Episode
055 - Stacks Of Bricked Chips
- Published
- Mar 13, 2022
- Duration seconds
- 3717
- Processing state
processed- Canonical source
- https://unnamedre.com/episode/55
Actions
POST https://stenobird.com/v1/public/podcasts/unnamed-reverse-engineering-podcast-752753/episodes/055-stacks-of-bricked-chips/transcription-requests
Idempotently request low-priority transcript generation for this episode.GET https://stenobird.com/podcast/unnamed-reverse-engineering-podcast-752753/055-stacks-of-bricked-chips.md
Read the agent-friendly Markdown representation of this episode resource.
Summary
Laura Abbott from Oxide Computer details her discovery of a privilege escalation vulnerability in NXP's Arm TrustZone-M implementation. The discussion covers the technical process of reverse engineering ROM patches and the challenges of coordinated disclosure with hardware vendors.
Topics
- Reverse Engineering
- Arm TrustZone-M
- NXP Semiconductors
- Ghidra
- Rust Programming
- Linux Kernel
- Hardware Security
- Privilege Escalation
- Firmware Analysis
Highlights
- Main idea: Vulnerabilities in hardware ROM patches can break the fundamental security assumptions of Arm TrustZone-M
- Practical takeaway: Using Ghidra and SVD loaders can help reconstruct hardware register access during reverse engineering
- Failure mode: Relying on vendor-provided security settings without verifying the underlying hardware implementation can lead to broken trust chains
- Technical insight: Code golfing Arm assembly is a useful technique for developing minimal, impactful proofs of concept
- Lesson learned: Documentation, including obscure spreadsheets attached to PDFs, is often the most undervalued tool in a researcher's arsenal
Chapters
1:00The Future of Systems Programming: A discussion on the transition from C to Rust in kernel development and the promise of memory-safe languages for microcontrollers.6:00Establishing a Root of Trust: Exploring the difficulty of verifying exactly what software is running on a system and building a verifiable chain of trust.10:00Reverse Engineering with Ghidra: How the researcher utilized Ghidra and existing projects to begin analyzing hardware firmware.15:00Analyzing the ROM Patch: A deep dive into reviewing the ROM patch functionality and identifying potential bugs in the immutable code.24:00Demonstrating Privilege Escalation: The process of creating a proof of concept to show the ability to read secure registers from a non-secure state.29:00Code Golfing for Exploitation: Using minimal instruction sets to demonstrate the bypass of hardware security boundaries.38:00Tooling and Research Methodology: Discussing the use of SVD loaders, register allocation, and the importance of technical documentation.