arXiv 2301.045912023-01-11cs.CR

MVAM：面向IoT信任计算的内存多变量攻击

MVAM: Multi-variant Attacks on Memory for IoT Trust Computing

Arup Kumar Sarker, Md Khairul Islam, Yuan Tian

备注：: 12 pages, 6 figures, 6 code blocks

摘要：

随着物联网和低成本云服务的显著发展，物联网系统的传感和数据处理要求不断提高。TrustZone是专为物联网手持系统设计的ARM处理器的受硬件保护的可信执行环境（TEE）。它提供内存隔离技术来保护受信任的应用程序数据不被恶意实体利用。在这项工作中，我们专注于识别ARM Cortex-M处理器的TrustZone扩展的不同漏洞。然后设计并实现一个威胁模型来执行这些攻击。我们发现TrustZone容易受到基于缓冲区溢出的攻击。我们已经使用它创建了一个名为MOFlow的攻击，并成功泄露了另一个受信任应用程序的数据。这是通过故意溢出一个应用程序的内存来访问安全世界中其他应用程序的加密内存来完成的。我们还发现，由于没有验证entry函数中的输入参数，TrustZone暴露了一个安全漏洞。我们称之为阿喀琉斯之踵，并提出了一个攻击模型，展示了如何利用这一弱点。我们提出的新的攻击实现，并成功地测试了两个最近的ARM Cortex-M处理器在市场上（M23和M33）。

英文摘要：

With the significant development of the Internet of Things and low-cost cloud services, the sensory and data processing requirements of IoT systems are continually going up. TrustZone is a hardware-protected Trusted Execution Environment (TEE) for ARM processors specifically designed for IoT handheld systems. It provides memory isolation techniques to protect trusted application data from being exploited by malicious entities. In this work, we focus on identifying different vulnerabilities of the TrustZone extension of ARM Cortex-M processors. Then design and implement a threat model to execute those attacks. We have found that TrustZone is vulnerable to buffer overflow-based attacks. We have used this to create an attack called MOFlow and successfully leaked the data of another trusted app. This is done by intentionally overflowing the memory of one app to access the encrypted memory of other apps inside the secure world. We have also found that, by not validating the input parameters in the entry function, TrustZone has exposed a security weakness. We call this Achilles heel and present an attack model showing how to exploit this weakness too. Our proposed novel attacks are implemented and successfully tested on two recent ARM Cortex-M processors available on the market (M23 and M33).

机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。

摘要：

英文摘要：

相关论文