BarriCCAde: Isolating Closed-Source Drivers with ARM CCA - Schulze, Sven Matti; Lindenmeier, Christian; Röckl, Jonas (2024 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW), 2024)
Due to the nature of monolithic kernels, a driver's vulnerability always results in a vulnerable kernel, as disas-trous examples show. Some research aims to solve this issue by isolating drivers from the main kernel. The most promising approaches rely on virtualization techniques. However, as they usually require driver and kernel modification, they can only be applied to open-source drivers. As closed-source drivers are also standard these days, e.g., for GPUs or anti-cheat tools, we propose BarriCCAde, a new design for isolating even closed -source drivers from the kernel. Most notably, BarriCCAde allows driver isolation without adding a hypervisor to the TCB. Relying on upcoming confidential computing techniques, we only add small-scale memory protection components to our TCB. Contemporary approaches focus on deciding which of the kernel's resources the driver may access and how they can be synchronized between the kernel and the driver. However, one aspect mainly ignored is cases in which the driver misuses kernel resources it can access to attack the system, e.g., by crafting malicious inputs for kernel functions. To cover such cases, we integrate an eBPF -based filter into our system architecture, which allows a fine-granular specification of which kernel-level resource can be accessed in which way. We believe that BarriCCAde is an important step towards isolating future closed-source drivers and, thus, strengthening the confidentiality, integrity, and availability of future kernel

Conditional Network Availability: Enhancing Connectivity Guarantees for TEE-Based Services - Röckl, Jonas; Lindenmeier, Christian; Schulze, Sven Matti; Müller, Tilo (2024 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW), 2024)
Trusted Execution Environments (TEEs) are widely available, allowing the isolation of security-sensitive trusted services from an untrusted commodity OS. Driven by manifold use cases, more and more trusted services requiring network connectivity are developed. Typically, the traffic of trusted services is routed through the OS, while cryptography ensures confidentiality and integrity. However, the extent to which TEEs can also help to provide network availability for trusted services remains underexplored. We introduce Conditional Network Availability (CNA) as a novel concept for TEE-based networking, ensuring that a trusted service can process network traffic, whenever the potentially malicious OS can do so. Our concept prevents an attacker from monopolizing the network channel (e.g., for a botnet campaign). TEE-based remote device management, system monitoring, and intrusion detection systems can profit from our concept. Proposing a split-driver model, we implement a proof-of-concept on real hardware, multiplexing a complex Ethernet interface between the OS and the ARM TrustZone TEE. Our evaluation shows that our system achieves near-native throughput while keeping the additions to the TCB small.<br
Keywords: Multiplexing; Manifolds; Program processors; Intrusion detection; Ethernet; Telecommunication traffic; Throughput

IlluminaTEE: Effective Man-At-The-End Attacks from within ARM TrustZone - Schulze, Sven Matti; Lindenmeier, Christian; Röckl, Jonas; Freiling, Felix (CheckMATE '24: Proceedings of the 2024 Workshop on Research on offensive and defensive techniques in the context of Man At The End (MATE) attacks, 2024)
To break end-to-end encryption used by apps (e.g., messengers) today, attackers must obtain code execution directly on an end device to access data before it is encrypted, resulting in Man-At-The-End (MATE) attacks. The effectiveness of such attacks rises with the privilege level the code is executed on, e.g., the system or hypervisor level employing techniques such as virtual machine introspection (VMI). Another option to perform MATE attacks is to place software in trusted execution environments (TEEs), as on many platforms, these have the highest privilege while also providing security guarantees. However, unlike hypervisors, TEEs were primarily built to achieve isolation and not introspection. For this reason, TEEs usually lack technical means like hardware breakpoints, apparently limiting the possibilities of fine-grained system monitoring. By presenting IlluminaTEE, a sophisticated TEE-based introspection tool, we show that TEE-based introspection is as powerful as VMI. By applying a novel technique which we call state-change trapping, we show that IlluminaTEE can extract highly ephemeral personal data from arbitrary applications. We implement IlluminaTEE as an extension to the TEE firmware of real hardware with a stock version of Android and demonstrate that we can extract the encryption keys of the Signal messenger, one of the most highly ephemeral and privacy-critical bits of data existing on personal devices today. This highlights the need to implement better software protection mechanisms to mitigate the risks of powerful MATE attacker

SyncEmu: Enabling Dynamic Analysis of Stateful Trusted Applications - Lindenmeier, Christian; Schulze, Sven Matti; Röckl, Jonas; Busch, Marcel (2024 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW), 2024)
Modern mobile devices leverage ARM TrustZone to implement a Trusted Execution Environment (TEE). The security-critical services, called Trusted Applications (TAs), deployed in these TEEs form the backbone of those devices' security architectures. Unfortunately, TAs are not free from bugs and constitute the biggest attack surface of the TEE. A vulnerability in a TA can have devastating consequences, fundamentally compromising the whole system's security. Given the locked-down nature of COTS smartphones, the analysis of closed-source TAs remains challenging for independent security researchers. In this paper, we present SyncEmu to enable dynamic analysis of proprietary TAs found on COTS Android devices. To this end, we develop a framework to execute unmodified TEE firmware in an emulated environment (so-called rehosting). Using SyncEmu, we successfully rehost TrustedCore, a closed-source TEE implementation found on older Huawei devices. Furthermore, we propose and implement a novel technique called CA-in-the-loop, that allows SyncEmu to forward realistic requests of Client Applications (CAs) running on a physical smartphone to the rehosted TAs, pushing the boundaries of state-of-the-art in TEE rehosting.<br