00:03:57,730 --> 00:03:59,370
Why should they go and watch it?

51
00:04:00,030 --> 00:04:01,610
The demo music.

52
00:04:03,050 --> 00:04:05,530
Yeah, the bossanova thing.

53
00:04:05,530 --> 00:04:06,370
Well done.

54
00:04:07,750 --> 00:04:08,770
No, no.

55
00:04:08,770 --> 00:04:08,950
Yeah.

56
00:04:08,950 --> 00:04:13,730
So, so really, I mean, like guys, what inspires you to take like such a complete look at the attack surface, right?

57
00:04:13,730 --> 00:04:17,630
Like, how did you think to start to look at all these different ways that you could go after devices?

58
00:04:22,900 --> 00:04:27,640
We both have similar perspectives, but they're slightly different.

59
00:04:29,120 --> 00:04:30,460
What got us into this?

60
00:04:30,460 --> 00:04:34,340
Well, I'd say we got tired of getting caught.

61
00:04:36,380 --> 00:04:48,800
So when we do the red team exercises or whatnot, and we want to hide our payloads and we always get caught and, you know, adding in a memory and on disk and all kinds of locations.

62
00:04:49,080 --> 00:04:52,360
And we've had a lot of experience dealing with hardware and firmware.

63
00:04:52,360 --> 00:04:53,280
And we thought, why the hell not?

64
00:04:53,280 --> 00:05:01,320
I mean, there's so many places that everyone thinks that once you go, the lower you go in the stack, the more complicated things get.

65
00:05:01,360 --> 00:05:08,960
They don't actually, they're way simpler, but they're just a little bit low level than most people are comfortable with.

66
00:05:08,960 --> 00:05:11,520
But they're not too complex.

67
00:05:11,640 --> 00:05:16,320
And once you get over that hurdle, you go, oh, I can just do that.

68
00:05:16,320 --> 00:05:17,000
That's awesome.

69
00:05:17,000 --> 00:05:19,480
I'll just write firmware to this thing.

70
00:05:20,660 --> 00:05:22,140
As simple as that.

71
00:05:23,260 --> 00:05:23,820
Yeah.

72
00:05:23,820 --> 00:05:31,340
I mean, there are a lot of mitigations in the operating system and application level that there's been a lot of attention there.

73
00:05:31,340 --> 00:05:40,640
So there's all kinds of OS level application security stuff, looking at the file system, doing scans of the file system are really common.

74
00:05:40,640 --> 00:05:46,860
And there's been a move towards like fileless malware and doing stuff only in memory.

75
00:05:47,160 --> 00:05:56,820
But a lot of that is just, you get code execution on the box and run fileless in, or just in memory.

76
00:05:56,820 --> 00:06:13,540
But being able to store stuff in places that people aren't looking gives you that additional persistence where the loader that you actually have on disk looks completely benign because people don't understand how these access mechanisms work in most cases.

77
00:06:13,540 --> 00:06:33,760
So being able to have something that looks benign on disk and it'll pass all the, like you can throw it up on VirusTotal and everything is 100% clean, but it still can go read the actual malicious payload out of the GIGI region or from some random USB controller firmware that's unsigned.

78
00:06:33,940 --> 00:06:46,820
And maybe it has some encryption key or something like that, where the only thing that happens in memory is malicious, but the thing that actually happens on disk is completely benign.

79
00:06:46,820 --> 00:06:50,860
And it's an interesting mechanism for persistence.

80
00:06:50,860 --> 00:06:58,500
And we wanted to provide more visibility into that and let people know that this type of capability exists in the system.

81
00:06:58,980 --> 00:07:00,780
Were you inspired?

82
00:07:01,220 --> 00:07:02,560
Go ahead.

83
00:07:02,600 --> 00:07:08,420
I was going to say, yeah, if you were inspired by any particular researcher attackers using similar techniques.

84
00:07:10,400 --> 00:07:21,000
I mean, there's generally been, like I said, there's been all this research and attackers in the operating system space and attackers have started moving down in the stack.

85
00:07:21,000 --> 00:07:23,220
Like we've seen UEFI implants.

86
00:07:23,220 --> 00:07:25,160
There was like a Lojax implant.

87
00:07:25,280 --> 00:07:27,720
There were some other ones were found in the wild.

