Unix forever!

DSR enhanced security and "formal verification" course

This summary of the DSR security course is meant for deciders

How modern Multi Stage Attacks work

"Microarchitectural attacks threaten the security of computer systems even in the absence of software vulnerabilities. While x86 and ARM CPUs have been extensively studied, the rising popularity of RISC-V CPUs demands a thorough examination of their microarchitectural attack surface. With the standardization of the RISC-V instruction set architecture and the announcement of support for the architecture by major processor vendors, RISC-V CPUs are on the verge of becoming ubiquitous. In this talk, we will show a systematic investigation of the microarchitectural attack surface on the first commercially-available 64-bit hardware RISC-V CPUs..."

By: Lukas Gerlach , Michael Schwarz , Daniel Weber
https://youtube.com/watch?v=HCZ6DCu2ciE

Full Abstract and Presentation Materials: https://www.blackhat.com/eu-23/briefings/schedule/#a-security-risc-the-state-of-microarchitectural-attacks-on-risc-v-34183

This goes back to a decision long time ago to make CPUs superscalar. The problem at that time was, that after a Machine Code Instruction taking a branch after a CMP (compare instruction) followed by a JMP (jump instruction) that in case of a cache miss you have waitstates: CPU doing nothing but waiting for slow (in terms of latency) DDR Memory. That's as if your 5GHz machine suddenly is slowed down to ancient 250MHz. What every programmer should know about memory: https://www.akkadia.org/drepper/cpumemory.pdf

To avoid this, they heavily modified the branch and table lookup predictor to forecast those jumps.

"Forecasting" here means being able to prefetch the most likely instructions and the data to be processed and then executing some small calculations ahead of time. The buffer, the instruction prefetch queue, can analyze upto 160-192 instructions.

Here, even branches (finally not taken) are executed, whose results then simply are thrown away. Sure, it is a waste of energy. But this way, they could vastly accelerate the "Instructions Per Cycle" (IPC) throughput, finally important for sales.

For the then neccessary speculative, parallel execution the also needed to add more ALUs (Arithmetic Logical Units) Normal CPUs have 4 of them, some highly sophisticated and ultra expensive server CPUs even have 8 per processor core!!

That "hardware design architecture" began with Haswell and Skylake Intel CPUs, and the "ARM Cortex" series took that idea over: https://en.wikichip.org/wiki/intel/microarchitectures/haswell_(client).

Today, all modern CPUs designed with software from global market leader US Synopsis® have this issue. Note, that Synopsis® chip design software is tighly coupled with TSMC® and Samsung fabrication processes: https://www.synopsys.com/

Stopping that nonsense, finding other solutions - for them - is no option as "customers demand it", as they say. And indeed, performance always was and still is an important marketing argument.

So reading out credentials bypassing the Kernel protection mechanisms, which in modern CPUs mainly is done by a subsystem called MMU (Memory Mananaging Unit) is always possible, even from a low privileged user account. Today, this bypassing trick is used everywhere to gain admin or even superadmin privileges from the underlying host machine, e.g. from the VMware ESXi or Windows Server with Hyper-V or Xen Hypervisor. The Arm A15 core in the Intel IME management spy engine running Minix is also effected. This is why the IME got also hacked:

How to Hack a Turned-Off Computer, or Running Unsigned Code in Intel Management Engine: https://youtube.com/watch?v=HCZ6DCu2ciE

Nevertheless normal buffer overflows over remotely reachable communication ports are still exploited in the millions:

https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=Microsoft+remote

How is such an overflow done? Here an example in C: https://www.geeksforgeeks.org/buffer-overflow-attack-with-example/

Once having gained access and having uploaded malware on the machines, the process of "privilege escalation" starts:

https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=Microsoft+privilege

The leading hacker toolkit here is "Mimikatz", written in Python, Cython and some C code:

How it began. The Story Behind Mimikatz - Paula Januszkiewicz talks with Benjamin Delpy https://youtube.com/watch?v=-V-vEQ0sDoo

Windows Post Exploitation - Dumping Hashes With Mimikatz https://youtube.com/watch?v=AZirvtZNIEw

To Benjamin Delpy's well maintained software: https://github.com/gentilkiwi

The result: Permanent outages of Microsoft's Azure: https://www.tomshardware.com/software/search-engines/microsoft-suffering-from-outage-bing-copilot-and-duckduckgo-inaccessible-for-several-hours

Canadian pharmacy chain down for months now: https://www.techradar.com/pro/security/another-major-pharmacy-chain-shuts-following-possible-cyberattack

Even the cash systems of german supermarkets were affected over weeks. No payment possible over credit cards: https://www.google.com/search?q=supermarkt+störung+kassen

With greetings from Moskau: "We are in your banking systems!" Meant as a very "polite" warning to the USA and also to the EU what could happen when politicians are going to freeze offshore assets from russian citizens. Or what possibly could happen to DoD and NATO Headquarter in Europe when NATO troops dare to (further) meddle between the family dispute between Ukraine and Russia.

https://blogs.microsoft.com/newyork/2016/02/17/department-of-defense-to-move-4-million-devices-to-windows-10/

The signs are clear!

