5 ms·
As an aside, this was published last week, Imagine how much they could of done if they didn't have to do blackbox fuzzing, and how many holes in the device woul
by molticrystal 4y ago
As an aside, this was published last week, Imagine how much they could of done if they didn't have to do blackbox fuzzing, and how many holes in the device would of been closed.
"Attacking Titan M with Only One Byte" [0]
> ...Titan M, a security chip introduced by Google in their Pixel smartphones, starting from the Pixel 3. In this blog post, ...we show how we found this vulnerability, using emulation-based fuzzing with AFL++ in Unicorn mode. Then, we go over the exploitation and its inherent challenges, that eventually led us to obtain code execution on the chip.
[0] https://blog.quarkslab.com/attacking-titan-m-with-only-one-byte.html https://blog.quarkslab.com/attacking-titan-m-with-only-one-b...
- surajrmal 4y agoI've talked with security professionals who have told me they prefer to not have source so that they don't get lazy. The bugs you find via black box methods aren't always the same you would find through scanning the code. Assuming the attacker also lacks source, you're better off finding the bugs they would find through similar methods. I don't work in security so I don't know if this is a commonly held belief.
- londons_explore 4y agoMany blackbox methods are made easier if you can make minor changes to the code and recompile. Eg. Instrumenting memory allocations.