Read It Twice! A mass-storage-based TOCTTOU attack
Collin Mulliner and Benjamin Mich´ele Security in Telecommunications Technische Universit¨at Berlin and Telekom Innovation Laboratories {collin,ben}@sec.t-labs.tu-berlin.de
Abstract are mostly not hardened against hacking and modding. Here the effort mostly comes down to figuring out file Consumer electronics and embedded devices often al- and firmware formats or finding the serial console on low the installation of applications and firmware up- the hardware. More costly devices contain more sophis- grades from user-provided mass-storage devices. To ticated security measures. Here firmware upgrades are protect the integrity of these devices and the associ- protected by cryptographic signatures. Attacking the ated electronic markets, the software packages are pro- more costly and thus protected devices comes down to tected by cryptographic signatures. The software instal- finding and exploiting software bugs to achieve code ex- lation code assumes that files on attached mass-storage ecution often requiring a lot of effort. devices cannot change while the storage device is con- Many embedded systems and especially consumer nected. The software installation is therefore not bound electronics (CE) support the installation of software to the file integrity check, thus laying the founda- and firmware upgrades through attached mass-storage tions for a time-of-check-to-time-of-use (TOCTTOU) devices. Most commonly, USB mass-storage devices are attack. This work presents a TOCTTOU attack via ex- used for this, such as flash drives and hard disks. De- ternally attached mass-storage devices. The attack pending on the type of embedded system, Secure Dig- is based on emulating a mass-storage device to ob- ital (SD) and Compact Flash (CF) cards are also pop- serve and alter file access from the consumer device. ular. The TOCTTOU attack is executed by providing dif- In this paper we present a novel time-of-check-to- ferent file content to the check and installation code time-of-use (TOCTTOU) attack that targets file con- of the target device, respectively. The presented at- tent. We attack software installation and firmware up- tack effectively bypasses the file content inspection, grade code that reads files from an external mass- resulting in the execution of rogue code on the de- storage volume. Our attack is based on an emulated vice. mass-storage device that allows to change the content of files while the mass-storage volume is connected to Keywords: race condition, USB, mass-storage, con- the attacked target. sumer electronics, software attestation Our attack method is based on a number of obser- vations that are present on many different consumer electronics devices today. The main observation is that 1. Introduction code for software installation and firmware upgrade is separated into two parts: check and install. If each part Consumer electronics today are heavily targeted by implements its own file access it is potentially prone to the hacking and modding community with the primary a TOCTTOU attack. goal to modify or replace the software running the de- This work demonstrates a practical implementation vices. To fulfill this goal the attacker (the modder) has of such an attack against a Linux-based TV-set. We to execute his own code on the target device. In most show that we are able to install a shared library on the cases the attack further needs to gain system or root system, which is then loaded by the main application privileges on the target device. running on the TV-set. Our code runs with root privi- There are many ways to achieve code execution and leges. Our attack currently is the only method to root a firmware replacement mostly depending on the type specific series of Samsung TV-sets. We further present of device and software running on it. Low cost devices a tool to analyze the behavior of CE devices to deter- mine if a device might be susceptible to mass-storage- an attached mass-storage device will not change dur- based TOCTTOU attacks. ing the installation. In general, an installation consists Similar issues exist in the areas of trusted com- of the following steps: puting and software attestation. One party tries Check the software package or firmware upgrade. to verify or measure the integrity of another party This step verifies version numbers and crypto- (the other partie’s code) before accessing or us- graphic signatures of the packages that are going ing it. If a time window between measurement and to be installed. access exists, the software attestation might be vul- nerable to a TOCTTOU attack. Install the actual software or firmware upgrade. This step copies the files from the external storage de- The contributions of this paper are the following: vice to the internal storage or flashes the firmware. • Read It Twice (RIT) Attack which is a mass- The check and installation phases are not com- storage-based TOCTTOU attack based on the bined in an atomic operation as file contents are condition that software installation and firmware assumed to be immutable while the mass-storage de- upgrade code are separated into two parts: check vice is plugged-in. and install. If each code part individually reads file(s) from an external mass-storage device an ex- Our RIT attack works as follows: ploitable TOCTTOU condition might exist. Our attack also specifically accounts for a possible ex- Given