Last call to make your voice heard! Our 2022 Developer Survey closes in less than a week. Take survey.

Questions tagged [arm]

A family of processor architectures used in many embedded applications, network and other appliances, and almost all smartphones.

Filter by
Sorted by
Tagged with
0 votes
1 answer
76 views

TPM use without secure boot

I've been asked to improve the security of my company's iot device, and encrypt a storage partition. It's a general purpose arm based device, and currently can boot from a variety of sources (USB, ...
user avatar
  • 101
1 vote
0 answers
88 views

Access control for SMC call in TrustZone

What I found so far is that Application requests TA service using qseecom kernel driver. Monitor route that request and TA handles the request in Secure world and return the result.(generated private ...
user avatar
2 votes
2 answers
120 views

Is it possible to determinate which functions a kernel module calls?

Trusting kernel drivers is bad. Is there something we can do to have at least an idea about what it does? For example, let's suppose an armv8a linux kernel. I'd search for all the syscalls, which ...
user avatar
  • 121
0 votes
0 answers
73 views

Can I prevent thieves from unlocking Android's bootloader? [duplicate]

I know that anything can be exploited. But let's say I want to prevent thieves that do not have access to not openly available exploits, to reset my phone so he can sell. If no openly available ...
user avatar
  • 121
1 vote
0 answers
93 views

PKI Usage in Trusted Boot

I am trying to understand how PKI is used to boot an ARM board. The following image relates to BL1: The booting steps state: Also from: The certificate used in step 1 appears to be a content ...
user avatar
  • 1,095
1 vote
1 answer
254 views

In an Arm TrustZone based Trusted Application (TA), how can a remote party tie an output to a particular TA?

I've been looking at the following figure which shows, with Arm TrustZone architecture, resources of a system can be divided into a Rich Execution Environment (REE) and a Trusted Execution Environment ...
user avatar
9 votes
3 answers
2k views

Ring -3 exploits and existence of other rings

Concept of Rings Rings were introduced in the forerunner of UNIX, Multics, and had 8 rings for reading, writing, executing and calling (I don't quite understand why it needed 8 rings to do this, if ...
user avatar
  • 959
2 votes
1 answer
434 views

Is it necessary to understand Linux kernel internals to do binary exploitation? [closed]

I am second-year CS student, I know C, OOP concepts, x86 architecture, reverse engineering basics, TCP/IP stack and OS concepts, also I love Linux OS. I have just one question: Is it a mandatory to ...
user avatar
  • 59
0 votes
1 answer
898 views

Android x86 vs Android on Qemu ARM

Situation: Emulating Android devices for pen-testing Problem: Choosing between emulating Android x86 or emulating Android on Qemu runing on ARM Question: In terms of vulnerabilities/exploitability, ...
user avatar
3 votes
1 answer
754 views

Extra features required for TrustZone to provide main security features

The paper Trustworthy Execution on Mobile Devices: What Security Properties Can My Mobile Platform Give Me? describes 5 desired security features for mobile devices: Isolated Execution Secure Storage ...
user avatar
2 votes
1 answer
877 views

using secure boot in embedded systems

The whole idea about using Secure Boot in Embedded Systems to boot an operating system is new to me. I've never paid much attention to it previously. I just know that it prevents the loading at start-...
user avatar
6 votes
2 answers
2k views

How to Check Compilation Options For SO File - Android Application VA

During the security assessment of Android applications, I have encountered multiple instances where .so (Shared Objects) files are present in lib directory. What can be possible security test cases ...
user avatar
3 votes
1 answer
1k views

BOF on ARM Linux - Ret2Libc attempt with system(3) fails due to nullified parameter

In the spirit of gaining a deep understanding, I have read up and worked on some small hacks involving Buffer OverFlow (BOF) attacks, in particular, on an ARM-32 system, via the Ret2Libc style attack....
user avatar
  • 131
4 votes
1 answer
2k views

Does Linux support the NX-bit on ARM processors?

