Slide 1: What the HEC? Security implications of HDMI Ethernet Channel and other related protocols
What the HEC? Security implications of HDMI Ethernet Channel and other related protocols Andy Davis, Research Director NCC Group
Slide 2: NCC Group offices
UK Offices North American Offices Australian Offices Manchester - Head Office San Francisco Sydney Cheltenham Atlanta Edinburgh New York Leatherhead Seattle London Thame European Offices Amsterdam - Netherlands Munich – Germany Zurich - Switzerland
Slide 3: Agenda
Agenda • Why am I talking about video interfaces? • What does HDMI bring with it? • The CEC protocol – enabling the user to expend as little energy as possible • CECSTeR – The CEC Security Testing Resource • The HEC protocol – you mean I get network access too? • HEC internals and potential security
Slide 4: Why am I talking about video interfaces?
Why am I talking about video interfaces? • It all started with a BlackBerry PlayBook research project… • I was investigating USB security at the time (green interface) • What other ports are available? • A power connector (blue interface) – probably not that exciting… • Hmm…microHDMI – what can I do
Slide 5: HDMI is an output isn't it?
HDMI is an output isn’t it? Well…yes and no • Video out • Audio out • Display identification and capability advertisement in via EDID • Remote control via CEC in and out • Network data via HEC in and out • Encryption and authentication data via HDCP and DPCP in and out
Slide 6: HDMI - High-Definition Multimedia Interface
HDMI - High-Definition Multimedia Interface • http://www.hdmi.org/manufacturer/specification.aspx (HDMI adopters only) • Transmits encrypted uncompressed digital video and audio data using TMDS (Transition-Minimised Differential Signalling) • Supports Enhanced DDC for display identification and capa
Slide 7: CEC – I've not heard of that before…
CEC – I’ve not heard of that before… Trade names for CEC are: • BRAVIA Link and BRAVIA Sync (Sony) • VIERA Link , HDAVI Control, EZ-Sync (Panasonic) • Anynet+ (Samsung) • Aquos Link (Sharp) • SimpLink (LG) • EasyLink (Philips) etc…
Slide 8: CEC - Consumer Electronics Control
CEC - Consumer Electronics Control Purpose: • Control two or more HDMI devices using a single remote control • Devices can control each other without user-intervention. Physical: • The architecture of CEC is an inverted tree • One-wire bidirectional serial bus (AV.link) Logical: • Up to ten AV devic
Slide 9: Supported CEC commands
Supported CEC commands • One Touch Play, System Standby • Pre-set Transfer, One Touch Record • Timer Programming, System Information • Deck Control , Tuner Control • OSD Display, Device Menu Control • Routing Control, Remote Control Pass • Device OSD Name Transfer, System Audio Control
Slide 10: The CEC protocol
The CEC protocol CEC Block layout: CEC Header block: CEC Message: • Messages are either Directed or Broadcast • Logical addresses are 0x0 – 0xF (0 always TV, F always broadcast) • Physical addresses x.x.x.x (TV = 0.0.0.0)
Slide 11: Can we fuzz CEC?
Can we fuzz CEC? • Feature rich protocol - could potentially yield some interesting security vulnerabilities in different implementations • Arduino library - http://code.google.com/p/cec-arduino/ • Publicly available Arduino - CEC interface circuit: • USB-CEC Adapter from Pulse Eight: • USB-CEC Brid
Slide 12: Introducing CECSTeR
Introducing CECSTeR • Consumer Electronics Control Security Testing Resource • Download it here - http://tinyurl.com/ncctools • Supports CEC and CDC (more on that later) • Capture and display traffic • Send arbitrary commands • Fuzz the protocols • Time for a demo…
Slide 13: HDMI Connectivity for the demo
HDMI Connectivity for the demo
Slide 14: What are the fuzzer results?