the file-X that is expected by the check-install isting block and file system cache on the target code. We have the benign file-B and the modified ver- device. Our approach is different from traditional sion file-M. We construct a mass-storage device that TOCTTOU attacks as we target the content of can observe the read requests to fileX. For the first ac- files and not their permissions. cess to fileX our mass-storage device serves the benign file-B. This is likely the check code that calculates and • USB-Mass-Storage RIT Attack Implemen- compares the cryptographic hashes or verifies other pa- tation and Evaluation against a Samsung TV- rameters contained in fileX. For the second read access set. Using this attack we were able to gain code to fileX our mass-storage device serves our modified execution and root privileges on our target device. file-M. This is likely the installation phase of software • Mass-Storage File Access Analysis Method install code. and tool for black box investigation of file ac- The attack succeeds if the check code verifies the sig- cess to external mass-storage devices. This anal- nature of the benign file file-B and then the install code ysis method allows to detect possible TOCTTOU uses the modified file file-M. Effectively our attack cir- conditions in firmware upgrade and software in- cumvents the signature check and/or file content in- stallation code of embedded systems that read files spection. from external mass-storage devices. 2.1. Boundary Conditions The rest of this paper is organized as follows. In Sec- tion 2 we introduce our novel Read It Twice attack. In There are two boundary conditions for our RIT at- Section 3 we provide a brief overview of our target, a tack that have to be resolved in real world implemen- TV-set. Section 4 presents our Mass-Storage File Ac- tations. These are: cess Analysis method and tool. Our method is general and can be used for black box analysis of arbitrary de- File size of the benign file and the modified file vices that read files from a USB mass-storage device. likely need to be equal. Further the filesystem us- In Section 5 we present a practical implementation of age must be exactly the same to guarantee that our RIT attack against the software installation sub- both files are located within the same blocks in system of our TV-set. In Section 6 we discuss related each filesystem image. work and in Section 7 we briefly conclude. Block cache. Embedded devices running sophisti- cated operating systems such as Linux, BSD, and 2. The Read It Twice Attack Windows implement a block cache. If the target file fits in the block or filesystem cache the at- Our Read It Twice (RIT) attack is based on the ob- tack has to be adjusted so that the install code servation that software installation and firmware up- will read the file from the attached device rather grade code on embedded devices assumes that files on than from the block cache.
2 Another boundary condition is that the target de- 1 vice does not copy the software package or firmware up- 2
The busybox-based Linux system executes a large 3.2. The SamyGO Jailbreak binary called exeDSP. This binary controls the entire TV-set. It is responsible for showing the On Screen Previously, before the introduction of CI+ [1] de- Display (OSD) to navigate through the TV chan- vices, Samsung TV-sets allowed to execute and install
3 int Game_Main(char *path, char *udn) ule and sent back to the host via USB. { system("telnetd &"); Our tool works as follows: return 0; g file storage.ko operates as designed. The given } file is exported as an emulated mass-storage vol- ume. Blocks requested by the host are read from Figure 2. Simple Samsung content library appli- the file and sent back to the host. cation that executes system(3). Block and file system access tracking. We track every block read access and match the file and di- rectory associated to that block. This allows us to applications based on shared objects from USB mass- monitor which files are accessed by the host and storage devices. Execution of an application is straight- how often a given file is actually read from our forward: The application was selected and run from the emulated block device. We implemented this for content menu. The only requirement for installing an FAT16 and FAT32 [12] as these are the common application on the TV-set was to enable write access to filesystems for our target devices. Other filesystem the TV-set’s internal memory via the WiseLink Write types can easily be added if required. option in the TV configuration [16]. Once the applica- tion was installed, the shared object could be loaded by Our tool enables us to conduct black box analysis the exeDSP process. As exeDSP is run with root privi- of USB mass-storage-based firmware upgrade and soft- leges, code from the user-supplied shared object is exe- ware installation code running on embedded systems cuted with root privileges, too, hence taking over con- such as CE devices. We were able to gather the follow- trol of the TV system. This enabled the installation of ing information about our Samsung TV-set by using custom applications like a telnetd server or flashing of this tool. customized firmware versions to the TV set. File and directory access during the check and in- Flashing a customized firmware involves additional stall phase of the target device. This allows us to steps, which are not important in the scope of this identify the files actually being accessed by the work. They can be found on the SamyGO Wiki [15]. check and install code during a firmware update or software package installation. 