Organizer
Partner Company
Using Fault Injection for Turning Data Transfers into Arbitrary Execution
Cristofaro Mune, Niek Timmers
Abstract
Unprivileged data is often transferred across multiple security boundaries.
In secure systems, such data is carefully checked, handled and sanitized, often leaving little chance for exploitable software vulnerabilities.
We have already demonstrated that fault injection could achieve the following on ARMv7 systems (PC directly addressable):
- [2016]: precise control of Program Counter from data transfers
- [2017]: Linux kernel code execution from userspace.
- [2019]: Encrypted Secure Boot bypass without knowledge of the actual encryption key.
Nonetheless, the full potential of the underlying concepts has not been publicly discussed until now.
In our talk, we go through techniques for turning a transfer of attacker-controlled data into a fully fledged execution primitive.
Additionally, we share for the first time techniques that allow for PC control on architectures where PC is not directly addressable.
Such techniques could be applied to ARMv8 devices, including mobile phones, potentially achieving 1), 2) and 3), without relying on any software vulnerability.
Speaker Info
Cristofaro Mune has 15+ years of experience in SW & HW security assessment of highly secure products. He has given talks at renown security conferences, like BlackHat, BlueHat, HITB, WarCon, hardwear.io, on Fault Injection (EoP and Encrypted Secure Boot bypass), TEEs, White-Box cryptography, IoT exploitation and mobile security.
Niek Timmers(MSc) is an independent Device Security Expert at TwentyTwo Security. Niek has been analyzing and testing the security devices for over 10 years. Usually Niek’s interest is sparked by technologies where the hardware is fundamentally present. Niek shared his research on topics like secure and fault injection at various conferences like Black Hat, Bluehat and hardwear.io.