KINTSUGI Identifying & addressing challenges in embedded binary security jos wetzels Supervisors

214 Pages·2017·2.83 MB·English

KINTSUGI
Identifying & addressing challenges in embedded binary security
jos wetzels
Supervisors:
Prof. dr. Sandro Etalle
Ali Abbasi, MSc.
Department of Mathematics and Computer Science
Eindhoven University of Technology (TU/e)
2017
June
Jos Wetzels: Kintsugi, Identifying & addressing challenges in embed-
2017
ded binary security, © June
To my family

Kintsugi ("golden joinery"), is the Japanese art of repairing broken pottery
with lacquer dusted or mixed with powdered gold, silver, or platinum.
As a philosophy, it treats breakage and repair as part of the history of an
object, rather than something to disguise.
254
— [ ]
ABSTRACT
Embedded systems are found everywhere from consumer electron-
ics to critical infrastructure. And with the growth of the Internet of
Things (IoT), these systems are increasingly interconnected. As a re-
sult, embedded security is an area of growing concern. Yet a stream
of offensive security research, as well as real-world incidents, contin-
ues to demonstrate how vulnerable embedded systems actually are.
This thesis focuses on binary security, the exploitation and miti-
gation of memory corruption vulnerabilities. We look at the state of
embedded binary security by means of quantitative and qualitative
analysis and identify several gap areas and show embedded binary
security to lag behind the general purpose world significantly.
Wethendescribethechallengesandlimitationsfacedbyembedded
exploit mitigations and identify a clear open problem area that war-
rants attention: deeply embedded systems. Next, we outline the cri-
teria for a deeply embedded exploit mitigation baseline. Finally, as a
firststeptoaddressingthisproblemarea,wedesigned,implemented
and evaluated µArmor : an exploit mitigation baseline for deeply em-
bedded systems.
v

When you want to know how things really work,
study them when they’re coming apart.
— William Gibson
ACKNOWLEDGEMENTS
First of all, I would like to thank my supervisors, Prof. dr. Sandro
EtalleandAliAbbasi,MSc.,fortheirassistanceandsupportthrough-
out the process of researching and writing this thesis. Sandro’s guid-
ance helped me structure the rather voluminous body of research
produced by this thesis while Ali’s continuous feedback and brain-
storming helped this work achieve its current depth.
Secondly, I am grateful to my family, without whom none of this
would have been possible, for their unconditional love and support.
Finally, I am thankful to my friends for their moral support and to
the many people from the information security field and the outer
reaches of the internet who, over the years, have continued to inspire
me.
Jos Wetzels
Eindhoven University of Technology (TU/e)
2017
June
vii

