This is a sel -a chi ed e sion o an o iginal a icle. This e sion
may di e om he o iginal in pagina ion and ypog aphic de ails.
Au ho (s):
Ti le:
Yea :
Ve sion:
Copy igh :
Righ s:
Righ s u l:
Please ci e he o iginal e sion:
CC BY 4.0
h ps://c ea i ecommons.o g/licenses/by/4.0/
A acking T us Zone on de ices lacking memo y p o ec ion
© The Au ho (s) 2021
Published e sion
S ajn od, Ron; Ben Yehuda, Raz; Zaidenbe g, Neze Jacob
S ajn od, R., Ben Yehuda, R., & Zaidenbe g, N. J. (2022). A acking T us Zone on de ices lacking
memo y p o ec ion. Jou nal o Compu e Vi ology and Hacking Techniques, 18(3), 259-269.
h ps://doi.o g/10.1007/s11416-021-00413-y
2022
Jou nal o Compu e Vi ology and Hacking Techniques
h ps://doi.o g/10.1007/s11416-021-00413-y
ORIGINAL PAPER
A acking T us Zone on de ices lacking memo y p o ec ion
Ron S ajn od1·Raz Ben Yehuda2·Neze Jacob Zaidenbe g2,3
Recei ed: 11 Augus 2021 / Accep ed: 26 No embe 2021
© The Au ho (s) 2021
Abs ac
ARM T us Zone o e s a T us ed Execu ion En i onmen (TEE) embedded in o he p ocesso co es. Some endo s o e
ARM modules ha do no ully comply wi h T us Zone speci ica ions, which may lead o ulne abili ies in he sys em. In his
pape , we p esen a DMA a ack u o ial om he insecu e wo ld on o he secu e wo ld, and he design and implemen a ion
o his a ack in a eal insecu e ha dwa e.
Keywo ds T us Zone ·Secu i y
1 In oduc ion
The de elopmen o he In e ne o Things (IoT) is hailed
as he hi d wa e o wo ld in o ma ion de elopmen a e
compu e s and he In e ne [56], wi h embedded sys ems
as he d i ing o ce o echnological de elopmen in many
domains in he eme ging pos -PC e a. As an inc easing num-
be o compu a ional de ices in eg a e in o ou li es in a
pe asi e and in isible way, secu i y becomes c i ical o
he dependabili y o all in elligen sys ems buil upon hese
embedded sys ems [40].
Embedded IoT p oduc s a e inc easingly no connec ed
o he powe g id. The e o e, such de ices a e cons ained
in e ms o compu ing powe due o limi ed elec ic powe
[29]. The cons ained na u e o such de ices means we a e
ying o “build a o ess om pebbles.” The e o e, we mus
ake he bes secu i y measu es o p e en malicious ac i i y
on hose de ices gi en he limi ed condi ions, which o en
means cu ing co ne s compa ed wi h o he esou ce- ich
a eas o compu ing (pe sonal compu e s, se e s, e c.).
BNeze Jacob Zaidenbe g
[email p o ec ed]
Ron S ajn od
[email p o ec ed]
Raz Ben Yehuda
[email p o ec ed]
1In e disciplina y Cen e , He zliya, Is ael
2Uni e si y o Jy äskylä, Jy äskylä, Finland
3College o Managemen Academic S udies, Is ael Uni e si y
o Jy äaskylä, Rishon LeZion, Is ael
ARM T us Zone [5] was in oduced as pa o he ARM 6
a chi ec u eandiswidelyusedinsma phones, able s, wea -
ables, and o he de ices. As T us Zone gains popula i y in
ha dwa e secu i y a chi ec u e o mobile de ices and IoT, i
is i al o ensu e he secu i y o T us Zone i sel [57].
Though ARM T us Zone is a g ea way o implemen
secu i y mechanisms ac oss IoT-embedded de ices, i is s ill
p one o inadequa e ha dwa e and so wa e implemen a-
ions.Thus, heha dwa eo di e en companieslikeGoogle,
Samsung, Huawei, e c., migh s ill be a ec ed by se e e
ulne abili ies ha comp omise he en i e secu i y sui e
[11,21,33,43].
One o he key ea u es o he AMBA (Ad anced Mic o-
con olle Bus A chi ec u e) AXI (Ad anced Ex ensible
In e ace) [3] is add ess space sepa a ion. Thus, lacking
hem c ea es insecu e memo y sepa a ion be ween he no -
mal wo ld and he secu e wo ld. In his pape , we p esen
a Di ec Memo y Access (DMA) a ack [26] on OP-TEE
(Open Po able T us ed Execu ion En i onmen ) [18,39].
