Questions tagged [arm]
A family of processor architectures used in many embedded applications, network and other appliances, and almost all smartphones.
28
questions
0
votes
0
answers
86
views
reverse https windows meterpreter payload for ARM
I am working with this meterpreter payload:
windows/meterpreter/reverse_https
It works fine but it does not support ARM architecture.
Do you know how I can compile this payload into ARM code?
And do ...
- 49
1
vote
1
answer
673
views
TPM use without secure boot
I've been asked to improve the security of my company's iot device, and encrypt a storage partition. It's a general purpose arm based device, and currently can boot from a variety of sources (USB, ...
- 111
1
vote
0
answers
162
views
Access control for SMC call in TrustZone
What I found so far is that
Application requests TA service using qseecom kernel driver.
Monitor route that request and TA handles the request in Secure world and return the result.(generated private ...
- 111
2
votes
2
answers
137
views
Is it possible to determinate which functions a kernel module calls?
Trusting kernel drivers is bad. Is there something we can do to have at least an idea about what it does?
For example, let's suppose an armv8a linux kernel. I'd search for all the syscalls, which ...
- 121
0
votes
0
answers
119
views
Can I prevent thieves from unlocking Android's bootloader? [duplicate]
I know that anything can be exploited. But let's say I want to prevent thieves that do not have access to not openly available exploits, to reset my phone so he can sell.
If no openly available ...
- 121
1
vote
0
answers
132
views
PKI Usage in Trusted Boot
I am trying to understand how PKI is used to boot an ARM board.
The following image relates to BL1:
The booting steps state:
Also from:
The certificate used in step 1 appears to be a content ...
- 1,095
1
vote
1
answer
403
views
In an Arm TrustZone based Trusted Application (TA), how can a remote party tie an output to a particular TA?
I've been looking at the following figure which shows, with Arm TrustZone architecture, resources of a system can be divided into a Rich Execution Environment (REE) and a Trusted Execution Environment ...
- 177
10
votes
3
answers
3k
views
Ring -3 exploits and existence of other rings
Concept of Rings
Rings were introduced in the forerunner of UNIX, Multics, and had 8 rings for reading, writing, executing and calling (I don't quite understand why it needed 8 rings to do this, if ...
- 1,015
2
votes
1
answer
479
views
Is it necessary to understand Linux kernel internals to do binary exploitation? [closed]
I am second-year CS student, I know C, OOP concepts, x86 architecture, reverse engineering basics, TCP/IP stack and OS concepts, also I love Linux OS.
I have just one question:
Is it a mandatory to ...
- 59
0
votes
1
answer
943
views
Android x86 vs Android on Qemu ARM
Situation: Emulating Android devices for pen-testing
Problem: Choosing between emulating Android x86 or emulating Android on Qemu runing on ARM
Question: In terms of vulnerabilities/exploitability, ...
- 173
3
votes
1
answer
862
views
Extra features required for TrustZone to provide main security features
The paper Trustworthy Execution on Mobile Devices: What Security Properties Can My Mobile Platform Give Me? describes 5 desired security features for mobile devices:
Isolated Execution
Secure Storage
...
- 149
2
votes
1
answer
956
views
using secure boot in embedded systems
The whole idea about using Secure Boot in Embedded Systems to boot an operating system is new to me. I've never paid much attention to it previously. I just know that it prevents the loading at start-...
- 267
6
votes
2
answers
2k
views
How to Check Compilation Options For SO File - Android Application VA
During the security assessment of Android applications, I have encountered multiple instances where .so (Shared Objects) files are present in lib directory.
What can be possible security test cases ...
- 951
3
votes
1
answer
1k
views
BOF on ARM Linux - Ret2Libc attempt with system(3) fails due to nullified parameter
In the spirit of gaining a deep understanding, I have read up and worked
on some small hacks involving Buffer OverFlow (BOF) attacks, in particular, on an ARM-32 system, via the Ret2Libc style attack....
