11 ms·
This requires the attacker to sign an image with a private key which is owned by NXP or the Oem. A much larger hack! Now if they glitched the startup code befo
by demondemidi 3y ago
This requires the attacker to sign an image with a private key which is owned by NXP or the Oem. A much larger hack!
Now if they glitched the startup code before programming the vtor and setting up tz, wouldn’t that fault with the debugger AP active?
- zitterbewegung 3y agoIt’s a good advertisement or due diligence that they respect security and take it seriously.
- demondemidi 3y agoAny MCU manufacturer that wants to sell in the EU needs to adhere to RED/CRA, which outlines some pretty strict requirements. The implementaiton varies (e.g. PSA). It's consumer protection laws and not due-diligence that force this. Sure, some companies were using security to differentiate, but OEMs/ODMs didn't give a f__k until regulations made them. And this benefits us all.