Главная
Study mode:
on
1
Intro
2
Unnamed real estate lockbox
3
ekey Android app
4
Programmed auth flow
5
Must access firmware
6
Physical access
7
Board photos
8
Internals
9
Reverse-engineering steps
10
MSP430 firmware extraction
11
BSL Overview
12
Voltage glitching attack
13
Results of voltage glitching
14
BSL timing attack
15
Timing attack problems
16
Timing attack results
17
Modified attack results
18
Timing attack conclusions
19
MSP430 JTAG security
20
MSP430 1/2/4xx fuse
21
MSP430 firmware reversing
22
Firmware reversing finds
23
Manufacturer's crypto architecture
24
Syscode Key
25
Third authentication mode
26
Brute Force
27
Hardware backdoor
28
Flash write+erase attack
29
Conclusions/solutions
Description:
Explore the reverse-engineering and exploitation of a hardened MSP430-based embedded device in this Ekoparty 2014 conference talk. Delve into techniques for exploiting devices with blown JTAG fuses, reviewing past attacks against the MSP's bootstrap loader (BSL) and addressing the challenges researchers face. Learn how to reliably extract firmware from an MSP430 with a blown JTAG fuse, gain insights into reverse-engineering MSP430 firmware, and discover a software-only attack that leverages BSL features to extract sensitive data from RAM. Follow along as the speaker dissects a real estate lockbox, examines its internals, and walks through the reverse-engineering process. Understand voltage glitching and timing attacks, their results, and limitations. Investigate MSP430 JTAG security, firmware reversing techniques, and the manufacturer's crypto architecture. Conclude with discussions on brute force attempts, hardware backdoors, and potential solutions for securing embedded devices.

Exploitation of a Hardened MSP430-Based Device - Braden Thomas - Ekoparty Security Conference - 2014

Ekoparty Security Conference
Add to list
0:00 / 0:00