CONTENTS
i embedded binary security 1
1 introduction 3
11 3
. Problem Statement . . . . . . . . . . . . . . . . . . . . .
12 4
. Research Goal & Questions . . . . . . . . . . . . . . . .
13 4
. Contributions . . . . . . . . . . . . . . . . . . . . . . . .
14 5
. Outline . . . . . . . . . . . . . . . . . . . . . . . . . . . .
2 background 7
21 7
. Basic Embedded Concepts . . . . . . . . . . . . . . . . .
22 11
. Embedded Security Threat Landscape . . . . . . . . . .
23 14
. Embedded Patching Issues . . . . . . . . . . . . . . . .
24 17
. Memory Corruption Vulnerabilities . . . . . . . . . . .
241 18
. . Language Safety . . . . . . . . . . . . . . . . . .
242 19
. . ’Weird Machines’ & Exploitation . . . . . . . . .
25 20
. Exploit Mitigations . . . . . . . . . . . . . . . . . . . . .
3 embedded exploit mitigation baseline 25
31 25
. Establishing a Minimum Baseline . . . . . . . . . . . . .
32 26
. Baseline Mitigations In-Depth . . . . . . . . . . . . . . .
321 26
. . Executable Space Protection (ESP) . . . . . . . .
322 30
. . Address Space Layout Randomization (ASLR) .
323 34
. . Stack Canaries. . . . . . . . . . . . . . . . . . . .
33 36
. Exploit Mitigation Dependencies . . . . . . . . . . . . .
331 36
. . ESP Dependencies . . . . . . . . . . . . . . . . .
332 38
. . ASLR Dependencies . . . . . . . . . . . . . . . .
333 39
. . Stack Canary Dependencies . . . . . . . . . . . .
ii analysis of embedded exploit mitigations 41
4 quantitative analysis 43
41 43
. Embedded OS mitigation & dependency support . . .
42 44
. Embedded hardware feature support . . . . . . . . . .
43 48
. Conclusions . . . . . . . . . . . . . . . . . . . . . . . . .
5 qualitative analysis 53
51 53
. QNX . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
511 55
. . Security History . . . . . . . . . . . . . . . . . .
512 55
. . QNX ESP . . . . . . . . . . . . . . . . . . . . . .
513 56
. . QNX ASLR . . . . . . . . . . . . . . . . . . . . .
514 64
. . QNX Stack Canaries . . . . . . . . . . . . . . . .
515 67
. . QNX OS CSPRNG . . . . . . . . . . . . . . . . .
52 73
. RedactedOS . . . . . . . . . . . . . . . . . . . . . . . . .
521 74
. . RedactedOS OS CSPRNG . . . . . . . . . . . . .
53 75
. Zephyr . . . . . . . . . . . . . . . . . . . . . . . . . . . .
531 77
. . Zephyr Stack Canaries . . . . . . . . . . . . . . .
54 80
. Conclusions . . . . . . . . . . . . . . . . . . . . . . . . .
ix
x contents
6 embedded challenges 83
61 83
. Development Practices & Cost Sensitivity . . . . . . . .
62 84
. Resource Constraints . . . . . . . . . . . . . . . . . . . .
63 85
. Safety, Reliability & Real-Time Requirements . . . . . .
64 87
. Hardware & OS Limitations . . . . . . . . . . . . . . . .
641 87
. . MPUs, MMUs & Hardware ESP . . . . . . . . .
642 88
. . Virtual Memory . . . . . . . . . . . . . . . . . . .
643 88
. . Advanced Processor Features . . . . . . . . . . .
644 89
. . OS CSPRNGs . . . . . . . . . . . . . . . . . . . .
65 91
. Open Problems . . . . . . . . . . . . . . . . . . . . . . .
651 92
. . Deeply Embedded Exploit Mitigation Criteria .
652
. . OSCSPRNGDesignforDeeplyEmbeddedSys-
93
tems . . . . . . . . . . . . . . . . . . . . . . . . .
iii µarmor design, implementation & evaluation 95
7 µarmor design 97
71 97
. Representative Platform . . . . . . . . . . . . . . . . . .
72 98
. Attacker Model . . . . . . . . . . . . . . . . . . . . . . .
73 98
. High-Level Design . . . . . . . . . . . . . . . . . . . . .
7.4 µESP Design . . . . . . . . . . . . . . . . . . . . . . . . . 99
7.5 µScramble Design . . . . . . . . . . . . . . . . . . . . . . 101
7.6 µSSP Design . . . . . . . . . . . . . . . . . . . . . . . . . 105
7.7 µRNG Design . . . . . . . . . . . . . . . . . . . . . . . . 107
8 µarmor implementation 113
8.1 µESP Implementation . . . . . . . . . . . . . . . . . . . 113
8.2 µScramble Implementation . . . . . . . . . . . . . . . . 116
8.3 µSSP Implementation . . . . . . . . . . . . . . . . . . . . 118
8.4 µRNG Implementation . . . . . . . . . . . . . . . . . . . 119
9 µarmor evaluation & limitations 121
91 121
. Real-Time Compatibility & Safety Issues . . . . . . . .
92 121
. Overhead Evaluation . . . . . . . . . . . . . . . . . . . .
93 129
. Security Evaluation . . . . . . . . . . . . . . . . . . . . .
9.3.1 µESP Security . . . . . . . . . . . . . . . . . . . . 129
9.3.2 µScramble Security . . . . . . . . . . . . . . . . . 129
9.3.3 µSSP Security . . . . . . . . . . . . . . . . . . . . 133
9.3.4 µRNG Security . . . . . . . . . . . . . . . . . . . 134
94 136
. Limitations . . . . . . . . . . . . . . . . . . . . . . . . . .
iv conclusion 137
10 related work 139
101 139
. Embedded Mitigation Support & Quality . . . . . . . .
102 139
. Embedded Mitigation Design . . . . . . . . . . . . . . .
11 discussion conclusions future work 145
, &
111 145
. Discussion . . . . . . . . . . . . . . . . . . . . . . . . . .
112 147
. Conclusions . . . . . . . . . . . . . . . . . . . . . . . . .
113 148
. Future Work . . . . . . . . . . . . . . . . . . . . . . . . .