A family of processor architectures used in many embedded applications, network and other appliances, and almost all smartphones.

learn more… | top users | synonyms

27
votes
4answers
4k views

A tiny version of wget (51 bytes?)

On this ISC article on DVR compromise the author talks about the compromise of an embedded system. In particular, the attacker executes a series of echo commands on the remote host, and: This DVR ...
14
votes
1answer
7k views

Diffie Hellman parameters still calculating after 24 hours

I have a fresh install of Arch Linux on a RaspberryPi model B. I'm setting up OpenVPN and using easy-rsa with OpenSSL 1.0.2d to generate initial keys and certificates. All went fine until I ran ./...
8
votes
2answers
2k views

Does the ARM TrustZone technology support sealing a private key under a code hash?

One of the extremely valuable functions of a Trusted Platform Module (TPM) chip is its ability to seal a private key under the hash of the code that will use it. This means that one can create a ...
5
votes
1answer
556 views

Hardware enforced DEP on different CPUs

Are there any differences how hardware DEP is implemented on CPUs from different manufacturers (Intel, AMD, nVidia, Texas,...)? Are there any significant differences how hardware DEP works on x86 ...
5
votes
1answer
996 views

ROP Exploitation on ARM

I was wondering about since, Ret2Libc attack doesn't works on ARM, and we have to rely on ROP for that. How different is ROP on ARM from the x86 architecture. Are there any tools, such as mona.py ...
5
votes
0answers
340 views

ROP Programming/Exploitation on ARM - Gadget chain

Unfortunately, I cannot find this gadget in my libc.so. How can we reprogram this using different instructions: pop {r0, r1, r2, r3, pc} Which instructions will achieve the same? What gadgets I ...
4
votes
1answer
146 views

Building a project on ARM Cortex-M, anything I can do to keep IP secure? Dealing with Chinese knockoffs and sick of it

Chinese have decided to ripoff a PIC product I make. Switching to ARM for other reasons anyhow, mainly that Microchip is a joke, either STM32 or NXP LPC, exact chip is open still. There are sites ...
3
votes
2answers
159 views

Does Intel or Arm support private key memory?

I know some security processors have an isolated bus where you can store a private key and use it with hardware encryption without the key ever being stored in memory. Some even have key storage ...
3
votes
1answer
217 views

What are security implications of enabling access to performance counters on ARM Cortex A9?

On an ARM Cortex A9 core, privileged instructions have to be executed so that unprivileged code can use performance counters. For instance with this GCC inline code, which would have to be run in a ...
2
votes
3answers
2k views

Stack Overflow on ARM : Null Bytes Issue

I am trying to follow the research paper by Tiger Security for ARM Exploitation : Link For the simple stack overflow exploitation, the code is : #include <stdio.h> #include <string.h> #...
2
votes
1answer
435 views

Loading code securely in the Trusted Execution Environment (ARM)

I am reading up on TEE in ARM. I am looking for pointers for the following questions: How does the TEE load code from the OS securely and guarantee that its not malicious code? I am guessing the ...
2
votes
1answer
304 views

ARM TrustZone with Normal and Secure World

I am new to Security testing and I am working on a 64-bit ARM server. We are using ARM TrustZone technology. Is it possible for me to check if I am in the Secure world or the Normal world? How do I ...
0
votes
0answers
30 views

Decrypting keys wrapped by the Storage Root Key (SRK) of a TPM

Lets say I have a symmetric key wrapped with a storage root key (SRK) in a TPM. The SRK cannot be read by an attacker and so I perform the decryption and using the SRK and get the symmetric key in ...
0
votes
0answers
47 views

What is the market acceptance of ARM trustzone vs standalone TPM?

ARM are keen on marketing their Trustzone features, in a secure implementation (e.g. with OTP memory/fuses), to establish a TEE on an SOC. Generally, what is the market view on the security of this ...