MITRE eCTF: The Ohio State University Attacking University of Massachusetts Amherst

Bug

Protected firmware and configuration are stored in chunks (~1 KB), which are each individually authenticated and encrypted. While the chunks have an authenticated index that ensures correct orderering, we can swap chunks from two different protected files as long as they have the same index.

Firmware Rollback

The first chunk of the protected firmware contains the release message and version number. To boot fw_v1, we can replace the first chunk of fw_v1 with the first chunk of fw_v2. The bootloader verifies this and boots it, giving us the flag.

Flight Abort

To get a flight abort, we need the device to boot with a corrupted configuration. Both cfg1 and cfg2 are protected properly so their chunks will be accepted by the device, but their contents are different. Thus we can replace a chunk in cfg1 with a chunk from cfg2 of the same size and the resulting content which gets stored on the device will form a corrupted configuration. Running an aircraft simulation with the device in this state gives us the abort flag.