5 ms·

PiFex: JTAG Hacking with a Raspberry Pi

218 points by wrongbaud 2y ago

MrBuddyCasino 2y ago
A device that is a bit similar, but more advanced is the Glasgow Interface Explorer: https://www.crowdsupply.com/1bitsquared/glasgow https://www.crowdsupply.com/1bitsquared/glasgow It costs 145$ instead of 50$, and you can interface with it via Python3 over USB. It is quite flexible due to a reconfigurable FPGA and has some nice features such as automatically detecting UART baud rates, JTAG pinouts, ESD / Under / and Over-Voltage protection on the I/O pins and more.
- wrongbaud 2y ago
  The Glasgow is an awesome piece of kit, I have one and love it! I wanted the PiFex to be a little more user friendly and targeted towards beginners
- westurner 2y ago
  A $5 Pi Pico has two UARTS, but is not an FPGA; "Show HN: PicoVGA Library – VGA/TV Display on Raspberry Pi Pico" https://news.ycombinator.com/item?id=35117847#35120403 https://news.ycombinator.com/item?id=35117847#35120403 According to https://www.reddit.com/r/raspberrypipico/comments/1aut3l2/comment/kr7kfzo/ https://www.reddit.com/r/raspberrypipico/comments/1aut3l2/co... , pico-uart-bridge turns a pico into 6 TTL UARTs; https://github.com/Noltari/pico-uart-bridge https://github.com/Noltari/pico-uart-bridge
cushychicken 2y ago
I'm always surprised how infrequently JTAG interfaces are disabled on actual honest to god products that go into the field. It's not at all hard to blow the JTAG enable fuse in most chips. And you can give away a ton of info from your device if you don't do this. That potentially includes really sensitive info - through backdoors like this. People keep all kinds of stuff on their hard drives. (Full disclosure: I'm the HW eng who reviewed this design. Hi Matt! Reverse engineering is still magic.)
- londons_explore 2y ago
  I don't disable JTAG on field hardware because theres a good chance I'll be expected to do failure analysis or bug-hunting on the production hardware. JTAG is going to make that much easier. And, lets be honest, your smart IoT coffee maker doesn't really have any secrets that need protecting from you, despite whatever the business team thinks.
  - foldor 2y ago
    Hard disagree. That "smart IoT coffee maker" stores your wifi details, including the password so it can reconnect. I appreciate the level of sophistication and effort required for someone to be able to abuse that is beyond the realm of likelihood, it's not unreasonable to believe that there may be higher value targets (like journalists) who are being targeted where this is a reasonable method for dedicated attackers to use to gain access to a targets home network. Better to just secure these things by default.
    - OJFord 2y ago
      You're worried about someone with physical access and time to dump info from a JTAG header gaining the WiFi password?
      - bongodongobob 2y ago
        Target throws out coffee maker. Threat actor goes through trash. They don't have to break into the building to get it.
        buildbot 2y ago
        If someone is targeting you that precisely they are sorting through your trash for a coffee maker, then I would posit you are already in deep trouble and they'd likely do something easier like wait for you to leave and insert physical access into your network then...
zoobab 2y ago
Go-JTAGenum is a rewrite in Go of JTAGenum, a rewrite of some arduino scripts JtagFinder and Arduinull that Lekernel and I made years ago: https://github.com/cyphunk/JTAGenum https://github.com/cyphunk/JTAGenum Good to see an web interface to go-jtagenum via Jupyter Notebooks :-)
farmdve 2y ago
This is fine for devices that expose a true JTAG interface. But imagine something like Hitachi's User Debug Interface that exposes only boundary scan. The rest of the protocol is undocumented unless you have specific NDA clearance. In which case a methodology is needed to reverse engineer this protocol, treating the device like a black box. I really liked how a solution to this was found for x86 processors and hidden instructions https://github.com/xoreaxeaxeax/sandsifter https://github.com/xoreaxeaxeax/sandsifter
- randomcarbloke 2y ago
  the world needs more Christopher Domas talks, he is inspirational.