4. Mass-Storage File Access Analysis Files read by the check and install code. This dis- closes if files are read completely or only partially. To determine if a specific device is suscepti- Timing of file access. The time of each block ac- ble to our RIT attack the behavior of its check cess is logged accurately, thus allowing the obser- and install code has to be analyzed. We devel- vation of delays between accesses to consecutively oped a Mass-Storage File Access Analysis tool read files. This can provide hints about processes that allows black box analysis of the access behav- such as signature checks after having read one file ior to USB mass-storage devices. and before reading the next one. Our analysis tool is implemented using a The output of our analysis tool provides a great gumstix [10] board running Linux. The gum- starting point for designing our attack. Figure 3 shows stix board is equipped with a USB OTG [4] an example output for the installation of a content li- port and thus can emulate a USB client de- brary application on our Samsung TV set. vice. The Linux USB stack already has support This output allows to deduce some of the TV set’s for USB mass-storage emulation through the gad- internal functioning by matching user interface inter- get API [3]. The driver source is in file storage.c actions to file access patterns. After invoking the USB (in linux/drivers/usb/gadget/), which com- inspection menu of the content library (11:18:56), the piles as the kernel module g file storage.ko. TV set scans each directory for a clmeta.dat file. Each The g file storage module works in a simple way. of these files is read to populate entries in each of the At module load time, the filename of a filesystem im- content categories, being Wellness in our example soft- age or block device is passed to the module as a pa- ware package. rameter. The module exports the given file or block As the user opens the Wellness category (11:19:10), device as a USB mass-storage volume. Each block re- the TV set reads the corresponding bitmap file of each quested by the host is read from the file by the mod- package as indicated in the clmeta.dat file. These
4 11:18:56 TOCTTOU (DIR) face, therefore, shared object-based applications still 11:18:56 CLMETA.DAT (471b) [/TOCTTOU] seem to be supported. 11:18:56 CLMETA.DAT -> read completed! Our RIT attack is based on the observation that 11:18:56 CACHE (DIR) shared object applications are supported while only 11:18:56 CLMETA.DAT (450b) [/CACHE] Flash applications can be copied to the device. The 11:18:56 CLMETA.DAT -> read completed! goal of our attack is to trick the TV-set into copy- 11:19:10 CACHE.BMP (843758b) [/CACHE] ing an application that is based on a shared object to 11:19:10 CACHE.BMP -> read completed! the TV-set’s internal memory from which it can be ex- 11:19:10 TOCTTOU.BMP (490734b) [/TOCTTOU] ecuted. 11:19:10 TOCTTOU.BMP -> read completed! The software check-install code determines the kind 11:19:56 TELNETD (1745016b) [/TOCTTOU] of application by inspecting the clmeta.dat file, as 11:19:56 TELNETD -> read completed! shown in Figure 1 and described in Section 3.1. The 11:19:56 TOCTTOU.SO (4608b) [/TOCTTOU] categories Wellness and Children denote Adobe Flash- 11:19:56 TOCTTOU.SO -> read completed! based applications that may be installed, i.e., copied to internal flash memory. The Game type application is based on a shared object and thus may not be in- Figure 3. The output shows files and directories stalled. We call this first part the check code as de- being access. In addition it shows that files are scribed in Section 2. being read completely and the time at which the The install code that actually copies the applica- files have been accessed. tion files to the TV-set’s internal memory is not check- ing the clmeta.dat file and just copies the whole sub- directory. If we can change the clmeta.dat file from bitmaps are then displayed to the user as the pack- category Wellness to category Game our tocttou ap- age’s icon. plication will change to a shared object-based applica- Finally, the user selects an application to be installed tion. As a result we will have our code running inside (11:19:56), which in our example is the TOCTTOU the exeDSP process which runs with root privileges. package. The package content, i.e., the entire directory, Note that the execution of code from shared object is then copied from the mass-storage device to the in- files is prohibited only for files from external storage. ternal flash memory. This includes the executable files Once this code is executed from internal storage, no telnetd and tocttou.so. restrictions apply. Therefore, an attacker has to per- After installation, the user can launch the freshly suade the check-install code to copy the shared object installed application from internal memory by select- file and a corresponding clmeta.dat to internal mem- ing it in the content menu. Each time the application ory. is launched, the TV set will analyze the clmeta.dat The remainder of this section describes our attack to choose how to launch the application, i.e., as Adobe tool and how it is leveraged to perform our RIT attack Flash or as a shared object. against