Unearthing the TrustedCore: A Critical Review on Huawei’s Trusted Execution Environment
summary
Reverse-engineering of Huawei’s TrustedCore (TC) reveals concrete breaks: a white‑box AES in the global loader lets attackers decrypt any TA (119 of 133 firmware images use it; models include P9 Lite 2016 and P20 Lite 2018), the keystore uses a constant device‑wide key so attackers can export‑protected keys and spoof key blobs, and a stack overflow in keymaster combined with a constant stack canary and one‑byte ASLR enables a code‑reuse exploit to execute arbitrary code in TrustZone, map physical pages and escalate to the secure kernel.
AI-written summary · about
chapters (18)
- 0:00Intro
- 0:22Motivation
- 1:02Outline
- 1:40Trusted Execution Environments (TEES)
- 2:33ARM Trustzone on ARMVB-A Systems
- 3:47TEEs in the Field (on Android)
- 4:50Overview
- 5:07TrustedCore - Normal World
- 6:01TrustedCore-Secure World
- 7:47Loading Encrypted Trusted Applications (cont.)
- 9:29Protection of Crypto Keys
- 10:45Scope & Consequences
- 12:07Export-Protected Crypto Keys
- 14:02The Key Encryption Key (KEK)
- 16:30Memory Corruption in keymaster TA
- 17:05Exploit Mitigations
- 19:29Lessons Learned - Hardware-Protected Crypto Keys
- 20:37Lessons Learned - Attack Surface
related talks
39mReflections on Trusting TrustZone
34mCore Escalation: Unleashing the Power of Cross-Core Attacks on Heterogeneous System
43mBreaking Samsung's ARM TrustZone
44mCan You Trust Me Now? An Exploration Into the Mobile Threat Landscape
18mIoT Security's Toughest Challenges: Root of Trust, TEEs, & Firmware Updates
49mBreaking Hardware-Enforced Security With Hypervisors
27mCLKSCREW: Exposing the Perils of Security-Oblivious Energy Management
41mPanel: A New Root Of Trust: Changing Computing With TEE