Bits, Please!

"I had read that qualcomm's trustzone has had software exploits in the past, but I didn't think it would happen again" Of course it's going to happen again, given the abysmal state of security in QSEE, Qualcom's implementation of Trust Zone. I used to do software/firmware security reviews at Google, and let me tell you that what Gal found at [1] would have never passed my reviews had Qualcomm had a similar internal security process in place. This is one of the many reasons Google realized they couldn't trust vendors, so they rolled out their own security chip Titan M: https://www.blog.google/products/pixel/titan-m-makes-pixel-3-our-most-… So, if you want a secure phone, buy a Pixel 3 or later. [1] http://bits-please.blogspot.com/ : there are so many WTF moments, like Qualcomm not revoking trustlets, never sanitizing arguments passed to QSEE syscalls, etc, etc

The Nexus 6's L1 keys were dumped through a vulnerability in Qualcomm's trusted code execution environment. http://bits-please.blogspot.com/2016/05/qsee-privilege-escalation-vuln… https://googleprojectzero.blogspot.com/2017/07/trust-issues-exploiting…

I would think so (the repo suggests this is a Lenovo TB-X505X key, I'd imagine they're at least per-product). I could certainly be be wrong about L1 keys being burned-in, that was just my understanding of it (vendor docs say things like "Hardware DRM", but maybe I'm jumping to conclusions from marketing speak) The Widevine spec doesn't say either, it just says that all processing is within the Trusted Execution Environment, so I suppose the keys could be loaded/updated in firmware. I'm looking for more docs now... Edit: looks like I was wrong and they can be changed with firmware updates: http://bits-please.blogspot.com/2016/04/exploring-qualcomms-secure-exe…

note: I don't even dabble, and getting my info from [1] so salt with Qualcomm, if I'm not wrong, it should suffice to, with FDE, (transparently, on entry of pin), nuke the DEK (random key generated by Keymaster), and force a device reset; this does seem like an interesting usecase for custom firmware and/or magisk [1] http://bits-please.blogspot.com/2016/06/extracting-qualcomms-keymaster… albeit, if this does end up being implemented in some manner, wouldn't the fallback be a "confiscate electronic devices first for forensic" approach?

The "trustlets" that run in the TrustZone have enhanced privileges and must be securely written. Once crap like DRM ends up in there, as it invariably does, it turns actively harmful. http://bits-please.blogspot.com/2016/05/qsee-privilege-escalation-vuln…

Heh, good luck with that. http://bits-please.blogspot.com/2016/06/extracting-qualcomms-keymaster…

Watch out for TrustZone. There are definitely flaws in it too, for example: https://bits-please.blogspot.com/2016/06/trustzone-kernel-privilege-es…

DRM for example, see this older post where a bug in Qualcomm's DRM software enabled full system compromise: http://bits-please.blogspot.com/2016/05/qsee-privilege-escalation-vuln…

TrustZone. It is "one level deeper" just like any other hypervisor or monitor. As far as I know, it is quite common in Android phones for HSM and DRM purposes. Yay? =\ http://www.arm.com/products/processors/technologies/trustzone/ Edit: And, of course, it is probably exploitable in some way. See http://bits-please.blogspot.com/2015/08/exploring-qualcomms-trustzone.…

> This is not to make excuses for Intel ME, which is entirely unauditable by third parties and has harbored significant security vulnerabilities in the past. But, remember, we all use one processor architecture from one of two vendors, so Intel doesn't have a whole lot of motivation to do better. Lest you respond that ARM is the way, remember that modern ARM SOCs used in consumer devices have pretty much identical capabilities. I actually took advantage of one such security vulnerability to unlock my old Moto X's bootloader! The details of the exploit are quite interesting: https://bits-please.blogspot.com/2015/03/getting-arbitrary-code-execut… https://bits-please.blogspot.com/2015/08/exploring-qualcomms-trustzone… https://bits-please.blogspot.com/2015/08/full-trustzone-exploit-for-ms… https://bits-please.blogspot.com/2016/02/unlocking-motorola-bootloader…

Of course it depends on the phone. Many qualcomm based Android devices seem to have had their Full Disk Encryption scheme broken at the moment [1], for example. But either way, if your disk encryption scheme doesn't fully wipe the disk before use, then any data that ever hit the disk unencrypted could still possibly be sitting there until its physical blocks are consumed (or could be in a cache somewhere). Again this also depends on the hardware, in this case the storage hardware itself. SSDs using TRIM can wipe unused, unencrypted blocks for example in some scenarios. Who knows about the particular functioning of some SD type controller in a phone or even the card's own embedded OS [2]. I would say if you have data on your smartphone you don't want recoverable at rest, take module0000's advice, then also use encryption, and then also use a multi-pass wipe tool on particluar files. Of course all of this could still not work. For example, I'm not sure what the forensic ramifications of a seemingly more complex filesystem like APFS will be in the near future when it hits iOS. [1] https://bits-please.blogspot.com/2016/06/extracting-qualcomms-keymaste… [2] https://www.bunniestudios.com/blog/?p=3554

Keymaster is a Key Management application that runs "ontop" of TrustZone this doesn't mean that TrustZone or even QM's (hardware) implementation of TrustZone is flawed. It's more likely than not just a flaw within Keymaster itself, or within the Trustzone Kernel which means that this can effectively be patched, this isn't the first time vulnerabilities like this have been identified[0] (same author) and previous issues have been patched. For anyone who wonders TrustZone is a Trusted Execution Environment (TEE) technology for ARM CPU's the more known equivalent is probably Intel's TXT, it's not something QM has (solely) developed internally and an underlying issue with TZ can affect many more SOC's than just QM's (since AMD also uses TrustZone[1] this could potentially also affect desktop/server CPU's). My personal bet would be that this is an issue with Keymaster, or the TZ Kernel that QM has built not with TZ itself on a hardware or even microcode level and most likely very possible to be patched. [0]http://bits-please.blogspot.co.uk/2015/08/exploring-qualcomms-trustzon… [1]http://www.amd.com/en-us/innovations/software-technologies/security