Understanding the Security of ARM Debugging Features Zhenyu Ning and - PowerPoint PPT Presentation

Understanding the Security of ARM Debugging Features Zhenyu Ning and Fengwei Zhang COMPASS Lab Wayne State University May 21, 2019 Understanding the Security of ARM Debugging Features, S&P 19 1

Outline ◮ Introduction ◮ Obstacles for Attacking the Traditional Debugging ◮ Nailgun Attack ◮ Mitigations ◮ Conclusion Understanding the Security of ARM Debugging Features, S&P 19 2

Introduction Modern processors are equipped with hardware-based debugging features to facilitate on-chip debugging process. - E.g., hardware breakpoints and hardware-based trace. - It normally requires cable connection (e.g., JTAG [1]) to make use of these features. Understanding the Security of ARM Debugging Features, S&P 19 4

Traditional Debugging Debug Authentication JTAG Interface Debug Target Debug Host (TARGET) (HOST) Security? Understanding the Security of ARM Debugging Features, S&P 19 5

Introduction Security? We have obstacles for attackers! ◮ Obstacle 1 : Physical access. ◮ Obstacle 2 : Debug authentication mechanism. Do these obstacles work? Understanding the Security of ARM Debugging Features, S&P 19 9

Introduction Security? We have obstacles for attackers! ◮ Obstacle 1 : Physical access. ◮ Obstacle 2 : Debug authentication mechanism. Do these obstacles work? Understanding the Security of ARM Debugging Features, S&P 19 10

Obstacles for Attacking the Traditional Debugging Obstacles for attackers: ◮ Obstacle 1 : Physical access. ◮ Obstacle 2 : Debug authentication mechanism. Does it really require physical access? Understanding the Security of ARM Debugging Features, S&P 19 12

Inter-Processor Debugging We can use one processor on the chip to debug another one on the same chip, and we refer it as inter-processor debugging . ◮ Memory-mapped debugging registers. - Introduced since ARMv7. ◮ No JTAG, No physical access. Understanding the Security of ARM Debugging Features, S&P 19 13

Obstacles for Attacking the Traditional Debugging Obstacles for attackers: ◮ Obstacle 1 : Physical access. ◮ Obstacle 2 : Debug authentication mechanism. Does debug authentication work as expected? Understanding the Security of ARM Debugging Features, S&P 19 14

Processor in Normal State TARGET (Normal State) ... pc MOV x3, #3 x4, #4 MOV MOV x0, x3 x1, x4 MOV LDR pc, [pc, #-0x10] ... TARGET is executing instructions pointed by pc Understanding the Security of ARM Debugging Features, S&P 19 15

Processor in Non-invasive Debugging TARGET (Normal State) ... pc MOV x3, #3 x4, #4 MOV MOV x0, x3 x1, x4 MOV LDR pc, [pc, #-0x10] ... Non-invasive Debugging : Monitoring without control Understanding the Security of ARM Debugging Features, S&P 19 16

Processor in Invasive Debugging TARGET (Debug State) ... MOV x3, #3 pc x4, #4 MOV MOV x0, x3 x1, x4 MOV LDR pc, [pc, #-0x10] ... Invasive Debugging : Control and change status Understanding the Security of ARM Debugging Features, S&P 19 17

ARM Debug Authentication Mechanism TARGET (Normal State) ... Debug pc Disabled MOV x3, #3 x4, #4 MOV MOV x0, x3 x1, x4 MOV LDR pc, [pc, #-0x10] ... Debug Authentication Signal : Whether debugging is allowed Understanding the Security of ARM Debugging Features, S&P 19 18

ARM Debug Authentication Mechanism TARGET (Normal State) ... Debug pc Disabled MOV x3, #3 x4, #4 MOV MOV x0, x3 x1, x4 MOV LDR pc, [pc, #-0x10] ... Four signals for: Secure/Non-secure, Invasive/Non-invasive Understanding the Security of ARM Debugging Features, S&P 19 19

ARM Ecosystem ARM SoC Vendor OEM User ◮ ARM licenses technology to the SoC Vendors. - E.g., ARM architectures and Cortex processors ◮ Defines the debug authentication signals. Understanding the Security of ARM Debugging Features, S&P 19 20

ARM Ecosystem ARM SoC Vendor OEM User ◮ The SoC Vendors develop chips for the OEMs. - E.g., Qualcomm Snapdragon SoCs ◮ Implement the debug authentication signals. Understanding the Security of ARM Debugging Features, S&P 19 21

ARM Ecosystem ARM SoC Vendor OEM User ◮ The OEMs produce devices for the users. - E.g., Samsung Galaxy Series and Huawei Mate Series ◮ Configure the debug authentication signals. Understanding the Security of ARM Debugging Features, S&P 19 22

ARM Ecosystem ARM SoC Vendor OEM User ◮ Finally, the User can enjoy the released devices. - Tablets, smartphones, and other devices ◮ Learn the status of debug authentication signals. Understanding the Security of ARM Debugging Features, S&P 19 23

