FFRI,Inc.

Monthly Research 2016.7
About security assessment framework “CHIPSEC”

FFRI,Inc.
E-Mail: research-feedback[at]ffri.jp
Twitter: @FFRI_Research

http://www.ffri.jp

1

FFRI,Inc.

Outline• About CHIPSEC• Inspection menu
• How to install• Usage• Check of inspection result• Data analysis• Conclusion• References

2

FFRI,Inc.

About CHIPSEC• A hardware security assessment tool developed by Intel– It inspects BIOS/UEFI configurations and data read/write– The inspection result is “PASSED” or “FAILED”– It includes some utility scripts• Dump/Restore CMOS memory• Dump PCI interface information– Execution environments are Windows, Linux and UEFI Shell– It is written in Python and it has been developed on GitHub– License is GPL v2

3

FFRI,Inc.

Inspection menu
• SMRAM Locking/SPI Controller Locking/BIOS Interface Locking– Checking lock of controller settings– There are risks of brick or persistent malware if unlocked setting
was modified• BIOS Keyboard Buffer Sanitization– Checking keyboard buffer– There is a risk of password leak if data remain on keyboard buffer• SMRR Configuration– Checking protection for the SMRR(System Management RangeRegister)– There is a risk of rootkit infection if it has problem with thisconfiguration

4

FFRI,Inc.

Inspection menu
• BIOS Protection– Checking BIOS settings– There is a risk of brick if the settings are rewritten by malware• Access Control for Secure Boot Keys/Variables– Checking Secure Boot settings– There is a risk of secure boot bypass if this settings haveproblems

5

FFRI,Inc.

How to install
1. Install Python
2. Install of python modules– pwin32– Wconio– py2exe
3. Disable Windows driver signing check– bcdedit /set TESTSIGNING ON– reboot
4. Install Driver––sc create chipsec binpath= <PATH_TO_CHIPSEC_SYS> type=kernel DisplayName= "Chipsec driversc start chipsec

For more information refer to the manual of CHIPSEC

6

FFRI,Inc.

Usage•

Inspection (chipsec_main.py)– BIOS lock check• python chipsec_main.py -m common.bios_wp– SPI Memory lock check• python chipsec_main.py –m common.spi_lock etc...
– Summary is displayed when the check is completed• Result is “PASSED” or “FAILED”•Utility (chipsec_util.py)– SPI Memory Dump• python chipsec_util.py spi dump
– PCI ROM Dump
• python chipsec_util.py pci dump

7

FFRI,Inc.

Inspection result• An example of the results is shown below

8

FFRI,Inc.

Data analysis (PCI ROM)
• PCI ROM dump by chipsec_util.py– Obtaining information of each PCI devices which are connected– e.g. 2byte from the top vendor ID(Little endian) 8086 is Intel

9

FFRI,Inc.

Data analysis (CMOS Memory)• CMOS memory contains the BIOS settings– Data sequence is defined in Memory map– Red frame represents the date and time(2016/07/22 10:32:48)

10

FFRI,Inc.

Conclusion• Vulnerable BIOS/UEFI configuration can become target of cyberattack– The following threats are concerned• Brick• Persistent malware/rootkit infection• Leak of password from BIOS keyboard buffer• Bypass of Secure boot
• CHIPSEC is a useful tool for BIOS/UEFI security checking– Various inspection modules and simple command– Possible to add original inspection modules– Possible to integrate to the other tool
– Possible to dump various data with utility scripts

11

FFRI,Inc.

References• CHPSEC’s GitHub page
– https://github.com/chipsec/chipsec• CMOS Memory Map - BIOS Central– http://www.bioscentral.com/misc/cmosmap.htm• CHIPSEC Platform Security Assessment Framework– BlackHat2014– https://www.blackhat.com/docs/us14/materials/arsenal/us-14-Bulygin-CHIPSEC-Slides.pdf• A Tour of Intel CHIPSEC– http://www.basicinputoutput.com/2016/05/a-tour-of-intelchipsec.html• Malicious Code Execution in PCI Expansion ROM– http://resources.infosecinstitute.com/pci-expansion-rom/
12