Shadow-Box v2: The Practical and Omnipotent Sandbox for ARM
summary
Shadow-box v2 claims a ring‑1 style protector for ARM that runs inside a TEE using OP-TEE and enforces kernel integrity via IMA plus a page‑hash verifier with randomized page-hash measurement and workload-adaptive checking. A reference implementation runs on a Raspberry Pi 3 and adds remote attestation to report periodic hash failures to a server. Demo shows detection of a kernel module rootkit even after the module is re-signed, but hash‑based checks cannot stop transient in-memory attacks without hardware memory protections.
AI-written summary · about
chapters (11)
- 0:00Start
- 2:34Devices that use Linux kernel share security threats
- 4:02Shadow-Box v2 focuses on ARM TrustZone!
- 6:15We need an open source and portable TEE!
- 24:04Connect Raspberry Pi 3
- 24:35Check OP-TEE driver is working
- 25:42Encrypt hashes with the secret
- 26:33Start remote attestation service
- 26:57Start remote attestation server
- 27:47Let's check protection mechanism
- 29:32Sign malware files with the key
related talks
38mOne Ring -3 To Secure Them All: Computing with Hardware Enclaves
41mPanel: A New Root Of Trust: Changing Computing With TEE
48mOP-TEE: Using the ARM Trust-Zone to Control Tamper Resistant Processors
38mBootloaders Under Fire: Real-World Threats and Practical Defenses
20mArchitectural Extensions for a RISC V Processor for Embedded Security
22mSandboxes all the way down - A hitchhiker's guide to platform...
22mPrivbox: Faster System Calls Through Sandboxed Privileged Execution
27mvTZ: Virtualizing ARM TrustZone