Wibbly Wobbly, Timey Wimey: What's Inside Apple's U1 Chip
SEEMOO researchers reverse engineer Apple's proprietary U1 Ultra-Wideband (UWB) chip, analyzing its operating system, cryptographic ranging protocols, and security.
Summary
The Introduction of Ultra-Wideband in Consumer Devices
Apple introduced the proprietary U1 Ultra-Wideband (UWB) coprocessor in the iPhone 11 and AirTags, enabling high-precision spatial distance measurement and direction finding.
Reverse Engineering the U1 Hardware and OS
Jiska Classen and Alexander Heinrich extract and reverse engineer the U1 real-time operating system (RTOS) firmware, mapping internal peripherals and memory layouts.
Auditing Cryptographic Distance Bounding Protocols
The researchers evaluate the security of the IEEE 802.15.4z secure ranging protocol, investigating potential relay attacks and time-of-flight manipulation.
Open-Source Tooling for UWB Security Research
The authors release open-source tools to interact with the iOS Nearby Interaction framework and analyze raw UWB packet telemetry.
Related talks
Main Stage·43 min
Yaniv Balmas · Lior Oppenheim
Yaniv Balmas and Lior Oppenheim demonstrate reverse engineering KVM switch firmware, subverting the 8051 microcontroller to install an undetectable, persistent hardware keylogger.
Main Stage·38 min
Joseph Gabay
Reverse engineers electronic shopping cart containment wheels, capturing ultra-low-frequency and 2.4 GHz RF signals to unlock wheel braking mechanisms.
Main Stage·41 min
Jeroen 'Jeroen' Domburg
Demonstrates hardware hacking and reverse engineering to run custom Linux kernels and open software on inexpensive USB webcams.