Danish cybersecurity experts Alexander Krog, Jens Stærmose and Kasper Terndrup of cybersecurity firm Lyrebirds ApS, and independent Danish researcher Simon Sillesen, announced a new vulnerability dubbed Cable Haunt. In the announcement, they disclosed a critical remote code execution vulnerability in hundreds of millions of cable modems.

According to the website the researchers set up, “The vulnerability enables remote attackers to execute arbitrary code on your modem, indirectly through an endpoint on the modem. Your cable modem is in charge of the internet traffic for all devices on the network. Cable Haunt might therefore be exploited to intercept private messages, redirect traffic, or participation in botnets.”

The researchers further state that the affected modems are vulnerable to a DNS rebind attack followed by overflowing the registers and executing malicious functionality. Use of default credentials and a programming error in the spectrum analyzer also contribute to the vulnerability.

While a buffer overflow exploit would normally be written directly to the memory stack, the memory structure of the MIPS assembly language that runs the spectrum analyzer requires the attack code to know the precise memory address of the vulnerable code. To get around this, Cable Haunt uses return-oriented programming to move between pre-existing pieces of code and then create a patchwork of existing code.

This approach indicates that through the use of a hardware root of trust model, this vulnerability could have been eliminated.

Bart Stevens, senior director of product marketing for Rambus elaborates. “The recent Cable Haunt exploit demonstrates the need for a security by design approach, led by a hardware root of trust to silo away secure processes from the main CPU. This siloed approach to security ensures that a potential compromise of the main processor does not expose critical keys and credentials — or impair the execution of security applications that monitor system operation and detect tampering. A hardware root of trust would not necessarily prevent the host CPU from being attacked by a similar attack like Cable Haunt. But at a minimum, a hardware root of trust could prohibit alternate firmware from replacing the original firmware. In addition, many future vulnerabilities could be prevented if sensitive configuration and network parameter handling is moved from the normal host CPU onto a separate and dedicated, secure CPU residing inside the root of trust section.”

It is important to note that this is a proof-of-concept exploit and has not been seen in the wild. The exploit is complicated by the fact that the vulnerable spectrum analyzer component is available on the cable modem’s internal network, and not directly exposed to the internet. While it would require a lot of skill, and maybe a bit of luck, if successful it would give a hacker intimate access to all the data coming in and going out. In a high-value target, the value of that access could inspire some to try.

Additional Resources:
“Hundreds of millions of Broadcom-based cable modems at risk of remote hijacking, eggheads fear,” The Register, 1/10/2020

“Hundreds of millions of cable modems are vulnerable to new Cable Haunt vulnerability,” ZDNet, 1/10/2020

“Cable Haunt Vulnerability Exposes Modems to Remote Attacks,” Tom’s Hardware, 1/13/2020

“Cable Haunt vulnerability affects millions of Broadcom cable modems,” Security Boulevard, 1/13/2020

Written by Paul Karazuba, head of product, Rambus Security

Passed by former California governor Jerry Brown, cybersecurity law SB-327 is slated to go into effect on January 1, 2020. This proactive legislation requires manufacturers to equip IoT devices with “reasonable” security features to prevent unauthorized access, modification and data leaks. Specifically, SB-327 requires manufacturers to implement a unique preprogrammed (default) password for each device. Additionally, manufacturers must ensure that users create a new password the first time a device is activated. Together, these steps are expected to help protect California consumers, as hackers are known to routinely target vulnerable devices shipped with generic or default login credentials.

From our perspective, SB-327 is clearly long overdue. Indeed, unprotected IoT devices continue to pose a threat to both consumer privacy and security across the country. For example, a Ring camera installed in the Memphis bedroom of a young girl was recently hijacked by a hacker who seized control of the device to spy on the 8-year-old, taunt her with music and encourage destructive behavior. Another instance of a Ring camera falling victim to a hacker was reported in December by a Houston family who heard an eerily disembodied voice ask if “anyone [was] home” and promised it was “gonna find out.”

According to various reports, the recent spate of Ring hacks likely involved basic attack techniques such as credential stuffing. This simple process involves accessing accounts with stolen account credentials and large-scale automated login requests. Consequently, Ring users who don’t enable the optional two-step authentication skip setting a unique password or recycle credentials across multiple online services, and are at a greater risk of being hacked. To be sure, malicious hackers have coded dedicated software for breaking into Ring security cameras. Beyond Ring cameras, a wide range of vulnerable consumer IoT devices are frequently targeted by hackers who actively search for devices with default or weak login credentials such as “admin” usernames and “1234” passwords.

