Главная
Study mode:
on
1
Intro
2
What is TrustZone?
3
TrustZone Architecture
4
Real-World Uses
5
Prior Work
6
Motivation
7
Toolchain
8
Attack Surface
9
Attacker Assumptions
10
QSEE SCM Interface
11
SCM Call-by-Register Convention
12
SCM Command Structures
13
Structure Sanity Checking
14
Secure Memory Checking Pseudocode
15
Review: Integer Overflow
16
Integer Overflow Vulnerability
17
Pathological Command Buffer
18
What is Written to Response Header?
19
Sorcery!
20
Building Better Primitives
21
Choosing A New Write Primitive
22
SMC Handler Table
23
SMC Table Extension Attack
24
Arbitrary TZ Code Execution
25
Lessons Learned
Description:
Explore the intricacies of TrustZone security in ARM devices through this Black Hat conference talk. Delve into a technical analysis of a major vendor's TrustZone kernel implementation, examining its vulnerabilities and exploitation techniques. Learn about the architecture, real-world applications, and prior work in TrustZone exploitation. Discover a previously undisclosed vulnerability, its exploitation process, and witness a live demonstration of unlocking an Android phone's bootloader. Gain insights into the implications of such vulnerabilities for mobile device security, covering topics like secure boot, DRM key storage, mobile payments, and kernel integrity validation.

Reflections on Trusting TrustZone

Black Hat
Add to list
0:00 / 0:00