How Lack of Transparency in Firmware/Hardware Fuel Advanced Cyber Attacks
Introduction: The Unprecedented iPhone Backdoor Campaign
In a startling revelation, a four-year-long campaign has been uncovered that compromised iPhones using what might be the most sophisticated exploit ever seen. This attack, detailed on Ars Technica, leveraged a secret hardware feature to execute its nefarious activities. While we will delve into the specifics of the exploit chain later, it’s crucial to understand the high-level aspects of this attack first. For a deeper dive into the campaign’s intricacies, the CCC presentation offers invaluable insights (CCC Presentation).
To fully grasp the nature of this attack, we must first explore the architecture of modern systems and their exploit prevention mechanisms. This includes understanding the complexity of devices, the threat model, privilege levels, and the likelihood of different vulnerability classes being exploited.
The Art of Threat Modeling: A Technical Perspective
Threat modeling, in the context of system and software security, is a structured approach that identifies and prioritizes potential threats to a system. It involves analyzing the system’s architecture, looking for ways that it could be exploited, and designing mitigations to protect against those threats.
A threat model should be created up front as an integral part of designing a system or device. Still, sometimes this step is skipped and an ad-hoc threat model is created afterward, often as a response to exploitation in the field. This sort of after-the-fact analysis can uncover systemic problems with the overall architecture that should have been identified earlier during the design phase.
Here’s a more technical breakdown of the key components of threat modeling:
1. Defining the System Architecture
- Component Analysis: Identify and document all components of the system, including hardware, software, network elements, privilege boundaries, and data flows. This step is crucial for understanding the attack surfaces.
- Data Classification: Classify data based on sensitivity and confidentiality. Understanding what data is critical helps in prioritizing security efforts.
2. Identifying and Categorizing Threat Agents
- Threat Agents Identification: Determine who might attack the system. This includes hackers, insiders, competitors, or state actors.
- Capability and Intent Assessment: Assess the capability (skill level, resources) and intent (motivation) of potential threat agents. This helps in understanding the likelihood of different types of attacks.
3. Modeling Attack Vectors
- Entry Points: Identify all possible entry points an attacker might use. This includes public-facing interfaces, internal privilege boundaries, internal network access points, and physical access.
- Attack Paths: Map out potential paths an attacker could take through the system, considering different levels of access and privilege.
4. Determining Mitigations
- Risk Mitigation Strategies. This can include technical solutions (like encryption, access controls, and intrusion detection systems) and policy and procedural changes. Also, exploit prevention methods fall into this category.
- Residual Risk Analysis: Understand and accept the level of risk that remains after mitigation strategies are implemented.
5. Continuous Review and Update
- Regular Updates: Threat models should not be static. Regularly update the threat model to reflect identified gaps, changes in the system architecture, emerging threats, and evolving attacker tactics. Security relevant functionality within the system may have been overlooked during previous threat modeling and design analysis efforts and any identified omissions should be integrated into the threat model.
- Feedback Loop: Incorporate feedback from security incidents, audits, and testing into the threat model to continuously improve it.
Threat modeling is a dynamic and ongoing process that requires a deep understanding of the system’s architecture, potential threats, vulnerabilities, and the impact of potential security breaches. It’s a critical component in the design and maintenance of secure systems, ensuring that security considerations are integrated throughout the system’s lifecycle.
Classifying Vulnerabilities: A Technical Deep Dive
In the realm of cybersecurity, accurately classifying vulnerabilities is crucial for effective risk management and mitigation. Here’s a very simplified breakdown of the primary categories of vulnerabilities:
1. Logical Vulnerabilities
- Definition: Logical vulnerabilities are flaws in software logic that can be exploited without necessarily exploiting traditional memory corruption issues. They often arise from missing authentication, inadequate input validation, improper error handling, or flawed application logic.
- Subcategories:
- Web Vulnerabilities: These include SQL Injection (SQLi), Cross-Site Scripting (XSS), Cross-Site Request Forgery (CSRF), and others. These types of vulnerabilities often exploit the logic of web applications to gain unauthorized access or perform unauthorized actions.
- Misconfiguration and Hardware Issues: This includes vulnerabilities arising from incorrect system configurations or hardware design flaws. Examples include insecure BIOS settings (like BIOS_WP), unlocked debug interface, or vulnerabilities in peripheral devices.
- A comprehensive threat model plays a crucial role in helping to identify and prevent logical vulnerabilities. Exploit prevention mechanisms very rarely help to mitigate this class of vulnerabilities.