Does Linux (kernel and applications) support the NX-bit on ARM processors? If so, how can I check if an ARM-binary is compiled with this protection enabled?
user avatar
  • 197
4 votes
2 answers
1k views

Decrypting keys wrapped by the Storage Root Key (SRK) of a TPM

Lets say I have a symmetric key wrapped with a storage root key (SRK) in a TPM. The SRK cannot be read by an attacker and so I perform the decryption and using the SRK and get the symmetric key in ...
user avatar
4 votes
2 answers
1k views

Does Intel or Arm support private key memory?

I know some security processors have an isolated bus where you can store a private key and use it with hardware encryption without the key ever being stored in memory. Some even have key storage ...
user avatar
7 votes
1 answer
3k views

ROP Programming/Exploitation on ARM - Gadget chain

Unfortunately, I cannot find this gadget in my libc.so. How can we reprogram this using different instructions: pop {r0, r1, r2, r3, pc} Which instructions will achieve the same? What gadgets I have ...
user avatar
  • 937
4 votes
1 answer
593 views

Building a project on ARM Cortex-M, anything I can do to keep IP secure? Dealing with Chinese knockoffs and sick of it

Chinese have decided to ripoff a PIC product I make. Switching to ARM for other reasons anyhow, mainly that Microchip is a joke, either STM32 or NXP LPC, exact chip is open still. There are sites ...
user avatar
72 votes
2 answers
91k views

Diffie Hellman parameters still calculating after 24 hours

I have a fresh install of Arch Linux on a RaspberryPi model B. I'm setting up OpenVPN and using easy-rsa with OpenSSL 1.0.2d to generate initial keys and certificates. All went fine until I ran ./...
user avatar
  • 843
5 votes
2 answers
2k views

Loading code securely in the Trusted Execution Environment (ARM)

I am reading up on TEE in ARM. I am looking for pointers for the following questions: How does the TEE load code from the OS securely and guarantee that its not malicious code? I am guessing the ...
user avatar
28 votes
4 answers
5k views

A tiny version of wget (51 bytes?)

On this ISC article on DVR compromise the author talks about the compromise of an embedded system. In particular, the attacker executes a series of echo commands on the remote host, and: This DVR ...
user avatar
  • 1,921
2 votes
1 answer
1k views

ARM TrustZone with Normal and Secure World

I am new to Security testing and I am working on a 64-bit ARM server. We are using ARM TrustZone technology. Is it possible for me to check if I am in the Secure world or the Normal world? How do I ...
user avatar
  • 121
19 votes
2 answers
11k views

Does the ARM TrustZone technology support sealing a private key under a code hash?

One of the extremely valuable functions of a Trusted Platform Module (TPM) chip is its ability to seal a private key under the hash of the code that will use it. This means that one can create a ...
user avatar
  • 383
4 votes
1 answer
503 views

What are security implications of enabling access to performance counters on ARM Cortex A9?

On an ARM Cortex A9 core, privileged instructions have to be executed so that unprivileged code can use performance counters. For instance with this GCC inline code, which would have to be run in a ...
user avatar
  • 2,283
5 votes
1 answer
2k views

ROP Exploitation on ARM

I was wondering about since, Ret2Libc attack doesn't works on ARM, and we have to rely on ROP for that. How different is ROP on ARM from the x86 architecture. Are there any tools, such as mona.py ...
user avatar
3 votes
3 answers
4k views

Stack Overflow on ARM : Null Bytes Issue

I am trying to follow the research paper by Tiger Security for ARM Exploitation : Link For the simple stack overflow exploitation, the code is : #include <stdio.h> #include <string.h> #...
user avatar
6 votes
1 answer
1k views

Hardware enforced DEP on different CPUs

Are there any differences how hardware DEP is implemented on CPUs from different manufacturers (Intel, AMD, nVidia, Texas,...)? Are there any significant differences how hardware DEP works on x86 ...
user avatar
  • 2,802