In fact, hackers easily gain access to networks behind firewalls either by exploiting weaknesses in browsers and their JIT engines (Just in Time compiler, see the Self hotspot engine or over Outlook and Exchange since decades. Writing secure "bug free" parsers - with e.g. Ragel - obviously is not one of Microsoft's strengths:

https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=Microsoft+Outlook+remote
https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=Microsoft+Exchange+remote

Perhaps Microsoft and especially Accenture people should re-read Leslie Lamport's (the famous Turing Prize Winner's) papers about secure programming with function pointer transition tables: https://lamport.azurewebsites.net/pubs/state-machine.pdf

What do we see instead? Microsoft's latest despreate counter intelligence attempts:

https://learn.microsoft.com/en-us/azure/sentinel/fusion
https://learn.microsoft.com/en-us/defender-office-365/attack-simulation-training-get-started

Very convenient. Security check at mouseclick. Isn't it exactly that, what the average Windows administrator is deaming of and would like to report to his boss?

"Hey boss, we have driven the whole attack scenario, our network is safe from hackers!"

There is a little drawback: You'll have to buy some more extra licenses from Microsoft for being able to execute the "attack simulation" on your own network. This normally is a Mafia business. Microsoft now making additional billions of dollars with blackmailing enterprises?

Paying Microsoft for protection against Microsoft bugs? Seriously?

But then also this happend ... https://www.exploit-db.com/exploits/51960

Sorry, Microsoft, your're more than - complete idiots! But your marketing department is excellent!!!

Of course, more software has more bugs. One bug per 1000 Lines of Code - on average.

So this is obviously the wrong strategy. Correct strategy would be to strictly remove all unneccessary code. But in fact, the opposite happens: More and more code is added.

See: https://www.hyrumslaw.com/. Difficult to take away functionality once it is introduced. With Linux - no problem. Unix, by design, is a module Lego™ bricks system. You can remove any functionality, even from the kernel, by just unchecking and recompiling: https://www.baeldung.com/linux/kernel-recompilation

And finally Copilot (expensive license, of course!) gets highly recommended by Microsoft for helping programmers to write "bug free" code. Unlucklily Copilot was trained with the complete Github archive. And Github is full of buggy code with severest security issues. As stupid bear, i would rather say that Github rather is a place where you learn howto not to do, full of negative, partly even very bad examples.

But they call it "Cyber defense with AI support" or "AI supported cyber defense", even US CISA is in the boat: https://www.google.com/search?q=Cyber+defense+with+AI+support

"When you are a Bear of Very Little Brain, and you Think of Things, you find sometimes that a Thing which seemed very Thingish inside you is quite different when it gets out into the open and has other people Copilot looking at it." A.A. Milne, Winnie-the-Pooh

In the mean time, here's e.g. where the scene meets. You could hear them loud laughing about Microsoft's childish attempts to bring at least some little security into their systems: https://0x00sec.org/t/super-stealthy-droppers/3715

https://www.google.com/search?q=microsoft+ceo+us+senate+grilling

To proof, that this attack scenario - described here - is not at all an illusion: The so called "Full stack attack" on the C++ written Unix clone: SerenityOS: https://devcraft.io/2021/02/11/serenityos-writing-a-full-chain-exploit.html

No interaction is needed by the user: It's the "one click" exploit! Bypassing even the highest sophisticated firewall.

In the mean time, Linux is leading the MITRE ranking list with thousands of patched security bugs alone in this year: https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=Linux+kernel

But not because Linux is so much more buggy. It's because of the new GCC Static Analyzer: https://developers.redhat.com/articles/2024/04/03/improvements-static-analysis-gcc-14-compiler

He's doing an excellent job, making C now the safest programming language of all times. He finds everything. And he is even better than the best security researcher doing a code review or those rare people who are doing "formal verification" e.g. Gernot Heiser on seL4 kernel: https://gernot-heiser.org/

Why C and no other languages? Because a C compiler is a very simple thing. See the Plan9 C compiler, that was ported to RISC-V: https://youtube.com/watch?v=LHJqdXGb0uc

Every computer science student (at least in germany) has to build one as homework (I did it to pass my exam, and i think everybody in IT should learn howto do it) within 4 weeks: https://www.google.com/search?q=compilerbau+universität

Such a thing can be programmed and maintained by a single human, as Fabrice Bellard did with his famous: https://bellard.org/otcc/ . His initial OTCC compiler could easily recompile itself or any other C program, as long as it did not use macros: https://bellard.org/otcc/otccex.c

The most remarkable thing about his compiler is: He wrote it as joke for a "2048 characters programming contest": https://github.com/c00kiemon5ter/ioccc-obfuscated-c-contest/blob/master/2001/bellard.hint

And it's C's simplicity, that makes writing an "automatic verifier for C code" at all possible. Other programming languages are way too complicated for any automated verification process.

