Threat video1:00
Hi3519 U-Boot Hard-Coded AES Kernel Key: Detection & IOCs
The Hi3519 bootloader embeds its kernel AES key, so kernels decrypt offline from vendor firmware. 9 detection rules, 11 IOCs and a free Splunk SPL rule.
Read the full threat intel for Hi3519 U-Boot Hard-Coded AES Kernel Key: Detection & IOCs →
Chapters
- 0:00The hookHard-coded bootloader key recovered in lab emulation.
- 0:04The storyResearchers published analysis of Hi3519 bootloader encryption.
- 0:13Attack pathBinwalk unpacked the firmware, entropy analysis showed encryption.
- 0:31AttributionNo threat actor: this was defensive research.
- 0:35Indicators of compromise3 indicators to hunt: 1 hash and 2 file names.
- 0:40MITRE ATT&CK techniques5 ATT&CK techniques, from reconnaissance to credential access.
- 0:44Remediation2 steps now: Treat the kernel encryption key in affected bootloaders as compromised.
- 0:51Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00Hard-coded bootloader key recovered in lab emulation.
0:05Researchers published analysis of Hi3519 bootloader encryption.
0:11They emulated the AES decryption.
0:14Binwalk unpacked the firmware, entropy analysis showed encryption.
0:18Ghidra mapped memory and identified AES in U-Boot.
0:22Rather than reimplement, they chose Unicorn Engine emulation.
0:26Emulation decrypted the kernel. Image magic verified success.
0:32No threat actor: this was defensive research.
0:363 indicators to hunt: 1 hash and 2 file names.
0:415 ATT&CK techniques, from reconnaissance to credential access.
0:452 steps now: Treat the kernel encryption key in affected bootloaders as compromised.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.