How to set up and run OPTEE on QEMU

This is a tutorial on how to run Linaro's OPTEE Trusted Execution Environment on QEMU. I decided to write this post to help someone who might have trouble getting and building the correct versions. I had some trouble initially as well but with the help of Joakim Bech I was successful in building the right version and run my first secure application .Here are some pre-requisites.

1. Linux based machine.
2. Good internet plan
3. Some patience

Some Required Packages:

$ sudo apt-get install android-tools-fastboot autoconf bison cscope curl \ flex gdisk libc6:i386 libfdt-dev libglib2.0-dev \ libpixman-1-dev libstdc++6:i386 libz1:i386 netcat \ python-crypto python-serial uuid-dev xz-utils zlib1g-dev

$ sudo apt-get install ccache

We need to install the repo tool which is used by Android as well to make a central repo of the dependencies.

$ mkdir ~/bin
$ PATH=~/bin:$PATH
$ curl https://storage.googleapis.com/git-repo-downloads/repo > ~/bin/repo
$ chmod a+x ~/bin/repo

Initialize and sync the repo

$ mkdir -p $HOME/devel/optee
$ cd $HOME/devel/optee
$ repo init -u https://github.com/OP-TEE/manifest.git -m default_stable.xml -b master
$ repo sync

This will take some time to finish depending on your internet speed, so sit back with a cup of coffee. Once this finishes we need to build the toolchains, I had some issues here so I will write my solution as well.

$ cd $HOME/devel/optee/build
$ make toolchains

If this step fails. For some reason it was unable to download the complete files for me so I will post the links where you can manually download the toolchains and paste them in the $HOME/devel/optee/toolchains folder, and I will also post my updated make file. Replace the existing toolchain.mk from the build folder.
Links:

• http://releases.linaro.org/14.08/components/toolchain/binaries/gcc-linaro-arm-linux-gnueabihf-4.9-2014.08_linux.tar.xz
• http://releases.linaro.org/14.08/components/toolchain/binaries/gcc-linaro-aarch64-linux-gnu-4.9-2014.08_linux.tar.xz
• http://releases.linaro.org/14.07/components/toolchain/binaries/gcc-linaro-aarch64-none-elf-4.9-2014.07_linux.tar.xz

Updated make file:

https://gist.github.com/hybridNeo/1cc0d49d510e4d8e9320

Now, time to build!

$ cd $HOME/devel/optee/build
$ make all run

Congratulations, you have successfully built OPTEE, now you can start building applications for it, I will cover that in the next tutorial.

Chapter 2 : Looking for Vulnerabilities

A new feature was added to the app which records the user's score and saves the file. Now the quiz display's the user's best score for a particular quiz in the quiz selection menu.

I also had to root my phone to test for some vulnerabilities with the current application.Speaking of the obvious vulnerabilities. There are two basic requirements for this app from the security point of view.

1. App Integrity: When the app is accessed offline the an other app/user should not be able to change or view the data of the app e.g. The user should not be able to view the questions and answers for the quiz.
2. Device Integrity: User's progress should not be transferable from one device to another. What would happen is one person complete his quiz and shares his files with the other students.

From the perspective of a non-rooted device both the above requirements are met thanks to Android's Access Control Mechanism which treats each app as a separate user , thus an applications data is actually private. But a rooted user or a malicious application do not follow the same rules.

As we know all the application private data is stored in the data/data directory under root, We could use a simple root file explorer(ES File Explorer) available in the Android market to make the changes we require.

Shown below , a rooted user accessing the questions and answers.

The user can also change his scores.

Chapter 1 : The Beginning

This week marks the dawn of the 8th semester, the final semester in my course. We are required to do a project worth 18 credits spanning the entire duration of the semester. I've always wanted to do a project which involves digging down into the hardware level and getting my hands dirty with assembly/low level code, maybe excessive web programming in the past made me lust for a system's project. Back in my 3rd semester the course that changed my outlook towards Computer Science was the Computer Architecture course handled by Dr. Viraj Kumar. We learnt a lot in that course and by far it was my favorite course in the whole of Engineering. So I contacted Professor Viraj along with a couple of my friends(Sreya & Abhinav) and asked him for a project in the system's field. He got back to us in no time and introduced us to a contact of his who works at Microsoft Research, Dr Sriram Rajamani. In a week's time we met to discuss a potential project.

The theme of the project is Secure Computing in Android/ARM devices. Information Security in the traditional sense involves an array of crypto algorithms and secure communication over client/server protocol . In the current landscape if we want to make an app secure so that it cannot be tampered by the user or  malicious software one such solution is to have all the sensitive information stored on the server, this method has its advantages but the main gripe is the application needs to be connected to the internet all the time. This has become a mainstay in the PC gaming industry to curb piracy, recently even Android applications have taken this route to achieve a secure environment. The other problem with this approach is the requirement for an application server which has to cater to all the user's queries. Dr Sriram who has pioneered in the field of Secure Computation interfaces for products such as the Azure suggested that we look into a concept known as enclave. An enclave is a part of application software/code which is isolated from the privileged software (i.e Operating System). As it turns out ARM processors the most popular choice for Android phones has a new feature known as TrustZone which is actually present in 96% of all Android Phones, TrustZone allows for a Trusted Execution Environment(TEE). From our understanding TrustZone is barely used in Android, and most of the solutions are proprietary. So we embarked to build an application which uses TrustZone for secure computing and allow for an offline solution to the classic problem.