Although SB-327 sets an important precedent by requiring a unique preprogrammed (default) password for each IoT device, we believe much more needs to be done to secure connected devices. Security starts at the hardware level, and it should begin on day one of product design. Device designers need to prioritize security as a primary design goal of a connected device; not an afterthought, and certainly not lip service. A solid start to security is basing the foundation of your security in silicon; specifically, a siloed security co-processor capable of executing all security-centric processes completely independently of the main CPU.

Our CryptoManager Root of Trust is an ideal implementation. While located on the same chip as the main CPU, its physical separation and 7 layers of hardware security ensure that secure processes remain exactly that – secure. The root of trust can better help protect consumers by enabling robust remote access authentication and monitoring of anomalous system activity. This siloed approach to security ensures that a potential compromise of the main processor does not expose critical keys and credentials – or impair the execution of security applications that monitor system operation and detect tampering.

Cybersecurity law SB-327 is a good start for California consumers, although far more needs to be done to comprehensively protect IoT devices. Implementing a unique preprogrammed (default) password for each device and requiring users to create a new password can help prevent basic attacks, although a siloed security co-processor is necessary to thwart determined adversaries and complex hacking techniques.

Additional Resource:
California’s IoT Law Is A Good Start, But More Needs To Be Done

An international team of white hat researchers has successfully corrupted the integrity of Intel Software Guard Extensions (SGX) on Intel Core processors with a software-based fault injection attack aptly dubbed “Plundervolt.” Using Plundervolt, attackers can recover keys from cryptographic algorithms (including the AES-NI instruction set extension) and induce memory safety vulnerabilities into bug-free enclave code.

As the researchers explain, Intel SGX is a set of security-related instruction codes that are integrated into modern Intel CPUs. Essentially, SGX shields sensitive operations inside so-called enclaves. In theory, the contents of these enclaves are protected and cannot be accessed or modified from outside the enclave. This includes an attacker who has root privileges in the normal (untrusted) operating system.

“[However], modern processors are being pushed to perform faster than ever before – and with this comes increases in heat and power consumption,” the researchers state on the Plundervolt website. “To manage this, many chip manufacturers allow frequency and voltage to be adjusted as and when needed. But more than that, they offer the user the opportunity to modify the frequency and voltage through privileged software interfaces.”

Plundervolt, says the researchers, demonstrates how these vulnerable software interfaces can be maliciously exploited to undermine system security.

“Plundervolt carefully controls the processor’s supply voltage during an enclave computation, inducing predictable faults within the processor package. Consequently, even Intel SGX’s memory encryption/authentication technology cannot protect against Plundervolt,” the researchers write in an in-depth paper detailing the exploit. “In multiple case studies, we show how the induced faults in enclave computations can be leveraged in real-world attacks to recover keys from cryptographic algorithms (including the AES-NI instruction set extension) or to induce memory safety vulnerabilities into bug-free enclave code.”

It should be noted that a malicious attacker does not require physical access to execute Plundervolt.

“The undervolting interface is accessible from software, so if a remote attacker can become root in the untrusted OS, [the attacker] can also mount the Plundervolt attack,” the researchers add. “In any case, attackers with physical access would also be in the threat model of SGX (e.g. to protect against malicious cloud providers).”

Protecting against Plundervolt-like techniques

Plundervolt is a technique that enables an attacker to manipulate the voltage of Intel chips and extract information by exploiting Intel’s Secure Guard Extensions (SGX) feature. Plundervolt highlights the real-world challenges of designing processors that satisfy both performance and security demands. This is because the complexity of modern CPUs creates an incalculable number of potential vulnerabilities that can be taken advantage of by an attacker.

To protect CPUs against techniques like Plundervolt, we recommend implementing a secure co-processor that is siloed away from the primary, general performance processor. A purpose-built security co-processor can be hardened against a wide range of attack vectors, including side-channel attacks and voltage manipulation. This paradigm allows the primary processor to be designed uncompromisingly for performance — with sensitive operations safeguarded in a dedicated security co-processor.