Out Of The Box Exploitation Breaking The Trust Chain Of The Ethereum Phone
summary
Starts from an unenforced MediaTek download-mode auth and uses a Loader-of-the-Loader in-memory patching chain to reach EL3, install HVC/SMC backdoors in Genius Zone and BL2, and avoid touching flash so no factory reset is triggered. The exploit uploads patched preloader and a boot image, gains a root shell, brute forces the software gatekeeper to bypass screen lock, extracts the device’s ERC4337 signing key from the system wallet blob, and abuses printed IMEI/serial airdrop flow to claim pre-activation funds.
AI-written summary · about
chapters (12)
- 0:00Introduction to cryptophones
- 1:16What is a cryptophone
- 3:25Airdrop incentives for crypto phones
- 6:59MediaTek boot chain analysis
- 9:31Exploiting the boot chain
- 13:24Genius Zone and AVF
- 18:48Little Kernel patching
- 21:39Live exploitation demo
- 23:17Bypassing screen lock
- 28:39Private key extraction
- 34:17Airdrop security flaws
- 36:10Conclusion and Q&A
related talks
34mCore Escalation: Unleashing the Power of Cross-Core Attacks on Heterogeneous System
38mMission mPOSsible
44mExposing Critical Threats In Millions Of Connected Devices
39mReflections on Trusting TrustZone
36mPhysical Attacks Against Smartphones
01h 01mCellular Exploitation on a Global Scale: The Rise and Fall of the Control Protocol
15mExploiting Android Apps with Counterfeit Art
43mBreaking Samsung's ARM TrustZone