Our choice of application was a quiz application. Traditionally questions are retrieved from the server every time and the user's answer is sent to the server and is checked with the answer key and a response is retrieved and the user's score is also maintained in the server. Our application downloads the questions and answers from the server in an encrypted format and the key is stored in the enclave. The quizzes are downloaded only when Internet Connection is available and the result is also stored in the enclave so that the user will not be able to access the answers or modify his score. The user's score will be uploaded to the server when the network is available.

We built a simple quiz application which at the moment is not secure, but works in an offline environment. In this approach we need a remote json file to hold the index for the list of quizzes, the json file will further have links to other remote files containing the quizzes.

We hope to continue our progress and to find a way to enable TrustZone on the Android emulator or QEMU by next week.

TYPO3 Neos:Multi Channel Publishing (Facebook)

In this Blog post I will try to explain and demonstrate the whole process of publishing content of your Neos website on other channels.This will cover basic usage as well as extending it.

Installation:

• This Package is available on Packagist and Github Download manually or do composer install.
• Include the Root.ts2 file of the Package in the Root.ts2 file of the Site.

Facebook:

Suppose you/your client has a facebook page and is tired posting the same content on his facebook page,what this basically does is it takes the data from your neos website and posts it on your clients facebook page and provides a link to the website.

Facebook is secure and works on the concept of access tokens,since I'm using a signal slot setup an Oauth popup would not be feasible and posting to a page would be impossible,therefore it is needed to specify the access token in the configuration file.this is a one time thing and may take 5 minutes.

• Get a facebook Developer account first here
• Create an app make sure the account is the page admin access.

                             

• Head over to the Facebook Graph API Explorer
• Choose your app in the dropdown

• Click Get Access token and make sure you check the manage pages and publish access permissions.

                         

• The access token which you get is valid only for 60 minutes hence it is required to extend it by visiting this link Convert this access token into a long lived one by https://graph.facebook.com/oauth/access_token?client_id=<your FB App ID>&client_secret= < your FB App secret> &grant_type=fb_exchange_token&fb_exchange_token=< your short-lived access token>
• Your enter your appid and client secret from your app settings page and enter the access token which you got earlier in the link to get a long lived access token.
•  Make a Graph API call to see your accounts using the new long-lived access token: https://graph.facebook.com/me/accounts?access_token=< your long-lived access token>

• This displays all pages managed by you.Note down your pageid and access token for the page .Now you have an access token which is valid forever.
• For any errors during the process you can debug your access token Debug token.
• Go to your Configuration.yaml file in the Package and enter the above details.

• appid and secret are available in you developer account page,user will be the id of your page which you got earlier
• link will be the link to your server/website
• caption/name/desc/image are any defaults you want to assign to your facebook post.Leave them blank preferably
• token will contain your access token.

Congratulations you have successfully set up SocialConnect for facebook.

Let's try it out.

Currently Headline,Text and Document/Page Nodes are supported.

• Enable Social Connect for a Headline Node and publish.

• Try it out for other Nodes too!

Extending Social Connect:

• Sometimes the client has custom NodeTypes which require SocialConnect
• SocialConnect is built in such a way that it's easy to extend and add/customize NodeTypes
• Basically the package consists of Helpers,Factories and Overrides.Helpers do all the communicating with the API,Factories make sure the right nodes are fetched and the Overrides define the content of the post.
• In most cases it is taken care of,if the NodeType is a subclass of an existing one,for example RobertLemke's Blog Plugin work's fine because it inherits the Document type.
• If you want a new NodeType to behave just like an existing one.you can change the FacebookFactory file to do so.

•  To customize a way how an Override works,extend the base class FacebookOverride.php make sure all methods are overriden .Make the changes in the Factory file as above.

Social Connect also supports Twitter and Blogger.Please let me know if something is to be done to improve the Project and Request for new NodeType/Social Network Support.

Week 12

This week was less productive compared to the previous weeks because of my semester resuming ,but nevertheless I fixed a major issue which had in the closet since the first few weeks.the textFinder function which is employed in the override for facebook used to find child nodes based the on the given grammar,but if a page contained a page it would traverse that node too,since I was implementing this in FlowQuery there was no way known to me to ignore those pageNodes and successfully find all other child nodes,so I coupled the TYPO3 Content Repository along with FlowQuery ,I get an array of all child nodes satisfying the grammar(node type) and then use TYPO3CR to check if their parent page node is the page concerned.This was I was able to find the best matching nodes for that page.

Next week I wish to implement a multi-threading approach for all the api-calls to improve performance.

Week 11 - Blogception

This title is a homage to 2010's Hollywood blockbuster of
the name Inception,which dwells into the concept of dreams inside
dreams.Usually every weekend i log into blogger and post my updates about that week's work,this week I used the Blogger Posting feature of Social Connect which i just added to post directly from my Neos Website.
This week's progress:

• Made enhancements to some more code.

• Added blogger posting to social connect.

• Providing a username/password combination in the Configuration file along with the name of the blog to post to blogger.

Issues faced:

• The Blogger posting is still very basic and unstable.

Next Week Goals:

•  Improve Blogger Posting support complex structures/nodes if possible

• clean up some more old code.

Catch the progress on Github and comment here for any suggestions/changes.

Week 10 - Fine Tuning Part 2

Ten week's have passed since the coding period began for gsoc 2014,and I spent the last week fine tuning the code which I had written.

Fixes/Improvements:

• Validation for nodes in fluid,It wont crash if the target nodes do not exist.
• Logger now saves the log in the Data/Logs folder of the installation.
• Work in progress to try and integrate blogger api.

Issues:

• Blogger Api which i'm using is not namespaced,hence using that is quite tricky.