OP-TEE is one o he common ope a ing sys ems ha un
on T us Zone. OP-TEE is a popula , open-sou ce, T us Zone
ope a ing sys em. We used OP-TEE as a e e ence T us Zone
OS o demons a e he a ack p esen ed in his pape , hough
he a ack is no due o an OP-TEE bug bu a he a missing
ha dwa e ea u e.
Ou a ack allows an a acke o execu e a bi a y code in
he secu e wo ld o ead a bi a y da a om he secu e wo ld
in o he ich OS. Ou a ack is a con ol- low a ack [14,55]
on he OP-TEE ke nel.
Also in he pape , we show a ha dwa e ulne abili y on
SoC [10] ha comp omises ARM T us Zone. Using he
123
R. S ajn od e al.
Fig. 1 No mal and secu ed wo lds ©A m
DMA a ack, we gain he abili y o eplace us ed appli-
ca ions wi h malicious ones. Fu he mo e, we demons a e
an a ack on a Raspbe y Pi compu e and explain how his
me hod a ec s o he pla o ms. This pape also p o ides
measu es o mi iga e his ulne abili y. The a ack was no
possible when AMBA AXI was p esen . Un o una ely, he
AMBAAXIisno p esen ona ewmode nha dwa ede ices,
including Raspbe y Pi 3,4 and Je son Nano.
2 Backg ound
2.1 ARM T us Zone
ARM T us Zone echnology aims o es ablish us in ARM-
based pla o ms. In con as o a TPM (T us ed Pla o m
Module), which is designed as a ixed- unc ion de ice wi h
a p ede ined ea u e se , T us Zone ep esen s a much mo e
lexible app oach by le e aging he CPU as a eely p o-
g ammable us ed pla o m module. To do ha , ARM
in oduced a special CPU mode called ‘secu e mode’ in addi-
ion o he egula no mal mode, he eby es ablishing he
no ions o a ‘secu e wo ld’ and a ‘no mal wo ld’ (Fig. 1).
The dis inc ion be ween hese wo lds is en i ely o hogonal
o he s anda d ing p o ec ion be ween use -le el and ke nel-
le el code, and hidden om he ope a ing sys em unning in
he no mal wo ld [1].
As an example, he Linux ke nel uns in EL1 and he
use space p ocesses execu e in EL0. The sepa a ion o he
secu e and no mal wo lds p o ec s speci ic RAM anges and
pe iphe als only accessible by he secu e wo ld. This sep-
a a ion means ha a comp omised no mal wo ld code (in
he use space o he ke nel) canno access hese memo y
anges o de ices. Howe e , his sepa a ion is en i ely a i i-
cial. The same co es un bo h secu e and no mal wo lds, and
hey use he same RAM (Fig. 2). The Non-Secu e (NS) bi
de e mines whe he he CPU execu es in he no mal wo ld
o in he secu e wo ld con ex o c ea e a sepa a ion in mem-
o y. T us Zone echnology ex ends beyond he p ocesso
in o he SoC pe iphe als connec ed wi h he SoC, such as
Fig. 2 NS Bi ©Lina o
he DRAM con olle (Fig. 2), he DMA (Di ec Memo y
Access), he secu e boo ROM, he GIC (Gene ic In e -
up Con olle ), he T us Zone Add ess Space Con olle
(TZASC), he T us Zone P o ec ion Con olle (TZPC), and
he Dynamic Memo y Con olle (DMC). The abo e com-
ponen s communica e h ough he AXI bus and he SoC
communica es wi h pe iphe als h ough he AXI_ o_APB
b idge. Thi d-pa y companies implemen he SoC pe iph-
e als; he e o e, some endo s do no comply en i ely wi h
T us Zone speci ica ions o educe cos s.
I is possible o access he en i e memo y om he secu e
wo ld bu no ice e sa. To a e se o EL3, we use he
Secu e Moni o Call (SMC) ins uc ion. Un o una ely, he
SMCimplemen a ion dependson hemanu ac u e and, hus,
is p one o bugs and o he ulne abili ies [21]. This pape
ocuses on he physical le el o memo y isola ion.
T us Zoneenablesmemo ypa i ionsbe weenno maland
secu e wo lds by using he TZASC and he TZPC. In addi-
ion, hesecon olle s p o idea secu eI/O o pe iphe als o e
s anda d in e aces. Fo ins ance, he TZPC ou es he SPI
access o he secu e wo ld. Fu he mo e, he NS bi secu es
on-chip pe iphe als om accessing om he Rich Execu-
ion En i onmen (REE) [8]. TZASC u ilizes he NS bi o
a memo y-mapped de ice like DRAM. These wo de ices
equi e suppo om he AXI bus, which is endo -speci ic.
Examples o he secu e wo ld us ed applica ions a e
secu e PIN and biome ic checks. Ano he us ed applica-
ion use case is Digi al Righ Managemen (DRM) o online
media. Again, p i a e in o ma ion is kep wi hin he secu e
wo ld so hacke s canno access he keys equi ed o e e se-
enginee he sys em. [36] desc ibes many mo e use cases o
T us Zone o IoT and mobile de ices.
