Your Peripheral Has Planted Malware—An Exploit of NXP SOCs Vulnerability

The presentation discusses the vulnerability found in ARM Cortex M SOC and how it can be exploited to implant malware into the peripheral. The focus is on the security measures built within and around the chip, and how they can be bypassed.

• ARM Cortex M SOC vulnerability and how it can be exploited to change the SOC unique ID and write firmware or turn the device into a trojan or bot
• Breaking the security measures built within the SOC and bypassing the unique ID verification in secure boot
• Breaking the security measures built around the SOC and writing into the firmware
• Recommendations for chip users to prevent such vulnerabilities

The presentation provides examples of attacks, such as modifying the Remora of a promoter cell to talk linear by cellular user, and discusses the implementation of secure boot in various systems. It also highlights the importance of unique ID feature and customized bootloader to protect against readout and erasure of flash memory.

There are billions of ARM Cortex M based SOC being deployed in embedded systems. Most of these devices are Internet ready and definitely security is always the main concern. Vendors would always apply security measurements into the ARM Cortex M product for few major reasons: 1) People will not be able to copy and replicate the product; 2) License control for the hardware and software; 3) Prevent malicious code injection in to the firmware. Vendors normally rely on the security measurements built within the chip (unique ID number/signature) or security measurements built around the chip (secure boot).In this talk, we will share the ARM Cortex M SOC vulnerability that we discovered and it will be two parts:The first is security measurement build within the SOC and how we break it. We could gain control of changing the SOC unique ID and write the firmware or even turn the device into a trojan or bot.The second is security measure built around the SOC and how we break the Secure Boot elements and write into the firmware.