- 131
4
votes
1
answer
2k
views
Does Linux support the NX-bit on ARM processors?
Does Linux (kernel and applications) support the NX-bit on ARM processors? If so, how can I check if an ARM-binary is compiled with this protection enabled?
- 197
4
votes
2
answers
2k
views
Decrypting keys wrapped by the Storage Root Key (SRK) of a TPM
Lets say I have a symmetric key wrapped with a storage root key (SRK) in a TPM. The SRK cannot be read by an attacker and so I perform the decryption and using the SRK and get the symmetric key in ...
- 893
4
votes
2
answers
1k
views
Does Intel or Arm support private key memory?
I know some security processors have an isolated bus where you can store a private key and use it with hardware encryption without the key ever being stored in memory. Some even have key storage ...
- 143
7
votes
1
answer
3k
views
ROP Programming/Exploitation on ARM - Gadget chain
Unfortunately, I cannot find this gadget in my libc.so. How can we reprogram this using different instructions:
pop {r0, r1, r2, r3, pc}
Which instructions will achieve the same? What gadgets I have ...
- 947
4
votes
1
answer
605
views
Building a project on ARM Cortex-M, anything I can do to keep IP secure? Dealing with Chinese knockoffs and sick of it
Chinese have decided to ripoff a PIC product I make. Switching to ARM for other reasons anyhow, mainly that Microchip is a joke, either STM32 or NXP LPC, exact chip is open still.
There are sites ...
74
votes
2
answers
97k
views
Diffie Hellman parameters still calculating after 24 hours
I have a fresh install of Arch Linux on a RaspberryPi model B. I'm setting up OpenVPN and using easy-rsa with OpenSSL 1.0.2d to generate initial keys and certificates. All went fine until I ran ./...
- 863
5
votes
2
answers
2k
views
Loading code securely in the Trusted Execution Environment (ARM)
I am reading up on TEE in ARM. I am looking for pointers for the following questions:
How does the TEE load code from the OS securely and guarantee that its not malicious code?
I am guessing the ...
- 893
28
votes
4
answers
5k
views
A tiny version of wget (51 bytes?)
On this ISC article on DVR compromise the author talks about the compromise of an embedded system. In particular, the attacker executes a series of echo commands on the remote host, and:
This DVR ...
- 1,911
2
votes
1
answer
1k
views
ARM TrustZone with Normal and Secure World
I am new to Security testing and I am working on a 64-bit ARM server.
We are using ARM TrustZone technology.
Is it possible for me to check if I am in the Secure world or the Normal world?
How do I ...
- 121
20
votes
2
answers
11k
views
Does the ARM TrustZone technology support sealing a private key under a code hash?
One of the extremely valuable functions of a Trusted Platform Module (TPM) chip is its ability to seal a private key under the hash of the code that will use it. This means that one can create a ...
- 413
4
votes
1
answer
516
views
What are security implications of enabling access to performance counters on ARM Cortex A9?
On an ARM Cortex A9 core, privileged instructions have to be executed so that unprivileged code can use performance counters. For instance with this GCC inline code, which would have to be run in a ...
- 2,283
5
votes
1
answer
2k
views
ROP Exploitation on ARM
I was wondering about since, Ret2Libc attack doesn't works on ARM, and we have to rely on ROP for that. How different is ROP on ARM from the x86 architecture.
Are there any tools, such as mona.py ...
- 115
3
votes
3
answers
4k
views
Stack Overflow on ARM : Null Bytes Issue
I am trying to follow the research paper by Tiger Security for ARM Exploitation : Link
For the simple stack overflow exploitation, the code is :
#include <stdio.h>
#include <string.h>
#...
- 115
6
votes
1
answer
1k
views
Hardware enforced DEP on different CPUs
Are there any differences how hardware DEP is implemented on CPUs from different manufacturers (Intel, AMD, nVidia, Texas,...)?
Are there any significant differences how hardware DEP works on x86 ...
- 2,812