Immanuel's 6441 Security Blog

Don’t trust anything wireless (especially Bluetooth). Logitech makes some of the finest wireless keyboard and mice around and this showcases 2 major vulnerabilities.

If an attacker can press some keys, or observe some keys being pressed while monitoring network traffic. They can inject key presses without the key to the crypto.

If an attacker can observe the pairing process, they can decrypt all key presses.

This article, while it says stop using RSA is more about the actual implementation of RSA. It’s too complex for a programmer to use, too many variables that if not set correctly will make it insecure. And the algorithm is deceptively simple meaning developers think they can implement it themselves. Instead they recommend using libraries that do most of the work for you.

I mentioned this in class, but this is an example of a white hat using a format string attack and XSS to get private information.

Basically he named his Tesla a XSS script. Nothing happened when he did it , or when it displayed the name on the app so he figured it was secure. A couple weeks later his windshield cracks and he submits a form to get a repair. That’s when he noticed a ping on his server. An internal Tesla app used to review repair orders was had executed his script. He got a bunch of privileged information, at which point he submitted a bug reported for it and was paid 10K.

Holy shit this is scary. Not only do they filter images based on hash, they OCR any text and check it against a blacklist of keywords.

My something awesome was to free my laptop, however these days we all have computers that are arguably more valuable (in terms of data) than our laptops. Our phones. I do most of my computing these day on my phone, most of the world does (most poor people only have 1 computer, their phone), and so it could be argued that it’s more important that your phone is free than your laptop.

However phones are FAR more difficult to free. Phone hardware is incredibly complex and closed off, the modem alone is an extra CPU with direct memory access (the Snapdragon x55 5G modem is literally a full Snapdragon 855 CPU), and to get a modem you need make a deal with the devil (Qualcomm) and you can’t release the code it runs.

Android is purportedly open source, however Google has been making it more and more difficult to separate their services from android. iOS is closed source, as is Jolla and KaiOS (a firefox OS derivative used in feature phones, popular in india, partially owned by Google).

So the free software advocate has 3 choices really in terms of smartphones:

Buy an android phone and flash it with some form of degooglified android

Buy an android phone and flash it with a fully free OS like postmarketOS, ubuntu phone, PureOS

Wait for the linux phone’s that should be coming out soon. The Librem 5 and the PinePhone (these would run the OSes from option 2)

This company purports to have a source code analyzer based on math that can guarantee C & C++ code to be free of buffer overflows, race conditions and memory leaks.

This is interesting to me since C is said to be memory unsafe, and most recommendations I hear are to just use Rust instead. However this GUARANTEES their analyzer.

This is a hilarious emacs extensions that sticks a bunch of political sensitive words like 

terrorism 9705 Samford Road Albright eavesdropping Freeh Baranyi DES number key Dateline satellite imagery clones ANC COSCO basement ASPIC 

Note: I ordered my SOIC8 test clip from China, but it never came and so this guide is a theoretical write up of how I would’ve done this had it arrived. This was very unfortunate as I had everything else prepared.

This is a guide on how to coreboot a thinkpad x220t. Most thinkpads are pretty similar so this guide can also be used for an x200-x230, though you should still google for any model specific details.

Also backup your BIOS for the love of god, and don’t panic if you brick it, just reflash with your backup. And be careful not to fry the flash chip, if you do, you might be able to desolder and replace it.

This guide comes with no warranty, proceed at your own risk.

What you need

x220t

Raspberry Pi 3B

A linux computer to SSH into the Pi

Female jumper leads (to connect the Pi and the test clip)

SOIC 8 pin test clip (like this)

Procedure

Download and flash Raspbian Lite to a micro SD card.

Make a file called ssh in the root directory (to enable SSH)

Follow the directions here to set up wifi on the Pi so you can access it remotely (you can use a wired connection if you want)

Use nmap or check your router to find the ip address of the Pi

SSH into the pi (default user and pw is pi and raspberry)

Prepare the Pi for flashing by updating it and installing everything with the following commands

sudo apt-get update && sudo apt-get dist-upgrade && sudo reboot

sudo apt-get update && sudo apt-get install libftdi1 libftdi-dev libusb-dev libpci-dev subversion

sudo apt-get install build-essential pciutils usbutils libpci-dev libusb-dev libftdi1 libftdi-dev zlib1g-dev subversion

svn co svn://flashrom.org/flashrom/trunk flashrom

cd flashrom/

make

sudo make install

Use the following commands to add the SPI kernal modules to /etc/modules so they persist between boots.

sudo modprobe spi_bcm2835

sudo modprobe spidev

Shutdown the Pi, unplug the x220t and remove the batteries.

Remove the palmrest and keyboard from the x220t (consult the hardware maintenance manual for instructions on how to) and expose the flash chip (see image 1 in the appendix)

Hook up the test clip to the Pi (see image 2 in the appendix for a wiring diagram)

Connect the clip to the motherboard then turn the Pi on

Read the contents of the flash chip with the following command (do this several times and make sure the hash matches

sudo flashrom -p linux_spi:dev=/dev/spidev0.0 -r read01.bin

Download coreboot and use the ifdtool to extract whats need from the stock rom

git clone http://review.coreboot.org/coreboot.git ~/coreboot

cd ~/coreboot

git submodule update --init --recursive

cd ~/coreboot/util/ifdtool

make

sudo make install

cd ~

ifdtool -x ~/flash01.bin

mkdir -p ~/coreboot/3rdparty/blobs/mainboard/lenovo/x220

cd ~/coreboot/3rdparty/blobs/mainboard/lenovo/x220

mv ~/flashregion_0_flashdescriptor.bin descriptor.bin

mv ~/flashregion_2_intel_me.bin me.bin

mv ~/flashregion_3_gbe.bin gbe.bin

Use me_cleaner to neutralize the Intel ME

git clone https://github.com/corna/me_cleaner ~/me_cleaner

sudo apt-get install python3

./me_cleaner.py ~/coreboot/3rdparty/blobs/mainboard/lenovo/x220/me.bin

Configure coreboot

cd ~/coreboot

make nconfig

Build coreboot

make crossgcc-i386 CPUS=4 -b

make iasl

make

Flash coreboot

sudo flashrom -p linux_spi:dev=/dev/spidev0.0 -w ~/coreboot/build/coreboot.rom -c flashChipModel

Disconnect the clip and power up the laptop, it should boot to SeaBIOS

Appendix

image 1 - Flash chip on the motherboard

image 2 - Wiring diagram for the Pi

References

https://github.com/grisu48/Coreboot/tree/master/x220t

https://karlcordes.com/coreboot-x220/

https://tylercipriani.com/blog/2016/11/13/coreboot-on-the-thinkpad-x220-with-a-raspberry-pi/

https://wej.k.vu/coreboot/coreboot_on_the_lenovo_thinkpad_x220/