Report on the security conference INSA-2016

Date : January 07, 2016

The French Engineering school INSA, and the LAAS-CNRS research institute have organized the third edition of a one-day conference on security in Toulouse on January 27, 2015. Six presentations were done that day (the agenda is available here) on various subjects, including security hardware or vulnerabilities in secure protocols. We present below a report for this day.

 

"Car connected : review on the security and protection of privacy"

By: Yves Roudier (Université de Nice Sophia Antipolis)

The speaker presents security problems in connected vehicles and solutions for protection.

Since the 70’s, embedded systems have continued to grow. Today they are becoming more numerous in modern vehicles, and their complexity is growing to the point that one can use the expression "computer on wheels ".

These systems are declined from communication applications (Internet, Wi-Fi, Bluetooth, NFC ...), GPS positioning, driving assistance (road sign recognition), … up to autonomous driving  systems.

All these embedded systems, as well as off-vehicle systems (road traffic management systems, guidance, road safety, ...) constitute what is called “Intelligent Transportation Systems” (ITS).

For example the speaker addresses in particular the following two embedded systems:

  • Connected services:
    - Emergency Call (eCall) is an automatic emergency call system allowing a rugged car to call the emergency services by giving its position (geolocation).
    - Breakdown call (bCall) is an automated support system dedicated to automotive crash.
  • Communication between vehicles, or with road infrastructure, based on sensors inside and outside the vehicle, as Car2Car (https://www.car-2-car.org/index.php) which is a European consortium of car manufacturers.

These systems raise two kind of security concern:

  • Hacking:
  • Tampering:
    • Tuning of the vehicle directly by modifying the firmware,
    • Changing the mileage.

New solutions are emerging targeting these new issues and aiming to protect embedded systems. EVITA ("E-safety vehicle intrusion protected application": http://www.evita-project.org/), is a European project which aims to design intra-vehicular secure architectures.

The number of connected vehicles increasing considerably from year to year, it is important that cyber security becomes a priority for car manufacturers, which should integrate in vehicles existing protection means (such as the detection of abnormal frames, or HSM module, …) and contribute to their development. Especially in perspective of the autonomous vehicle, because a remotely take control of vehicle can cause serious security problem.

 

"Critical look over SSL/TLS"

By: Olivier Levillain (ANSSI)

After a brief history, the speaker presents the SSL/TLS security protocols and their main problems.

The Secure Sockets Layer (SSL) protocol was created by Netscape in 1994 in order to secure exchanges on the internet. The IETF has bought the patent and renamed it Transport Layer Security (TLS).

SSL and TLS are two variants of the same protocol for secure communication between a client and a server: privacy (cyphering), integrity of data exchanged (hash mechanism) on the communication channel, and authentication of the parties (certificates).

The negotiation between a client and a server consists of an exchange of several messages in order to agree on algorithms and keys to use.

Since the beginning, this security mechanism is flawed and therefore was often attacked.

Overview of the main problems:

  • Attack on SSL (developed by Serge Vaudenay - 2001), based on the server response time, exploiting a weakness in the implementation of the padding in the CBC cipher mode,
  • “BEAST” attack (September 2011), exploiting a vulnerability in SSL 3.0 and TLS 1.0 protocols, and allowing, via a Man-in-the-Middle attack (MiTM), to decrypt HTTPS cookies,
  • "Heartbleed" attack (April 2014) exploiting a software vulnerability in the OpenSSL library, and allowing an attacker to read the memory of a server or a client to retrieve, for example, private keys used during the TLS communication,
  • "POODLE" attack (October 2014) exploiting a design flaw in SSL v3, and allowing, through a MiTM attack, to downgrade the security level of SSL / TLS  connections, and break SSLv3  ciphering,
  • "Freak" attack (February 2015), which exploits a cryptographic weakness in the SSL/TLS protocols, and allowing, via a MiTM attack, to downgrade the security level of the connection by providing a weak temporary RSA key during a RSA encryption key exchange,
  • "Logjam" attack (May 2015) which exploits a weakness in the key exchange algorithm Diffie-Hellman (DH), and allowing (as FREAK), via a MiTM attack, to downgrade the security level of the connection and to decrypt communications.

The knowledge of these flaws allows to conclude on the need to improve the quality of the software testing phase to do on the protocols, and on enhancing software development in particular by using compiler features to audit the quality of the source code.

TLS version 1.3 is soon expected to bring several improvements in the negotiation phase and the removal of obsolete cryptographic algorithms (PKCS # 1 v1.5, RC4, CBC).

 

"Credit card fraud: when the mobsters read research reports!"

By: Assia Tria (CEA, Gardanne)

The speaker presents the results of a forensic analysis of a credit card fraud (held in 2011). This analysis was done at the request of a court after the GIE Cartes Bancaires has complained owing to important sums of money stolen. This fraud, and the perpetrators, were discovered thanks to the arrest of a carrier of falsified card in France. Many illegal cash withdrawals were made outside the French territory, in particular in Belgium.

The forensic team made a first analyze on the falsified card without damaging it. This analysis shows that this card is composed of three parts:

  • The plastic body of the card,
  • The chip,
  • An additional FUN module (programmable open card containing a microcontroller and memory) glued on the chip.

An X-ray analysis identified tiny welds connecting the legs of the FUN module with certain connectors of the chip.

A deep analysis of the fraud mechanism (Side Channel Analysis on the current consumption curve during message exchanges) shows that the additional module lets some communications between the card and the ATM, then takes the lead when comes the PIN identification procedure to systematically return the checking code ok (9000). It lets the legitimate smart card to complete the transaction.