the Samsung TV set. Note that the clmeta.dat and the bitmap file is not read again as it is copied to the internal memory. This 5.1. The Attack Tool indicates that these files are copied directly from the internal block cache and that no second access to the Our attack tool is an extension of our analysis tool, block device occurred (cf. Section 2.1). basically two features were added. These are: Based on the results of our analysis we design and implement our RIT attack and corresponding tool, Trigger file monitoring. Our version of which we present in the following Sections. g file storage takes an additional filename as the trigger file. Every time the trigger file is read 5. The RIT Attack from the block device the trigger counter is incre- mented. The match of block access to filename is done via our block and filesystem access track- Our Samsung LE32B650 TV, like all current Sam- ing code that we added for our analysis tool (cf. sung CI+ TV-sets, does not allow to execute or copy Section 4). applications based on shared objects from a USB drive. Only Adobe Flash-based applications may be executed Filesystem switch. When the trigger counter and copied from USB drives. But pre-installed games reaches the trigger value, which is passed as a pa- such as WiseStar are based on the shared object inter- rameter to our version of g file storage, all block
5 requests are redirected to the modified filesys- tem image. Effectively, the volume is switched to TV-set the modified filesystem image. USB Host Hence, our version of the g file storage module re- quires three additional parameters: the path to our 1 modified filesystem image, a filename as the trigger file, and the trigger value to switch between the original and 3 the modified filesystem image. g_file_storage 5.2. Executing the Attack block access tracker + To execute the attack we require two FAT filesys- filesystem switcher tem images. The first image contains the benign filesys- 2 4 tem (compare file-B in Section 2). The second image contains the modified filesystem (file-M). Both filesys- Filesystem Filesystem tems contain exactly the same files with the exception Image Image of the clmeta.dat file. In the modified filesystem the B M clmeta.dat file of our tocttou application specifies the category Game whereas it is Wellness in the benign gumstix image. Note that the two filesystem images are required to Figure 4. Our attack in 4 steps: 1) The TV-set be completely identical as the host will use the FAT of request block 23 from our emulated storage de- the benign image to request blocks of the modified im- vice. 2) Our tool reads block 23 from the benign age. This can be achieved by first creating the benign filesystem image and delivers it to the TV-set. 3) image and modifying a copy thereof to create the mod- At a later point, the TV-set again requests block ified image. Alternatively, copying the files in exactly 23 form the storage device. 4) This time our tool the same order to both images will yield suitable im- reads block 23 from the modified filesystem im- ages. age and delivers the block to the TV-set. To execute the attack we have to further ensure that the clmeta.dat file is actually read multiple times. The problem is, as described in Section 2.1, that the TV runs Linux and thus has a block cache. Therefore, the 5.3. Countermeasures TV will read each block from the external storage de- vice only once and then store it in the block cache. There are many possibilities for countermeasures To resolve this issue and to force the TV to re-read the against our RIT attack; here we only discuss one sim- clmeta.dat file from our tocttou application, we added ple solution that is straightforward. a second application named cache. The second appli- The most obvious and easiest to implement is to cation is basically a copy of our tocttou application first copy the software or firmware files to internal stor- with a different name. To circumvent the block cache, age and then execute the checks on the copy. After all we padded the clmeta.dat file from the cache appli- checks have passed, the installation process is executed cation with spaces until it hit 260 Megabytes. When using the internal copy of the files. This countermea- the TV-set reads this large file all previously cached sure is only possible if the target device has enough un- blocks are discarded. The file size of 260MB was deter- used storage space. Alternatively, the copy could also mined by experimenting with various reasonable val- be held in free memory (RAM), if available. ues, i.e., common RAM sizes. Using our block access This simple copy-based countermeasure will only tracking code we can easily observe if the blocks of work for devices that contain excess storage or sys- the clmeta.dat from our tocttou application are re- tem memory. Consumer electronics devices are mostly quested again by the host. If this happens, the blocks built to be cheap and use as few resources as possi- are not in the block cache anymore and our attack suc- ble, often having just enough storage to support the ceeds. operational functionalities of the device. More sophis- Figure 4 shows the basic concept of our attack. The ticated countermeasures have to be developed to pro- tool’s output for a successful RIT attack is shown in tect devices that do not contain enough memory to im- Figure 5. plement a simple copy-based check-install procedure.