Obstacles for Attacking the Traditional Debugging Obstacles for attackers: ◮ Obstacle 1 : Physical access. ◮ Obstacle 2 : Debug authentication mechanism. Does debug authentication work as expected? Understanding the Security of ARM Debugging Features, S&P 19 24

Debug Authentication Signals ◮ What is the status of the signals in real-world device? ◮ How to manage the signals in real-world device? Understanding the Security of ARM Debugging Features, S&P 19 25

Debug Authentication Signals Table: Debug Authentication Signals on Real Devices. Debug Authentication Signals Category Platform / Device DBGEN NIDEN SPIDEN SPNIDEN ARM Juno r1 Board ✔ ✔ ✔ ✔ Development Boards NXP i.MX53 QSB ✖ ✔ ✖ ✖ IoT Devices Raspberry PI 3 B+ ✔ ✔ ✔ ✔ 64-bit ARM miniNode ✔ ✔ ✔ ✔ Cloud Packet Type 2A Server ✔ ✔ ✔ ✔ Platforms Scaleway ARM C1 Server ✔ ✔ ✔ ✔ Google Nexus 6 ✖ ✔ ✖ ✖ Samsung Galaxy Note 2 ✔ ✔ ✖ ✖ Mobile Huawei Mate 7 ✔ ✔ ✔ ✔ Devices Motorola E4 Plus ✔ ✔ ✔ ✔ Xiaomi Redmi 6 ✔ ✔ ✔ ✔ Understanding the Security of ARM Debugging Features, S&P 19 26

Debug Authentication Signals How to manage the signals in real-world device? ◮ For both development boards with manual, we cannot fully control the debug authentication signals. - Signals in i.MX53 QSB can be enabled by JTAG. - The DBGEN and NIDEN in ARM Juno board cannot be disabled. ◮ In some mobile phones, we find that the signals are controlled by One-Time Programmable (OTP) fuse. For all the other devices, nothing is publicly available. Understanding the Security of ARM Debugging Features, S&P 19 29

Obstacles for Attacking the Traditional Debugging Obstacles for attackers: ◮ Obstacle 1 : Physical access. We don’t need physical access to debug a processor. ◮ Obstacle 2 : Debug authentication mechanism. The debug authentication mechanism allows us to debug the processor. Understanding the Security of ARM Debugging Features, S&P 19 30

Understanding the Security of ARM Debugging Features Zhenyu Ning and - PowerPoint PPT Presentation

Understanding the Security of ARM Debugging Features Zhenyu Ning and Fengwei Zhang COMPASS Lab Wayne State University May 21, 2019 Understanding the Security of ARM Debugging Features, S&P 19 1 Outline Introduction Obstacles for

Understanding the Security of ARM Debugging Features Zhenyu Ning and Fengwei Zhang COMPASS Lab

Language-specific debugging Most languages include some features/support for debugging, good

Using Hardware Features for Increased Debugging Transparency Fengwei Zhang, Kevin Leach, Angelos

CSE 351 GDB Introduction Lab 2 Reading and understanding x86_64 assembly Debugging and

Using Hardware Features for Increased Debugging Transparency

Identifying Features of Android Apps from Execution Traces Qi Xin, Farnaz Behrang, Mattia

Debugging Debugging with High Level Languages Same goals as low-level debugging Examine and

Image Features Sanja Fidler CSC420: Intro to Image Understanding 1 / 64 Image Features Image

Debugging Debugging Tools Module Overview Introduction to Debugging Problems in Production

Image Features Sanja Fidler CSC420: Intro to Image Understanding 1 / 1 Image Features Image

Chapter 7: Unix Security Chapter 7: 1 Objectives Understand the security features provided

Visual Debugging Software What is Debugging Visualization Visualizing

Roadmap for Section 7.2. Windows Security Features Components of the Security System Windows

Debugging Techniques for C Programs Debugging Basics Will focus on the gcc/gdb combination.

AT ATI TEAS READING REVIEW PART 4 UNDERSTANDING TEXT FEATURES and REFERENCE SOURCES Text

ccTLD Security Understanding the Anxiety and Consequences Barry Raveendran Greene

CS201 RECITATION 1 Introduction to C++ Outline Part 1 : Writing and debugging code with

1 Crashes, interrupts, and backtrace Watchpoints GDB will automatically stop if the program

Coroutines Update Seva Tolstopyatov @qwwdfsad October 13, 2020 Coroutines debugging Coroutines

Understanding Goods and Services Tax Agenda Design of GST Main features of GST Law

Scalable Post-Mortem Debugging Abel Mathew CEO - Backtrace amathew@backtrace.io @nullisnt0

Advanced Production Debugging About Me Co-founder Takipi, JVM Production Debugging. Director,

Android Security Security Philosophy Humans have difficulty understanding risk Safer to

Embedded Software TI2726-B 8. Debugging techniques Koen Langendoen Embedded Software Group