Understanding the Security of ARM Debugging Features

Abstract

Processors nowadays are consistently equipped with debugging features to facilitate the program analysis. Specifically, the ARM debugging architecture involves a series of CoreSight components and debug registers to aid the system debugging, and a group of debug authentication signals are designed to restrict the usage of these components and registers. Meantime, the security of the debugging features is under-examined since it normally requires physical access to use these features in the traditional debugging model. However, ARM introduces a new debugging model that requires no physical access since ARMv7, which exacerbates our concern on the security of the debugging features. In this paper, we perform a comprehensive security analysis of the ARM debugging features, and summarize the security and vulnerability implications. To understand the impact of the implications, we also investigate a series of ARM-based platforms in different product domains (i.e., development boards, IoT devices, cloud servers, and mobile devices). We consider the analysis and investigation expose a new attacking surface that universally exists in ARM-based platforms. To verify our concern, we further craft NAILGUN attack, which obtains sensitive information (e.g., AES encryption key and fingerprint image) and achieves arbitrary payload execution in a high-privilege mode from a low-privilege mode via misusing the debugging features. This attack does not rely on software bugs, and our experiments show that almost all the platforms we investigated are vulnerable to the attack. The potential mitigations are discussed from different perspectives in the ARM ecosystem.

Evolution of Embedded Platform Security Technologies: Past, Present & Future Challenges

“…Both Arm TrustZone and Intel SGX security technologies use trust-based security. Being a passive defence method, it does not provide run-time respond and recover functions and found ineffective against wide-range of vulnerabilities and attacks specifically targeting run-time TEE and microarchitecture [6], [7], [12], [13], [16], [19], [20], [21], [22]. 2 Information Flow Tracking is an active defence method that provides run-time security against malicious attacks and software malfunction.…”

“…This includes the realisation of mix-critical applications, broader network connectivity, a need for code/data protection, isolation and segregation of resources leading to wider availability of embedded multiprocessing [6], [7], [9]. Where these computing platform advancements brought benefits, they have exposed platforms to wide-range security challenges due to increased system attack surface and micro-architecture vulnerabilities [12], [16], [17], [18], [19], [20], [21], [22].…”

“…This important secure software code is developed by the software/application developers, thus prone to human errors/bugs leading to vulnerabilities [7], [13] and microarchitectural side-channel leakage attacks e.g. Spectre [17], BOOMERANG [21], Nailgun [22].…”

“…Hex-FIVE MultiZone security technology introduces security through separation to approach security vulnerabilities [7], [13], [22] caused due to integration of untrusted third-party software (libraries, APIs, drivers) into TEE. It builds security boundaries by creating a policy-based security environment for the processor.…”

RAitc: Securely Auditing the Remotely Executed Applications

“…The executed program is also coded and stored in firmware; thus, it can be blocked by malicious BIOS tampering or bootkits [50]. Furthermore, if the local hardware or hypervisor RoTs are under attack, then the base of chain might be compromised [51], leading to verification errors. Another factor is flexibility: to ensure trustworthiness, users have fewer interfaces for accessing the trust base.…”