Beyond the Hype: Guanxing on Exploiting Crypto Phones and the Evolution of Security Research

### Overview In this post-talk interview, security researcher Gwen Chen (referred to at the end as Guangcheng) from CertiK discusses his research into exploiting crypto phones and Ethereum wallets with interviewer Meltem Ozsoy (Intuitive Surgical) and a co-interviewer. The discussion covers his live demonstration of a USB-based exploit, the role of generative AI in reverse engineering, architectural flaws in crypto phones, and how researchers select emerging hardware and Web3 targets.

### Key Topics - **Live Exploit Demos**: Chen reflected on delivering a live hardware exploit via USB to compromise an Ethereum wallet/phone. Because the attack utilized a physical USB connection rather than wireless vectors like Bluetooth or network connections, it was stable enough for a live stage demonstration. - **Impact of AI on Security Research**: Chen broke down how tools like ChatGPT accelerated his reverse engineering workflow. Tasks like reverse engineering complex functions that previously took months were solved almost instantly by AI. However, he noted AI "took the fun" out of the research process, making the researcher feel like an agent being directed rather than an explorer, while stressing that domain knowledge in areas like TrustZone and boot ROMs is still mandatory to identify AI hallucinations and steer inquiries accurately. - **Crypto Phone Architecture and Vendor Shortcuts**: The core premise of crypto phones is securing transactions and keys in trusted execution environments or hardware enclaves rather than regular userland Android space. While major manufacturers implement robust protections, smaller vendors often lack access to proprietary SDKs and relationships with chipset makers (e.g., Qualcomm, MediaTek) or Google, leading them to cut corners and downgrade security. - **Target Selection in Web3**: Chen explained that the Web3 hardware ecosystem evolves so rapidly—ranging from hardware wallets and crypto POS terminals to DePIN devices and crypto phones—that new targets present themselves constantly without needing extensive searching.

### Technical Details - **Exploit Vector**: Chen conducted a boot ROM exploitation delivered over USB to extract unencrypted keys from the crypto phone's Ethereum wallet in under a month. - **Hardware Isolation vs. Boot ROM Flaws**: Chen highlighted that while a boot ROM exploit is severe, it does not automatically necessitate total system compromise if defense-in-depth is present. For example, Apple mitigated the "checkmate" boot ROM vulnerability using an isolated Secure Enclave Processor (SEP). Similarly, crypto phone vendors can utilize isolated secure chips or additional Android application-level obstacles to prevent access to keys even during low-level execution compromises.

### Takeaways - Consumers and researchers should look beyond vendor marketing hype and white papers when evaluating crypto phones. - Device trustworthiness should be judged by independent external evaluations, transparent bug bounty programs, responsible disclosure channels, and vendor reputation. - Moving forward, Chen plans to shift focus toward more challenging hardware targets featuring newer technologies, such as hardware wallets incorporating iris biometric scanning.