88
00:07:27,800 --> 00:07:34,260
There was something in the Vault 7 leak that was talking about an EFI implant that they were using there.

89
00:07:34,380 --> 00:07:38,420
So I think there's a trend towards people moving further down into the stack.

90
00:07:38,720 --> 00:07:49,440
And a lot of these firmware components at those lower levels in the stack don't have all those same hardening protections that the application and operating system has.

91
00:07:49,440 --> 00:07:56,180
So you don't have things like code signing protecting your firmware in the stack or firmware in some of these devices.

92
00:07:56,180 --> 00:08:05,820
A lot of these are lower cost, lower power devices that maybe they don't have like a nice crypto engine built into this chipset.

93
00:08:05,820 --> 00:08:12,860
So a lot of that is lagging behind just because there isn't this additional visibility and people going after these components.

94
00:08:12,860 --> 00:08:18,600
And it's an area that's ripe for exploration and exploitation.

95
00:08:18,640 --> 00:08:25,560
And like we talked about in our talk, some friends of ours gave a talk about doing this type of thing using UEFI variables.

96
00:08:25,560 --> 00:08:28,240
And we were like, but wait, there's more.

97
00:08:28,240 --> 00:08:30,860
So let's go out after some of these other areas.

98
00:08:30,860 --> 00:08:34,460
So that was kind of the inspiration for this talk.

99
00:08:34,900 --> 00:08:37,320
So a lot of what you're saying is really interesting.

100
00:08:37,320 --> 00:08:39,680
I work way higher.

101
00:08:39,680 --> 00:08:51,740
I'm kind of in the website usually, and there's a lot of things that have happened over the years in the website that make it harder-ish to do the web hacking world.

102
00:08:52,120 --> 00:09:04,940
It sounds like there's maybe less... because there's less people working in the space of attacking low level, are there less mitigations that I would run across if I got into it?

103
00:09:07,100 --> 00:09:08,280
That depends.

104
00:09:08,280 --> 00:09:10,320
I mean, it is lagging behind to some degree.

105
00:09:10,320 --> 00:09:19,800
There are some... so people, depending on what people's understanding, like you said, you work in the web space.

106
00:09:19,800 --> 00:09:22,700
So you may be familiar with web stuff.

107
00:09:23,160 --> 00:09:25,440
People can talk about a full stack.

108
00:09:25,440 --> 00:09:35,640
And there's the full stack of the web stuff that's externally facing, going down to a lot of these underlying levels of the operating system.

109
00:09:35,640 --> 00:09:44,420
And you can get down to the point where you end up looking at bugs in CPU microcode that have side channel implications.

110
00:09:44,420 --> 00:09:48,620
And there's a lot of different vulnerabilities all throughout that stack.

111
00:09:48,620 --> 00:09:54,760
And there's been a lot of effort to do the easier stuff that's more directly exposed to the user.

112
00:09:54,760 --> 00:10:05,580
But there are some of these underlying things, some of these foundational technologies that everything is built on top of, that are kind of lagging behind those exploit mitigations.

113
00:10:05,580 --> 00:10:13,760
Where like when the system powers on and boots up, the processor starts executing code at the reset vector.

114
00:10:13,840 --> 00:10:18,780
It used to be the case this was BIOS, where there was no protections whatsoever there.

115
00:10:18,780 --> 00:10:23,820
Then people have standardized on UEFI, where there's the UEFI firmware that executes.

116
00:10:23,880 --> 00:10:27,060
And a lot of that is they're adding protections there.

117
00:10:27,060 --> 00:10:33,680
But a lot of the times when the UEFI firmware is running, there aren't things like address randomization.

118
00:10:33,800 --> 00:10:36,420
Sometimes the stack and heap are fully executable.

119
00:10:36,440 --> 00:10:42,540
A lot of those mitigations that you're totally used to in the operating system and application space aren't there.

120
00:10:43,120 --> 00:10:49,380
And there is some effort to put some of these mitigations into the reference code.

121
00:10:49,380 --> 00:10:58,800
So there's a... UEFI has a reference specification EDK, EFI development kit, development environment.

122
00:10:59,080 --> 00:11:01,560
And people take that specification.

123
00:11:01,560 --> 00:11:04,340
There's a reference implementation called TianoCore.

