CROWBAR: Natively Fuzzing Trusted Applications Using ARM CoreSight

Journal Article · Thu Jun 15 00:00:00 EDT 2023 · Journal of Hardware and Systems Security

DOI:https://doi.org/10.1007/s41635-023-00133-3· OSTI ID:1985308

Shan, Haoqi; Huang, Moyao; Liu, Yujia; Nissankararao, Sravani; Jin, Yier; Wang, Shuo; Sullivan, Dean

Abstract

Trusted execution environments (TEE) are deployed on many platforms to provide both confidentiality and integrity, and their extensive use offers a secure environment for privacy-sensitive operations. Despite TEE prevalence in the smartphone and tablet market, vulnerability research into TEE security is relatively rare. This is, in part, due to the strong isolation guarantees provided by its implementation. In this paper, we propose a hardware assisted fuzzing framework, CROWBAR, that bypasses TEE isolation to natively evaluate trusted applications (TAs) on mobile devices by leveraging ARM CoreSight components. CROWBAR performs feedback-driven fuzzing on commercial, closed source TAs while running in a TEE protected environment. We implement CROWBAR on 2 prototype commercial-off-the-shelf (COTS) smartphones and one development board, finding 3 unique crashes in 5 closed source TAs that are previously unreported in the TrustZone fuzzing literature.

• Sponsoring Organization: USDOE
• Grant/Contract Number: SC0018430
• OSTI ID: 1985308
• Journal Information: Journal of Hardware and Systems Security, Journal Name: Journal of Hardware and Systems Security Journal Issue: 2-3 Vol. 7; ISSN 2509-3428
• Publisher: Springer Science + Business Media
• Country of Publication: Country unknown/Code not available
• Language: English