Breaking Samsung's ARM TrustZone

## Overview

Maksim Potala (Quarks Lab, French security company) presented research on exploiting Samsung's ARM TrustZone implementation (conducted over ~1 year with collaborators Alex Adams and Refer Get). TrustZone is a system-wide hardware isolation mechanism providing trusted execution environments (TEEs) to protect sensitive operations from normal-world compromise. Evolution of embedded security shows repeated failure of software-only approaches: kernel compromise leads to full system compromise. TrustZone addresses this by leveraging hardware partitioning to create two isolated CPU states (secure and non-secure) where even compromised normal-world OS cannot access secure-world resources. Samsung uses TrustZone extensively for DRM, cryptographic operations, credential storage, and critical security features like RKP (Real-time Kernel Protection). The research demonstrates practical exploitation techniques defeating TrustZone isolation on Samsung devices—circumventing the hardware-backed security model intended to protect sensitive data and operations.

## TrustZone Architecture and State Management

**Hardware Isolation Fundamentals**: TrustZone is a system-wide two-layer isolation architecture. Hardware layer partitions SoC databus and control bus into secure and non-secure regions; resources (peripherals, memory) assigned to respective domains. Software layer implements actual secure code and trusted applications running in secure state. Two isolation domains: (1) Secure World—runs trusted code and sensitive operations (cryptographic engines, credential storage); (2) Normal World—runs untrusted code (Android OS on Samsung devices), assumed "compromised by design."

**CPU State and NS Bit**: Secure/non-secure CPU state determined by NS (Non-Secure) bit in secure configuration register (SCR). NS bit cleared = secure state; NS bit set = non-secure state. Hardware enforces state-based access control: non-secure state code cannot access secure-world resources regardless of privilege level. State transitions involve Secure Monitor, the highest-privilege execution layer.

**Exception Levels (Privilege Hierarchy)**: ARM privilege separation across exception levels: (1) EL0—user applications; (2) EL1—operating system kernel; (3) EL2—hypervisor (not available in secure world currently, planned for v8.4); (4) EL3—Secure Monitor (runs at highest privilege, orchestrates secure/non-secure world transitions). Critical design flaw: no hypervisor in secure world = EL1 code in secure world (OS kernel) has direct access to same resources as EL3 (Secure Monitor). Privilege escalation occurs by design if attacker gains EL1 code execution in secure world.

**Secure Monitor and World Switches**: Secure Monitor runs at EL3 (highest privilege) and mediates transitions between secure and non-secure worlds. Communication mechanisms: (1) SMC (Secure Monitor Call) instruction—explicit call from normal world to trigger secure operation; (2) Interrupts/exceptions—external events trigger world switch; (3) Direct CSR writes—code in EL1 (secure kernel) can directly manipulate CPU state via PSTATE register or CPS instruction (ARMv7). Non-secure world cannot directly manipulate CPU state.

## Secure World Implementation and Samsung's TrustZone Usage

**TrustZone Implementations**: (1) Full-featured Secure OS (Qualcomm QSEE, Samsung Knox)—complete OS kernel in secure world loading trusted applications (TAs) serving as security service providers; (2) Lightweight synchronous library (Nintendo Switch model)—cryptographic library exposed as SMC API; normal world calls perform crypto in secure world; secret keys stored only in secure world; (3) Intermediate options—theoretical hybrids not observed in practice.

**Hardware-Backed Security Services**: TrustZone secures access to: (1) Cryptographic engines—accelerated encryption/decryption unavailable to normal world; (2) Credential/key storage—secure storage inaccessible from normal world; (3) TRNG (True Random Number Generator)—hardware-based random number source; (4) DRM systems—content decryption keys protected in secure world.

**Samsung-Specific Security Features**: Samsung deploys additional protections layered on TrustZone: (1) RKP (Real-time Kernel Protection)—secure kernel monitors normal-world kernel for integrity violations, patches exploited kernel functions at runtime; (2) PKM (Periodic Kernel Measurements)—periodic cryptographic validation of normal-world kernel to detect tampering; (3) Knox security platform—uses TrustZone for attestation and sensitive operation protection. These features attempt to defend even compromised normal-world OS from persistent exploitation.

**Exploitation Implications**: Successful TrustZone exploitation allows: (1) breaking hardware-enforced isolation between secure/normal worlds; (2) executing arbitrary code in secure world; (3) accessing protected cryptographic keys and credential storage; (4) bypassing RKP/PKM protections by gaining secure-world code execution; (5) disabling DRM and extracting content decryption keys. Hardware isolation failure defeats all software protections layered on top.