124
00:11:04,480 --> 00:11:15,300
Some of these exploit mitigations are going into TianoCore, but there's this whole big supply chain for getting those out to actual customer systems.

125
00:11:15,300 --> 00:11:25,340
So there's reference code in TianoCore that then independent vendors like AMI Phoenix inside take that code, add their own special sauce.

126
00:11:25,340 --> 00:11:34,420
Then the OEMs like HP Lenovo Dell take the code from the independent virus vendor and do their own value add.

127
00:11:34,460 --> 00:11:38,540
And then quite a bit later, that actually ends up shipping in production firmware.

128
00:11:38,540 --> 00:11:43,020
So there's kind of this... there's a lot of components that are going into it.

129
00:11:43,020 --> 00:11:45,840
And it's just lagging behind a little bit.

130
00:11:45,840 --> 00:11:51,980
So something going into the reference code in TianoCore it might not be enabled by default.

131
00:11:51,980 --> 00:11:58,580
And even if it is enabled by default, it's going to take a little while before it actually gets out into the systems that are shipping to customers.

132
00:11:58,580 --> 00:12:07,680
So the other problem is that updating firmware is a lot harder than just pushing out a patch through some Windows update in general.

133
00:12:08,240 --> 00:12:18,620
So there's... they've tried to standardize on firmware updates for system firmware to some degree, but a lot of different vendors are doing things differently.

134
00:12:18,620 --> 00:12:21,620
And that isn't fully easy to do yet.

135
00:12:21,620 --> 00:12:31,980
And so there's the system firmware for your device, the UEFI firmware, but there's also all the firmware for all these embedded controllers like the S-Media controller that Mickey talked about.

136
00:12:31,980 --> 00:12:40,280
And there's a GigE controller that's as part of the Intel PCH chipset that we can write to that region.

137
00:12:40,280 --> 00:13:06,700
We're not reading and writing to the firmware directly for that GigE region, but there's other controllers on the system like there's a lot of servers have a Broadcom 5917 chip that we talked about in some research a while back that also has unsigned firmware that that's a common server chipset where maybe an HP DL380 will have that chipset and you can write firmware there as well.

138
00:13:06,700 --> 00:13:07,940
Sorry, I kind of rambled a lot.

139
00:13:07,940 --> 00:13:08,780
Did you want to say anything?

140
00:13:08,780 --> 00:13:11,600
I need to change my background after that.

141
00:13:14,080 --> 00:13:20,440
Yep, that's pretty much it summarizes everything Jesse talked about.

142
00:13:20,440 --> 00:13:40,180
Yeah, so you have like a operating system security which maybe is updated through Windows Update or maybe Debian or Canonical or Red Hat SUSE repositories where they're providing updates there, but there is a little bit of an effort to update firmware,

143
00:13:40,180 --> 00:13:45,820
all of these different components are out there and some of them just don't have the capability to have signed firmware.

144
00:13:45,820 --> 00:13:58,580
So there's a lot that you can do there and there's not a really good easy way to fix it other than just waiting for the next generation to come out and hopefully it has the capability to have signed firmware as well.

145
00:13:58,740 --> 00:14:05,920
Sometimes they'll have checksums and stuff like that, but that's not a security mechanism and it's pretty easy to bypass and recalculate a checksum.

146
00:14:07,220 --> 00:14:15,600
Excellent, there's a lot there and I'm sure that I'll be watching through this talk later to make sure I get more of what you just said.

147
00:14:15,680 --> 00:14:19,360
We do have some questions coming in from the audience, so I'm going to get to one of those.

148
00:14:21,380 --> 00:14:34,400
So RPTK2015 says, question, do you know of a way to write some code into one of the various EEPROMs that will be capable of executing code by itself without code in the disk?

149
00:14:35,580 --> 00:14:59,820
Yeah, I mean that depends on the capabilities of the specific device, but as an example, there's all the rubber ducky bad USB devices where a lot of flash controllers or flash devices use an 8051 processor as part of the controller and you can write firmware to that and have that essentially act as a keyboard and inject keystrokes,

150
00:14:59,820 --> 00:15:01,060
mass storage, stuff like that.

151
00:15:01,060 --> 00:15:17,880
So if you have the ability to update firmware depending on the capabilities of the device, if it's an internal USB device, it might have the ability to essentially act as a rubber ducky and execute code and basically restage back from the device.