6 1 TOCTTOU (DIR) lowed arbitrary code execution on the PlayStation 3. 2 CLMETA.DAT (471b) [/TOCTTOU] In [17] the authors added malicious functionality to 3 CLMETA.DAT -> read completed! [1/2] the USB drivers of an Android-based smartphone to at- 4CACHE (DIR) tack the attached computer while the phone was con- 5 CLMETA.DAT (272630223b) [/CACHE] nected for charging its battery. The malicious function- 6 CLMETA.DAT -> read completed! [2/2] ality emulated a keyboard and mouse to interact with [device switched!] the computer. 7 CACHE.BMP (843758b) [/CACHE] There are various attacks based on USB mass- 8 CACHE.BMP -> read completed! storage devices [8, 11] that contain autorun files for 9 TOCTTOU (DIR) either Windows or Linux. 10 TOCTTOU.BMP (490734b) [/TOCTTOU] The GTV Hacking scene [5] found that the Sony 11 TOCTTOU.BMP -> read completed! Google TV could be rooted and downgraded by a sim- 12 TELNETD (1745016b) [/TOCTTOU] pler version of our RIT attack. Their attack is based 13 TELNETD -> read completed! on three USB flash drives that contain different ver- 14 TOCTTOU.SO (4608b) [/TOCTTOU] sions of firmware and firmware meta files. The attack 15 TOCTTOU.SO -> read completed! works by inserting and removing the USB flash disk 16 CLMETA.DAT (471b) [/TOCTTOU] during a firmware upgrade. Since the Sony GTV soft- 17 CLMETA.DAT -> read completed! [3/2] ware doesn’t seem to check if a device is inserted and removed during the upgrade process this simple attack is able to downgrade the firmware version. After the Figure 5. Output of our attack tool for the RIT downgrade the device can be rooted since the older ver- attack. In line 6 the device is switched to the sion contains a software vulnerability that allows shell modified filesystem image after the access to command injection. Our attack is similar but targets the clmeta.dat file in the cache directory. The more hardened systems that can detect removal of the clmeta.dat in the cache directory is 260MB in upgrade medium such as the USB flash drive. size to flush tocttou/clmeta.dat from the block Our work also falls into the area of trusted comput- cache of the TV-set. The attack is finalized in ing and software attestation. One of the challenges in line 16 where the TV-set reads clmeta.dat again these areas is to prove the integrity of data stored in but this time the block are read from the modi- the off-chip memory, i.e., memory not part of the ac- fied filesystem image. tual CPU. [9] presents a survey on memory authenti- cation mechanisms and attacks that also deal with ex- ternal memory and storage. Our attack relies on the 6. Related Work ability to modify the content of an external storage de- vice that is connected to the target system. Related work falls into four different areas. First, general race conditions and file-based TOCTTOU at- 7. Conclusions tacks, second USB mass-storage-based attacks, third USB-based attacks, and fourth trusted comput- In this work we presented a novel time-of-check-to- ing and software attestation. time-of-use (TOCTTOU) attack that targets the con- tent of files based on emulated mass-storage devices. Bishop et al. [7] characterized and analyzed a simi- Our attack is called Read It Twice! (RIT). We designed lar class of TOCTTOU attacks that targets file access and implemented a USB mass-storage-based version of on UNIX systems. Their work mainly targeted file per- our novel TOCTTOU attack to inject a shared object mission checks versus file open operations. In this pa- into a Samsung TV-set bypassing the implemented se- per we present a novel TOCTTOU attack against the curity checks. The shared object is executed with root content of files. privileges thus it is effectively rooting or jailbreaking The PSjailbreak and the open source version PS- the device. Groove [6] attack to jailbreak Sony’s PlayStation 3 is We believe that our RIT attack applies to many based on a rogue USB device. The exploit leverages a kinds of consumer electronics and embedded systems memory corruption bug in the PlayStation USB driver that install software packages from external storage code that parses USB device descriptors. The attack devices, given the same boundary conditions apply. works by emulating multiple USB devices with mali- Mainly the check and install code must not be bound cious content in the device descriptors. The attack al- together.
