bk99.de entertain the web since 1997

bk99.de
CCC · Hardware hackingCurated

Examining devices with JTAG

Summary

The talk presents JTAG as a hardware-level interface for debugging processors, examining memory and analysing embedded devices. Manufacturing interfaces often turn into powerful analysis tools after production. Physical access fundamentally changes the threat model of embedded systems.

Ideas

  • JTAG connects the test logic of several chips through a standardised chain.
  • Debug access can make a device’s registers, memory and program execution visible.
  • Unlabelled test points can be identified systematically with data sheets and measurements.

Recommendations

  • First identify ground, supply and safe signal levels.
  • Back up flash contents before you try any write or debug commands.

References

Watch the talk

Search the Web Archive

CCC · 2022

Linux security monitoring with audit events

Hilko Bengen shows how Linux auditd delivers fine-grained host events and how the unwieldy format can be made usable for attack detection with reasonable effort. Network monitoring only detects many attacks together with context from the affected host. More telemetry only helps if events are reliably correlated and prioritised.

CCC · 2017

Freeing robot vacuums from the manufacturer’s cloud

Dennis Giese and DanielAW examine connected robot vacuums, expose their data collection and internal Linux systems and show ways to run your own IoT cloud. A household appliance becomes a privacy risk as soon as its sensors are tied to someone else’s infrastructure. Owning a device remains incomplete if essential functions only work with a manufacturer cloud.

CCC · 2015

Rowhammer.js: Hardware faults from the browser

Clémentine Maurice and Daniel Gruss show how repeated memory accesses cause DRAM bit flips and how even JavaScript can become a hardware-level attack surface. Rowhammer.js demonstrated a remote, software-induced hardware fault from JavaScript. Abstraction boundaries do not prevent attacks on shared physical resources.