152
00:15:18,160 --> 00:15:30,620
We had given a talk a number of years ago also at DEF CON about an internal Huawei LTE modem that we were able to update the firmware for that and this was an internal device.

153
00:15:30,780 --> 00:15:46,700
Basically it was an M.2 card that was connected to the rest of the system over a USB interface and it essentially was running a version of Android with the Android gadget interface inside of this little M.2 card.

154
00:15:46,700 --> 00:15:52,320
So it was a complete Linux distribution inside of the USB device inside of your laptop or tablet.

155
00:15:52,320 --> 00:15:56,520
So you could essentially update the firmware there and have your payload there.

156
00:15:56,520 --> 00:16:09,660
The cool thing about that one is that you can have that inject keystrokes back to your tablet or laptop and it also had a cellular connection so you could do a CNC out to AWS.

157
00:16:09,900 --> 00:16:13,560
So that was a fun talk also that was a few years ago at DEF CON.

158
00:16:13,560 --> 00:16:30,800
So yes, you definitely have the capability where if you can update the firmware for the device, depending on the capabilities of the device, you might have the ability to directly attack it again without needing that loader within the operating system that's on disk in the file system.

159
00:16:30,860 --> 00:16:37,840
Additionally, if you have like a PCI device, you could potentially do DMA attacks against the system and do that same type of capability.

160
00:16:37,840 --> 00:16:46,520
Sometimes the operating system has DMA protections but the boot process doesn't and you can do an injection into the boot process while the system is booting up.

161
00:16:48,120 --> 00:16:53,180
There was a quick follow-up question on that from the same user.

162
00:16:53,180 --> 00:16:55,960
Did you use this in an assessment?

163
00:16:57,700 --> 00:17:06,440
Well, we don't work as consultants or red teamers.

164
00:17:06,560 --> 00:17:07,940
Not currently.

165
00:17:07,940 --> 00:17:15,820
So we were on a red team and we've since moved to different positions doing more hardware and low-level security.

166
00:17:16,000 --> 00:17:21,400
And it was like this is the type of thing that we would have wanted while we were still actively red teaming.

167
00:17:21,400 --> 00:17:28,280
But we haven't specifically used this on an engagement, just proof of concepts and playing around with our own systems.

168
00:17:28,340 --> 00:17:32,100
We've heard others use the high trick in an engagement.

169
00:17:32,340 --> 00:17:34,920
But not the rest of it.

170
00:17:34,920 --> 00:17:38,340
The rest of it's just so many options we haven't had a chance to try them all.

171
00:17:40,360 --> 00:17:42,920
That's kind of the problem across this space, isn't it?

172
00:17:42,920 --> 00:17:45,620
There's a target-rich environment.

173
00:17:48,460 --> 00:17:52,640
While I read this next question in my head...

174
00:17:54,760 --> 00:17:56,660
We'll just go right into it.

175
00:17:57,480 --> 00:18:01,460
It was like this when I found it.

176
00:18:01,520 --> 00:18:06,520
So the demo jumps right into and here's this stuff and we can write and read to it.

177
00:18:06,520 --> 00:18:07,940
Isn't this cool?

178
00:18:08,040 --> 00:18:11,460
And the natural is it is.

179
00:18:11,460 --> 00:18:12,440
It totally is.

180
00:18:12,440 --> 00:18:14,220
Plus one for elevator music.

181
00:18:14,360 --> 00:18:18,480
Any more pointers on enumerating access methods for these things?

182
00:18:18,480 --> 00:18:19,340
White papers?

183
00:18:19,340 --> 00:18:24,960
I presume you're not using physical methods, JTAG or in-circuit programming.

184
00:18:24,960 --> 00:18:30,680
So, point three, what APIs functions are you using for this kind of thing in general?

185
00:18:30,680 --> 00:18:37,740
It seems like you could drop stuff into legit update image and flash it, but it looks like this is on the fly.

186
00:18:38,480 --> 00:18:43,120
So a couple of... I can go through the TLDR of that.

187
00:18:43,800 --> 00:18:45,000
We can answer that.

188
00:18:45,000 --> 00:18:49,420
Well, it's going to take 15 minutes, but I'm going to jump right at it.

