Half-blind attacks: Mask ROM bootloaders are dangerous

3rd USENIX Workshop on Offensive Technologies, WOOT 2009

Volumn , Issue , 2009, Pages

  Goodspeed, Travis ^b   Francillon, Aurélien ^a  

^a INRIA Rhône Alpes   (United Kingdom)

^b NONE

Author keywords

[No Author keywords available]

Indexed keywords

BUFFER STORAGE;

BOOT LOADERS; BRUTE FORCE; BUFFER OVERFLOWS; ENTRY POINT; EXTRACTION TECHNIQUES; PRACTICAL METHOD; RETURN-ORIENTED PROGRAMMING; SOFTWARE VULNERABILITIES;

FIRMWARE;

EID: 85084164484     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: None     Document Type: Conference Paper

References (14)

1. ATMEL INC. AT91 ARM Thumb-based microcontrollers. Atmel documentation DOC6175, December 2008.
2. BECHER, A., BENENSON, Z., AND DORNSEIF, M. Tampering with motes: Real-world physical attacks on wireless sensor networks. In SPC (2006), pp. 104–118.
3. FRANCILLON, A., AND CASTELLUCIA, C. Code injection attacks on Harvard-architecture devices. In CCS (2008).
4. GOODSPEED, T. Stack overflow exploits of 802.15.4 wireless sensors. Toorcon, September 2007.
5. GOODSPEED, T. MSP430 BSL passwords: Brute force estimates and defenses, June 2008.
6. GOODSPEED, T. Practical attacks against the MSP430 BSL. 25C3, December 2008.
7. GOODSPEED, T. A side-channel timing attack of the MSP430 BSL. Black Hat USA, August 2008.
8. MAXIM. MAXQ family user’s guide: MAXQ3210/MAXQ3212 supplement, 2006.
9. NERGAL. The advanced return-into-lib(c) exploits (pax case study). Phrack Magazine 58, 4 (2001).
10. SCHAUER, S. Features of the MSP430 bootstrap loader. TI Application Report SLAA089D, August 2006.
11. SHACHAM, H. The geometry of innocent flesh on the bone: return-into-libc without function calls (on the x86). In CCS (2007).
12. SHACHAM, H., PAGE, M., PFAFF, B., GOH, E.-J., MODADUGU, N., AND BONEH, D. On the effectiveness of address-space randomization. In CCS (2004).
13. SKOROBOGATOV, S. P. Semi-invasive attacks – A new approach to hardware security analysis. Doctor of Philosophy, University of Cambridge, 2005. ISBN 9729961506.
14. SOLAR DESIGNER. return-to-libc attack. Bugtraq mailing list, August 1997.