2. Object Hijacking
- Definition: Object hijacking involves exploiting vulnerabilities like Use-After-Free (UAF) and Double-Free, where an attacker manipulates memory management features of a program to execute arbitrary code.
- Technical Aspects:
- Use-After-Free (UAF): This occurs when an application continues to use a pointer after it has been freed, leading to arbitrary code execution or crashing the program.
- Double-Free: Involves freeing a memory allocation twice, potentially leading to memory corruption.
- Detection and Mitigation: Modern mitigation techniques like Control Flow Integrity (CFI) and Control-flow Enforcement Technology (CET) can detect and prevent object hijacking. However, their effectiveness can vary based on the software’s architecture and the presence of interpreters or complex scripting environments.
3. Memory Corruption
- Definition: Memory corruption vulnerabilities occur when the contents of a memory location are altered due to programming errors, leading to undefined behavior, crashes, or code execution.
- Some examples of these are buffer overflows due to unbounded or incorrectly bounded copy or transformation operations and writing outside of buffers due to missing or incorrect bounds checks.
- Memory Corruption Protections can make this type of vulnerability very hard or impossible to exploit.
Privilege Levels: Then and Now
The Old Days: App and Kernel Level
In the early days of computing, systems were simpler, with primary privilege levels being the application and the kernel. Exploitation techniques were relatively straightforward, involving executable stacks and overwriting the saved Instruction Pointer in the stack (this is sometimes referred to as the Return Instruction Pointer). These methods are still applicable in many firmware systems like UEFI and embedded Linux. Our research on exploiting UEFI/Linux provides practical examples of these vulnerabilities (RCE in UEFI).
In response to attacks against these older systems, newer protection mechanisms have been developed to attempt to mitigate these types of attacks. These have included adding additional privilege levels and other mechanisms for isolating code executing on the platform to reduce the impact of successful exploitation.
The New Era: Expanded Privilege Layers
Modern systems have evolved, introducing additional layers like Hypervisors, TrustZone (TZ), and more. Hypervisor and Virtualization Based Security (VBS) technologies have become crucial (Hypervisor Attacks, Firmware Attacks). TZ and technologies like SMM with STM add further complexity and security layers (TZ Exploitation, STM User Guide).
Sandboxes: The New Defense Perimeter
Sandboxes have become a critical defense mechanism, with browsers like Chrome leading the way (Chrome Sandbox, Sandbox Exploitation). iPhones, for instance, sandbox third-party apps and mount their operating system partition as read-only, adding an extra layer of security.
Secure-Core PC: The Next Frontier
Secure-Core PCs represent the latest advancement in system security. They combine various technologies to create a robust defense system. However, questions remain about their threat models and transparency (Secure-Core PC Demo).
Exploit Prevention Techniques
Traditional and Advanced Methods
In addition to implementing new privilege levels and isolation mechanisms, system designers have also sought to mitigate entire classes of vulnerabilities through the development and application of advanced exploit prevention methods. These mitigation techniques have evolved over time and new mechanisms often build on previous ones in order to close newly identified gaps in protection. Some of these are modifications to software implementations, such as modifying compilers to insert stack canaries and canary checks. Still, in many cases, these have involved adding new hardware mechanisms to the CPU.
- DEP (Data Execution Prevention also known as NX or Non-Execute)
- Operating system methods for making the stack, heap, or other memory regions not executable.
- This prevents simple exploits where an exploit payload is written to a stack or heap buffer and a vulnerability allows code execution to be redirected to the buffer to execute native instructions directly from memory.
- This can be bypassed through the use of ROP (Return Oriented Programming, Return-oriented Programming: Exploitation without Code Injection, BlackHat 2008) and other similar methods.
- ASLR (Address Space Layout Randomization):
- Randomizing the addresses that those regions are loaded to so that hardcoded pointers can’t be used as part of exploit payloads
- These are foundational exploit prevention techniques, though bypasses exist (DEP/ASLR Bypass).
- Stack Canaries and other software mitigations:
- Software method to set and check a value in the stack frame to protect the saved return address from being overwritten by simple linear buffer overflows.
- These methods can sometimes be bypassed with read/write primitives.
- Even in 2021-2022, Browser attacks demonstrate their limitations (Browser Security).
- Memory Corruption Protections:
- Memory Tagging: Techniques like ARM’s Memory Tagging Extension (MTE) tag memory allocations and check these tags during operations to prevent unauthorized access.