189
00:18:49,420 --> 00:18:56,480
So there are certain tools you can use to flash a pre-infected image.

190
00:18:56,860 --> 00:19:05,540
Like you can modify the legitimate image and then use the provided tool by the vendor to send it to the device and have the device flash it to its image.

191
00:19:07,240 --> 00:19:19,300
There was another way where we use one of the code releases was actual talking directly to the spy controller in the computer.

192
00:19:20,040 --> 00:19:23,140
So, Jesse, you're itching to say something, so go ahead.

193
00:19:23,140 --> 00:19:29,200
I just wanted to point out that if you haven't taken a look at it, we do have a sample code up on GitHub now.

194
00:19:29,700 --> 00:19:42,360
Basically, GitHub hacking things slash bytes in disguise that shows how some of this code works where... I will beg you after this thing to post that GitHub to the TrackOne channel, but go ahead.

195
00:19:42,500 --> 00:19:43,300
Okay.

196
00:19:43,300 --> 00:19:48,860
So, yeah, basically we have some examples to show off doing things like reading and writing to CMOS.

197
00:19:49,440 --> 00:20:05,240
Essentially, the low-level hardware interfaces that the processor uses to talk to some of these resources are things like IOPorts, where there's an x86 command called in and another called out that are literally for doing reads and writes to these IOPorts,

198
00:20:05,240 --> 00:20:08,400
and that's an architectural feature of the system.

199
00:20:08,440 --> 00:20:20,940
There's also a PCI access where you can do IOPort read and write to IOPorts CF8 and CFC in order to do what's called legacy PCI access.

200
00:20:21,260 --> 00:20:33,160
And then there's also what's called memory mapped IO, where if you can read and write to specific physical memory addresses in the system, you can basically talk to these PCI devices through the PCI controller.

201
00:20:33,560 --> 00:20:53,820
And generally, in order to talk to these interfaces, IOPort, you can basically do a privilege access like IOPL in Linux in order to set your IO privilege level, so then you can do IO reads and writes from ring three and talk to these ports.

202
00:20:54,120 --> 00:21:07,940
But in order to do reads and writes to the memory mapped IO, you generally need a ring zero access, kernel access, or a privileged proxy that can do that for you.

203
00:21:07,940 --> 00:21:13,280
So we gave a talk last year about a lot of drivers that provide this access for you.

204
00:21:13,280 --> 00:21:25,860
Basically, you can do IO controls to talk to the driver, and then the driver will go do reads and writes to these IOPorts, or PCI access, or reads and writes to physical memory.

205
00:21:25,860 --> 00:21:30,480
And we found a number of these drivers that can provide this type of access.

206
00:21:30,500 --> 00:21:37,800
And we took one of the specific examples that's pretty commonly found, the PMX driver from Intel.

207
00:21:37,800 --> 00:21:46,980
And it has a lot of capabilities, like you can do an IO control to talk to the driver, and it'll do an arbitrary read write to a port, or arbitrary PCI access.

208
00:21:46,980 --> 00:22:01,740
So we have some code that shows how to do that, including things like talk to the CMOS, read and write CMOS, read and write different areas of memory, talk to PCI devices.

209
00:22:02,640 --> 00:22:23,060
So one complication is that if you use the direct PCI access mechanism in that driver, it goes through the IO, or it goes through the Windows API functions to do that IO, which is how get bus by offset, bus by offset.

210
00:22:24,600 --> 00:22:34,620
The interesting thing is that the spy driver, or the spy device, when the Windows system is booted up, is actually hidden.

211
00:22:34,620 --> 00:22:35,780
It's a hidden device.

212
00:22:35,780 --> 00:22:45,720
So if you try and go through the API in Windows, you won't be able to talk to that spy device at bus 0, device 31, function 5.

213
00:22:46,240 --> 00:22:54,900
But if you do legacy PCI access by going through that IO read write of CF8CFC, you can directly talk to the spy controller in that device with no problem.

214
00:22:54,900 --> 00:22:57,640
So we have some code to demonstrate that.

215
00:22:57,640 --> 00:23:04,780
And using what's called hardware sequencing, where you basically say, here's the address within the spy chip that I want to talk to.

216
00:23:04,980 --> 00:23:07,820
Go read the 64 bytes from that and give me that data back.

