Publications
Defeating Cisco Trust Anchor: A Case-Study of Recent Advancements in Direct FPGA Bitstream Manipulation
USENIX:WOOT - 2019
We present an analysis of the efficacy of Cisco TAm and discuss both the high-level architectural flaws of the TAm as well as implementation specific vulnerabilities in a TAm protected Cisco router. By combining techniques presented in this paper with other recent advancements in FPGA bitstream manipulation, we demonstrate the feasibility of reliable remote exploitation of all Cisco TAms implemented using Xilinx Spartan-6 FPGAs. The TAm exploit described in this paper allows the attacker to fully bypass all Trust Anchor functionality, including hardware-assisted secure boot, and to stealthily inject persistent malicious implants within both the TAm FPGA and the application processor. Lastly, we discuss the applicability of our bitstream manipulation techniques to other FPGA-based devices and propose several practical mitigations.
Defeating Modern Secure Boot Using Second-Order Pulsed Electromagnetic Fault Injection
USENIX:WOOT - 2017
We present a novel method of leveraging controlled electromagnetic pulses to attack modern computers using second-order effects of induced faults across multiple components of the target computer. Second, we present the design and implementation of BADFET: a low-cost, high-performance pulsed EMFI platform. We aim to share BADFET with the research community in order to democratize future EMFI research. Using these two contributions, we present a reliable and effective attack against a widely used TrustZone-based secure boot implementation on a multi-core 1Ghz+ ARM embedded system. Additionally, we disclose two novel vulnerabilities within a widely used implementation of TrustZone SMC in Appendix A.
SoK: Privacy on Mobile Devices – It’s Complicated
PETS - 2016
In this work, we survey the numerous components of mobile devices, giving particular attention to those that collect, process, or protect users’ private data. Where as the individual components have been generally well studied and understood, examining the entire mobile de-vice ecosystem provides significant insights into its over-whelming complexity. The numerous components of this complex ecosystem are frequently built and controlled by different parties with varying interests and incentives. Moreover, most of these parties are unknown to the typical user. The technologies that are employed to protect the users’ privacy typically only do so within a small slice of this ecosystem, abstracting away the greater complexity of the system. Our analysis suggests that this abstracted complexity is the major cause of many privacy-related vulnerabilities, and that a fundamentally new, holistic, approach to privacy is needed going forward. We thus highlight various existing technology gaps and propose several promising research directions for addressing and reducing this complexity
Convulsive seizure detection and notification system (Patent)
A convulsive seizure detection and notification device includes an acceleration module to measure acceleration of a body part of a user and generate acceleration measurement values, a storage to store a first threshold value and a second threshold value, and a data processor to compare acceleration measurement data with the first and second threshold values and generate a signal if a predetermined relationship between the acceleration measurement data and the first and second threshold values is satisfied.