Digging into Xiaomi's TEE to Get to Chinese Money
Slava Makkaveev reverse engineers Xiaomi's Trusted Execution Environment (TEE), discovering critical vulnerabilities that allow forging mobile payment transactions.
Summary
The Architecture of Mobile Payment Trust in Asia
Mobile wallets process trillions of dollars annually, relying on the hardware-isolated Trusted Execution Environment (TEE) to manage cryptographic keys and sign transactions.
Reverse Engineering Xiaomi's MediaTek TrustZone Architecture
Slava Makkaveev dissects Xiaomi's proprietary TEE microkernel, trustlets, and trusted application communication interfaces.
Discovering Memory Corruption in Payment Trustlets
Makkaveev details uncovering memory corruption vulnerabilities in WeChat Pay and Alipay trustlet binaries, enabling arbitrary code execution in secure world.
Forging Mobile Payment Signatures and Vendor Remediation
The author demonstrates extracting root payment signing keys to forge valid financial transactions and discusses Xiaomi's patch deployment.
Related talks
Main Stage·47 min
Hugo Gonzalez · Caleb Howell
Deconstructs the anti-cheat and runtime integrity mechanisms in Pokemon Go, demonstrating mobile reverse engineering and integrity bypass tradecraft.
Main Stage·21 min
Patrick Wardle · Tom McGuire
Patrick Wardle and Tom McGuire expose commercial security vendors who covertly copied open-source macOS security tools into commercial enterprise products.
Main Stage·1 hr 4 min
Elinor Mills
Elinor Mills presents the l0pht testimony 20 years later and other things: 2018 is the 20th anniversary of the hacker think-tank L0pht Heavy Industries testimony before the US Senate Homeland Security & Governmental...