Funderbolt - PUT.AS · •Background •Thunderbolt •Apple and Intel •External Port •PCI...

Funderbolt Adventures in Thunderbolt DMA Attacks

Russ Sevinsky

A Trip Down Memory Lanes

• Background

• Thunderbolt • Apple and Intel

• External Port

• PCI Express (PCIe) and DisplayPort using the same port

• DMA • Direct Memory Access

• Processor becomes bottleneck for high-speed transfers

• Lets devices read and write directly to RAM

• Why external buses matter for security experts?

• Digital Forensics • Getting data to solve a mystery

• User protection • So RAM contents can be safe

• Sneaky DRM • Bus encryption

• PCI Express (PCIe)

• High-speed serial bus

• Data sent via “lanes”

• A Lane is made up of differential wire pairs • One + and one – wire offset a small amount

• Helps reducing noise

• One lane (x1) is made up of two differential pairs • Transmit pair (PET)

• Receive pair (PER)

• PCIe (cont)

• Four lanes (x4) has eight pairs, x8 has 16 pairs, etc…

• All lanes use another differential pair for clock • REFCLK

• So… x1 uses 6 wires for data communication • PET, PER and REFCLK

• Data sent via “packets”

• Point-to-point topology using Root Complex • Requests for devices and memory go to “root complex”

• Mitigations

• Epoxy (really?)

• Input/Output Memory Management Units (IOMMUs) • Maps physical memory addresses to logical addresses

• Think “VM for DMA”

• Prevents devices from requesting physical addresses directly

• Secure Configurations

• Current attacks?

• Daisy chaining Thunderbolt and Firewire

• Inception

How My Adventures Went

• Improvised Tools for Analysis

• Multimeter

• Soldering station

• Heat gun

• Desoldering tools

• Ethernet cable

• Epoxy (really?)

• Logic Analyzer

• Image Editor

• Reversing Thunderbolt – The Process

• Research a product

• Take it apart

• Trace all interesting chips

• Look for datasheets

• Sniff buses

• Develop a map

• Looking at consumer products

• Buffalo MiniStation Thunderbolt/USB3 Hard Drive • 500GB and 1TB model

• USB3 and Thunderbolt

• Decent form factor for reversing

• Apple Thunderbolt to Gigabit Ethernet Adapter • Tiny

• Small

• Little

• External Hard Drive

• Researching the product

• Taking it apart

• Tracing all interesting chips

• Looking for datasheets

• Sniffing buses

• Developing a map

• Excellent Anandtech review:

• http://www.anandtech.com/show/6127/buffalo-ministation-thunderbolt-review-an-external-with-usb-30-and-thunderbolt

• Identified ICs for us!

• Main ICs

• MLDU03 • Medial Logic USB3.0 to SATA 6G Bridge

• ASM1061 • ASMedia PCIe to SATA Controller

• DSL2210 (Peak Ridge) • Intel Thunderbolt Controller

• Supports PCIe x1

• LPC1114 • NXP ARM Cortex M0

• ASMedia ASM1061

• PCIe/SATA Controller

• Datasheets?

• ROMs/Flashes?

• Patch PCIe Controllers’ SPI ROM to send DMA read requests?

• NXP LPC1114

• ARM Cortex M0

• Used for… ??

• No ROMs or Flashes

• TONS of info

• Connects into DSL2201 • How do I know?

• Intel DSL2210

• Thunderbolt Controller

• No Datasheets

• Promo info only

• ROMs/Flashes?

• Thunderbolt Connector

• 1 pair of High Speed lanes • TX and RX

• All others pulled to ground

• “LowSpeed” lines go into ARM’s UART?

• ARM UART Traffic

• String “EM “

• Thunderbolt Firmware Update

• Display contents of Application Package

• Decompress “Payload” file

• Two Firmwares for Thunderbolt?

• One is probably ARM

• Let’s look for string “EM “

Jackpot!

• Round 2…

• String “\x27\x0a\x00\x00“

Successaroo!

• Gigabit Ethernet Adapter

• Researching the product

• Taking it apart

• Attack vectors

• Altera Cyclone IV GX Transceiver Starter Kit

• Hard IP for PCIe

• PCIe x1

• ~$450

• Tips and Tricks

• Get A LOT of devices!

• Heat up everything SLOWLY!

• Continuity testing WINS

• Sniff EVERYTHING

• Read all ROMs/Flashes

• Russ Sevinsky

• Security Consultant at iSEC Partners

• rsevinsky@isecpartners.com

• Special thanks to:

• Jesse Burns

• Everyone @ iSEC Partners

Thank You

UK Offices Manchester - Head Office Cheltenham Edinburgh Leatherhead London Thame

North American Offices San Francisco Atlanta New York Seattle

Australian Offices Sydney

European Offices Amsterdam - Netherlands Munich – Germany Zurich - Switzerland

Funderbolt - PUT.AS · •Background •Thunderbolt •Apple and Intel •External Port •PCI...

