BootStomp: On the Security of Bootloaders in Mobile Devices
summary
Built a static-binary analyzer called BOOTSTOMP that combines multi-tag taint analysis with constrained dynamic symbolic execution to trace attacker-controlled inputs from persistent storage to bootloader behavior. Evaluated four vendor bootloaders (Qualcomm, NVIDIA, Huawei, etc.), reports six zero-days (five confirmed), and rediscovers one bug; found arbitrary code execution at EL3, permanent DoS vectors, and two unlocking bypass issues that let a rooted OS break the chain of trust. Proposes storing state in replay-protected memory and key-binding mitigations; tool and alerts are published.
AI-written summary · about
chapters (19)
- 0:00Introduction
- 1:08What is a bootloader
- 2:01Why attack boot loaders
- 2:21Bootloader properties
- 2:45Root privileges
- 3:11Outline
- 3:26Exceptional Levels
- 3:57Booting Process
- 6:05Unlocking Process
- 7:01Device Security State
- 8:04BootStomp
- 12:52Propagation Removal
- 14:13Since Obtained
- 16:06Explosion Problem
- 16:52Evaluation
- 18:17Bypass Bug
- 19:17Mitigations
- 20:15Conclusions
- 20:39Questions
related talks
31mThe Bootloader: An Underestimated Risk To Embedded Linux Security
38mBootloaders Under Fire: Real-World Threats and Practical Defenses
27mBreaking the Chain of Trust
25mBreaking Bootloaders on the Cheap
28mBOOTKITTY: Multi-OS Trust Chain compromise from Bootkit to Rootkit
26mBootloops & Coffee: The Daily Grind of an AOSP Developer
27mProtecting Data In-Use from Firmware and Physical Attacks
44mLogoFAIL: Security Implications of Image Parsing During System Boot