Sadly both espressiv and arm didn't respond to his vuln disclosure contact. This prompted him to go deeper, targeting secure boot. Secure boot is vital in a hardware root of trust world. The secure boot key (sbk) is burned into the e-fuses blk2. This stops readout or modding
-
Prikaži ovu nit
-
Based upon his reverse engineering, this is the boot process. There are two verifications here. Boot ROM stage 0 and ECDSA verification by the stage 2 bootloaderpic.twitter.com/QHjrMkLasJ
1 reply 0 proslijeđenih tweetova 2 korisnika označavaju da im se sviđaPrikaži ovu nit -
The next logical step is bypassing the secure boot. this gives you code exec. This isn't easy as you need to force the ESP32 to boot an unsigned bootloader to boot an app. Dump the bootroom and use a FT2232H board and use gdb
1 reply 0 proslijeđenih tweetova 2 korisnika označavaju da im se sviđaPrikaži ovu nit -
This is bloody amazing to me, and sounds trivial but this is not easypic.twitter.com/Xq1suGscsB
1 reply 0 proslijeđenih tweetova 0 korisnika označava da im se sviđaPrikaži ovu nit -
The vuln is sexy too. Set the a10 register to 0 via the burned JTAG fuse and bish bash bosh.pic.twitter.com/p89QmwSf0M
0 proslijeđenih tweetova 4 korisnika označavaju da im se sviđaPrikaži ovu nit -
Fault injection is utterly amazing as a approach to find flaws but also really hard to fix from speaking to real experts who are far more intelligent that me.pic.twitter.com/SANpPkL1X0
1 reply 0 proslijeđenih tweetova 3 korisnika označavaju da im se sviđaPrikaži ovu nit -
The one thing he struggled with was flash encryption. That's bloody hard and this was his kryptonite. Something something Yoda use the hate so he turned to the OTP/E-fuses and started to reverse these impossible to change fusespic.twitter.com/gpwkDfsX1b
1 reply 0 proslijeđenih tweetova 1 korisnik označava da mu se sviđaPrikaži ovu nit -
The special boot mode is the target. Thing is, you can't read BLK1 or BLK2 so he wanted to use glitching to be able to dump the contents.pic.twitter.com/g3845SpVsi
1 reply 0 proslijeđenih tweetova 1 korisnik označava da mu se sviđaPrikaži ovu nit -
Like a Hollywood thriller with wizards and robes and shit.. throwing power at chipspic.twitter.com/PkjcNnXJcB
1 reply 0 proslijeđenih tweetova 1 korisnik označava da mu se sviđaPrikaži ovu nit -
Abracadabra boom. Sorry
@msuiche but your title of coolest Frenchman in hacking is gone.@LimitedResults took it off you old man. This is va va voompic.twitter.com/SbUfVza61p
1 reply 1 proslijeđeni tweet 5 korisnika označava da im se sviđaPrikaži ovu nit
I got excited about this when he submitted it, this is bloody amazing and sexy (@L_AGalloway used first time today) research. This is CVE-2019-17391
Much respect @LimitedResults
-
-
Odgovor korisnicima @dcuthbert @LimitedResults
Think you tagged the WRONG L?
1 reply 0 proslijeđenih tweetova 0 korisnika označava da im se sviđa -
Odgovor korisnicima @L_AGalloway @LimitedResults
I tagged you to police my sexy usage
0 proslijeđenih tweetova 1 korisnik označava da mu se sviđa - Još 1 odgovor
Novi razgovor -
Čini se da učitavanje traje već neko vrijeme.
Twitter je možda preopterećen ili ima kratkotrajnih poteškoća u radu. Pokušajte ponovno ili potražite dodatne informacije u odjeljku Status Twittera.