Documents

SV231DPUA SV431DPUA Instruction Manualcdn.cnetcontent.com/9a/d6/9ad62d56-dcf0-43ca-b229-0cba28... · DisplayPort KVM Switch 2/4-Port Professional USB, DisplayPort KVM Switch with

Port(al) to the iOS Core - PUT.AS · – Author: Stefan Esser – Idea: Fill kernel heap with C++ objects via OSUnserializeXML() and overwrite them – Status: Apple mitigated but

Dell OptiPlex 7070 Small Form Factor€¦ · 1. Line-out audio port 2. PS2 Port (Keyboard) 3. Serial port 4. PS2 Port (Mouse) 5. DisplayPort/HDMI 2.0b/VGA/USB Type-C Alt-Mode (optional)

2-Port USB DisplayPort KVM Switch€¦ · The ATEN CS782DP 2-Port USB DisplayPort KVM Switch features 4K UHD video resolution and allows users to access two 4K-enabled computers from

2-Port USB DisplayPort Cable KVM Switch with Remote Port ...€¦ · The CS22DP 2-Port USB DisplayPort Cable KVM Switch is a control unit that allows access to two computers from

2-Port USB DisplayPort KVM Switchassets.aten.com/product/spec_sheet/cs782dp_kvm_switch_ds_en.pdf• USB 2.0 mouse port can be used for USB hub and USB peripheral sharing6 • Bus-Powered

2-Port USB DisplayPort Cable KVM Switch with Remote Port ...assets.aten.com/product/spec_sheet/cs22dp_kvm_switch_ds_en.pdfPublish Date: 11/2018 V2.0 SOHO & SMB Solutions Speciﬁ cations

CS1964 4-Port USB3.0 4K DisplayPort Triple Display KVMP ...€¦ · 3/19/2020 · DisplayPort technology provides 4K UHD @ 60 Hz and 4K DCI @ 60Hz resolution that displays the most

iOS Kernel Exploitation - PUT.AS

OptiPlex 7060 타워 - Dell · 2018-07-03 · 후면 모습 1 라인 출력 포트 2 PS/2 키보드 포트 3 Serial Port 4 PS/2 마우스 포트 5 DisplayPort(2개) 6 DisplayPort/HDMI

Alienware AW2521HF Monitor Panduan Pengguna...• Konektivitas digital melalui 1 port DisplayPort dan 2 port HDMI. • Dilengkapi dengan port upstream 1 USB dan port downstream 4 USB

2-Port USB DisplayPort KVM SwitchThe ATEN CS782DP 2-Port USB DisplayPort KVM Switch features 4K UHD video resolution and allows users to access two 4K-enabled computers from a single

Belkin Secure 2and4 port DisplayPort KVM Switch User Manualbelkinbusiness.com/sites/default/files/Belkin Secure 2and4 port... · Reporting Belkin Product Security Vulnerability

OptiPlex 7060 Small Form Factor · 2018-07-03 · Back view 1 Line-out port 2 PS/2 keyboard port 3 Serial port (optional) 4 PS/2 mouse port 5 DisplayPort/HDMI 2.0b/VGA/USB Type-C

NEC LCD High Brightness Displays · External Control RS-232C, LAN, DDC/CI Output Terminals Digital DisplayPort (DisplayPort, HDMI, DVI-D or Option Signals out of this port) Analog

2-Port USB DisplayPort KVM Switchassets.aten.com/product/manual/cs782dp-w_2017-07-20.pdf · limits for a Class A digital device, ... interfaced KVM models by offering DisplayPort

Advanced 2/4 Port DisplayPort Secure KVM Switch · Advanced 2/4-Port DisplayPort Secure KVM Switch 1 Document ID: DOC-IPG-2008 Revision: 1.10 Release Date: December 13, 2016

2-Port USB DisplayPort KVM SwitchFeb 21, 2020 · Mode be disabled). SeeHotkey Summary Table, page14 for information. 2.Plug your monitor into the DisplayPort port, located on the

HP DisplayPort Adapters - CNET Content · Models HP DisplayPort to HDMI Adapter BP937AA HP DisplayPort to DVI-D Adapter FH973AA HP DisplayPort to VGA Adapter AS615AA HP DisplayPort

Emerson® Avocent® SV 220D/240D/340D 2 and 4-Port DisplayPort