Virtual machine, she ignores, owns the bot, then controls yours.

Steve Grobman, Chief Technology Officer at Intel Security

August 21, 2015

4 Min Read

At this week’s Intel Developer Forum, CEO Brian Krzanich demonstrated some gesture-controlled spiderbots during his opening keynote that lit up and danced across the stage, entertaining the crowd. These robots spawned from Intel’s investments in the maker movement, demonstrating the limitless creativity and innovation of the developer community.

Spiderbot-1.jpg

Big Mama spiderbot, reporting for duty

One significant upside to the evolution of technology is lowering the barrier to entry for developers. Innovations like Intel’s Edison board enable an individual or small team to create sophisticated, autonomous robots in days instead of weeks. During the mega-session of Chris Young, senior VP and general manager of Intel Security Group, the bots were assigned sentry duty, guarding a big donut because software developers need to protect important assets such as sugary food and drinks. All joking aside, the reality is that we really do need to protect key assets, and sound coding is critical to securing our infrastructure.

Spiderbot-2.jpg

Spiderbot on duty, guarding the donut

Along with this development agility, however, come new risks that need to be understood by Intel Security and developers. As connected devices become more sophisticated, they are inherently more susceptible to attacks. We took the opportunity during Young’s mega-session to showcase how vulnerabilities in the computing ecosystem can be exploited if platform and application developers are not careful in their coding practices.

We replicated a common cloud environment with multiple virtual machines running on the same physical server. In this case, the robots had a control application running in a virtual machine, which was communicating wirelessly and giving the spiderbot commands. Then we asked one of our senior software engineers, Jenny Mankin, to see if she could commandeer the robot for her own nefarious purposes. She could, and she commanded the robot to stop performing its sentry duty.

Spiderbot-3.jpg

Jenny Mankin commandeering Steve Grobman's spiderbot

First, Jenny needed to steal credentials from the control application in the virtual machine. She took advantage of a vulnerability in the firmware implementation to install a rootkit inside the firmware. The rootkit allowed her to remap memory from the controlling VM to her own VM and monitor all activity in the controlling VM. (For more information on this class of attack, refer to the presentation from Black Hat USA 2015 by Intel’s Advanced Threat Research team.) This is a BIOS implementation vulnerability that breaks the VM isolation, moving the classic issue of privilege escalation in the realm of cloud, virtualization, and the Internet of Things. It also shows the attack technique of lateral movement, where the attacker uses her position in the environment (in this case, being on the physical machine) to take the next step in her attack.

In this case, once Jenny had the credentials she was able to reprogram the spiderbot by sending a return-oriented programming (ROP) exploit remotely to open a reverse-shell on the spiderbot. With ROP attacks, instead of trying to inject her own code into the software on the spiderbot, Jenny uses instructions that are already in memory and exploits a buffer-overflow vulnerability to chain together short sequences of instructions in an unintended order to execute the functionality she wants.

With Capabilities Comes Risk

As IoT devices become connected, we get much greater capabilities, but at the same time we expose ourselves to new risks. I think of the challenges demonstrated last month on automotive hacking, where a remote attacker completely took over control of a car. It is a big issue and one that developers need to comprehend in the world of rapid development, which can lead to quick but sloppy coding practices that are functional but susceptible to security vulnerabilities.

In the short term, our focus is helping the developer community understand good security coding practices. For more information, check out the following resources:

In the long term, Intel and Intel Security are looking at technology to detect and prevent this type of exploitation so that your spiderbot -- and your donuts -- remain yours. 

About the Author(s)

Steve Grobman

Chief Technology Officer at Intel Security

Steve Grobman is the chief technology officer for Intel Security Group at Intel Corporation. In this role, Grobman sets the technical strategy and direction for the company's security business across hardware and software platforms, including McAfee and Intel's other security assets.

 

Grobman joined Intel in 1994 as an architect in IT and has served in a variety of senior technical leadership positions during his Intel career. Before assuming his current role in late 2014, he spent a year as chief technology officer for the Intel Security platform division. Prior to that role, he spent two years as chief technology officer at Intel's subsidiary McAfee to integrate security technology from the two companies.

 

In prior roles, Grobman served as chief security technologist for the Intel Atom processor system-on-chip design group and spent seven years as chief architect for Intel vPro technology platforms. In the latter position, he led work on the solutions architecture that resulted in a business platform with unique hardware-based management and security capabilities.

 

Before joining Intel, Grobman spent four years at IBM as a solutions programmer and developer. Grobman has published a number of technical papers and books, and holds 20 U.S. and international patents in the fields of security, software, and computer architecture, with about another 20 patents pending. He is also the recipient of two Intel Achievement Awards, the first earned in 2005 for the invention, initial architecture, and strategy of the first PC embedded appliance; and the second in 2007 for the success of the Intel vPro technology platform.

 

Grobman earned his bachelor's degree in computer science from North Carolina State University

Keep up with the latest cybersecurity threats, newly discovered vulnerabilities, data breach information, and emerging trends. Delivered daily or weekly right to your email inbox.

You May Also Like


More Insights