The Application Of Reverse Engineering Techniques Against The Arduino Microcontroller To Acquire Uploaded Applications

Transcription

1 DIGITAL FORENSIC RESEARCH CONFERENCE The Application Of Reverse Engineering Techniques Against The Arduino Microcontroller To Acquire Uploaded Applications By Steve Watson Presented At The Digital Forensic Research Conference DFRWS 2014 USA Denver, CO (Aug 3 rd - 6 th ) DFRWS is dedicated to the sharing of knowledge and ideas about digital forensics research. Ever since it organized the first open workshop devoted to digital forensics in 2001, DFRWS continues to bring academics and practitioners together in an informal environment. As a non-profit, volunteer organization, DFRWS sponsors technical working groups, annual conferences and challenges to help drive the direction of research and development.

2 Disclaimer Theopinionsexpressedandmaterialssharedinthis presenta1onaremyownandmaynotreflectthe opinions,policies,orproceduresofmyemployer. SteveWatson 2 DFRWSUS2014

3 What is Arduino? Asingleboard microcontroller plahorm. Anopensource electronicsplahorm. SteveWatson 3 DFRWSUS2014

4 Why are we talking about Arduino? New, founda1onal technology appearing in manydifferentformfactors. Nocleardirec1ononforensicacquisi1onofdata onthisevolvingplahorm. SteveWatson 4 DFRWSUS2014

5 Where is Arduino today? SteveWatson 5 DFRWSUS2014

6 Examples - MakerBot Thing-O-Matic By2018,3Dprin0ng willresultinthelossof atleast100billionper yearinintellectual propertyglobally. IntroducedSeptember2010atMakerFaireNYC SteveWatson 6 DFRWSUS2014

7 Example - Arduino Phone htp:// htp://blog.arduino.cc/2013/08/12/diyycellphone/ SteveWatson 7 DFRWSUS2014

8 Examples - ArduSat SteveWatson DFRWSUS2014

9 Arduino Basics microcontroller CPU, RAM and ROM on a single chip. shield daughter card that sits on top of the Arduino sketch the code or application written in C++ that is uploaded to the Arduino SteveWatson 9 DFRWSUS2014

10 Is there data to recover?

11 Where is the data? Microcontroller DevelopmentSystems RemoteEndpoints SteveWatson 11 DFRWSUS2014

12 What is the data? Microcontroller DevelopmentSystems RemoteEndpoints runningapplica1ons (flash) NVM,persistent (eeprom).csv,.txt (asciorhexonsdcard) Fuses (singlebytehexvalues).ino (Arduinosketch).elf (intermediatestepbetweenc+ +andassembly).hex (assembly) cloudcompu1ngupdates (TwiTer,Facebook,IoTpages) controlmessages (c&cofothermicrocontroller devices).txt,.csv.json (JSONcallstoother applica1ons) SteveWatson 12 DFRWSUS2014

13 How I approach new devices 1. Whatistheopera1ngsystem? 2. Whatisthestorage? 3. Whatistheconnec1vity? 4. Howisthesystemupdated,installed,accessed? 5. Whataretheparallelswithothersystemsand devices? 6. Whatexis1ngdocumenta1onandinforma1on exists? SteveWatson 13 DFRWSUS2014

14 Focus on the Arduino

15 Connection to the target 1. Chipremoval(chipYoffequivalent) 2. TetheredtoanotherArduino(computerto computerequivalent) 3. Connecttoaprogrammingportontheboard (JTAGequivalent) SteveWatson 15 DFRWSUS2014

16 Connection: Chip-off Example:ZIFSocket28YPin,hTps:// SteveWatson 16 DFRWSUS2014

17 Connection: Tethered Arduino SteveWatson 17 ArduinoTutorial: UsinganArduinoasanAVRISP(InYSystem Programmer) htp://arduino.cc/en/tutorial/arduinoisp DFRWSUS2014

