4 ms·
> Now you know why I deployed security-focused stuff on PPC at one point. The economics of hacking alone work in your favor. Perhaps true for a small-time, ind
by saidajigumi 11y ago
> Now you know why I deployed security-focused stuff on PPC at one point. The economics of hacking alone work in your favor.
Perhaps true for a small-time, individual hacker. Over a decade ago, I recall being quite impressed by a professional pentest team whose tools included a lovely exploit authoring DSL embedded in a popular scripting language. That DSL allowed them to write "abstract" descriptions of specific software exploits, ala vs openssh vX.YpZ, then "render" (~~ compile) the exploit code automatically against any of their supported target architectures and/or OSes. (i.e. all of them.) Even though perfectly capable of it, they got tired of manually porting everything around.
This has also been a strong reminder for me that exploits are usually against the software, irrespective of the hardware architecture. It's easy for folks to get mixed up about that.
For something like hacking a PS4, the "obscure platform" logic might apply(), but never assume it applies to any attacker who can afford (n.b.: not just build) a sophisticated attack platform.
() With the caveat that now it's a numbers game, and you're up against bored teens/tweens with way too much time to throw at the problem.
- rsync 11y ago"That DSL allowed them to write "abstract" descriptions of specific software exploits, ala vs openssh vX.YpZ, then "render" (~~ compile) the exploit code automatically against any of their supported target architectures and/or OSes. (i.e. all of them.)" Fair enough, but was one of those targets PPC ? MIPS ? Sparc ? Genuinely curious ...
- saidajigumi 11y agoAbsolutely all of those three (and x86, obviously) were supported. I forget if ARM was supported back then, but I can't imagine that it isn't now.
- monocasa 11y agoYou're also up against hardware hackers who stand to make a buck selling prepackaged hardware exploits (AKA modchips). You'd be surprised how much resources these guys have available to them.
- nickpsecurity 11y agoI wouldn't be. They're quite clever. And mod-chips are a physical attack. All systems are assumed compromised if enemy has physical possession, especially modifications. How well are they currently doing with remote, software attacks to fully compromise the gaming consoles?
- monocasa 11y agoWell, they don't really care about software attacks as much since those don't make them as much money. It's also fairly difficult for a remote hack because everything leaving the console has to go through an IPSEC tunnel to pass cert (at least on the 360). And you'd be surprised how secure you can get a game console these days from a hardware perspective. For instance, on the 360, all stacks and everything in the hypervisor is encrypted with a per boot random key and hashed as it leaves L2 for main memory. If the hash doesn't match on the way back, the system resets. You're very protected from DMA attacks. Particularly of the kind that that's easily reproducible and able to be sold in mass.
- nickpsecurity 11y agoThe console security was good work. They wisely applied the tech being developed by academics and industry. There's a number of similar tech designed to stop leaks, protect control flow, and so on with crypto in SOC. I can dig up and post some of you'd like.
- monocasa 11y agoYeah, I'd love to read that if it's not too much effort. : )
- nickpsecurity 11y agoFirst that was easier than AEGIS was SP/Bastion: http://palms.ee.princeton.edu/sp_bastion http://palms.ee.princeton.edu/sp_bastion SecureME's cloaking was interesting: https://docs.google.com/file/d/0B1i_Zf52vJctMTA4YTI1MmUtNzdjNC00ZDRmLTlhYTItYjM0YjhlNGE2MzUz/edit?hl=en&pli=1 https://docs.google.com/file/d/0B1i_Zf52vJctMTA4YTI1MmUtNzdj... HIDE - an infrastructure for efficiently protecting information leakage on the address bus http://www.cc.gatech.edu/people/home/santosh/papers/asplos2004.pdf http://www.cc.gatech.edu/people/home/santosh/papers/asplos20... Using address independent seed encryption and bonsai Merkle Trees to make secure processors OS- and performance-friendly http://www.ece.ncsu.edu/arpers/Papers/micro07-brian.pdf http://www.ece.ncsu.edu/arpers/Papers/micro07-brian.pdf Embedded Software Security through Key-Based Control Flow Obfuscation http://engr.case.edu/bhunia_swarup/papers/C/C80.pdf http://engr.case.edu/bhunia_swarup/papers/C/C80.pdf Memory encryption: Survey of Existing Techniques http://www.thayer.dartmouth.edu/tr/reports/tr13-001.pdf http://www.thayer.dartmouth.edu/tr/reports/tr13-001.pdf ASIST - architecture support for instruction set randomization http://www.ics.forth.gr/_publications/papadog-asist-ccs.pdf http://www.ics.forth.gr/_publications/papadog-asist-ccs.pdf Hardware architectures for software security http://scholar.lib.vt.edu/theses/available/etd-10112006-204811/unrestricted/edmison_joshua_dissertation.pdf http://scholar.lib.vt.edu/theses/available/etd-10112006-2048...
- spott 11y agoSo, I'm kind of curious: It seems that the whole ROP thing depends on X86's CISC architecture in order to allow turing complete programming. Am I wrong in this understanding?
- mjb 11y agoYes. The techniques are possible (though have slightly different tactics) on other architectures. I'm aware of ROP being used for exploits on x86, ARM, MIPS and PPC.
- nickpsecurity 11y agoOh, the attackers in academia have been clever for a long time. Check out this old gem: Automatic Patch-based Exploit Generation is Possible http://bitblaze.cs.berkeley.edu/papers/apeg.pdf http://bitblaze.cs.berkeley.edu/papers/apeg.pdf Gave me a sly grin when I saw it years ago. And to think I thought I was clever because I always tried to compromise networks via whatever they trusted for security. These jokers straight-up turned patches into weapons. I realized at that point, along with all the hacks in media, that computer security was fundamentally (censored). Started focusing on clean-slate approaches where possible with obfuscation, diversity, and strong interface protection everywhere else.
- nickpsecurity 11y agoI don't assume anything and actually made security DSL's myself at one point for defence. The threat model was widely deployed malware and some targeted attacks. The ISA knocked out the malware plus targeted attacks according to monitoring. The more clever attacks we saw (firmware I guess) were blocked by guards and strong, app-level security. One thing I always got guards to do was modify the traffic patterns to make the system pretend to be a different type of system (eg Linux on x86). Even sophisticated attackers, unable to bypass or even see the guard, apparently couldn't get by because they were never smart enough to try an obscure OS + ISA combination. That was a nice hold-up until I learned about separation kernels and split-trust architectures. That was a nice hold-up until recent work on modifying CPU's to increase security. Got plenty of those at concept stage that should do plenty with a few having been implemented by others w/ ranging Linux or FreeBSD support. Now, I'm working on verified specification and synthesis of hardware plus mask and mixed-signal verification to solve the last part of the problem. On a side note, I told some people with simple IT needs to switch to PPC Mac's after Apple switched to x86. They just hated all the hacking and malware issues. Set them up with portable software on PPC so they could leave at any time and take their data with them. Predicted software would get supported for years, some of Internet would be usable, and replacement hardware would be cheap due to PPC Macs going on eBay. They're still using them today and I got another laptop as an air-gapped machine-in-progress last year for $80. Gonna port Tinfoil Chat transmit node to it if I get time. :)