Compare with the US LLVM/Clang toolchain: https://openhub.net/p/llvm

11 million lines only for the backend, 3200 man-years of invested wasted human brainpower. US software industry always had the strong tendency to implement more and more features to leave competitors behind.

Also see the Wintel Alliance: https://en.wikipedia.org/wiki/Andy_and_Bill's_law

But this is not their only problem of the US software industry. They have introduced masses of functions into their libraries over time. Here again, to leave competitors behind, setting "standards", creating monopolies.

They succeeded quite well with that strategy. They have got their monopoly. A monopoly in "unmaintainable software full of serious security bugs". Estimated one million bugs still in there.

Those "industry standards", once estabished, can no longer be transformed to fulfill new security demands. Here again: Hyrum's law:

The whole Microsoft billion LoC code base, mainly written in C++ is doomed. Neither can complex C++ compiler be verified nor can C++ code. How will you ever verify a programming language that is so complex, that it hardly fits into 2200 A4 pages?

https://www.open-std.org/jtc1/sc22/wg21/docs/papers/2023/n4928.pdf

Same for Rust compiler and Rust libraries, though attempts with "Miri" are promising: https://github.com/rust-lang/miri

Rust suffers another problem: Rust was designed for the new age of multi core machines. Here, unlike in normal formal verification, where a single CPU core can only execute "serialized" machine code step by step, the interference of many cores on a virtual timeline comes into play while trying to access shared ressources at the same time. "Race conditions" appear and mainly "use after free" problems.

Rust claims to address this, but finally the search space for possible interference of two CPUs (or threads) is too large. From the theoretical standpoint it cannot be done automatically: Too large, too complex. You also would need specialized tools like TLA+ by Leslie Lamport. T here stands for the temporal aspect of interfering individuals. TLA+ only works for small projects, but not for giant projects with billions of lines, Microsoft, Oracle and Apple have surpassed already some time ago.

"Use after free" bug is such a bug that contains the "temporal aspect":

https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=use+after+free

All these bugs were found with the new GCC Static Analyzer. And they were patched. No exploit was ever written, ever existed.

Note: GCC Static Analyzer is doing an excellent job!!!

So what's the solution for our very new future - e.g. now?

Use software, operating systems (e.g. seL4 or Linux) graphical user interfaces (e.g
GNOME desktop, GTK4 libraries) that are already mainstream and that are written in pure C. Push every single line of code through the GCC Static Analyser remove the bugs, recompile and then it's (mostly) fine.

What higher programming language you could use? Anything, that can compile to C, of course! There are a couple of them:

The Java/C# clone Vala: https://en.wikipedia.org/wiki/Vala_(programming_language)
Genie: https://en.wikipedia.org/wiki/Genie_(programming_language)
Cython, almost Python: https://en.wikipedia.org/wiki/Cython
CGo, the supported 100% Go implementation: https://go.dev/blog/cgo

Use with https://github.com/diamondburned/gotk4

Alternatively: Wine, the Windows compatible GUI for Linux, Windows, Mac OS X, Android:

https://wiki.winehq.org/Developer_FAQ#:~:text=Wine is written entirely in,the Microsoft Visual C compiler.

The library behind the Linux GNOME desktop is GTK4. It has many language bindings, that are well maintained and auto generated from C header files:

https://www.gtk.org/docs/language-bindings/index

Or use it with this version of JavaScript: https://bellard.org/quickjs/ No JIT, but it's blindingly fast and it passes the whole ECMASCRIPT2023 standard.

It's tiny, "one human" understandable: https://github.com/bellard/quickjs/blob/master/quickjs.c

The advantage: It's not a complex JIT engine, as you can find in Chrome or Firefox. The both have security bugs without end. The code base is too complex. And both are mainly written C++. Only some Rust code in the rendering engine of Firefox.

https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=chrome+use+after+free
https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=firefox+use+after+free

Both are nighmares in terms of security. "Use after free" is a clear indicator for problems within the JIT engine.

So my urgent advice: KISS principle everywhere and (somehow) back to the roots!

Have fun!

Back to last lesson - https://rentry.co/DSRsecuritycoursepart11
Next lesson - https://rentry.co/DSRsecuritycoursepart13

Edit
Pub: 27 Jun 2024 09:28 UTC
Edit: 14 Jul 2024 15:06 UTC
Views: 291