18 Connection: JTAG Equivalent OlimexSTK500v2 connectedviaicsptoan ArduinoUNO SteveWatson 18 DFRWSUS2014

19 Connection: ICSP ICSPYInYCircuitSerialProgramming SteveWatson 19 DFRWSUS2014

20 Software used to acquire 1. AVRDUDEYAVRDownloader/UploaDEr a. opensource b. htp:// c. IncludedintheArduinoIDEinstallunderinstall directory../arduino/hardware/tools/avr/bin/ avrdude.exe SteveWatson 2. AtmelAVRStudio 20 DFRWSUS2014

21 Data to acquire Flash(32KB) EEPROM(1KB) NVMreservedforpersistenceacrossuploads Fuses(1Bx3reserved) lfuse,hfuse,efuse singlebytehexconfigura1onsrelatedtoclock,bootloader andvoltage(seereferenceslideformoredetail) SteveWatson 21 DFRWSUS2014

22 Software: AVRDUDE Example:Readflashmemoryanddumphextospecificfile. avrdudeypm328pycstk500v2ypcom4yuflash:r:"[path/to/file/filename.hex]":r Yp[partnumber] Yc[programmer] YP[comport] YU[memoryopera1on] Notethe:r:and:rtodefineREAD change flash toeeprom,lfuse,hfuseand/orefusetoacquirereserved por1ons. SteveWatson 22 DFRWSUS2014

23 Software: AVRDUDE C:\apps\avrdude,-p,m328p,-c,stk500v2,-P,com4,-U,flash:r:"c:/temp/arduino_uno.hex":r,, avrdude:,avr,device,initialized,and,ready,to,accept,instructions, Reading,,##################################################,,100%,0.03s, avrdude:,device,signature,=,0x1e950f, avrdude:,reading,flash,memory:, Reading,,##################################################,,100%,94.89s, avrdude:,writing,output,file,"c:/temp/arduino_uno.hex", avrdude:,safemode:,fuses,ok,(e:05,,h:d6,,l:ff), avrdude,done.,,thank,you., SteveWatson 23 DFRWSUS2014

24 Software: Atmel Studio Fullwalkthrough(screenshots)ofanMCU acquisi1oninthebackupslides. SteveWatson 24 DFRWSUS2014

25 Investigations where data may be needed 1. Supplychaininves1ga1ons 2. Malwareanalysis 3. Improviseddevices 4. Automa1onandcontrolsystems 5. Medical,fitness 6. Security,accesscontrol 7. Drones 8. Cloud SteveWatson 25 DFRWSUS2014

26 Why does this matter? 1. Inves1ga1onsandli1ga1onarecomingtothis newtechnologyarea. 2. Theprinciplesappliedherecanbeexpandedto otherembeddedtechnologies. SteveWatson 26 DFRWSUS2014

27 Thank you! SteveWatson LinkedInYwatsonsteve

28 Backup Material

29

30 Credits 1tleslideYArduinoschema1c,hTp://arduino.cc/en/uploads/Main/arduinoYunoYschema1c.pdf slide3yarduinounophoto,htp://arduino.cc/en/uploads/main/arduinouno_r3_front.jpg slide5yiconsmadebywww.fla1con.com slide6yimagehtp://upload.wikimedia.org/wikipedia/commons/8/87/makerbot_thingyoyma1c_assembled_prin1ng_blue_rabbit.jpg htp:// slide7yhttp://blog.arduino.cc/2013/08/12/diy-cellphone/, slide 8 - Screenshots and images in order of animation: slide11yiconsmadebywww.fla1con.com slide16yexample:zifsocket28ypin,htps:// slide17yimagecreatedwithfritzing slide19ymonochromeimages

31 Reference - Fuses lfuse hfuse efuse

32 AVR Acquisition with Atmel Studio Begin&

33 Software: Atmel Studio

34

35 1. FromAtmelStudio mainscreen,choose Debug then Device Programming. 2. Iden1fythe Tool, Device,and Interface thenclick Apply.

36

37

38

39

40

41

42

43

44 AVR Acquisition with Atmel Studio End&