2.2 OP-TEE
OP-TEE [39] is a T us ed Execu ion En i onmen (TEE)
designed as a companion o a non-secu e Linux ke nel
unning on ARM Co ex-A co es using he T us Zone ech-
nology. OP-TEE implemen s TEE In e nal Co e API 1.1.x,
which is he API exposed o T us ed Applica ions and he
TEE Clien API 1.0, which is he API desc ibing how o
communica e wi h a TEE. The GlobalPla o m API de ines
123
A acking T us Zone on de ices lacking memo y p o ec ion
Fig. 3 Ou line o T us Zone ©Miled opedia
hese speci ica ions [22]. The non-secu e OS is e e ed o
as he Rich Execu ion En i onmen (REE) in TEE speci ica-
ions.
OP-TEE is widesp ead in Snapd agon, IMX7, Hikey,
D agonBoa d, and many o he p oduc s.
OP-TEE is designed p ima ily o ely on he ARM
T us Zone echnology as he unde lying ha dwa e isola ion
mechanism. Howe e , i is compa ible wi h o he isola ion
echnologies sui able o he TEE concep and goals, such
as unning as a i ual machine o on a dedica ed p ocesso
co e. The main design goals o OP-TEE a e:
–Isola ion - OP-TEE p o ides isola ion om he non-
secu e OS and p o ec s he loaded T us ed Applica ions
(TAs) om each o he by using unde lying ha dwa e sup-
po .
–Small oo p in - OP-TEE should emain small enough
o eside in a easonable amoun o on-chip memo y as
ound on ARM-based sys ems.
–Po abili y - OP-TEE is aimed o be pluggable o di e -
en a chi ec u es and mus suppo a ious se ups such as
mul iple clien OSs o mul iple TEEs.
OP-TEE o e s h eads and sha ed memo y be ween he REE
o he secu ed OS, secu ed in e up s RPC om he secu e
wo ld o he REE and he SMC in e ace communica ion
om he REE o he secu e wo ld.
OP-TEE main componen s a e he:
– OP-TEEbina yOSexecu inginsecu eEL1 (T us Zone);
– OP-TEE Linux ke nel d i e ;
– Linux use space lib a ies; and
– a Linux use space daemon ( ee-supplican ) ha pe o ms
se iceson behal o he OP-TEE OS. I is esponsible o
passing he secu ed pa o he TA in o he secu e wo ld.
The e a e se e al ypes o TAs. The ea ly TAs ha d-link o
OP-TEE co e bina y and, he e o e, a e a ailable be o e he
REE uns. The second ype is an REE File sys em TA, which
is a ailable once he REE OS uns. The TA is composed o
wo pa s: secu ed and non-secu ed. I is signed and may be
enc yp ed. The key used o sign he TA is he same key used
osign heo iginalOP-TEE bina yco eblob usedwhenbuil .
Each TA is composed o wo pa s: a Linux use space
applica ion and a secu e wo ld applica ion. TA execu ion ol-
lows he nex s eps:
1. Ini ialize Con ex and Open Session: C ea es a con ex
and loads he TA secu e pa in o he OP-TEE co e in he
T us Zone.
2. In oke command. The non-secu e pa sends commands
o he secu ed TA ecei e .
3. Close session and Finalize con ex .
OP-TEE secu e s o age manage implemen s a secu e ile
sys em in wo ways: REE-FS and p o ec ed memo y (i pos-
sible). When a TA w i es da a o he secu ed s o age, he
us ed s o age in okes TEE ile sys em ope a ions o s o e
he da a. Then he TEE ile sys em enc yp s he da a and
passes he da a o ee supplican , keeping he da a in he REE
ile sys em. The TEE ile sys em is isible in he Linux ile
sys em as a di ec o y. Each objec wi hin he TEE is assigned
an in e nal iden i ie in addi ion o he TA objec s.
Kep in he TEE ile sys em, he key-manage esponsibil-
i ies a e da a enc yp ion and dec yp ion. I uses h ee ypes
o keys:
–SSK - Secu e s o age keys
–TSK - TA s o age keys
–FEK - File sys em key
The FEK de i es om TSK, which de i es om he SSK.
The SSK de i es om he unique ha dwa e key (HUK). The
HUK may no be accessible om he REE and i is up o he
manu ac u e o p o ide i , and p o ide access o i .
The OP-TEE ke nel is no enc yp ed. The e o e, a DMA
a ack on he OP-TEE ke nel is mo e s aigh o wa d han
on a TA-enc yp ed p og am as i bypasses he MMU pe mis-
sions model and he need o enc yp he code.
