Hacking the Xbox

204
Hacking the Xbox: An Introduction to Reverse Engineering
Hacking the Trusted PC
The current proposals for the trusted PC are weak against some fairly simple
hardware attacks, even in the absence of any integration oversight or bugrelated
back doors.
The first attack is one that I call the “Surreptitious BIOS,” or SPIOS
(pronounced “Spy OS”) attack. SPIOS can be used to defeat DRM
policies that rely on the cryptographically sealed storage feature of the
trusted PC to prevent unauthorized user access to data. The basic idea is
to boot the PC with an unmodified BIOS into trusted mode and extract
all the desired data into system RAM, then to perform a warm reset of
the system while swapping the BIOS image.
The modified BIOS image can be used to read out the desired data from
system RAM. The desired data may be a session key stored in memory,
or the actual decrypted data itself, depending upon how the program
structures and caches its data in memory. Since the current trusted PC
specifications call for an LPC bus based BIOS, inexpensive alternate
firmware devices (similar to those used on the Xbox) can be used to
execute this attack. There are techniques that application programmers
can use to complicate this attack, such as only decrypting a single block
of data each time into system memory, but many of these techniques
severely degrade system performance. The degradation of system
performance may be especially pronounced if file caching and
prefetching is disabled.
Another attack is one that I call the “Surreptitious RAM,” or SPAM
attack. The goal of this attack is to spoof the trusted routines responsible
for measuring the fitness of the system state. A device, such as an FPGA
or ASIC, is installed on the plug-in memory cards in between the DRAM
chips and the memory connector. This device monitors the pattern of
addresses going by, or it may have an extra connector that sniffs the state
of the wires connected to the I/O pins of the cryptomodule responsible
for authenticating the system.
Either way, when a system measurement is in progress, the SPAM device
presents a memory image that is consistent with an unmodified, trusted
system state. However, during all other operating modes, the SPAM
device presents a memory image that is modified to do whatever the user
pleases. This modification can be very subtle: Just a couple of bits flipped
at the right locations is all it takes to modify key branch instructions in
the security kernel.
This device is more powerful than the SPIOS since it works on a system
that is powered-up and supposedly trustworthy. It can be applied to
effectively defeat a wider range of DRM schemes as well as some
authenticated transactions between the local machine and the server.
SPAM alone cannot be used, however, to falsely identify a system as
another registered, trusted system, since SPAM lacks the secret shared