Questions tagged [arm]
A family of processor architectures used in many embedded applications, network and other appliances, and almost all smartphones.
26
questions
1
vote
0answers
43 views
Access control for SMC call in TrustZone
What I found so far is that
Application requests TA service using qseecom kernel driver.
Monitor route that request and TA handles the request in Secure world and return the result.(generated private ...
2
votes
2answers
93 views
Is it possible to determinate which functions a kernel module calls?
Trusting kernel drivers is bad. Is there something we can do to have at least an idea about what it does?
For example, let's suppose an armv8a linux kernel. I'd search for all the syscalls, which ...
0
votes
0answers
42 views
Can I prevent thieves from unlocking Android's bootloader? [duplicate]
I know that anything can be exploited. But let's say I want to prevent thieves that do not have access to not openly available exploits, to reset my phone so he can sell.
If no openly available ...
1
vote
0answers
57 views
PKI Usage in Trusted Boot
I am trying to understand how PKI is used to boot an ARM board.
The following image relates to BL1:
The booting steps state:
Also from:
The certificate used in step 1 appears to be a content ...
1
vote
1answer
175 views
In an Arm TrustZone based Trusted Application (TA), how can a remote party tie an output to a particular TA?
I've been looking at the following figure which shows, with Arm TrustZone architecture, resources of a system can be divided into a Rich Execution Environment (REE) and a Trusted Execution Environment ...
9
votes
3answers
2k views
Ring -3 exploits and existence of other rings
Concept of Rings
Rings were introduced in the forerunner of UNIX, Multics, and had 8 rings for reading, writing, executing and calling (I don't quite understand why it needed 8 rings to do this, if ...
2
votes
1answer
377 views
Is it necessary to understand Linux kernel internals to do binary exploitation? [closed]
I am second-year CS student, I know C, OOP concepts, x86 architecture, reverse engineering basics, TCP/IP stack and OS concepts, also I love Linux OS.
I have just one question:
Is it a mandatory to ...
0
votes
1answer
833 views
Android x86 vs Android on Qemu ARM
Situation: Emulating Android devices for pen-testing
Problem: Choosing between emulating Android x86 or emulating Android on Qemu runing on ARM
Question: In terms of vulnerabilities/exploitability, ...
3
votes
1answer
666 views
Extra features required for TrustZone to provide main security features
The paper Trustworthy Execution on Mobile Devices: What Security Properties Can My Mobile Platform Give Me? describes 5 desired security features for mobile devices:
Isolated Execution
Secure Storage
...
2
votes
1answer
823 views
using secure boot in embedded systems
The whole idea about using Secure Boot in Embedded Systems to boot an operating system is new to me. I've never paid much attention to it previously. I just know that it prevents the loading at start-...
6
votes
2answers
1k views
How to Check Compilation Options For SO File - Android Application VA
During the security assessment of Android applications, I have encountered multiple instances where .so (Shared Objects) files are present in lib directory.
What can be possible security test cases ...
3
votes
1answer
1k views
BOF on ARM Linux - Ret2Libc attempt with system(3) fails due to nullified parameter
In the spirit of gaining a deep understanding, I have read up and worked
on some small hacks involving Buffer OverFlow (BOF) attacks, in particular, on an ARM-32 system, via the Ret2Libc style attack....
4
votes
1answer
2k views
Does Linux support the NX-bit on ARM processors?
Does Linux (kernel and applications) support the NX-bit on ARM processors? If so, how can I check if an ARM-binary is compiled with this protection enabled?
4
votes
2answers
1k views
Decrypting keys wrapped by the Storage Root Key (SRK) of a TPM
Lets say I have a symmetric key wrapped with a storage root key (SRK) in a TPM. The SRK cannot be read by an attacker and so I perform the decryption and using the SRK and get the symmetric key in ...
4
votes
2answers
1k views
Does Intel or Arm support private key memory?
I know some security processors have an isolated bus where you can store a private key and use it with hardware encryption without the key ever being stored in memory. Some even have key storage ...
7
votes
1answer
3k views
ROP Programming/Exploitation on ARM - Gadget chain
Unfortunately, I cannot find this gadget in my libc.so. How can we reprogram this using different instructions:
pop {r0, r1, r2, r3, pc}
Which instructions will achieve the same? What gadgets I have ...
4
votes
1answer
561 views
Building a project on ARM Cortex-M, anything I can do to keep IP secure? Dealing with Chinese knockoffs and sick of it
Chinese have decided to ripoff a PIC product I make. Switching to ARM for other reasons anyhow, mainly that Microchip is a joke, either STM32 or NXP LPC, exact chip is open still.
There are sites ...
71
votes
2answers
88k views
Diffie Hellman parameters still calculating after 24 hours
I have a fresh install of Arch Linux on a RaspberryPi model B. I'm setting up OpenVPN and using easy-rsa with OpenSSL 1.0.2d to generate initial keys and certificates. All went fine until I ran ./...
5
votes
2answers
2k views
Loading code securely in the Trusted Execution Environment (ARM)
I am reading up on TEE in ARM. I am looking for pointers for the following questions:
How does the TEE load code from the OS securely and guarantee that its not malicious code?
I am guessing the ...
28
votes
4answers
5k views
A tiny version of wget (51 bytes?)
On this ISC article on DVR compromise the author talks about the compromise of an embedded system. In particular, the attacker executes a series of echo commands on the remote host, and:
This DVR ...
2
votes
1answer
1k views
ARM TrustZone with Normal and Secure World
I am new to Security testing and I am working on a 64-bit ARM server.
We are using ARM TrustZone technology.
Is it possible for me to check if I am in the Secure world or the Normal world?
How do I ...
16
votes
2answers
10k views
Does the ARM TrustZone technology support sealing a private key under a code hash?
One of the extremely valuable functions of a Trusted Platform Module (TPM) chip is its ability to seal a private key under the hash of the code that will use it. This means that one can create a ...
4
votes
1answer
474 views
What are security implications of enabling access to performance counters on ARM Cortex A9?
On an ARM Cortex A9 core, privileged instructions have to be executed so that unprivileged code can use performance counters. For instance with this GCC inline code, which would have to be run in a ...
5
votes
1answer
2k views
ROP Exploitation on ARM
I was wondering about since, Ret2Libc attack doesn't works on ARM, and we have to rely on ROP for that. How different is ROP on ARM from the x86 architecture.
Are there any tools, such as mona.py ...
3
votes
3answers
4k views
Stack Overflow on ARM : Null Bytes Issue
I am trying to follow the research paper by Tiger Security for ARM Exploitation : Link
For the simple stack overflow exploitation, the code is :
#include <stdio.h>
#include <string.h>
#...
6
votes
1answer
1k views
Hardware enforced DEP on different CPUs
Are there any differences how hardware DEP is implemented on CPUs from different manufacturers (Intel, AMD, nVidia, Texas,...)?
Are there any significant differences how hardware DEP works on x86 ...
