Presented at
Black Hat Europe 2021,
Nov. 11, 2021, 11:20 a.m.
(40 minutes).
In the past years, most of the Android devices were relying on ARM Trustzone for critical security features.
In 2018, with the release of the Pixel 3, Google introduced the Titan M chip, a hardware security module used to enhance the device security by reducing its attack surface, mitigating classes of hardware-level exploits such as Rowhammer or Spectre, and providing several security sensitive functions, such as a Keystore backend called StrongBox, Android Verified Boot (or AVB) and others. It has been now almost three years since this announcement and yet very little information about it is available online.
In this presentation, we will deep dive into the Titan M's internals and usages. Our goal is to give an understanding of its attack surface as well as its role in some critical security features such as the StrongBox/Keymaster. We will provide some details on how we performed our research from the reverse engineering of the firmware to the physical sniffing of the communication and fuzz testing. We discovered some known and previously unknown vulnerabilities which, among others, allowed us to execute code on the chip and helped us to solve some of the remaining mysteries behind this chip.
Presenters:
-
Maxime Rossi Bellom
- Security Researcher and Team Leader, Quarkslab
Maxime Rossi Bellom (@max_r_b) is a security researcher and team leader working at Quarkslab. He is interested in embedded and mobile software security, and recently started to look into hardware as well. In his previous life, he spent quite some time designing defenses for Android based systems.
-
Philippe Teuwen
- Security Researcher and Team Leader, Quarkslab
Philippe Teuwen (@doegox) is a Security Researcher and Team Leader at Quarkslab happily sailing across the frontier between hardware and software, having enabled new vector attacks and open source tools such as adaptation of side-channel techniques towards whitebox cryptography, EEPROM tear-off attacks defeating various RFID security features, etc. He's in the editorial team of the International Journal of PoC||GTFO and loves organizing Hardware CTFs.
-
Damiano Melotti
- Security Researcher, Quarkslab
Damiano Melotti (@DamianoMelotti) is a Security Researcher at Quarkslab and a master student at the University of Twente. His interests range from systems security (especially Android) and reversing and security engineering in general. He also enjoys playing CTFs and reached the Italian finals of the CyberChallenge competition with the University of Trento team, in 2020.
Links:
Similar Presentations: