Asia-24-Pinto-What-The-TrustZone-M-Doesnt-See.pdf

1、#BHASIA BlackHatEventsWhat the TrustZone-M Doesnt See,theMCU Does Grieve OverLessons Learned from Assessing a Microcontroller TEECristiano Rodrigues|Sandro Pinto,PhD(Centro ALGORITMI/LASI,Universidade do Minho)#BHASIA BlackHatEventsWhat the TrustZone-M Doesnt See,theMCU Does Grieve OverLessons Learn

2、ed from Assessing a Microcontroller TEECristiano Rodrigues|Sandro Pinto,PhD(Centro ALGORITMI/LASI,Universidade do Minho)AGENDAIntroductionBackground and Motivation0102A Bumpy but Revealing JourneyWeak Protections,TEE Assessment and our Responsible Disclosure Journey 03What Can Go WrongAttack Example

3、s and“Live”Demo04Lessons LearnedAdvices for HW&SW providers and System Designers05SummaryFinal Thoughts and BH Sound BytesIntroductionBackground and MotivationINTERNET OF THINGSHOMEAPPLIANCESWEARABLESDRONESHARDWAREWALLETSMEDICALDEVICESSMARTCITIESSMARTFACTORIESAUTONOMOUSVEHICLESAI-ENABLEDEDGE DEVICES

4、 SMARTAGRICULTURE INTERNET OF THINGSHOMEAPPLIANCESWEARABLESDRONESHARDWAREWALLETSMEDICALDEVICESSMARTCITIESSMARTFACTORIESAUTONOMOUSVEHICLESAI-ENABLEDEDGE DEVICES SMARTAGRICULTURE INTERNET OF THINGSHOMEAPPLIANCESWEARABLESDRONESHARDWAREWALLETSMEDICALDEVICESSMARTCITIESSMARTFACTORIESAUTONOMOUSVEHICLESAI-E

5、NABLEDEDGE DEVICES SMARTAGRICULTURE THE AGE OF CYBERWARFAREINTERNET OF THINGSHOMEAPPLIANCESWEARABLESDRONESHARDWAREWALLETSMEDICALDEVICESSMARTCITIESSMARTFACTORIESAUTONOMOUSVEHICLESAI-ENABLEDEDGE DEVICES SMARTAGRICULTURE MCUINTERNET OF THINGSMCUTRUSTZONEINTERNET OF THINGSArmv8-M TrustZoneArmv6/7-M Proc

6、essor ModesESRGv3BLACKHAT24Armv8-M TrustZoneTHREADArmv6/7-M Processor ModesESRGv3BLACKHAT24Armv8-M TrustZoneTHREADHANDLERArmv6/7-M Processor ModesESRGv3BLACKHAT24Armv8-M TrustZoneTHREADHANDLERArmv6/7-M Processor ModesArmv6/7-M Privileges LevelsESRGv3BLACKHAT24Armv8-M TrustZoneTHREADHANDLERArmv6/7-M