Each TA is signed and op ionally enc yp ed wi h a p i a e
key. The dec yp ion akes place in OP-TEE in he T us Zone.
Thus, he p og am in i s dec yp ed o m is only isible in he
secu ed RAM and he p ocesso ’s EL3 cache. I is, he e o e,
sensible o a ack in he dec yp ion a ea.
3 The DMA a ack
Di ec Memo y Access (DMA) allows I/O de ices o access
he memo y. DMA has e ol ed since i s incep ion and a e
in oducingmanyhigh-speedI/Ope iphe als, endo ss a ed
o inco po a e DMA engines o ini ia e DMA ansac ions
wi hou coo dina ing wi h he DMA con olle .
123
R. S ajn od e al.
ARMimplemen s head ancedmic ocon olle busa chi-
ec u e (AMBA), an open s anda d o on-chip in e connec
speci ica ion. DMA ansac ions connec h ough he DMA
con olle o he on-SOC AMBA AXI Bus (AMBA ad anced
ex ensible in e ace), and he AMBA AXI Bus suppo s
he T us Zone NS-bi . Thus, he DMA con olle can han-
dle secu e and non-secu e e en s simul aneously, wi h ull
suppo o in e up s and pe iphe als. Examples o DMA
de ices a e g aphic ca ds, ne wo k adap e s, Fi eWi e, Thun-
de Bol , e c. Al hough DMA is essen ial o as I/O ans-
ac ions, i also opens new ulne abili ies o DMA a acks
[7,26,46].
3.1 A ack goal
On a SOC lacking an SMMU (Sys em Memo y Managemen
Uni ) o TZASC, unning OP-TEE wi hou NS-bi suppo ,
hesecu edmemo y isaccessible h ough DMA ansac ions.
Th ough his ulne abili y, we can exploi T us Zone. We
escala e p i ileges by eading da a om he secu e wo ld.
In his a ack, we injec code o he Moni o in EL3, hus
execu ing malicious p og ams in he secu e wo ld OS. This
injec ion le s us bypass any alida ion o he secu e ope a ing
sys em and makes i possible o pa ch he EL1 ke nel and
execu e a bi a y code.
3.2 The a ack -‘ us ed’a bi a y code execu ion
We base he a ack p imi i e on W i e Wha Whe e ul-
ne abili y achie ed using DMA ansac ions. We use his
ulne abili y o show ha we can gain access o execu e a bi-
a y code in he OP-TEE OS. We bypass OP-TEE OS TA
signa u e alida ion and gain con ol o e e y us ed appli-
ca ion in he sys em, which we p esen la e in he pape . Ou
app oach is o change he opcodes ha e u n e o alues
o key unc ions wi hou changing he s ack. This echnique
impedes CFI ools such as gcc compile s ack gua d [13],
Clang CFI [2], o kFCI [34] o de ec ou a ack.
T us ed applica ions a e loca ed on he REE ile sys em
because i usually con ains mo e memo y; using his ile sys-
em makes i easie o upda e hose applica ions. The us ed
applica ions a e buil sepa a ely om he us ed ope a ing
sys em (simila o Linux ke nel and use space applica ions
in he no mal wo ld) and a e signed wi h a p i a e key om
he manu ac u e o he de ice applica ion (e.g. Samsung
sign hei us ed applica ions wi h hei p i a e key). Typical
usages o us ed applica ions a e DRM alida ions, HMAC
(keyed-hash message au hen ica ion code)-based one- ime
passwo d,AES enc yp ion and mo e. Using he us edappli-
ca ions, hede ice’s manu ac u e can ensu e a comp omised
use o ke nel will no b eak he de ice’s in eg i y. When he
manu ac u e wan s o upda e a us ed applica ion, hey sign
he new e sion wi h he same p i a e key and dis ibu e i o
Table 1 PI3 speci ica ions
SoC B oadcom BCM2837
CPU 4 co es, ARM Co ex A53, 1.2GHz,
(clocked o 700MHz)
RAM 1GB LPDDR2 (900MHz)
Clock 19.2MHz
he use s. When he secu e wo ld OS execu es a us ed appli-
ca ion, a secu i y e o will occu i he signa u e is in alid
and he p og am will no un.
