Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Attacking Titan M with Only One Byte

blog.quarkslab.com

Post reply on HN
Print view View original

61–70 of 84 posts

Re: Attacking Titan M with Only One Byte

#61

Post by dmitrygr »

rob_c wrote: post #59
dmitrygr wrote: post #48

Earlier quoted context omitted.

If THAT is your idea of security, i hope you do not work on any hardware whose security matters. First thing anyone would do is find the pins and connect to them. It buys you nothing, and if anything tells me that i should go look for them. Visible and labeled UART pins tell me that you've (hopefully) thought through the consequences of me having access to them. Hidden UART tells me that most likely nobody ever gave…

Do you have __any idea__ how difficult removing the chip and re-surface mounting it for an attack... Removing the trace means an extra step which is the whole point. Ffs

Yes i do. done it. at home. for fun. Which means anyone motivated to do it can easily get it done too..

Re: Attacking Titan M with Only One Byte

#62

Post by rob_c »

nickzana wrote: post #39
rob_c wrote: post #25

Very cool. I wonder why companies still leave the UART pins accessible. Fine they're on the chip, but just remove the trace and slow down attack evolution is worth the cost of a board revision surely...

Isn't it better to leave them exposed and make it easier for security researchers who genuinely want to test the chip? Someone interested in and capable of developing and using/selling an exploit won't be deterred by needing a special cable to get a UART console, whereas a security researcher might appreciate the simpler access. So long as it doesn't weaken the actual security model, companies should make their produ…

Then sell a dev unit surely, not a consumer grade device...

Re: Attacking Titan M with Only One Byte

#63

Post by alexbakker »

This is amazing work!

I was surprised to see that the reward was set at 10k initially. Granted, it was bumped to 75k later, but even that seems on the low side considering the degree of compromise that occurred here.

I may have given up too early during my (fairly brief) research on CVE-2019-9465. I let the lack of firmware source code availability stop me at the time, but in hindsight the presence of "0dd0adde0dd0adde" in the ciphertext likely indicated a crash in Titan M as well. Perhaps there would have been a similarly interesting path to exploitation there.

Re: Attacking Titan M with Only One Byte

#64

Post by rob_c »

Lorin wrote: post #60
dylan604 wrote: post #28

Earlier quoted context omitted.

Nah, you're not cynical enough. My cynical take is there is nothing they would ever pay $1M for. "Up to" is a marketing term to get people to think that if they work hard enough, they might qualify for this mythical unicorn bounty, but at the end of the day they just get peanuts.

"You might win this car!"

Really sign me up!

Re: Attacking Titan M with Only One Byte

#65

Post by rob_c »

dmitrygr wrote: post #61
rob_c wrote: post #59

Earlier quoted context omitted.

Do you have __any idea__ how difficult removing the chip and re-surface mounting it for an attack... Removing the trace means an extra step which is the whole point. Ffs

Yes i do. done it. at home. for fun. Which means anyone motivated to do it can easily get it done too..

With data intact after etching a custom PCB for a custom chip? I'd be impressed if that skillset overlaps with someone hacking bytecode

Re: Attacking Titan M with Only One Byte

#66

Post by atwood22 »

trhway wrote: post #56

Sounds like an amateur hour at that Google team. While post authors are putting blame on the un-safeness of C, absence of user input validation, like that integer from a message, is a path to a very unhappy place independent of language. The rest of the exploited places of that Titan software seem to be similarly sloppy.

Most languages don't let you (or at least make it hard to) directly convert user input into memory locations though. The scope of the issue in other languages would likely be much more limited.

Re: Attacking Titan M with Only One Byte

#67

Post by muricula »

pmalynin wrote: post #49
keepquestioning wrote: post #44

Earlier quoted context omitted.

Hmm, doesn't ARM have mitigation against Return oriented Programming

Yeah some devices support PAC use that feature to sign return pointers. But not everyone uses it (even when available), and there exist methods to bypass PAC— from attacking the micro architecture to finding signing oracles.

PAC (pointer signing) & Branch Target Identification are not available on 32 bit arm chips, and judging by the assembly in the blog post the Titan M is a 32 bit chip.

Re: Attacking Titan M with Only One Byte

#68

Post by dylan604 »

rob_c wrote: post #64
Lorin wrote: post #60

Earlier quoted context omitted.

"You might win this car!"

Really sign me up!

First, we'll need you to fill out this form with some basic information:

  --First, Middle, Last Name
  --Phone number, email address, social contacts
  --Mother's Maiden Name
  --First concert you attended
  --Name of the street you grew up on
  --Name of your best friend
  --Name of your first pet
  --Make/Model of your first car

Re: Attacking Titan M with Only One Byte

#69

Post by trhway »

atwood22 wrote: post #66
trhway wrote: post #56

Sounds like an amateur hour at that Google team. While post authors are putting blame on the un-safeness of C, absence of user input validation, like that integer from a message, is a path to a very unhappy place independent of language. The rest of the exploited places of that Titan software seem to be similarly sloppy.

Most languages don't let you (or at least make it hard to) directly convert user input into memory locations though. The scope of the issue in other languages would likely be much more limited.

It is unrelated. For example the input may be used only as a parameter for reading operations - ie. one can easily imagine a situation where even in a safest language using un-validated input may result in a call/query producing info outside of what would be expected for valid parameters.

Re: Attacking Titan M with Only One Byte

#70

Post by google234123 »

ClumsyPilot wrote: post #18
posnet wrote: post #8

Earlier quoted context omitted.

Remote 0-day onto all google internal infra?

thats literally worth billions, and could be sold to many governments. If thr right people don't buy these zero-days, yhe wrong people will.

Billions? couldn’t a government just get a person affiliated with them hired by google?
Post reply on HN