Breaking TrustZone-M: Privilege Escalation on LPC55S69
Laura Abbott and Rick Altherr break ARM TrustZone-M hardware isolation on the NXP LPC55S69 microcontroller, elevating privileges from Non-Secure to Secure world.
Summary
The Architecture of ARMv8-M TrustZone-M
TrustZone-M introduces hardware-enforced Trusted Execution Environments (TEEs) to low-power embedded microcontrollers, isolating sensitive cryptographic keys from general application firmware.
Auditing Secure-to-Non-Secure Transitions
Laura Abbott and Rick Altherr examine the hardware memory protection controller and Non-Secure Callable (NSC) function gateway implementations on the NXP LPC55S69.
Discovering Hardware Configuration and Firmware Flaws
By exploiting improper SAU/IDAU register configurations and memory aliasing bugs, the researchers bypass TrustZone isolation and execute arbitrary code in Secure world.
Secure System Design for Embedded Developers
The authors outline best practices for configuring ARMv8-M security attribution units and validating transition boundaries.
Related talks
Main Stage·41 min
Jeroen 'Jeroen' Domburg
Demonstrates hardware hacking and reverse engineering to run custom Linux kernels and open software on inexpensive USB webcams.
Main Stage·44 min
Enrique Nissim · Krzysztof Okupski
Enrique Nissim and Krzysztof Okupski disclose AMDSinkclose, a vulnerability allowing Ring -2 execution and System Management Mode takeover across millions of AMD processors.
Main Stage·43 min
Yaniv Balmas · Lior Oppenheim
Yaniv Balmas and Lior Oppenheim demonstrate reverse engineering KVM switch firmware, subverting the 8051 microcontroller to install an undetectable, persistent hardware keylogger.