What is Arduino? A single board microcontroller plahorm. An open source electronics plahorm.

Transcription

1 Disclaimer The opinions expressed and materials shared in this presenta1on are my own and may not reflect the opinions, policies, or procedures of my employer. Steve Watson 2 DFRWS US 2014

2 What is Arduino? A single board microcontroller plahorm. An open source electronics plahorm. Steve Watson 3 DFRWS US 2014

3 Why are we talking about Arduino? New, founda1onal technology appearing in many different form factors. No clear direc1on on forensic acquisi1on of data on this evolving plahorm. Steve Watson 4 DFRWS US 2014

4 Where is Arduino today? Steve Watson 5 DFRWS US 2014

5 Examples - MakerBot Thing-O-Matic By 2018, 3D prin0ng will result in the loss of at least $100 billion per year in intellectual property globally. Introduced September 2010 at MakerFaire NYC Steve Watson 6 DFRWS US 2014

6 Example - Arduino Phone htp:// htp://blog.arduino.cc/2013/08/12/diy- cellphone/ Steve Watson 7 DFRWS US 2014

7 Examples - ArduSat Steve Watson DFRWS US 2014

8 Arduino Basics microcontroller CPU, RAM and ROM on a single chip. shield daughter card that sits on top of the Arduino sketch the code or application written in C++ that is uploaded to the Arduino Steve Watson 9 DFRWS US 2014

9 Is there data to recover?

10 Where is the data? Microcontroller Development Systems Remote Endpoints Steve Watson 11 DFRWS US 2014

11 What is the data? Microcontroller Development Systems Remote Endpoints running applica1ons (flash) NVM, persistent (eeprom).csv,.txt (asci or hex on SDCARD) Fuses (single byte hex values).ino (Arduino sketch).elf (intermediate step between c+ + and assembly).hex (assembly) cloud compu1ng updates (TwiTer, Facebook, IoT pages) control messages (c&c of other microcontroller devices).txt,.csv.json (JSON calls to other applica1ons) Steve Watson 12 DFRWS US 2014

12 How I approach new devices 1. What is the opera1ng system? 2. What is the storage? 3. What is the connec1vity? 4. How is the system updated, installed, accessed? 5. What are the parallels with other systems and devices? 6. What exis1ng documenta1on and informa1on exists? Steve Watson 13 DFRWS US 2014

13 Focus on the Arduino

14 Connection to the target 1. Chip removal (chip- off equivalent) 2. Tethered to another Arduino (computer to computer equivalent) 3. Connect to a programming port on the board (JTAG equivalent) Steve Watson 15 DFRWS US 2014

15 Connection: Chip-off Example: ZIF Socket 28- Pin, htps:// Steve Watson 16 DFRWS US 2014

16 Connection: Tethered Arduino Arduino Tutorial: Using an Arduino as an AVR ISP (In- System Programmer) Steve Watson 17 htp://arduino.cc/en/tutorial/arduinoisp DFRWS US 2014

17 Connection: JTAG Equivalent Olimex STK500v2 connected via ICSP to an Arduino UNO Steve Watson 18 DFRWS US 2014

18 Connection: ICSP ICSP - In- Circuit Serial Programming Steve Watson 19 DFRWS US 2014

19 Software used to acquire 1. AVRDUDE - AVR Downloader/UploaDEr a. opensource b. htp:// c. Included in the Arduino IDE install under install directory../arduino/hardware/tools/avr/bin/ avrdude.exe Steve 2. Watson Atmel AVR Studio 20 DFRWS US 2014

20 Data to acquire Flash (32KB) EEPROM (1KB) NVM reserved for persistence across uploads Fuses (1B x 3 reserved) lfuse, hfuse, efuse single byte hex configura1ons related to clock, bootloader and voltage (see reference slide for more detail) Steve Watson 21 DFRWS US 2014

21 Software: AVRDUDE Example: Read flash memory and dump hex to specific file. avrdude - p m328p - c stk500v2 - P com4 - U flash:r:"[path/to/file/filename.hex]":r - p [part number] - c [programmer] - P [com port] - U [memory opera1on] Note the :r: and :r to define READ change flash to eeprom, lfuse, hfuse and/or efuse to acquire reserved por1ons. Steve Watson 22 DFRWS US 2014

22 Software: AVRDUDE C:\apps\avrdude - p m328p - c stk500v2 - P com4 - U flash:r:"c:/temp/arduino_uno.hex":r avrdude: AVR device initialized and ready to accept instructions Reading ################################################## 100% 0.03s avrdude: Device signature = 0x1e950f avrdude: reading flash memory: Reading ################################################## 100% 94.89s avrdude: writing output file "c:/temp/arduino_uno.hex" avrdude: safemode: Fuses OK (E:05, H:D6, L:FF) avrdude done. Thank you. Steve Watson 23 DFRWS US 2014

23 Software: Atmel Studio Full walkthrough (screenshots) of an MCU acquisi1on in the backup slides. Steve Watson 24 DFRWS US 2014

24 Investigations where data may be needed 1. Supply chain inves1ga1ons 2. Malware analysis 3. Improvised devices 4. Automa1on and control systems 5. Medical, fitness 6. Security, access control 7. Drones 8. Cloud Steve Watson 25 DFRWS US 2014

25 Why does this matter? 1. Inves1ga1ons and li1ga1on are coming to this new technology area. 2. The principles applied here can be expanded to other embedded technologies. Steve Watson 26 DFRWS US 2014

26 Thank you! Steve Watson LinkedIn - watsonsteve

27 Backup Material

28

29 Credits 1tle slide - Arduino schema1c, htp://arduino.cc/en/uploads/main/arduino- uno- schema1c.pdf slide 3 - Arduino UNO photo, htp://arduino.cc/en/uploads/main/arduinouno_r3_front.jpg slide 5 - Icons made by slide 6 - Image htp://upload.wikimedia.org/wikipedia/commons/8/87/makerbot_thing- O- Ma1c_Assembled_Prin1ng_Blue_Rabbit.jpg htp:// slide slide 8 - Screenshots and images in order of animation: slide 11 - Icons made by slide 16 - Example: ZIF Socket 28- Pin, htps:// slide 17 - image created with Fritzing slide 19 - monochrome images

30 Reference - Fuses lfuse hfuse efuse

31 AVR Acquisition with Atmel Studio Begin

32 Software: Atmel Studio

33

34 1. From Atmel Studio main screen, choose Debug then Device Programming. 2. Iden1fy the Tool, Device, and Interface then click Apply.

35

36

37

38

39

40

41

42

43 AVR Acquisition with Atmel Studio End