对DICE证明的TOCTOU攻击
A TOCTOU Attack on DICE Attestation
摘要：
现代物联网（IoT）部署的一个主要安全挑战是确保设备运行合法的固件而不受恶意软件的影响。这个挑战可以通过一个称为证明的安全原语来解决，它允许远程后端验证它管理的设备的固件完整性。为了加速物联网领域广泛采用证明，可信计算组织（TCG）推出了设备标识符组合引擎（DICE）系列规范。DICE是一种硬件-软件架构，用于约束，例如，基于微处理器的IoT设备，其中固件被划分为连续执行的层。在本文中，我们演示了一个远程的时间检查时间的使用（TOCTORM）攻击基于DICE的证明。我们证明，它是可能的安装持久性恶意软件的闪存的受约束的微控制器，不能通过基于DICE的认证检测。我们攻击的主要思想是在顶层固件层的应用程序逻辑运行时安装恶意软件。恶意软件读取有效的证明密钥并将其存储在设备的闪存中。重新启动后，恶意软件使用先前存储的密钥进行所有后续后端证明。我们通过面向返回的编程（ROP）进行恶意软件的安装和密钥的复制。作为演示平台，我们使用基于Cortex-M的nRF 52840微控制器。我们提供了几种可能的对策，可以减轻DICE规范的缺点的讨论。
英文摘要：
A major security challenge for modern Internet of Things (IoT) deployments is to ensure that the devices run legitimate firmware free from malware. This challenge can be addressed through a security primitive called attestation which allows a remote backend to verify the firmware integrity of the devices it manages. In order to accelerate broad attestation adoption in the IoT domain the Trusted Computing Group (TCG) has introduced the Device Identifier Composition Engine (DICE) series of specifications. DICE is a hardware-software architecture for constrained, e.g., microcontroller-based IoT devices where the firmware is divided into successively executed layers. In this paper, we demonstrate a remote Time-Of-Check Time-Of-Use (TOCTOU) attack on DICE-based attestation. We demonstrate that it is possible to install persistent malware in the flash memory of a constrained microcontroller that cannot be detected through DICE-based attestation. The main idea of our attack is to install malware during runtime of application logic in the top firmware layer. The malware reads the valid attestation key and stores it on the device's flash memory. After reboot, the malware uses the previously stored key for all subsequent attestations to the backend. We conduct the installation of malware and copying of the key through Return-Oriented Programming (ROP). As a platform for our demonstration, we use the Cortex-M-based nRF52840 microcontroller. We provide a discussion of several possible countermeasures which can mitigate the shortcomings of the DICE specifications.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