The authors of this study were very surprised by the quality of the welding work, and by the mounting sandwich of all elements on a card of less than one millimeter.

This fraud has exploited an article published in 2010 (https://www.cl.cam.ac.uk/research/security/banking/nopin/oakland10chipbroken.pdf) about the possibility to hack banking cards chip by British researcher (Mr Ross Anderson, professor at the University of Cambridge).

Fraudsters have made possible what Ross Anderson’s article presented as a case of attack. And with a lot of ingenuity, they managed to miniaturize what the presentation of Anderson showed as a bulky electronic system, incompatible with the necessary discretion to hack a cash machine.

 

"Security Challenges in SDN/NFV 5G Networks"

By: Kahina Lazri (Orange Labs)

SDN (Software Defined Networking) principles:

  • Separation of Control and Data Planes.
  • Centralization of network control functions.
  • Standardization of interfaces: OpenFlow protocol for instance.

NFV (Network Function Virtualization) principle: Use virtualization technologies applied to network equipment.

This allows the usage of VMs instead of physical appliances for network functions.

Most of the security issues of these models are linked to the equipment controller (centralized):

  • This controller is a SPOF.
  • If the Controller is compromised, then the whole network is also compromised.
  • Inconsistency of the different network "views" of the different equipment (topology, routing) if a problem occurs.
  • Scalability (Orange's controller can manage today approximately environ 200 switches).

Example of an attack on SDN networks: Topology poisoning (Hong 2015 http://faculty.cs.tamu.edu/guofei/paper/TopoGuard_NDSS15.pdf)

This attack uses the LLDP protocol to change the network topology and induce a Man-In-The-Middle attack.

 

"PayTV and protection of industrial property"

By: Edouard et Mohamed (Groupe Canal+)

The Canal+ encrypted TV programs are composed of two types of flows:

  • The TV program itself (weak encryption).
  • The control data which is used to decrypt this program (strong encryption).

The presentation is focused on the "linear" hacking: to see the TV show live and not for download or streaming days after.

There are several types of hacking:

  • Pirate relay: A Canal+ subscriber sends the unencrypted flow to recipients. The main drawback with this method is high bandwidth usage.
  • Card Sharing: A Canal+ subscriber sends the control data only to recipients. With this control data, the recipients can decrypt and watch the program.

A security audit has been performed on the G5 decoder (2010) and revealed several issues:

  • The subscriber's card serial number is sent in cleartext over the internet.
  • The credentials of several collect servers (used for statistics) are visible in clear text in Java classes.
  • A library which is in one of the decoder's modules is vulnerable to Buffer Overflow attacks.

 

"Security and hardware"

By: Raphaël Rigo (Airbus Group Innovations)

PCs have evolved in the past 20 years. Modern PCs have code in several components: keyboard controller, screen, network controller, Touchpad, GPU, etc.

This presentation explains the impact of integrated controllers, of this hardware which contains software, and of secure boot functions.

BadUSB example: An USB key chipset has a reprogrammable firmware, which can become an attack vector.

Techniques and steps of reverse engineering:

  • "Big" embedded equipment:
    • Firmware extraction.
    • Reverse of the binaries.

Problem: Material components such as cryptoprocessors make the analysis more difficult, and these components are more and more used.

  • "Small" embedded equipment:
    • Dump of the flash memory.
    • Bus sniffing.
    • "Decapping" of components in order to reinitialize the security fuse and to perform the analysis.

Example of a study on an equipment: The Zalman VE400 encrypted hard drive.

This example was presented at the 2015 SSTIC: https://www.sstic.org/2015/presentation/hardware_re_for_software_reversers/

First observations:

  • The encryption is independent of the hard drive case. An encrypted hard drive placed in a new Zalman case is accessible once the correct PIN code is entered.
  • The activation of encryption creates a binary blob at the end of the disk.

In order to evaluate the security level of the disk, the following steps were taken:

  • Study of the upgrades: everything is encrypted, which makes the binary reverse impossible.
  • Research on the Internet in order to find information on the components, the datasheets, or other information in press releases.
  • PCB (electronic card) analysis: With a photo of the front and back of the card to understand the connections between the components.
  • Memory dumps.
  • Controller dumps.

To analyze the PCB in detail, an x-ray image of the card was made. This makes it easier to view the connections between components which are invisible to the human eye.

The flash memory is connected to the PIC32 controller. In order to read the flash, it was unsoldered, and then a tool named GoodFET was used to get the content. But the code on the flash is also encrypted.

After that, a "black box" analysis was done with a Saleae Logic Pro 16 logical analyzer (oscilloscope for digital signals).

The exchanges between the microcontroller and the SoC made it possible to retrieve the hash of the PIN (64 bit hash). But this hash (proprietary algorithm) didn't make it possible to get the PIN.

A "decapping" analysis was lead with acetone, which allowed seeing the transistors with a microscope. To see the different layers, it is necessary to practice "delayering" by removing the metal layers with hydrofluoric acid for instance.

Then, we can analyze the structure to understand the logic of the components with an optical or electronic microscope.

Conclusion:

Hardware reverse engineering is essential but is more and more difficult to perform because of miniaturization and increased speed of components.

There are more and more cryptography and trusted boot mechanisms, which makes security audits on equipment more difficult, and more specifically for proprietary products.

Previous Previous Next Next Print Print

© 2024 Cert-IST