Everybody be Cool, This is a Robbery!
summary
Evaluation targets a FIPS 140-2 L3 PCIe HSM and demonstrates pre-auth arbitrary code execution via PKCS#11 parsing and memory-corruption bugs found by an automated mutation fuzzer. A custom in-module debugger and modified PKCS#11 tools enable exploitable primitives, leading to a full takeover: attackers dumped flash plus decryption key and extract all objects despite sensitive/extractable flags. Persisted backdoor is installed by abusing the update flow with a firmware-signature bypass, survives legitimate firmware upgrades, and the vendor issues fixes after disclosure.
AI-written summary · about
chapters (9)
- 0:00Introduction to HSMs
- 1:37HSM architecture overview
- 7:32Initial assessment and demo
- 11:08Understanding PKCS#11
- 18:35Vulnerability research tools
- 25:26Exploitation and vulnerabilities
- 33:48Data extraction demonstration
- 36:54Persistence and backdoors
- 44:06Conclusion and Q&A
related talks
34mCore Escalation: Unleashing the Power of Cross-Core Attacks on Heterogeneous System
24mSecurity through Transparency: Tales from the RP2350 Hacking Challenge
51mExploiting Hardware Glitches And Side Channels In Perfect Software
52mSecuring The Unseen: Vulnerability Research In Confidential Computing
38mMission mPOSsible
27mProtecting Data In-Use from Firmware and Physical Attacks
44mExposing Critical Threats In Millions Of Connected Devices
38mFail Harder: Finding Critical 0-Days in Spite of Ourselves