Hi everyone ! Here we go with the collection of references of the past week.
Till next time,
Thierry
Articles and other News
The right to repair community in the US can celebrate some great progress now that John Deere has agreed to let US customers fix their own equipment. John Deere has for quite a while been the poster child of restrictive repair options. Combined with the Apple self-repair scheme from 2022, we might be noticing the beginning of a trend. Article: https://www.bbc.com/news/business-64206913
This article takes a stab at side-channel attacks against the AES implementation in an ARM Cortex-A50 and -A70, which leverages the ARMv8 instruction set with dedicated AES instructions. Full article is at https://eshard.com/posts/sca-attacks-on-armv8
Many things can be learned out of this analysis. First, ARM did not provide an algorithm intrinsically resistant to side-channel. Unless there is a rework by the semiconductor provider, the implementation cannot be deemed resistant. This means that any developer should consciously look at the hardware resources to perform sensitive operations and consider specific hardware accelerators claiming resistance to side-channel. This is confirmed by ARM's answer to our responsible disclosure, stating that mitigations are in the scope of their silicon partners.
Papers
A paper was released on evaluating the security of aircraft systems. A must read for anyone interested in aviation security.
This paper provides a comprehensive review of aircraft systems and components and their various networks, emphasizing the cyber threats they are exposed to and the impact of a cyber attack on these components and networks and the essential capabilities of the aircraft. In addition, we present a comprehensive and in-depth taxonomy that standardizes the knowledge and understanding of cyber security in the avionics field from an adversary's perspective. The taxonomy divides techniques into relevant categories (tactics) reflecting the various phases of the adversarial attack lifecycle and maps existing attacks according to the MITRE ATT&CK methodology. Furthermore, we analyze the security risks among the various systems according to the potential threat actors and categorize the threats based on STRIDE threat model. Future work directions are presented as guidelines for industry and academia.
A paper was released introducing a new privacy attack which enables adversaries to analyse encrypted LTE/5G traffic and recover any VoLTE/NR call details. Full paper here: https://arxiv.org/abs/2301.02487
We achieve this by implementing a novel mobile-relay adversary which is able to remain undetected by using an improved physical layer parameter guessing procedure. This adversary facilitates the recovery of encrypted configuration messages exchanged between victim devices and the mobile network. We further propose an identity mapping method which enables our mobile-relay adversary to link a victim's network identifiers to the phone number efficiently, requiring a single VoLTE protocol message. We evaluate the real-world performance of our attacks using four modern commercial off-the-shelf phones and two representative, commercial network carriers. We collect over 60 hours of traffic between the phones and the mobile networks and execute 160 VoLTE calls, which we use to successfully identify patterns in the physical layer parameter allocation and in VoLTE traffic, respectively. Our real-world experiments show that our mobile-relay works as expected in all test cases, and the VoLTE activity logs recovered describe the actual communication with 100% accuracy. Finally, we show that we can link network identifiers such as International Mobile Subscriber Identities (IMSI), Subscriber Concealed Identifiers (SUCI) and/or Globally Unique Temporary Identifiers (GUTI) to phone numbers while remaining undetected by the victim.
Vulnerabilities
Threema has long carried a reputation of being the secure option amongst messenger applications. Researchers from the Applied cryptography group at ETH Zurich actually took a closer look and found there was definite room for improvement. Website with more details and the paper is at https://breakingthe3ma.app/
A group of multiple people have spent a considerable effort looking for vulnerabilities in API endpoints used by vehicles, with an impressive impact. Across a range of car manufacturers, they succeeded e.g. in remotely lock/unlocking and starting/stopping vehicles, gaining access to internal applications, gaining access to customer records and taking over accounts.
Very nice work that you can read at https://samcurry.net/web-hackers-vs-the-auto-industry/
Tools
Are you into reverse engineering Windows software ? Here’s a handy tool that allows you to download debugging symbols. https://github.com/dbgsymbol/getsymbol
Bits and Pieces
The Zero Day Initiative has announced its next Pwn2Own contest for end of March and is, amongst others, bringing back the automotive category with Tesla. Great prize money, but also not an easy challenge for sure. I will be looking forward to the contest entries across all categories.
NIST is calling for participants for a Community of Interest focusing on Automotive Cybersecurity. If this is your jam, head over and join me at https://csrc.nist.gov/Projects/auto-cybersecurity-coi