Главная
Study mode:
on
1
Intro
2
Bringing Security in System Design
3
What is Titan M?
4
Research Status and Goals
5
Specification
6
Memory Layout
7
Titan M Operating System
8
EC Tasks
9
Firmware Boot
10
Firmware Update
11
Firmware Rescue
12
Firmware Security Measures
13
Communication with Android
14
Static Analysis: Ghidra Loader
15
Dynamic Analysis: Sniffing Communication
16
Sniffing Communication: Command Parsing
17
Dynamic Analysis: Sending Commands
18
Dynamic Analysis: Sending Custom Commands
19
Hardware Reverse: Finding SPI
20
Hardware Reverse: Guessing Pinout
21
Hardware Reverse: Tracing SPI
22
Taking Control of SPI
23
First O-day: Out of Bounds Read
24
Second O-day: Downgrade Issue
25
Looking for a known Vulnerability
26
Post Exploitation
27
Fuzzing Titan M
28
Remarks
29
Conclusion
Description:
Explore the inner workings of Google's Titan M chip in this 35-minute Black Hat conference talk. Delve into the security features and architecture of this hardware security module introduced with the Pixel 3 in 2018. Learn about its role in reducing attack surfaces, mitigating hardware-level exploits, and providing critical security functions like StrongBox and Android Verified Boot. Discover the research status, specifications, memory layout, and operating system of Titan M. Examine firmware boot processes, updates, and security measures. Gain insights into static and dynamic analysis techniques, including Ghidra loader usage and communication sniffing. Uncover hardware reverse engineering methods, focusing on SPI communication. Investigate discovered vulnerabilities, including out-of-bounds read and downgrade issues. Explore post-exploitation possibilities and fuzzing techniques for Titan M. Conclude with remarks on the significance of this security chip in the Android ecosystem.

A Titan M Odyssey

Black Hat
Add to list
0:00 / 0:00