217
00:23:07,820 --> 00:23:09,800
So we have an example of doing that.

218
00:23:09,800 --> 00:23:21,460
We have an example of basically mapping the physical address, the last page of the four gig region, and printing the bytes from the reset vector in the physical memory region.

219
00:23:21,460 --> 00:23:31,660
So all of that is using this driver and DLL that was included in a number of software packages for update mechanisms.

220
00:23:31,880 --> 00:23:36,140
And if that answer went way over your head, you can just go to the GitHub.

221
00:23:36,140 --> 00:23:36,800
No, that's fine.

222
00:23:36,800 --> 00:23:37,540
That's fine.

223
00:23:38,660 --> 00:23:41,280
Go to the GitHub and look at the code.

224
00:23:41,280 --> 00:23:46,620
It mostly is in C sharp, which is easier to understand than most things.

225
00:23:46,640 --> 00:23:50,740
It goes a little bit low level at some places.

226
00:23:50,740 --> 00:23:54,880
But if you go there and you look at the code, it's not big.

227
00:23:54,880 --> 00:23:55,640
It's not scary.

228
00:23:55,640 --> 00:23:56,800
Just take your time.

229
00:23:56,860 --> 00:23:59,340
If you have any questions, you can ask us later on.

230
00:23:59,340 --> 00:24:07,720
But whatever, everything that Jesse just said, and if you completely went over your head, it's not that complicated once you spend an hour reading on the internet.

231
00:24:07,720 --> 00:24:09,240
It's not that big of a deal.

232
00:24:09,240 --> 00:24:10,020
I promise you.

233
00:24:10,020 --> 00:24:12,420
It should be fairly straightforward.

234
00:24:12,680 --> 00:24:19,340
There are some defines and register offsets that are specified for certain things like the spy controller.

235
00:24:19,780 --> 00:24:30,000
If you look for the Intel PCH chipset data sheet, you'll be able to find the definitions for those registers and offsets.

236
00:24:30,000 --> 00:24:35,560
This was specifically put together on a Kaby Lake system, at least from my side.

237
00:24:35,560 --> 00:24:43,100
So some of the registers, like the fields, are a little bit different sizes between a couple different generations.

238
00:24:43,420 --> 00:24:48,380
But this code should work on everything from Sandy Bridge onward, I believe.

239
00:24:48,700 --> 00:24:49,540
All right.

240
00:24:49,540 --> 00:24:52,720
So I love where you're heading with this.

241
00:24:52,720 --> 00:25:09,600
And this is particularly the way that you're explaining how to... for some of us who don't have the depth of experience in the low level stuff, you're giving us some entry points so we can go look at your code.

242
00:25:09,600 --> 00:25:12,560
We can try and replicate some of this on our own.

243
00:25:12,800 --> 00:25:18,520
Are there other thoughts for those of us who might want to do this on our own?

244
00:25:18,520 --> 00:25:27,740
Do you have other places you would like us to maybe go point and get some base experience to start playing with you?

245
00:25:28,300 --> 00:25:29,080
Yeah, I mean...

246
00:25:29,640 --> 00:25:38,380
Before you do anything, before you start playing with anything, you got to remember too, if you're going to do something with something, back shit up.

247
00:25:38,800 --> 00:25:45,860
If you're going to experiment with non-volatile memory, first learn how to physically back it up and flash it back on.

248
00:25:47,440 --> 00:25:53,420
That said, go for whatever you see has a chip on it that contains data.

249
00:25:53,420 --> 00:25:54,620
Go wild.

250
00:25:55,380 --> 00:26:04,140
Yeah, to follow up on that, there are some things you can do, like writing to some locations in your system, where the system won't boot anymore.

251
00:26:04,140 --> 00:26:06,960
So you'll need to physically open the case.

252
00:26:07,620 --> 00:26:30,520
In the case of writes to just bare SPI chips that are easily accessible, like the BIOS or UEFI firmware or BMC firmware in a server, you could use something like a Dediprog with a chip clip and physically clip onto the SPI chip and read that, make a backup copy using physical access before you start messing with it.

253
00:26:30,920 --> 00:26:36,140
There's also, you can use a bus pirate to do SPI read and write if you don't have a Dediprog.

