2017 BSides Indy presentation by Price McDonald with Coalfire Labs

1. “HACK MODE” ENABLED
HARDWARE HACKING ON A BUDGET
BSIDES INDY 2017
PRICE MCDONALD

2. ABOUT:ME

3. O’RLY?

4. OK, SO
HARDWARE
SECURITY SUCKS…
BUT WHY FOCUS
ON THE
HARDWARE?

5. METHODOLOGY

6. WHERE DO WE GET THE THINGS?
• Beta Programs
• https://www.betabound.com/tp-link-router-
private-beta/
• https://beta.linksys.com/
• https://www.beta.netgear.com/signup/
• Flea Markets
• Ebay
• Craigslist
• Garage Sales

7. DISASSEMBLY “VOIDING THE WARRANTY”

8. TAMPER RESISTANCE/DETECTION/ALERTING
They mean different things, but may not matter either way.

9. COMPONENT IDENTIFICATION
What do you
see?

10. COMPONENT IDENTIFICATION(2)
• EOL 802.11G router SoC (System on Chip)
• 200 Mhz MIPS32 core
• Supports Serial or Parallel Flash
• One JTAG and two UART Ports
• 336 ball FBGA (Fine-pitch Ball Grid Array)
• 32M-BIT Parallel NOR Flash Memory
• 3V only
• 48-pin TSOP (Thin Small Outline Package)
• CMOS DDR400 RAM
• 66-pin TSOP II

11. COMPONENT IDENTIFICATION TIP AND TRICKS
The image part with relationship ID rId5 was not found in the
file.

12. ARTS AND CRAFTS TIME

13. FINDING GROUND
• Using the MultiMeter we can figure out which of the pins
on our headers connect to ground and which have
voltage.
GroundVoltage
Specifically
3.3v
• Got Ground?

14. PHYSICAL
COUNTER
MEASURES

15. COMMON INTERFACE TYPES
• UART - Universal Asynchronous Receiver/Transmitter
• SPI – Serial Peripheral Interface
• I2C – Inter Integrated Circuit
• JTAG – Joint Test Action Group – Hardware Debugging
Interface
• CAN – Controller Area Network (Cars/ATM/etc)
• RS232- Serial Interface used on many legacy devices

16. PINOUT REVERSING
• SALEAE LOGIC ANALYZER
• ~100 BUCKS ON THE LOW END @
HTTPS://WWW.SALEAE.COM
• ALSO, EDU DISCOUNTS AVAILABLE UP TO 50%
DEPENDING ON MODEL.
• KEEP IN MIND THAT LOGIC ANALYZERS ARE SAMPLING WHICH
CAN CAUSE ARTIFICIAL DATA DEPENDING ON THE SAMPLING
RATE AND THRESHOLDS.
• WORKS FOR I2C, UART, SPI, JTAG, CAN, ETC, ETC

17. SALEAE LOGIC UI
• Using the Saleae logic analyzer we can watch the pins during boot to check for
voltage spikes during. This is a good indication of either a UART, I2C or SPI
connection.
System Boot Likely the boot log
being transmitted over

18. SALEAE LOGIC - DECODERS
GIVEN that we SUSPECT Async Serial (UART) we will select that analyzer

19. SALEAE LOGIC - DECODING
Among small embedded devices 115200 is a very common bit rate so it is an
easy guess. But we will also cover a more automated way of determining bit

20. SALEAE LOGIC – DECODING(2)
We must also ensure we are configuring the device to analyze the
appropriate channel (which are color coded as long as you connect them

21. SALEAE LOGIC – OUTPUT
As you can see we are successfully decoding the output from the UART
serial connection on our Broadcom chip.

22. OR, HAVE YOU HEARD OF THE JTAGULATOR?
• Created by Joe Grand @ http://www.grandideastudio.com
• ~180-200 Bucks

23. CONNECTING TO INTERFACES
• Bus Pirate
• Less of a learning curve
• Slower transfer speeds
• Supports UART, SPI, I2C and JTAG
• Shikra
• No UI but faster transfer speeds as a result
• Supports UART, SPI, I2C and JTAG
• TIAO USB Multiprotocol Adapter
• No UI but faster transfer speeds as a result
• Supports UART, SPI, I2C, JTAG, RS-232
• Supports multiple connections from same device
• Slightly less reliable in my experience

24. USING THE SHIKRA
http://int3.cc/products/the-shikra

25. CONNECTING TO UART
The command used to connect to a UART serial adapter will vary by
device and OS but will generally be similar to the command below.
sudo screen /dev/[device id] baud rate
Or the the case of the Device ID below for the Shikra:
sudo screen /dev/ttyUSB0 115200

26. WE NOW HAVE SHELL!
HOPEFULLY
But now
what?

27. NO TECH HACKING

28. NO TECH HACKING(2)

29. FILE SYSTEM FIDDLING
Why is my root a mtdblock?
But wait, what is an mtdblock?
• MTD is a "Memory Technology Device.
• Unix traditionally only knew block devices and character devices. Character
devices were things like keyboards or mice, that you could read current data
from, but couldn't be seek-ed and didn't have a size. Block devices had a fixed
size and could be seek-ed.
• A mtdblock is a block device emulated over an mtd device.
Source: Wikipedia

30. FILE SYSTEM FIDDLING(2)
Often times embedded device manufacturers leave important file systems
unmounted.
Another good Resource:
http://wiki.in-circuit.de/index.php5?title=Flashfilesystem_

31. PILFERING FILE SYSTEMS
But, How do we get the file system off of the target device?

32. SSH WHOOPS?

33. Ultra quick JTAG primer
• JTAG stands for (Joint Test Action Group) which was formed in 1985.
• The following pins are required for JTAG use:
• TDI (Test Data In)
• TDO (Test Data Out)
• TCK (Test Clock)
• TMS (Test Mode Select)
• The TCK Pin (Test Clock) is what keeps the clock for the state machine.
• THE TMS Pin (Test Mode Select) is what determines when and how the State Machine advances
depending on it’s relative position during each clock cycle.
Source:
Wikipedia

34. OPTIONS FOR CONNECTING TO JTAG
Good Better Best
$45 $60-$600 $5000-
$20000

35. JTAGULATOR

36. HOW TO CONNECT WITH OPENOCD
The command to initiate openocd is : openocd –f interface –
f target
But now what? There are errors and stuff!!!!!
#openocd on

37. HOW TO CONNECT WITH OPENOCD(2)
Silly openocd!
That’s more like it J

38. USING OPENOCD

39. MY PET PROJECT == CEREAL

40. REVERSE ENGINEERING
• Binary Ninja
• Free version available
• Limited Architecture Support
• Learn one IL to reverse them all
• Ida Pro
• Paid Version required for disassembly
• ARM decompiler available but $$$$
• Also very good debugger
• Radare2
• Free multiplatform support
• No decompiler available

41. RADARE2

42. IDA PRO

43. OTHER NICE TO HAVES

44. • http://www.grandideastudio.com/hardware-hacking-training/
• http://www.xipiter.com/training.html
• https://www.eevblog.com
• http://www.embedded.com/electronics-blogs/beginner-s-corner/

45. THANK YOU!!!!
ANY MORE QUESTIONS?

46. CONTACT INFORMATION
TWITTER: @PRICEMCDONALD
LINKEDIN: LINKEDIN.COM/PRICEMCDONALD
EMAIL: PRICEMCDONALD@GMAIL.COM