Penetration Test Report (Cure53): pentest report nitrokey hardware

Pentest-Report Nitrokey Storage Hardware 08.2015
Cure53, Dr.-Ing. Dmitry Nedospasov, Dr.-Ing. Mario Heiderich
Index
Introduction
Scope
Identified Vulnerabilities
NK -02-001 JTAG Header accessible on the Nitrokey PCB ( Critica l)
NK -02-002 Weak Security Fuse Configuration ( Critica l)
NK -02-003 Security Relevan t Signals Routed On Surface Layers ( Critica l)
NK -02-004 Microcontroller Contains DFU bootloader ( Low )
NK -02-005 Brown Ou t Detection No t Enabled ( High )
NK -02-006 Micro SD and Smartcard Slots lack ejection switch ( High )
NK -02-007 Curren t Design Lacks Tamper Switches ( Medium )
NK -02-008 No Offline Tampering Detection ( Medium )
NK -02-009 Insufficien t Design Density ( Low )
Conclusion
Introduction
“Nitrokey is an USB key to enable highly secure encryption and signing of emails and
data, as well as login to the Web, networks and computers. Other than ordinary software
solutions, the secret keys are always stored securely inside the Nitrokey. Their
extraction is impossible which makes Nitrokey immune to computer viruses and Trojan
horses. The user-chosen PIN and the tamper-proof smart card protect in case of loss
and theft. Hardware and software are both available as Open Source to allow verifying
the security and integration with other applications.”
From https :/ / www . nitrokey . com /introduction
This penetration test against the Nitrokey Storage hardware was performed by one
engineer over the period of 10 days. The test is one of the components within a larger
scheme of security assessments, thus complimenting penetration tests of the software
employed in the Nitrokey setup. The main scope of this assessment was to evaluate the
security of the Nitrokey’s hardware against various offline hardware-based attacks.
The hardware design of the Nitrokey Storage is openly available on GitHub1. The EDA
tool used for its design is the DesignSpark PCB suite2, while the micro controller is Atmel
AT32UC3A3256S3. The platform also includes an OpenGPG-based secure smart card
and MicroSD (uSD) card for storage, though both of the cards were out of scope for this
1 https :// github . com / Nitrokey / nitrokey - storage - hardware
2 https :// en . wikipedia . org / wik i / DesignSpark _ PCB
3 http :// www . atme l . com / devices / AT 32 UC 3 A 3256 S .aspx
1/10
assignment. The Printed Circuit Board (PCB) is a four layer design. The assessment
included a review of hardware component placement, as well as a set of physical tests
of the targeted devices, primarily focusing on the hardware interface.
The test was carried out in reference to a threat model delivered by the Nitrokey Team.
In this threat model the attack scenarios considered vital in the realm of the overall
hardware design are specified. These are as follows:
• Malware trying to steal/export private keys while the device is being used on the
compromised computer.
• An attacker stealing or finding the (switched off) device, then trying to tamper
with the device in order to get access to private keys or encrypted mass-data.
This includes sophisticated physical attacks with laboratory equipment and
(digital) brute force attacks ("offline").
• Nitrokey protects against Malware attempting to program malicious firmware onto
the stick.
In addition, two security assumptions have been added to complete the threat model:
• The Admin PIN and Firmware Password are only used on secure computers for
administrative purposes.
• The User PIN can be used on potentially compromised computers.
Note that these specifications are subject to change, so they are relevant first and
foremost for this specific assessment. In the future, they may be augmented, changed or
extended, for instance with the upcoming hardware revisions and within future firmware
versions. In this document we report on the test findings, which have amounted to five
hardware-related vulnerabilities and four general weaknesses. In addition, we propose
some overall design recommendations.
Scope
The actual Nitrokey Storage Hardware implementation was handed out for testing.
2/10
Identified Vulnerabilities
The following sections list both vulnerabilities and implementation issues identified
during the assessment. Note that findings are listed in a chronological order rather than
by their degree of severity and impact, which is simply given in brackets following the
title heading for each vulnerability. Each vulnerability is additionally given a unique
identifier (e.g. NK-02-00X) for the purpose of facilitating any future follow-up
correspondence.
NK-02-001 JTAG Header accessible on the Nitrokey PCB (Critical)
The current revision of the PCB layout includes a header exposing the programming
interface of the device. An attacker with access to the device’s JTAG4 can perform a
“Chip Erase” of the micro controller and subsequently flash a malicious firmware. In
combination with the weak security fuse settings, an attacker would be able to flash the
device. This would occur without a prior erasing of any sensitive data stored in the non-
volatile memory. The “Chip Erase” feature belongs to the Atmel AT32UC3A3256S micro
controller family and cannot be disabled.
Fig.: JTAG Connector exposed using jumper wires. / JTAG ICE3 Programmer and
Saleae Pro 16 Logic Analyzer connected to Nitrokey JTAG Interface via solderless
breadboard.
4 http :// www . xjtag . com / suppor t - jtag / wha t - is - jtag .php
3/10
Fig.: Location of the JTAG Header
within the design.
The resolution of this issue must take into account the above mentioned fact that the
chip erase feature cannot be disabled. Therefore, it is vital to remove the programming
interface entirely. The micro controllers used within the design can be flashed either by
the chip manufacturer or a distributor. Alternatively a programming jig can be used for
flashing the micro controllers on site during manufacturing. Another valid option is
granted by physical removal of the programming header during the manufacturing
phase. There are two pathways to achieve this. First method is to engage in physical
milling away of the specific part of the PCB which contains the header. Second idea
relies on placing the header on a portion of the PCB that is separated with a V-groove,
meaning it is being snapped or broken off during manufacturing.
Note: This issue was fixed by the Nitrokey maintainers, the fix was verified by Cure53.
The fix also affects the issue described in NK-02-003.
NK-02-002 Weak Security Fuse Configuration (Critical)
The security fuse was not set on the device. Setting the security fuse bit disables the
following commands:5
• Write General-Purpose Fuse Bit (WGPB) to BOOTPROT or EPFL fuses
• Erase General-Purpose Fuse Bit (EGPB) to BOOTPROT or EPFL fuses
• Program General-Purpose Fuse Byte (PGPFB) of fuse byte 2
• Erase All General-Purpose Fuses (EAGPF)
Evidently the security fuse bit enforces the overall security configuration of the device. If
it is not set, a malicious attacker can arbitrarily change the security configuration of the
device. Subsequently, the attacker would be able to flash malicious firmware to the
device. If the security bit is not set, then the device’s fuse configuration can be changed
arbitrarily by the attacker. This includes disabling the Brown Out6 Detection (BOD) circuit
and removing flash region lock bits. Eventually an attacker would be able to flash a
5 Atmel "AT32UC3A3/A4 Series Complete" Page 137
6 https :// en . wikipedia . org / wik i / Brownou t _%28 electricity %29
4/10
malicious firmware without performing a chip erase, i.e. affecting all of the contents of
the device.
It is recommended to set the security bit during manufacturing. Additionally, the flash
memory regions should be locked in order to be prevented from being overwritten by the
firmware.
Note: This issue was fixed by the Nitrokey maintainers, the fix was verified by Cure53.
NK-02-003 Security Relevant Signals Routed On Surface Layers (Critical)
The current Nitrokey hardware design exposes s