Make Remote Forensic Investigations Forensic Again: Increasing the Evidential Value of Remote Forensic Investigations - Busch, Marcel; Nicolai, Florian; Fleischer, Fabian; Rückert, Christian; Safferling, Christoph; Freiling, Felix (Digital Forensics and Cyber Crime, 2021)
Due to the increasing use of encrypted communication and anonymous services, many countries introduced new regulations that allow law enforcement to perform remote forensic investigations. During such investigations, law enforcement agencies secretly obtain remote access to a suspect’s computer to search for and collect evidence, including full copies of the (unencrypted) communication data. In this paper, we argue that the evidential value of the acquired evidence can be substantially increased by two technical methods: (1) employing integrity verification techniques offered by secure hardware, and (2) exfiltrating the decryption key of encrypted communication only in order to decrypt communication obtained by lawful interception. To prove the practicality of both methods, we design and implement TEE-BI, a solution for Trusted Execution Environment-based introspection. We deploy TEEBI on an Android-based hardware platform featuring an ARM Trust- Zone and demonstrate the stealthy extraction of Secure Sockets Layer encryption keys from an Android userland application. We evaluate the effectiveness, performance, and compatibility of our prototype and argue that it provides a much higher level of evidential value than (the known) existing remote forensic software systems.<br
Keywords: IT Forensics; Cybercrime; Criminal Proceedings; Investigation; Evidential Value; Trust Zone

Memory corruption attacks within Android TEEs: A case study based on OP-TEE - Fleischer, Fabian; Busch, Marcel; Kuhrt, Phillip (ACM International Conference Proceeding Series, 2020)
Many security-critical services on mobile devices rely on Trusted Execution Environments (TEEs). However, due to the proprietary and locked-down nature of TEEs, the available information about these systems is scarce. In recent years, we have witnessed several exploits targeting all major commercially used TEEs, which raises questions about the capabilities of TEEs to provide the expected integrity and confidentiality guarantees. In this paper, we evaluate the exploitability of TEEs by analyzing common flaws from the perspective of an adversary. We provide multiple vulnerable TEE applications for OP-TEE, a reference implementation for TEEs, and elaborate on the steps necessary for their exploitation on an Android system. Our vulnerable examples are inspired by real-world exploits seen in-the-wild on commercially used TEEs. With this work, we provide developers and researchers with introductory knowledge to realistically assess the capabilities of TEEs. For these purposes, we also make our examples publicly available.
CRIS-Team Scopus Importer:2020-09-18
Keywords: ARM TrustZone; Exploitation; TEE; Trusted applications