Attacking TrustZone on devices lacking memory protection

ARM TrustZone offers a Trusted Execution Environment (TEE) embedded into the processor cores. Some vendors offer ARM modules that do not fully comply with TrustZone specifications, which may lead to vulnerabilities in the system. In this paper, we present a DMA attack tutorial from the insecure world onto the secure world, and the design and implementation of this attack in a real insecure hardware.

Bypassing Isolated Execution on RISC-V using Side-Channel-Assisted Fault-Injection and Its Countermeasure

RISC-V is equipped with physical memory protection (PMP) to prevent malicious software from accessing protected memory regions. PMP provides a trusted execution environment (TEE) that isolates secure and insecure applications. In this study, we propose a side-channel-assisted fault-injection attack to bypass isolation based on PMP. The proposed attack scheme involves extracting successful glitch parameters for fault injection from side-channel information under crossdevice conditions. A proof-of-concept TEE compatible with PMP in RISC-V was implemented, and the feasibility and effectiveness of the proposed attack scheme was validated through experiments in TEEs. The results indicate that an attacker can bypass the isolation of the TEE and read data from the protected memory region In addition, we experimentally demonstrate that the proposed attack applies to a real-world TEE, Keystone. Furthermore, we propose a software-based countermeasure that prevents the proposed attack.

Address Space Layout Randomization Comparative Analysis on Windows 10 and Ubuntu 18.04 LTS

Memory management is one of the main tasks of an Operating System, where the data of each process running in the system is kept. In this context, there exist several types of attacks that exploit memory-related vulnerabilities, forcing Operating Systems to feature memory protection techniques that make difficult to exploit them. One of these techniques is ASLR, whose function is to introduce randomness into the virtual address space of a process. The goal of this work was to measure, analyze and compare the behavior of ASLR on the 64-bit versions of Windows 10 and Ubuntu 18.04 LTS. The results have shown that the implementation of ASLR has improved significantly on these two Operating Systems compared to previous versions. However, there are aspects, such as partial correlations or a frequency distribution that is not always uniform, so it can still be improved.

NON-LINEAR SUSCEPTIBILITY TO INTERFERENCES IN DECLARATIVE MEMORY FORMATION

After encoding, memories go through a labile state followed by a stabilization process known as consolidation. Once consolidated they can enter a new labile state after the presentation of a reminder of the original memory, followed by a period of re-stabilization (reconsolidation). During these periods of lability the memory traces can be modified. Currently, there are studies that show a rapid stabilization after 30 min, while others show that stabilization occurs after longer periods (e.g. 6 h). Here we investigate the effect of an interference treatment on declarative memory consolidation, comparing distinct time intervals after acquisition. On day 1, participants learned a list of non- syllable pairs (List 1). Immediately after, 30 min, 3 h or 8 h later, they received an interference list (List 2) that acted as an amnesic agent. On day 2 (48 h after training) participants had to recall List 1 first, followed by List 2. We found that the List 1 memory was susceptible to interference when the List 2 was administered immediately or 3 h after learning; however, shortly after acquisition (e.g. 30 min) the List 1 memory becomes transiently protected against interference. We propose the possibility that this rapid memory protection could be induced by a fast and transient neocortical integration (where the memory is transiently protected) becoming partially independent from the hippocampus followed by a hippocampal re-engagement where the memory becomes susceptible to interferences again. Our results open a discussion about the contribution of molecular and systemic aspects to memory consolidation.

(a draft of) Non-secure Client Awareness in TF-M

<div>This paper presents a novel mechanism implemented in the SW to identify and authorize secure service call from the NW. While the current solution needs changes of the non-secure software (typically an RTOS), our solution exploits available hardware (i.e., the memory protection unit or MPU) to handle clients identification and authorization in a transparent way to non-secure software.</div>

(a draft of) Non-secure Client Awareness in TF-M

<div>This paper presents a novel mechanism implemented in the SW to identify and authorize secure service call from the NW. While the current solution needs changes of the non-secure software (typically an RTOS), our solution exploits available hardware (i.e., the memory protection unit or MPU) to handle clients identification and authorization in a transparent way to non-secure software.</div>