Terrorist Phone Unlocking 101

No ratings

Presented at bluehat 2018 by

The widely misreported realm of mobile phone unlocking and forensic extraction has significantly developed in the last few years.What was once a native ground for lab geeks who probe for forgotten JTAG interfaces or handle hot air blowers to carefully remove shielding and expose eMMC chips for ISP readings, has shifted into a domain where the art of vulnerability research and exploitation sets the tone to dictate whether a device can be forensically extracted or not.Behind the scenes, a silent but breathtaking arms race of exploits and mitigations is taking place. For the first time, researchers from Cellebrite's world-leading forensics research lab - will uncover a part of that ongoing story.During this talk, we will introduce the audience to the unique and often disregarded technical challenges to the forensic extraction world (hint: do RCE attackers even consider encryption?) and navigate a complete extraction scenario for a popular encrypted phone model.This talk will feature a complete walk-though for the discovery, analysis and exploitation of a never-before-detailed extraction-enabling BootROM vulnerability present in modern day phones. This vulnerability is already known to the affected vendor and was patched and fixed in newer versions.