Embedded Devices Reversingforensicinsight.org/wp-content/uploads/2013/07... · 2015. 8. 22. ·...

Kwonyoup Kim

Embedded Security & IP Consultant / CEO

[email protected]

Embedded Devices Reversing– 2015 FIOS #1 –

2 / 48

(주)에스엔티웍스

Cyber Law

&

Digital Forensics

Cryptographic

Theory

&

Practical

Hardware

R.E.

&

Software

R.E.

Based Technologies & Know-How

Security

• Offensive & Defensive Security

• Assessment, Evaluation, Assurance

- Cryptography

- Authentication

- Other’s security function

• Reverse engineering services

• Patent infringement investigations

• Patent Licensing defense

• Patent Litigation support

• Competitive technical intelligence

service

• Reverse engineering services

Intellectual Property

Patent attorney

& Law firm

3 / 48

목 차

임베디드장치역분석과정

임베디드장치정적/동적역분석

임베디드장치분석 Readiness

임베디드장치정보및자원수집

2

3

4

5

임베디드장치역분석필요성1

Embedded Devices Reversing- 임베디드 장치 역분석 필요성 -

5 / 48

Proving Spy Devices

임베디드 장치 역분석 필요성

6 / 48

Offensive / Defensive Analysis


7 / 48

Proving Counterfeit


8 / 48

Proving Supply Chain Attack


9 / 48

Proving device for Crime (1/3)


10 / 48



11 / 48



Embedded Devices Reversing- 임베디드 장치 역분석 과정 -

13 / 48

Black-box testing vs. White-box testing

임베디드 장치 역분석 과정

Black-box

input output

White-box

input output

14 / 48

Gray-Box Tesing


BlackBox

External Resources

Sniffing

Scanning

Internal Resources

Access

Booting log

Processing log

Error log

Static Analysis

Deobfuscation

Code & Data Extract

Disassembling

Dynamic Analysis

Tracing

Debugging

Memory Dump

GrayBox

15 / 48

임베디드장치의일반적인분석방법

• Interception (or Eavesdropping)

Gain access to protected information without opening the product

• Interruption (or Fault Generation)

Preventing the product from functioning normally

• Modification

Tampering with the product, typically invasive

• Fabrication

Creating counterfeit assets of a product


16 / 48

Embedded Reversing Process


정적 분석내·외부 자원

접근 및 수집

대상 장치

정보 수집

• Sniffing Communications

• Debugging Interfaces

• Acquisitions

- (Non) Volatile Data

- Boot-loader

- Microcode (MCU, FPGA)

- File-System

• De-obfuscation

• Code Extraction

• Disassembling

• Reconstruction

• Code Simulation/Emulation

• Identifying Factory Mode

• On-Chip Debugging

• Remote Debugging

• Targets Teardown

• Products Documents

• Identifying Chip / Interface

• OS / Firmware Information

• Development methods

동적 분석

Embedded Devices Reversing- 임베디드 장치 정보 및 자원 수집 -

18 / 48

General / Private / Secret Information Gathering

• Crawling the Internet for specific information

Product specifications, design documents, marketing materials

Check forums, blogs, Twitter, Facebook, etc.

• Acquire target hardware

Purchase, borrow, rent, steal, or ask the vendor

Ex. : eBay, surplus

• Dumpster diving

• Social engineering

임베디드 장치 정보 및자원 수집

19 / 48

Hardware Teardown (1/2)

• Hardware and electronics disassembly and reverse engineering

• Get access to the circuitry

• Component and subsystem identification

• Gives clues about design techniques, potential attacks, and system functionality

• Typically there are similarities between older and newer designs


20 / 48

Hardware Teardown (2/2)


21 / 48

On-Chip Debug Interfaces (1/6)

• UART (Universal Asynchronous Receiver / Transmitter)

UART 연결을위한 Pin : RxD, TxD, GND


22 / 48

On-Chip Debug Interfaces (2/6)

• UART (Universal Asynchronous Receiver / Transmitter)


23 / 48

On-Chip Debug Interface (3/6)

• JTAG (Joint Test Access Group, IEEE 1149.1)

Basic Pin : TMS, TCK, nTRST, TDI, TDO

Extended Pin : nRESET, VTref, DBGRQ, DBGACK


24 / 48


• JTAG (Joint Test Access Group, IEEE 1149.1)


25 / 48


• More difficult to located when available only on component pads or tented vias


26 / 48


• Automatic finding interfaces (UART, JTAG)

JTAGulator

JTAGFinder


27 / 48

내·외부자원수집

• Communications monitoring

• Protocol decoding and/or emulation

• Example – Smartcard, Serial, USB, JTAG, I2C, SPI, Ethernet, CAN

• Any interface accessible to the outside world may be an avenue for attack

Especially program/debug connections: if a legitimate designer has access to the

interface, so do we

• Using oscilloscope, logic analyzer, dedicated sniffers, software tools, etc.


