Finding 1-Day Vulnerabilities in Trusted Applications using Selective Symbolic Execution
Marcel Busch, Kalle Dirsch · 2020
Trusted Execution Environments (TEEs) constitute a major building block for modern mobile devices' security architectures.Yet, the analysis tools available to researchers seeking to examine these critical components are rudimentary compared to the vast range of sophisticated tools available for other execution contexts (i.e., Linux or Windows userland).We see the primary reason for the lack of tools is originating from the closed-source nature of TEEs.Specifically, the analysis of Trusted Applications (i.e., userland applications executed in a TEE) is of vital importance, since they account for the largest attack surface.However, hardware primitives (i.e., ARM TrustZone) prevent access to this high-privileged context and thwart any form of dynamic analysis.In this paper, we present our approach to investigate 1-day vulnerabilities using selective symbolic execution of real-world Trusted Applications (TAs).Our system, SimTA, is based on angr and emulates the TA's execution environment.We build SimTA based on insights gained from manual static analysis of a commercially and widely deployed closed-source TEE by using an exploit on a physical device.In our evaluation, we elaborate on how SimTA facilitates the binary-diff-guided analysis by replicating the analysis of a known critical vulnerability.Additionally, we reveal two further issues, an authentication bypass and a heapbased buffer overflow, that have quietly been introduced by the vendor.