What are the fuzzer results? My CEC targets: • Sony PS3 – no results • Panasonic Blu-ray player (DMP-BD45) – “random” lockups • BlackBerry PlayBook (very limited CEC functionality) - no results • XBMC (using Pulse-eight USB-CEC Adapter) – Permanent DoS • It “bricked” the Pulse-eight adapter! • Poten
Slide 15: HEC - HDMI Ethernet Channel
HEC - HDMI Ethernet Channel • Introduced in HDMI v1.4 (latest version is 1.4a) • Consolidates video, audio, and data streams into a single HDMI cable • The primary intention is to reduce the amount of cables required to connect AV devices together. • Uses CDC (Capability Discovery and Control) to co
Slide 16: CDC (Capability Discovery and Control)
CDC (Capability Discovery and Control) CDC is used to: • Discover potential HDMI Ethernet channels • Activate and deactivate channels • Communicate status of channels CDC messages are sent with the CEC “CDC Message” (0xF8) opcode All CDC messages are sent to the CEC logical broadcast address (0xF) C
Slide 17: HEC (CDC) Messages
HEC (CDC) Messages The following messages are used for Capability Discovery and Control: • <CDC_HEC_InquireState> • <CDC_HEC_ReportState> • <CDC_HEC_SetState> • <CDC_HEC_RequestDeactivation> • <CDC_HEC_NotifyAlive> • <CDC_HEC_Discover> • <CDC_HEC_SetStateAdjacent>
Slide 18: HEC potential combinations
HEC potential combinations Possible HECs within a certain HDMI network: (referenced from HDMI specification v1.4a)
Slide 19: HEC States
HEC States • PHEC (Potential HDMI Ethernet Channel) – part of a PHEC if at least one HDMI connection is HEC capable • VHEC (Verified HDMI Ethernet Channel) – part of a VHEC after CDC has confirmed HEC capability of all devices in a PHEC via a <CDC_HEC_Discover> message • AHEC (Active HDMI Ethernet C
Slide 20: Network loop prevention
Network loop prevention • Routing loops such as shown here are managed using RSTP (Rapid Spanning Tree Protocol)
Slide 21: Network loop prevention
Network loop prevention • Routing loops such as shown here are managed using RSTP (Rapid Spanning Tree Protocol) • HEC2 is disabled to remove the loop
Slide 22: Network loop prevention
Network loop prevention • Routing loops such as shown here are managed using RSTP (Rapid Spanning Tree Protocol) • HEC2 is disabled to remove the loop • If HEC1 link is broken, HEC2 is restored
Slide 23: Queue control
Queue control • Devices in a HEC network are expected to prioritise traffic. Time sensitive application traffic should be forwarded with higher priority than activities such as file downloads: • On-line gaming • Video • VoIP • This is achieved using a 3 bit priority field in VLAN tags
Slide 24: This is all very interesting, but…
This is all very interesting, but… • I’m never going to be pentesting a home AV network! • HDMI connectors are appearing on new laptops and PCs – soon these protocols will be implemented in all the major operating systems • If I found a bug in an HDMI enabled TV, so what? • Plasma/LCD TVs are becomi
Slide 25: HEC Risk #1 – Corporate boundary breach
HEC Risk #1 – Corporate boundary breach • Network-enabled projectors and TVs could circumvent corporate security boundaries • Will users be aware of the capabilities of this technology within their own devices?
Slide 26: HEC Risk #2 – Endpoint Protection Circumvention
HEC Risk #2 – Endpoint Protection Circumvention • HDMI could be used to connect unauthorised network-enabled devices to the corporate network • Endpoint Protection systems (unless they are HEC-aware) will be unable to detect this • Unauthorised devices could introduce malware or exfiltrate sensitive
Slide 27: HEC Risk #3 – Unauthorised Network Extension
HEC Risk #3 – Unauthorised Network Extension • HDMI could be used to create an unauthorised extension to the corporate network • This “private network” would not be visible to corporate network monitoring tool / NIDS devices
Slide 28: Testing HDMI Ethernet Channel
Testing HDMI Ethernet Channel Have I tested any HEC-enabled devices? no… The only device I could find that supports HEC is the T+A Blu-ray receiver: It costs £6000!
Slide 29: Another corporate HDMI security risk
Another corporate HDMI security risk Remember hardware-based key loggers? Here’s an HDMI video logger - VideoGhost: • http://www.keydemon.com/tiny_frame_grabber/ • “2GB storage” • “7 year battery life” This is potentially much more powerful than a key logger!
Slide 30: Conclusions
Conclusions • As users demand more and more “seamless” functionality in a plug-and- play world there will be a greater need for bi-directional data to be flowing in A/V links between devices • HDMI Ethernet Channel could have a major impact on corporate security, but the technology is still very new
Slide 31: Questions?
Questions? Andy Davis, Research Director NCC Group andy.davis@nccgroup.com