7 Although we developed our proof-of-concept attack [12] Microsoft Corporation. Microsoft Extensible Firmware for USB-based mass-storage, we believe the attack Initiative FAT32 File System Specification, FAT Gen- transfers to any kind of flash and disk technology as eral Overview On-Disk Format. http://msdn. long as the block access can be observed and altered. microsoft.com/en-us/windows/hardware/gg463084, A prime example of another kind of external storage December 2006. device is a Secure Digital (SD) or Multi Media Card [13] Samsung Inc. LE32Bxxx LCD TV. http://www. samsung.com (MMC) card. Any storage device technology that can . be emulated can be used to carry out our RIT at- [14] SamyGO. Creating Content Library applications - SamyGO. http://wiki.samygo.tv/index.php5/ tack. Storage devices containing a sophisticated pro- Creating_Content_Library_applications. cessor may be modified via software to carry out a RIT [15] SamyGO. SamyGO, Samsung Firmware on the GO. attack without emulation but directly returning differ- http://www.samygo.tv. ent data for multiple read operations of the same block. [16] SamyGO. Service Menu Enabling Add/Delete in Con- In the future, manufacturers need to take special tent Manager - SamyGO. http://wiki.samygo. care when reading sensitive data from external at- tv/index.php5/Service_Menu\#Enabling_Add. tached mass-storage devices. The device could be emu- 2FDelete_in_Content_Manager. lated to carry out an attack such as our Read It Twice! [17] Z. Wang and A. Stavrou. Exploiting smart-phone USB attack. connectivity for fun and profit. In Proceedings of the 26th Annual Computer Security Applications Confer- Acknowledgements ence, ACSAC ’10, pages 357–366. ACM, 2010.
The authors would like to thank Patrick Stewin, Dmitry Nedospasov, and Jean-Pierre Seifert for review- ing early versions of this paper.
References
[1] CI Plus (CI+). http://www.ci-plus.com. [2] Simple DirectMedia Layer. http://www.libsdl.org. [3] USB gadget API of the Linux kernel. http://kernel. org/doc/htmldocs/gadget.html. [4] USB on-the-go. http://www.usb.org/developers/ onthego/. [5] About Sony Downgrade + Rebooter (Root). http://gtvhacker.com/index.php/About_Sony_ Downgrade_+_Rebooter_(Root), February 2012. [6] Y. Alaoui. PSGroove. https://github.com/ psgroove/psgroove, December 2010. [7] M. Bishop, M. Bishop, and M. Dilger. Checking for Race Conditions in File Accesses. Computing Systems, 9:131– 152, 1996. [8] A. Crenshaw. Plug and Prey: Malicious USB Devices. http://www.irongeek.com/downloads/Malicious% 20USB%20Devices.pdf, January 2011. [9] R. Elbaz, D. Champagne, C. H. Gebotys, R. B. Lee, N. R. Potlapally, and L. Torres. Hardware mechanisms for memory authentication: A survey of existing techniques and engines. Transactions on Computational Science - Special Issue on Security in Computing, 4:1–22, 2009. [10] Gumstix Inc. gumstix. http://www.gumstix.com/, 2012. [11] J. Larimer. USB autorun attacks against Linux. http://blogs.iss.net/archive/papers/ ShmooCon2011-USB_Autorun_attacks_against_ Linux.pdf, January 2011.
8