254
00:26:36,320 --> 00:26:39,700
But you can often find a Dediprog on eBay for like 50 bucks or so.

255
00:26:39,700 --> 00:26:54,180
What I recommend is if you don't want to do that, I have an alternate method, which is you have a Thunderbolt capable device, you just plug in a PCI Thunderbolt adapter you can pick up for 100-150 bucks off Amazon.

256
00:26:54,600 --> 00:26:57,760
And then you just plug in one of these PCI cards.

257
00:26:57,760 --> 00:27:00,020
This is one of the cards we worked on for the demo.

258
00:27:00,020 --> 00:27:02,280
This is a USB controller PCI device.

259
00:27:02,360 --> 00:27:03,360
It has its own EEPROM.

260
00:27:03,360 --> 00:27:05,820
And if you mess it up, it's 15 bucks.

261
00:27:06,480 --> 00:27:11,800
Isn't that the thing too, but was not the controller you actually writing to?

262
00:27:12,040 --> 00:27:18,480
This is the same controller that I thought I was writing to, but apparently I had one in my motherboard that I've been reading and writing to.

263
00:27:18,480 --> 00:27:20,280
So yeah, be careful about doing that.

264
00:27:20,280 --> 00:27:27,680
It's nice if you can just pull out the PCI card and your system boots again, but sometimes it's more difficult.

265
00:27:27,880 --> 00:27:31,380
Remember to check you don't have your target already in your computer before you start flashing.

266
00:27:33,040 --> 00:27:34,920
This is all great advice.

267
00:27:34,920 --> 00:27:40,020
All right, gentlemen, we are right at the end of our allotted time.

268
00:27:40,380 --> 00:27:45,360
You two are incredibly easy to talk to about this stuff, so we appreciate that.

269
00:27:45,880 --> 00:27:51,160
I like to provide everybody an opportunity to distill a takeaway.

270
00:27:51,160 --> 00:27:56,800
What is the call to action you would like to provide for the community who is watching this?

271
00:27:58,460 --> 00:28:06,420
I would just start out by saying this might seem intimidating and difficult to get into, but it's really a lot easier than you think.

272
00:28:06,420 --> 00:28:15,580
And if you just start experimenting with this case and do some of this yourself, it's actually a lot of fun and it's not as hard as it might initially seem.

273
00:28:15,580 --> 00:28:18,320
So we have some code examples you can get to.

274
00:28:18,460 --> 00:28:22,120
Like I mentioned, the Intel PCH chipset data sheet.

275
00:28:22,500 --> 00:28:32,800
It's a pretty big document, but if you just look at certain things like the SPI controller registers, it can help guide you and get you started.

276
00:28:32,800 --> 00:28:35,100
So I totally recommend people to go.

277
00:28:35,160 --> 00:28:38,860
Don't be intimidated by this and just try it out and see what you can do.

278
00:28:39,100 --> 00:28:45,860
I'm just going to add that feel free to ask other people for advice.

279
00:28:45,860 --> 00:28:54,220
And I'm just going to caveat this with if you ask me for advice, I will gladly help you under the condition that you help others if they ask you.

280
00:28:55,980 --> 00:28:57,920
So don't be an asshole.

281
00:28:57,920 --> 00:28:59,100
Help others.

282
00:28:59,100 --> 00:29:00,860
This is the point of community.

283
00:29:00,960 --> 00:29:06,460
Yeah, that is one of the best takeaways that I've heard so far.

284
00:29:06,460 --> 00:29:14,300
So you have a whole series of people in chat wanting to buy you drinks next time they see you in person.

285
00:29:15,200 --> 00:29:26,460
Well, thank you two very much for coming and providing another deep load of content for DefCon and all that you do for us.

286
00:29:26,580 --> 00:29:40,600
So if anybody has additional questions, I'm going to see if I can get these two to post more of their contact information in the TrackOne channel so that people can find you later.

287
00:29:40,600 --> 00:29:47,820
Other than that, I hope you have a wonderful rest of your Con and that's pretty much it.

288
00:29:48,000 --> 00:29:48,880
Cool.

289
00:29:48,880 --> 00:29:49,200
Thank you.

290
00:29:49,200 --> 00:29:49,620
Thank you both.

291
00:29:49,620 --> 00:29:50,080
Thank you.