4 ms·
>2022-06-20: Quarkslab sent Google a new exploit that demonstrates code execution on the chip and exfiltration of encryption keys from it. A detailed descriptio
by ZeroCool2u 4y ago
>2022-06-20: Quarkslab sent Google a new exploit that demonstrates code execution on the chip and exfiltration of encryption keys from it. A detailed description of the exploitation technique, the exploit's source code, and a video showing its use to exfiltrate a StrongBox-protected AES key were provided.
This sounds close enough to me, but perhaps there's some subtle nuance between device keys and other keys in the chip.
- medo-bear 4y ago> perhaps there's some subtle nuance between device keys and other keys in the chip. Thats what im wondering too. particularly this line from mitigations section from the report >> However, we do want to point out an interesting feature that would have made the StrongBox key blob leak impossible. Indeed, an application can create a key that is authentication-bound, specifying setUserAuthenticationRequired(true) when building it with KeyGenParameterSpec. This way, users need to authenticate before using the key and the key blob is encrypted a second time using a special key derived from the user password that we do not have. so unless your phone doesnt have a password i dont see how they can retrieve device keys
- ZeroCool2u 4y agoYeah, okay I definitely missed that part. Makes more sense. Still, the bounty seems shockingly low. They probably could've gotten a lot more for it on the open market.
- medo-bear 4y agoyeah i think its a noteworthy attack and defn worth more than 10K. also google should be more open about how bug bounties are evaluated