In ou a ack, we i s use a DMA a ack o ead memo y
pages om he RAM. Pe iphe al de ices such as Fi eWi e,
PCI-connec ed de ices (Ne wo k ca ds, GPU, e c.) can ini i-
a e a DMA a ack, as demons a ed by [46,49], and [26]. The
CPU can also ini ia e DMA a acks by ac i a ing he DMA
con olle . A e eading memo y pages om he RAM,
we analyse he memo y and compa e i o ARM T us ed
Fi mwa e o loca e simila unc ions. (Mos T us Zone so -
wa e implemen a ions a e based on ARM T us ed Fi mwa e,
making e e se-enginee ing he code simple .) Mo eo e ,
some signi ican endo s’ secu e OS (T us ed Execu ion
En i onmen ) is in he ma ke (QSEE, OP-TEE). We com-
pa e ou memo y dump o he compiled e sions o hose;
by doing so, we can ind he unc ions ha alida e us ed
applica ion signa u es. Because in some cases, some o he
widely used TEE OS uses Add ess Space Layou Randomi-
sa ion(ASLR) [12], we can use he add ess om ou memo y
dump o o e ide us ed applica ions signa u e alida ions
wi h a DMA a ack. A e doing so, we can jus eplace any
TA wi h ou own malicious TA. Thus, e en hough we do
no know he co ec signa u e p i a e key, he TEE OS will
succeed o alida e ou malicious TA.
4 A ack e alua ion
4.1 Raspbe y Pi pla o m
We use a Raspbe y PI3 Model B o demons a e he a ack.
Table 1p esen s he Raspbe y PI3 Model B’s main speci i-
ca ions.
Figu e 4p esen s he BCM2837 chip. This B oadcom
SOC suppo s T us Zone and DMA ansac ions h ough
he AMBA Ad anced Mic ocon olle Bus A chi ec u e AXI
(Ad anced Ex ensible In e ace). As men ioned ea lie , no
all endo s’ implemen a ions comply wi h he en i e ha d-
wa e speci ica ions. Fo example, Fig. 4shows ha he
BCM2837 has he co ec AXI bus, bu i lacks he TZASC
and TZPC, making i ulne able o DMA a acks.
123

A acking T us Zone on de ices lacking memo y p o ec ion
Fig. 4 BCM2387 O e iew ©P emie Fa nell L d
Table 2 DMA Con ol Block Da a S uc u e
32-bi Wo d
O se
Desc ip ion Associa ed Read-
only Regis e
0 T ans e TI
In o ma ion
1 Sou ce Add ess SOURCE_AD
2 Des ina ion Add ess DEST_AD
3 T ans e Leng h TXFR_LEN
4 2D Mode S ide STRIDE
5 Nex Con ol Block Add ess NEXTCONBK
6–7 Rese ed - se o ze o N/A
4.2 OP-TEE o PI
OP-TEE suppo s Raspbe y Pi 3 Model B. In addi ion,
he ARM T us ed Fi mwa e is he basis o implemen ing
secu e wo ld so wa e o he ARM A-P o ile a chi ec u es
(ARM 8-A and ARM 7-A), including an Excep ion Le el
3 (EL3) Secu e Moni o . ARM T us ed Fi mwa e o he
Raspbe y Pi p o ides a sui able s a ing poin o he p o-
duc isa ion o secu e wo ld boo and un ime i mwa e [4].
When a endo uses OP-TEE on any ha dwa e in gene al
and on Raspbe y Pi speci ically, hey will mos likely use a
us ed applica ion o implemen ha dwa e secu i y measu es
and secu e hei de ices [35].
Table 3 DMA Con olle
32-bi Add ess o se Regis e name Desc ip ion
0 CS DMA Channel
Con ol and S a us
1 CONBLK_AD DMA Channel
Con ol Block Add ess
2 TI DMA Channel
T ans e In o ma ion
3 SOURCE_AD DMA Channel
Sou ce Add ess
4 DEST_AD DMA Channel
Des ina ion Add ess
5 TXFR_LEN DMA Channel
T ans e Leng h
6 STRIDE DMA Channel
2D S ide
7 NEXTCONBK DMA Channel
Nex CB Add ess
8 DEBUG DMA Channel
Debug
4.3 Raspbe y Pi DMA
As no ed ea lie , he CPU can access he DMA con olle .
The e o e, we chose o pe o m his a ack h ough he CPU.
We au ho ed a Linux ke nel module o pe o m he DMA
ansac ions.This module maps he DMA con olle and con-
igu es he DMA con ol block o ini ia e DMA ansac ions.
InOP-TEE’sLinuxke nel, heDMAcon olle add essspace
is no a ailable o he use space. Howe e , i is plausible
o assume ha an IoT de ice, o example, will enable his
de ice o pe iphe als access. We a gue an a ack is possi-
ble in many IoT de ices, and we will show he ollowing
scena ios:
1. Some IoT de ices map physical memo y o he use space
o inc ease pe o mance and sa e ke nel access, leading
o DMA con olle access.
2. Linux-based de ices (IoT de ices, ou e s, e c.) do no
upda e hei ke nel e sions e y o en due o compa ibil-
i y issues and many de ices. Thus one day’s ulne abili y
can be used o exploi he de ice and gain oo access o
pe o m ac ions on he DMA con olle [37,50].
