Google Nest Wifi Pro Bypassing Android Verified Boot
summary
Root access to the Nest Wifi Pro comes from a simple chip-off eMMC modification that adds an SBL environment partition and supplies a valid CRC so U-Boot uses attacker-controlled variables, then leverages U-Boot’s compiled-in commands and lack of ASLR/stack cookies to write into its code and patch the Android signature check. A separate chain exploits a Qualcomm secure-world trusted app with an unchecked length and shared-buffer destination — TA unwrap overflow — to extract parent code and secrets, yielding persistent boot compromise and a working interactive U-Boot shell on reboot.
AI-written summary · about
chapters (10)
- 0:00Introduction to Nest WiFi Pro
- 1:07Hardware investigation approach
- 3:38Boot process and uboot analysis
- 7:54Exploiting uboot environment
- 10:02Android kernel compromise
- 11:52Secure world QSC exploitation
- 15:29Physical vs remote persistence
- 17:36Live demonstration attempt
- 19:11Demo results and summary
- 20:15Q&A session
related talks
50mSmart Nest Thermostat: A Smart Spy in Your Home
36mPhysical Attacks Against Smartphones
37mVlind Glitch: Blind VCC Glitching Technique to Bypass the Secure Boot of Qualcomm MSM8916 Mobile SoC
36mOut Of The Box Exploitation Breaking The Trust Chain Of The Ethereum Phone
35mKernel Alchemy: Crafting Mobile Kernel Code to Evade Modern RASP Protections
01h 06mBackdoors in Back Doors
30mDroidGuard: A Deep Dive into SafetyNet
48mSecuring the System: A Deep Dive into Reversing Android Pre-Installed Apps