Breaking Samsung's ARM TrustZone
summary
Exploits chain from normal Android to Samsung TrustZone: buffer overflows in a trusted app and a secure driver on a Galaxy S7 (Android 7) lead to EL3 code execution by mapping and patching the secure monitor via a permissive MAP SMC. Built an ARM TrustZone emulator (unicorn), a fuzzer, Manticore symbolic engine, and Python mcclient bindings to develop and test exploits, then a debugger to instrument the trusted OS, allowing master key extraction and unsigned TA loading—all demonstrated working end-to-end.
AI-written summary · about
chapters (31)
- 0:00Introduction
- 0:42Agenda
- 1:09Embedded Security
- 1:39Runtime Confirmation
- 2:49Execution Environments
- 5:40NS Bits
- 6:03Privileges Separation
- 6:30L1 L2 L3
- 8:35Different software implementations
- 9:49What is chosen actually useful
- 10:31Samsungs implementation
- 12:05Previous research
- 14:01Architecture
- 18:30Lifecycle
- 21:07Attack Surface
- 24:17Liberator
- 24:35Emulator
- 25:28EiffelUnicorn
- 26:13Symbolic Execution
- 28:25Vulnerability Overview
- 29:04Attack Plan
- 29:22Lack of Error
- 30:06Vulnerability
- 31:17Cisco
- 31:48Map
- 33:12Framework
- 34:30Finding the Master Key
- 36:42Retrieving the Master Key
- 37:21Bypassing Signature Checks
- 39:10Instrumentation of TrustZone
- 40:37Debugging TrustZone
related talks
39mReflections on Trusting TrustZone
19mDisARMed: Attacking ARM TrustZone from Userspace with Memory Aliasing
35mKSMA: Breaking Android Kernel Isolation and Rooting with ARM MMU Features
36mPhysical Attacks Against Smartphones
27mCLKSCREW: Exposing the Perils of Security-Oblivious Energy Management
42mD1T2 - Rooting Android 8 with a Kernel Space Mirroring Attack
49mThe ARMs race for kernel protection
22mUnearthing the TrustedCore: A Critical Review on Huawei’s Trusted Execution Environment