3. A ack pe iphe al de ice (Blue oo h/WIFI chip, SSD con-
olle , e c.) o pe o m malicious DMA ansac ions
[17,47,52].
All hose scena ios may lead o a DMA a ack and, on some
de ices, o T us Zone ulne abili y.
123
R. S ajn od e al.
Fig. 5 Open session low
Table 2p esen s he Con ol Block s uc u e o a DMA in
he Raspbe y Pi. Table 3shows he DMA Con olle egis-
e s. To ini ia e a DMA ansac ion, we i s se he Con ol
Block s uc u e and hen se CONBLK_AD in he DMA con-
olle s uc u e. We pe o m wo ypes o DMA ansac ions:
1. Se SOURCE_AD o he secu e wo ld physical add ess o
ead da a o he secu e wo ld.
2. Se DEST_AD o he secu e wo ld physical add ess o
w i e malicious code o he secu e wo ld, he eby achie -
ing a bi a y code execu ion.
5 The a ack - e alua ion on aspbe y Pi
In he OP-TEE en i onmen , us ed applica ions a e signed
wi h he key om he build o he o iginal OP-TEE co e
blob. T us ed applica ions consis o a signed ELF heade ,
named om he UUID o he us ed applica ion (se du ing
compila ion ime) and he su ix . a.
When a us ed applica ion is eplaced in he REE ile-
sys em wi h he new one, he signa u es and UUID a e
alida ed by he OP-TEE OS (Fig. 5).
OP-TEE p o ides a Linux ke nel d i e o in e ac wi h
he OP-TEE in T us Zone. Fo ins ance, he PTA_SYSTEM
_OPEN _TA_BINARY unc ion access he OP-TEE OS.
PTA_SYSTEM_OPEN_TA_BINARY calls sys em _open _ a
_bina y, which looks o he use - us ed applica ion ELF
by he UUID in he s o age ( ile-sys em). A e inding he
us ed applica ion ELF in he REE ile-sys em, he OP-TEE
OS loads he ELF heade and maps he TA sec ions in o he
secu e memo y using PTA _SYSTEM_MAP _TA_BINARY.
A e loading he us edapplica ion, heuse isable oin oke
he us ed applica ion unc ionali y h ough he OP-TEE
Linux ke nel d i e .
We ocus on wo unc ions:
ee_ s_ a_open and
ee_ s_ a_ ead
called by PTA _SYSTEM _OPEN _TA _BINARY, and
PTA _SYSTEM _MAP _TA _BINARY, espec i ely.
T us ed applica ions bina ies con ain a signed heade so
ha a malicious use canno eplace he us ed applica-
ions. I a malicious use eplaces a us ed applica ion,
hen OP-TEE OS e u ns a secu i y e o when execu ing
hose us ed applica ions. In o de o OP-TEE OS o al-
ida e hose signa u es as a us ed applica ion execu es, he
unc ion ee_ s_ a_open loads he us ed applica ion heade ,
alida es he applica ion heade signa u e (Fig. 6) and ali-
da es i s size (Fig. 7). When OP-TEE OS maps he TA in o
he secu e memo y, i loads he applica ion o he memo y
using ee_ s_ a_ ead, which alida es he enc yp ed us ed
applica ion signa u e (Figs. 8and 9).
In he i s s ep, we e e se-enginee ed OP-TEE OS (using
ada e2 [31]) in o de o ind key opcodes o bo h unc ions
o exploi (Figs. 6,7,8,9). We used DMA ansac ions o
ead chunks o physical RAM in o de o ind he opcodes
ha ma ch he unc ions abo e. Once we loca ed he opcodes
in he memo y and no iced ha hese unc ions load in he
123
A acking T us Zone on de ices lacking memo y p o ec ion
1/∗Valida e heade signa u e ∗/
2 es = shd e i y signa u e(shd );
3i ( es != TEESUCCESS)
4go o e o ee payload ;
5
Fig. 6 ee_ s_ a_open Heade signa u e alida ion
1i ( a size != o s + shd −>img size) {
2 es = TEEERROR SECURITY ;
3go o e o ee hash ;
4}
5
Fig. 7 ee_ s_open TA size alida ion
Fig. 8 ee_ s_ a_ ead dec yp s a TA heade
same loca ion in physical memo y e e y ime. We used DMA
ansac ions o o e ide he e u n alues o he alida ions
men ioned abo e (Figs. 6,7,8,9), he eby gaining he abil-
i y o compile ou own us ed applica ion, sign i wi h an
a bi a y key and execu e i on he machine.
We eplaced wo ypeso opcodes: hecompa isonopcode
o w0 egis e was eplaced wi h cmp w0,w0 so i always
e u ned ue and, when mo ing he e u n alue o he unc-
ion o w0 egis e , we eplaced his command wi h eo
w0,w0,w0 so he alue o w0 egis e would be 0, again ha -
ing he e u n alues o he alida ion unc ions equal ue.
