#HITB2018AMS D1T1 - Real World Attacks Against Secure Elements

### Overview In this talk, security researcher Don analyzes the fundamental architectural limitations of secure elements deployed at scale, focusing specifically on Apple's Wireless Accessory Configuration (WAC) and Made for iPhone (MFI) chip ecosystem. Drawing an analogy to Capgras syndrome—where a person believes a familiar entity has been replaced by an impostor—the speaker demonstrates how IoT provisioning mechanisms fail to establish a trusted chain of identity between an accessory's application processor, the external secure element, and the configuring mobile device.

### Key Topics - **IoT Identity and Secure Elements at Scale**: The challenge of provisioning millions of embedded devices securely without ballooning manufacturing complexity and cost. - **Apple WAC and MFI Architecture**: How iOS configures Wi-Fi and network credentials on IoT accessories using MFI authentication chips. - **Threat Models of Secure Elements**: An analysis of three standard architectural models: the flash/no-SE model, the external secure element model (e.g., Apple MFI, Ledger Nano S), and the internal element/ARM TrustZone model. - **Man-in-the-Middle Provisioning Exploits**: Spoofing WAC beacons and relaying authentication traffic to coerce devices into leaking Wi-Fi provisioning credentials.

### Technical Details Apple's WAC protocol allows an iOS device to discover an unconfigured accessory via Wi-Fi beacons and provision credentials over HTTP to an embedded MFI chip. The MFI chip securely signs authentication challenges to verify itself as a legitimate Apple-authorized accessory. However, because the accessory's application processor (typically a low-cost microcontroller such as an ARM Cortex-M0+) lives in an insecure world and ultimately requires the Wi-Fi credentials to join the network, the credentials held in escrow by the MFI chip must eventually be handed off across an unauthenticated physical bus.

The speaker exploits this architectural gap using a test harness consisting of: - **hostapd**: Configured with a Wi-Fi vendor-specific element (Type `0xDD`) containing Apple’s OUI (`00:0A:F5` / `00:0a:f0`) to advertise a rogue access point as a WAC-compatible accessory. - **mDNS Forwarding (`fling` and `moops`)**: Because iOS looks for MFI configuration over multicast DNS, the speaker used custom Python tooling (`moops` / My Object-Oriented Packet Spoofer and a relay script named `fling`) to rewrite and bridge multicast frames across distinct network interfaces. - **Instrumented Target Accessory**: By flashing custom firmware onto a compromised MFI-bearing accessory (or communicating over a serial UART interface), the attacker acts as a man-in-the-middle between iOS and the real MFI chip. When iOS attempts to configure the device, the setup requests are relayed to the MFI chip, authenticating the exchange and prompting iOS to transmit network provisioning keys to the attacker.

The speaker compares this to Salim Rashid's attack on the Ledger Nano S, where the application processor tricks the external secure element by manipulating flash memory mappings during validation. Both illustrate that external secure elements cannot reliably attest to the integrity or identity of the application processors communicating with them.

### Takeaways The speaker highlights that the core failure in external secure element architectures is the lack of mutual attestation between the application processor and the secure element: the SE only authenticates its own silicon, not the surrounding host system. While internal hardware security architectures like ARM TrustZone mitigate bus sniffing, they introduce proprietary black-box implementations and often leave external DDR RAM buses unencrypted. Remediating these vulnerabilities across large-scale ecosystems requires coordinated protocol updates, application specification redesigns, and costly per-device manufacturing key injection. Consequently, these architectural gaps persist across consumer IoT ecosystems.