Blogs

Working With Ghidra's P-Code To Identify Vulnerable Function Calls

May 11, 2019

This year at INFILTRATE 2019, I got together with fellow RPISEC alumnus and Boston Cybernetics Institute co-founder Jeremy Blackthorne to present “Three Heads Are Better Than One: Mastering NSA’s Ghidra Reverse Engineering Tool”. Around 50 minutes into that presentation, I presented a demo of a proof of concept script I built to trace out how inputs to malloc are derived. In this blog post, we’ll take a deeper look at that script.

For those unfamiliar with the tool, Ghidra is an interactive reverse engineering tool developed by the US National Security Agency, comparable in functionality to tools such as Binary Ninja and IDA Pro. After years of development internally at NSA, Ghidra was released open source to the public in March 2019 at RSA.

Helping Embedded Developers Code More Securely: banned.h and strsafe

April 30, 2019

Windows developers may be familiar with “banned.h” or “strsafe” libraries. Introducing safe libraries to development is nothing new, as was covered in the 2007 presentation on SDL for Windows Vista (slide 7). While basic, these basic libraries have been shown to provide significant value - as discussed later in the deck, 41% of bugs that Microsoft removed in Vista early on were due to removal of ‘banned’ API function calls.

To date, we do not know of an open-source project applying these same principles to the embedded development community. That is why we’re releasing an open source embedded-focused banned.h library, available on GitHub.

A Tale of Two Supply Chains

December 3, 2018

This is the first of a multi-part series where we will share some of our methodology for supply chain verification in situations where there is very limited information. This content was previously shared by Sophia d’Antoine at Square’s r00ted¹ Conference on November 14th, 2018 in NYC.

We have previously shared our thoughts on the importance of supply chain validation with regard to hardware attacks, but this blog series will delve deeper into the specifics related to case alleged in Bloomberg Businessweek’s “The Big Hack” article.

Continue reading

Reactions to FDA Draft Cybersecurity Guidance

November 7, 2018

It’s not often that one can get excited reading draft regulatory guidance. However, our team was pleasantly surprised by the quality and quantity of specific and actionable cybersecurity recommendations in the US Food and Drug Administration (FDA) draft Content of Premarket Submissions for Management of Cybersecurity in Medical Devices, published October 18, 2018.

Hardware Hacks: The Importance of Supply Chain Validation

October 9, 2018

In the past few months, media reporting¹ ² on alleged Chinese backdoors via one or more types of hardware implants which compromised American products and companies has raised the public’s awareness of the risk of security compromise via hardware.

For those of us who deal with hardware security daily, such allegations are not a big surprise. Our team has worked on designing, securing, and hacking hardware used in places ranging from startups to security-critical government applications, and one item that is in almost every assessment that we do is a circuit board tear-down and detailed parts identification.

GoodFET: Step-by-step install/setup on Kali

September 24, 2018

In the hardware hacking community, one of the tried-and-true “go to” tools for serial communication, dumping SPI flash chips, and interacting with basic JTAG interfaces is the GoodFET, developed by our neighbor Travis Goodspeed. Some of the GoodFET instructions are a bit outdated and fragmented, and we recently were asked for help installing this on a modern Debian-based system, namely the Kali Linux security distribution. We have written up those procedures here in the hope that they are useful to people working with the GoodFET hardware.

Challenges and Trends in Device Security

August 20, 2018

While we are always excited to both learn and share the latest technical developments in cybersecurity (the recent Black Hat and DEF CON conferences were no exception), we also enjoy stepping back once in a while to look at macro trends in the embedded security industry. While security is a top priority in many enterprise and industrial settings, here are three key concepts that we think are important for us all to keep in mind:

SummerCon 2018 In Review

July 1, 2018

SummerCon is a different type of conference than most, and honestly sometimes it’s tough to hear the talks over the noise of the crowd at the bar. This year, the organizers added a second venue to try to spread out the noise from the great conversations and impromptu meetings, so some of the talks could be heard. We wanted to share a few notes on our teams’ key takeaways from the weekend.

Sharing the Team’s Recent Research at DefCon & BlackHat

June 19, 2018

At River Loop Security, we are always looking to advance the state of cybersecurity research alongside our work tackling our clients’ toughest problems. Presenting our research at computer security conferences is one way that we hope to share our lessons learned with the community.

This summer, we’re excited to present at BlackHat USA and DefCon. We’ll be showcasing some select areas of our team’s research: 1) RF Fuzzing and Hardware Tools, 2) Reversing a Windows Antivirus Emulator, 3) Understanding Attack Attribution. We aim to empower others to understand currently uncharted (or at least less charted!) areas, as well as share ways to frame complex problems facing the industry today.

ZigBee & Z-Wave Security Brief: Part 2

June 4, 2018

This is the second of two blog posts where we will share a summary of the differences. We encourage you to read the first post for background on the purpose of this post and discussion of security levels and keying techniques.

The ZigBee and ZWave protocols have both undergone numerous revisions and support many different security modes and edge cases. In this discussion, we will try to focus on core design decisions and features, and leave out discussion or investigation of edge cases for brevity. We will use the following shorthand: ZigBee (ZB)’s HA 1.2 spec as ZBHA1.2, the ZigBee 3.0 core protocol as ZB3.0, Z-Wave’s PHY and main protocol as ZW, and Z-Wave’s Security 2 specification as S2.