We we e able o pe o m his eplacemen using jus a simple
DMA ansac ion wi h he con ol block DEST_AD, which
con ains he physical add ess o he opcodes we ound, all o
which a e loca ed in he secu e wo ld memo y. In ou case,
we compiled a new TA wi h he same UUID as he o igi-
nal one and pu i in he ile-sys em loca ion. By execu ing
ou malicious TA, we gained he abili y o manipula e ARM
T us Zone o un in alidly signed bina ies. Fo ins ance, we
compiled a ake AES TA (gi en in he examples o he OP-
TEE sui e) ha enc yp s da a wi h ou malicious key. Thus,
e e y ime he use uses his TA o pe o m AES, i will no
enc yp he da a wi h he sec e key.
Fig. 9 ee_ s_ ead alida es he enc yp ed heade agains he hash o
he plain heade
5.1 O he a ack possibili ies
Using DMA a acks on he T us Zone gi es a wide ange
o a ack possibili ies. In his pape , we show he usage o
DMA a acks o pe o m ACE (A bi a y Code Execu ion);
howe e , i isalsopossible o use his me hod o eada bi a y
code om physical memo y whe eby a malicious use can
access sensi i e da a.
6 Mi iga ion
When choosing an SoC, you mus compa e he de ice
equi emen s o he SoC ea u es. In ou case, when selec -
ing an SoC, we wan o make su e he SoC a chi ec u e has
all he chips equi ed o ARM T us Zone o wo k co ec ly
(TZASC, TZPC, suppo ed bus, e c.). Un o una ely, check-
ing he SoC a chi ec u e is no always easy and no au oma ic
because no all endo s publish hei SoC a chi ec u e. We
sugges ha SoC endo s be mo e anspa en abou hei
a chi ec u e when i comes o secu i y ea u es. We also
ecommend ha manu ac u e s ensu e hei SoC ha dwa e
suppo sT us ZoneARMCo eandT us Zonespeci ica ions.
In cases whe e a ully compa ible T us Zone is no a ail-
able (lack o ha dwa e on he SoC ha makes he T us Zone
secu e), we lis o he p o ec ion echniques:
– Using SMMU (simila o IOMMU on In el x86) o con-
igu e speci ic add esses o DMA con olle s. SMMU
wo ks as MMU o BUS access so any memo y access
h ough he BUS is ma ched o he pe mission con ig-
u ed o he accessed add ess. Wi h SMMU and a co ec
con igu a ion, a DMA a ack h ough pe iphe als will no
be possible. I is also impo an o no e a ke nel a acke
could change his con igu a ion.
– In he case o Raspbe y Pi, by disabling he DMA con-
olle , a non-p i ileged use o pe iphe al would no be
able o use DMA ansac ions.
– Se he secu e wo ld on a di e en RAM wi hou DMA
con olle mapping so he e is no physical in e ace
be ween he no mal and secu e wo lds.
123
R. S ajn od e al.
A so wa e echnique would enc yp pa s o he OP-TEE
code i sel , mainly he TA deciphe unc ions. Then, when
OP-TEE uns hese unc ions,i dec yp s hemin o hecache,
alida es he TA, and e ic s he p ocesso s’ cache. Using his
me hod [54], an a acke would ha e o ime his a ack o ge
he RAM code. Howe e , combining his me hod wi h ASLR
impedes he a ack.
7 Rela ed wo k
In he a ea o ARM, [11] e al. desc ibe a downg ade o oll-
back a ack. A us ed applica ion is enc yp ed o secu i y
pu poses by public and p i a e keys ha o igina e om he
ha dwa e. In cases when he sys em is upda ed, old TAs can
s ill be execu ed on he new sys em. A downg ade a ack is
when an a acke exploi s a ulne abili y in he old TA e -
sion by pa ching he old e sion on o he new TA e sion.
Acco ding o [11], he abo e applies o he OP-TEE and
QSEE (Qualcomm’s Secu e Execu ion En i onmen ). [11]
e al. desc ibe a simple p ocedu e o mobile phones: oo
he de ice, emoun he ‘sys em’ pa i ion in READ-WRITE
mode, eplace hecu en us le wi h anold ulne able us -
le and use he us le . [11] e al. desc ibe ano he possible
ollback a ack on he chain o us and p o es i possible o
downg ade he boo loade success ully.