- Pointer Authentication Codes: Added in arm64e architecture to protect pointers in memory by allowing them to be cryptographically signed and verified through the use of new CPU instructions.
- Control Flow Integrity (CFI), and Control-Flow Enforcement Technology (CET): Their effectiveness against object hijacking vulnerabilities depends on implementation and target specifics.
- iPhone-Specific Protections: Apple has implemented several unique security features, such as Kernel Integrity Protection, Fast Permission Restrictions, and Pointer Authentication Codes, enhancing the security of their devices (Apple Security)
- Microsoft provides detailed exploit prevention documentation (Microsoft Exploit Protection)
- Good collection of exploit mitigation methods (NCC Exploit Mitigations)
Exploit Chain Details
Now that we understand a little more about modern architectures and exploit mitigation mechanisms, let’s take a closer look at the exploit chain itself.
User-Mode Exploitation
iMessage Vulnerability: A critical aspect of the exploit was the manipulation of the iMessage application. The attackers sent a malicious attachment processed by the application without user interaction. In particular, the attackers sent a PDF file which was parsed by the iMessage application and exploited a vulnerability in the TrueType font parser. TrueType fonts are the most common font format in the world, but they’re not just data and include a bytecode program that is executed inside the font processing library. In this case, undocumented TrueType bytecode instructions and a vulnerability within this execution environment allowed the attackers to break out of the sandbox to attack other parts of the system.
PAC Bypass: The exploit chain demonstrated a sophisticated bypass of Pointer Authentication Code (PAC), a security feature in modern ARM architectures. PAC aims to prevent unexpected alterations of pointers in memory, but the attackers successfully circumvented this protection by using existing signed pointers found in memory to gain access to call the signPointer function to sign any pointers they want for themselves.
A significant contributing factor to the success of this user-mode exploitation was the lack of transparency within the file format and the instructions that are supported within the file format. TrueType font parsing has been a continuing source of vulnerabilities since the 1990s.
Kernel-Level Exploitation
Object Hijacking Techniques: The kernel-level attack utilized object hijacking, specifically targeting Physical Use-After-Free (PUAF) (Analysis) vulnerabilities. This allowed the attackers to gain read/write access to the entire physical memory from a user-level privilege.
Bypassing Page Protection Layer (PPL)
MMIO Registers Exploitation: The attackers exploited undocumented hardware memory-mapped I/O (MMIO) registers that could be used to bypass the Page Protection Layer (PPL). This approach highlighted a significant gap in the threat model, where reliance on undocumented features and security through obscurity proved ineffective.
In particular, this hardware feature allows software to write certain values to MMIO registers, such as a destination address, data, and a calculated hash and the hardware will indirectly perform the write on behalf of the requestor. If not properly constrained, mechanisms like this can act as a confused deputy in hardware similar to a read/write/where primitive that is routinely encountered in kernel exploitation.
This type of vulnerable mechanism has previously been found in hardware devices such as integrated graphics (Graphics Aperture DMA, Attacking and Defending BIOS in 2015)
Threat Model Limitations: The incomplete threat model failed to account for the possibility of exploiting MMIO registers and other hardware features. This oversight underscores the importance of comprehensive documentation and understanding of all system components in threat modeling.
Security Implications and Recommendations
Comprehensive Threat Modeling: This case study emphasizes the need for exhaustive threat modeling that includes hardware-level features and undocumented system components.
Beyond Security Through Obscurity: Relying on the obscurity of system internals is not a sustainable security strategy. Full documentation and transparency are essential for robust security. If you don’t know about a particular hardware feature, you can’t analyze the security implications of its use and potential exploitation.
Enhanced Exploit Mitigations: The exploit chain’s success against sophisticated mitigation techniques like PAC suggests the need for continuous evolution and improvement of security measures.
Conclusion
The recent exploit chain highlights critical weaknesses in current threat modeling, primarily due to insufficient understanding of software, firmware, and hardware layers. This lack of transparency in foundational technology layers leaves significant vulnerabilities unaddressed. Effective threat modeling requires a comprehensive approach that encompasses all system components, including the often-overlooked firmware and hardware. To enhance system security against sophisticated threats, there is a pressing need for greater transparency and collaboration among manufacturers, developers, and security researchers. Ultimately, adapting and evolving security practices in line with technological advancements is essential for robust cybersecurity.