218 points by wrongbaud 2y ago

A device that is a bit similar, but more advanced is the Glasgow Interface Explorer: https://www.crowdsupply.com/1bitsquared/glasgow https://www.crowdsupply.com/1bitsquared/glasgow It costs 145$ instead of 50$, and you can interface with it via Python3 over USB. It is quite flexible due to a reconfigurable FPGA and has some nice features such as automatically detecting UART baud rates, JTAG pinouts, ESD / Under / and Over-Voltage protection on the I/O pins and more.

wrongbaud 2y ago
The Glasgow is an awesome piece of kit, I have one and love it! I wanted the PiFex to be a little more user friendly and targeted towards beginners
westurner 2y ago
A $5 Pi Pico has two UARTS, but is not an FPGA; "Show HN: PicoVGA Library – VGA/TV Display on Raspberry Pi Pico" https://news.ycombinator.com/item?id=35117847#35120403 https://news.ycombinator.com/item?id=35117847#35120403 According to https://www.reddit.com/r/raspberrypipico/comments/1aut3l2/comment/kr7kfzo/ https://www.reddit.com/r/raspberrypipico/comments/1aut3l2/co... , pico-uart-bridge turns a pico into 6 TTL UARTs; https://github.com/Noltari/pico-uart-bridge https://github.com/Noltari/pico-uart-bridge

cushychicken 2y ago

I'm always surprised how infrequently JTAG interfaces are disabled on actual honest to god products that go into the field. It's not at all hard to blow the JTAG enable fuse in most chips. And you can give away a ton of info from your device if you don't do this. That potentially includes really sensitive info - through backdoors like this. People keep all kinds of stuff on their hard drives. (Full disclosure: I'm the HW eng who reviewed this design. Hi Matt! Reverse engineering is still magic.)

londons_explore 2y ago
I don't disable JTAG on field hardware because theres a good chance I'll be expected to do failure analysis or bug-hunting on the production hardware. JTAG is going to make that much easier. And, lets be honest, your smart IoT coffee maker doesn't really have any secrets that need protecting from you, despite whatever the business team thinks.
- foldor 2y ago
  Hard disagree. That "smart IoT coffee maker" stores your wifi details, including the password so it can reconnect. I appreciate the level of sophistication and effort required for someone to be able to abuse that is beyond the realm of likelihood, it's not unreasonable to believe that there may be higher value targets (like journalists) who are being targeted where this is a reasonable method for dedicated attackers to use to gain access to a targets home network. Better to just secure these things by default.
  - OJFord 2y ago
    You're worried about someone with physical access and time to dump info from a JTAG header gaining the WiFi password?
    - bongodongobob 2y ago
      Target throws out coffee maker. Threat actor goes through trash. They don't have to break into the building to get it.
      - buildbot 2y ago
        If someone is targeting you that precisely they are sorting through your trash for a coffee maker, then I would posit you are already in deep trouble and they'd likely do something easier like wait for you to leave and insert physical access into your network then...

zoobab 2y ago

Go-JTAGenum is a rewrite in Go of JTAGenum, a rewrite of some arduino scripts JtagFinder and Arduinull that Lekernel and I made years ago: https://github.com/cyphunk/JTAGenum https://github.com/cyphunk/JTAGenum Good to see an web interface to go-jtagenum via Jupyter Notebooks :-)

farmdve 2y ago

This is fine for devices that expose a true JTAG interface. But imagine something like Hitachi's User Debug Interface that exposes only boundary scan. The rest of the protocol is undocumented unless you have specific NDA clearance. In which case a methodology is needed to reverse engineer this protocol, treating the device like a black box. I really liked how a solution to this was found for x86 processors and hidden instructions https://github.com/xoreaxeaxeax/sandsifter https://github.com/xoreaxeaxeax/sandsifter

randomcarbloke 2y ago
the world needs more Christopher Domas talks, he is inspirational.