Pushing Boundaries

We reviewed the code of a TA, executed within a TEE, which implemented a DRM solution.

We identified multiple vulnerabilities that can be exploited from the REE or other TAs, by attackers with and without physical access to the device.

We reviewed the security architecture of a modern SoC implementing the ARMv8 architecture.

We found multiple vulnerabilities and weaknesses in the SoC’s OTP controller, TZASC and TZPC. Also, we identified several potential fault injection vulnerabilities.

We used a (hardware) flash programmer to extract the software from the device and performed binary analysis.

We identified multiple exploitable vulnerabilities that can be exploited by attacker with and without physical access to the device.

We used our TEE expertise to support a manufacturer during the design and implementation of a TEE OS.

As our services were requested during the development phase, we were able to guide the manufacturer towards a stronger implementation before the product’s release.

We gave our TEEPwn training in a private setting to the personnel of a manufacturer and a security lab.

During these trainings the attendees worked their way through many hands-on exercises, immediately applying the concepts received during lectures.

We reviewed the code of a ROM bootloader implemented by a System-on-Chip (SoC).

We identified multiple vulnerabilities in the recovery mode implemented by the ROM code, which could be exploited by an attacker with physical access.