## 3 JTAG Exploitations
### Exploitation Using Interrupt-Oriented Bugdoor Programming Method  
[PERSON] et al. (2012) exploited embedded firmware through JTAG interface. They explained the concept called \"bugdoor\". \"Backdoor\" is a popular term used in software industry for a special code snippet left in the program to secretly control future debugging. However, if attacker gives proper inputs to the target program in the device, then the attacker can inject malicious code in the firmware causing unintentional behavior of device or stealing sensitive data. Generally, server exploitation considers getting shell (root) access, whereas microcontroller firmware access could be more devastating, since attacker can change the device behavior, steal protection keys and more. It can go unnoticed by the owner of the device so that attacker can continue stealing data and can keep a watch on the device. Authors targeted Texas Instrument's MSP430, a 16-bit ultra-low power microcontroller for exploitation through JTAG interface. The author preferred \"interrupt oriented programming tricks\", e.g. microcontroller-based architecture frequently uses interrupt input either from internal modules such as timer/counter, status registers, etc. or from external devices. Normally, external interrupt can easily be triggered by attacker by changing the pin states. After this, microcontroller generally executes interrupt handler code snippet. Similarly if the user carefully injects a specific code snippet at the start of execution of interrupt handler, then target microcontroller can also have programmed or program flow can be changed. Usually desktop, servers use high clock speed processors however, microcontroller runs on significantly less clock speed and usually downclocked in power down mode. This results in it being feasible to inject well timed code at execution of interrupt handler called \"Interrupt-oriented Programming (IOP)\". When interruption occurs, there is a state of change between interrupt handler code and some accumulation of state in interruption called \"IOP primitives\". The authors explained various IOP primitives such as state accumulation, memory write, arithmetic, stack growing, and stack alignment. To exploit TI's MSP430F2618, the authors created a setup in which two microcontrollers are connected to the target device. One microcontroller is connected through JTAG interface and other is connected to send signals to target device. The author performed three different exploits by writing a simple firmware on a microcontroller to generate timely nested interrupts. First, the state accumulation exploit acquires state changes information when interrupt occurs on target device, through which program behavior change has been done. Second, the loop execution exploit changes memory contents by nesting interrupt loop. Third, the stack growing exploit is done when the target device receives continuous interruptions, in which stack contents grow by 2 bytes each time. The authors exploited open source lightweight operating system, TinyOS. The team has added few lines of code on USART1 to receive an interrupt request, which makes interrupt handler re-entrant. As a result, the author showed stack growing primitive. The team also performed static analysis of the firmware of five MSP430-powered devices, FET430 UIF, EZ430U, MSP430 FET, EZ430 URF and GoodFET, using IDApro [13] debugger and wrote automation using IDAPython [14] scripts in which they did not find any significant results. However, in the hardware analysis, they observed the CPU state information that they received, which was modified when JTAG reset occurred, was not an \"actual\" reset interruption triggered by a signal edge on the RST/NMI pin. This is because JTAG debugger resets after every gain/loss action of JTAG control on target device. This is a contradictory observation with official document provided by MSP manual [15].