Many wo ds ha e been w i en on side-channel a acks
and o he ulne able a ge s in ARM a chi ec u e in p io
esea ch. Fo example, A mageddon [32] e al. explo e
a acks on ARM caches, concen a ing on c oss-co e cache
a acks in non- oo ed ARM mobile de ices and showing a
no el app oach o exploi he cohe ence p o ocols. Al hough
mos sma phones ha e mul iple p ocesso s ha do no sha e
caches, cache cohe ence p o ocols allow p ocesso s o e ch
cache lines. By exploi ing he lack o cache lush on ‘old’
ARM co es (be o e ARM 8), a no el echnique ha analy-
ses cache e ic ion s a egies and ano he app oach o pe o m
cycle- iming wi hou oo access, he A mageddon [32]e
al. p o ide a me hod o gain sensi i e in o ma ion such as
in e -keys oke imings o he leng h o a swipe ac ion. As
o T us Zone ulne abili y, A mageddon [32]e al.shows
a cache a ack used o moni o cache ac i i y caused wi hin
he ARM T us Zone om he no mal wo ld.
Flush and Reload a ack [53] e al. ake ad an age o he
cohe ence p o ocol in a mul ip ocesso compu e . In mos
ARM p ocesso s, he las -le el cache is inclusi e (i.e. i
includes low-le el cache lines); he e o e, examining he
con en o he las -le el cache may p o ide he con en s o
low-le elcachelineso ano he co e.Howe e , heAu oLock
[19] ool assesses he ac ual isk in cache a acks, p e en s
c oss-cache e ic ions and highligh s he in icacies o cache
a acks in ARM. [19] e al. claim ha unlike In el p oces-
so s, many ARM caches a e bo h inclusi e and exclusi e
and, he e o e, ha den he LLC (las -le el cache) a acks. In
hei wo k,Demme e al. [16] demons a e ha small changes
o he cache a chi ec u e ha e a conside able impac on side-
channel ulne abili y. Finally, [28] e al. p esen in hei wo k
a side-channel cache a ack agains Samsung T us Zone ia
he And oid’s Keymas e c yp og aphic unc ions.
Like cache a acks, DMA a acks a e con inuously unde
esea ch. [49] e al. show ha by dumping memo y e-
quen ly enough using DMA ansac ions, w i e pa e ns can
be examined. Some algo i hms, such as he RSA Mon -
gome y ladde [23], may leak sec e s. DAGGER [46], a
DMA-based keys oke logge , ex il a es cap u ed da a o
an ex e nal en i y and canno be de ec ed by an i- i us so -
wa e. [46] shows how DAGGER can s eal c yp og aphic
keys, a ge OS ke nel s uc u e, and copy iles om he ile
cache on Linux and Windows h ough DMA malwa e e en
i he memo y add esses a e andom. [46] e al. also o e
coun e measu es o de ec DMA a acks. [9] e al. in eg a e
DMA a acks h ough Fi eWi e in o Me asploi [24]. Thus,
an a acke could use Me asploi [24] o payload selec ion,
session con ol, e c. and a ack ia DMA o e Fi ewi e.
TRESOR-HUNT [7] elies on he insigh ha DMA-
capable ad e sa ies a e no es ic ed o simply eading
physical memo y bu can w i e a bi a y alues o memo y as
well. Ha d disk enc yp ion keys we e conside ed sa e i no
sa ed on he RAM. S ill, TRESOR-HUNT [7] injec s mali-
ciouscode o he ke nelusingaDMAa ackand hen ex ac s
disk enc yp ion keys om he CPU in o he a ge sys em’s
memo y om which hey can be e ie ed using a no mal
DMA ans e . [48] e al. show ha an ad e sa y wi h physi-
calaccess oade icecould impe sona e he de ice’s memo y
con olle by a aching a malicious memo y con olle o he
exposed pins o each DIMM socke o RAM; by doing so, an
a acke would ha e ull access (READ/WRITE) o he a -
ge memo y. Du lo e al. [17] in oduce he ulne abili y o
emo e code execu ion on a ne wo k adap e and how i could
comp omise he sys em- unning ke nel using DMA a ack.
BROADPWN [6] is a no el app oach o p i ilege escala ion
om exploi ing a bug in B oadcom WiFi chip in o a DMA
a ack on he main p ocesso o he de ice.
The e a e also ha dwa e ools ha pe o m a acks, such
as PCI leech [41] ha pe o ms DMA a acks, Lan u le [27]
ha pe o ms a man-in- he-middle a ack, and kon-boo [25]
ha bypasses Windows passwo d p o ec ion [45].
The eme ging cache, DMA and ha dwa e a acks demon-
s a e ha so wa e bugs can impose secu i y isks, and
weak ha dwa e implemen a ion is becoming mo e com-
mon, speci ically when new ea u es ely on old secu-
i y assump ions. Fo example, in he Raspbe y PI case,
CVE-2018-18068 is a p i ilege escala ion ulne abili y o
non-au ho ised memo y access ia in e -p ocesso debug-
ging. This ulne abili y is also demons a ed by [38]e
al. who show ha because ARM 7 ( he ARM debugging
123