EXPLOITING EMBEDDED SYSTEMS THE SEQUEL!

More documents

Recommendations

Info

Finding Hardware Targets• FCC ID search (http://www.fcc.gov/oet/ea/)• Includes photos of circuit internals• Helpful for determining processor• Determine JTAG ports• Good targets? Anything Internet connected!Copyright © 2007 Juniper Networks, Inc. Proprietary and Confidential www.juniper.net 18
Debugging and Reversing• Flash onboard firmware of BDI2000 for target CPU• Set up BDI configuration file:…[TARGET]CPUTYPE ARM946ECLOCK 1 ;JTAG clock (0=Adaptive, 1=8MHz, 2=4MHz, 3=2MHz)ENDIAN LITTLE;memory model (LITTLE | BIG)VECTOR CATCH 0x1f ;catch unhandled exceptionsBREAKMODE SOFT 0xDFFFDFFF ;SOFT or HARD, ARM / Thumb break codeSTARTUP RUNRESET NONECopyright © 2007 Juniper Networks, Inc. Proprietary and Confidential www.juniper.net 19
Page 1 and 2: EXPLOITING EMBEDDEDSYSTEMSTHE SEQUE
Page 3 and 4: Embedded Architectures• MIPS and
Page 5 and 6: The ARM Architecture• RISC based
Page 7 and 8: The BDI2000JTAG Support for:• MIP
Page 9 and 10: The JTAG Interface - ARM/XSCALE•
Page 11 and 12: The Serial Interface• Support for
Page 13 and 14: Locating the JTAG pointsTypical sce
Page 15 and 16: Connecting the BDI2000Copyright ©
Page 17: Defeating the Watchdog• Software
Page 21 and 22: Debugging and Reversing• Decrypte
Page 23 and 24: New Attack Classes• Exploitable N
Page 25 and 26: New Attack Classes - Vector Rewrite
Page 27 and 28: New Attack Classes - Prevention•
Page 29 and 30: System-On-Chip Designs• Many chip
Page 31 and 32: Exploitation (ARM)• The ARM proce
Page 33 and 34: ExploitationTwo Step Exploitation1
Page 35 and 36: Exploitation (ARM)Set remote config
Page 37 and 38: Exploitation• Successful exploit
Page 39 and 40: Firmware PatchConsiderations:• Ne
Page 41 and 42: Injector 2.0• Watch for downloads
Page 43 and 44: Exploit DemonstrationDEMO!Copyright
Page 45 and 46: Summary• Security flaws are abund

EXPLOITING EMBEDDED SYSTEMS THE SEQUEL!

Create successful ePaper yourself

Delete template?

Save as template?