28 / 48

내·외부자원수집 – Chip-Off (1/3)

• Flash memory (NOR / SPI) reading


29 / 48


• PC-3000 Flash Edition (NAND Devices)


30 / 48


• Extract Microcode (ROM, EEPROM, MCU, FPGA, …)

Searching “MCU Break” on Google search


Embedded Devices Reversing- 임베디드 장치 정적 분석 -

32 / 48

임베디드리눅스기반펌웨어구조

임베디드 장치 정적 분석

Decompress Code (RAW)

Boot Code (Compressed)

Kernel (Compressed)

File System (Compressed)

33 / 48

RTOS (Real Time Operating System)기반펌웨어구조


Decompressed Code (RAW)


Kernel (Compressed)

Additional Support File & Data(Compressed)

34 / 48

RAW Code 펌웨어구조


Decompressed Code (RAW)


RAW Code (Compressed)

35 / 48

펌웨어압축해제 (Decoding, Decompressing, De-Obfuscating) 방안

• 자동화 도구 활용

Binwalk, FMK(Fimrware Modification Kit)

• 1st / 2nd Bootloader 분석

부팅과정에펌웨어를분해하는코드분석

• UART / JTAG을 활용

메모리상에압축해제된코드수집


36 / 48

CISC vs. RISC Architecture

• 대상 장치의 Assembly 구조 및 패턴 이해 필요

Calling Convention, CallBack, IPC(Inter Process Communication)

Parameter, Static/Global Variable, Return Value

Store & Load Storage (Stack, Register, Memory)


CISC

(Complex Instruction Set Computer)

RISC

(Reduced Instruction Set Computer)

하드웨어가 강조됨 소프트웨어가 강조됨

여러 클럭의 복합 명령어를 포함 오직 단일 클럭의 축약명령어만 포함

Memory to Memory Register to Register

작은 코드 크기, 단위시간동안 높은 사이클 단위시간동안 낮은 사이클, 큰 코드 크기

Intel, AMDARM, MIPS, PowerPC, UltraSPARC

DEC Alpha, PA-RISC

37 / 48

Disassembly 코드변환

• Disassembling File Format Code

COFF, PE, ELF, iHEX, SREC, S19

• Disassembling RAW Code

Identifying Code / Architecture

Finding Base Address


38 / 48

코드정적분석

• 분석하고자 하는 코드 위치 파악

Symbols, Debug Message, API 활용

• Emulation/Simulation Tools 활용

IDA Pro with QEMU

Trace32

IAR

Product Disassembler

Custom Disassembler


Embedded Devices Reversing- 임베디드 장치 동적 분석 -

40 / 48

동적 역분석 환경 구축 (1/3)

• IDA Pro with Remote GDB (on QEMU)

• 장점

단독 PC 환경에서실행파일디버깅가능

• 단점

실행파일이아닌코드는디버깅불가능 (커널디버깅)

실행 중인 모듈 디버깅 불가능 (프로세스/쓰레드 디버깅)

임베디드 장치 동적 분석

IDA ProRemote GDB

41 / 48


• Trace32 with JTAG (on Target Devices)

• 장점

커널디버깅가능

내부모든자원에접근가능

• 단점

Enabling JTAG Pinout

실행 중인 모듈 디버깅 어려움 (프로세스/쓰레드 디버깅)


JTAG

PinoutTrace32

42 / 48


• IDA Pro with Remote GDB (on Target Devices)

• 장점

커널/프로세스/쓰레드디버깅가능

내부모든자원에접근가능

• 단점

펌웨어분해및재조립필요

Cross Compile (telnet, strace, gdb_server, …) 필요


Remote GDBIDA Pro

Embedded Devices Reversing- Readiness condition -

44 / 48

Secure Embedded Devices

임베디드 장치 역분석 – Readiness Condition

Authentication

Confidentiality

Integrity

Secure Boot

Secure Update

SecureDevelop

45 / 48

The Fundamental Tradeoffs


Cheap

Secure

Usable

46 / 48

Trade off – Security vs. Usability vs. Cheap


47 / 48

Readiness


•Bypass Temp Resistance

•De-Capping / De-Soldering

•Dumping Code/Data

•Debugging Environment

•Side Channel Environment

Hardware Reversing

Software Reversing

•Power Analysis

•Clock & Timing Analysis

•Fault Injection Analysis

Side Channel Attack

•Crypto Protocols Attack

•Crypto Algorithms Attack

•Crypto Keys Attack

Crypto Attack

Co-Works

•De-Obfuscation

•Exploiting Authentication

•Simulation/Emulation

•Automatic Reversing

•Code Interpretation

48 / 48

감사합니다.

Embedded Devices Reversingforensicinsight.org/wp-content/uploads/2013/07... · 2015. 8. 22. ·...

Documents

Transcript of Embedded Devices Reversingforensicinsight.org/wp-content/uploads/2013/07... · 2015. 8. 22. ·...