Can you still trust your network card? - Agence nationale de la ...

More documents

Recommendations

Info

The vulnerability Crash analysis Why does the card crash? RX RISC state register provides useful information: 1. bad memory alignment 2. invalid instruction fetch (jump to invalid location); 3. invalid data access (load/store in invalid location); 4. invalid instruction; Points 2 and 4 can mean direct flow execution redirection. Points 1 and 3 can mean indirect flow execution redirection (try to overwrite a return address in the stack). SGDSN/ANSSI – http://www.ssi.gouv.fr/trustnetworkcard 36/51
The vulnerability Crash analysis Changing the execution flow When the RX RISC CPU is crashing, an attacker needs to: ◮ find the source of the data; ◮ tune it to fit her needs. Trials and errors We managed to: ◮ make the username field overflow; ◮ overwrite a return address in the stack with an address under our control. SGDSN/ANSSI – http://www.ssi.gouv.fr/trustnetworkcard 37/51
Page 1 and 2: Can you still trust your network ca
Page 3 and 4: Impacts on security If an attacker
Page 5 and 6: What won’t be described today Thi
Page 7 and 8: Network interface controller The Ne
Page 9 and 10: Network interface controller The Ne
Page 11 and 12: Remote administration protocols ASF
Page 17 and 18: Remote administration protocols RMC
Page 19 and 20: Remote administration protocols RMC
Page 21 and 22: Remote administration protocols Sum
Page 23 and 24: Protocol analysis Protocol security
Page 25 and 26: Protocol analysis Implementation pr
Page 27 and 28: The vulnerability Instrumenting the
Page 35: The vulnerability Instrumenting the
Page 39 and 40: The vulnerability Crash analysis Ex
Page 41 and 42: The vulnerability Crash analysis St
Page 43 and 44: Real impact What can be done in the
Page 45 and 46: Real impact Controlling the host Us
Page 47 and 48: Real impact Controlling the host De
Page 49 and 50: Real impact Controlling the host Co
Page 51: Real impact Controlling the host Qu

Can you still trust your network card? - Agence nationale de la ...

Create successful ePaper yourself

Delete template?

Save as template?