Researchers at University of Tel Aviv discovered "serious" design flaws in the encryption of Samsung smartphones that allow attackers to obtain the devices' encryption keys.
In addition, intruders could exploit Samsung's cryptographic errors - there are many CVEs - to degrade a device's security protocols. This of course makes phones vulnerable to attacks and in particular to a practice known as initialization vector IV attacks.
The design flaws primarily affect devices using ARM's TrustZone technology. TrustZone divides a phone into two parts, the Normal world (for running regular tasks like Android OS) and the Secure world, which handles the security subsystem and where all the sensitive pterms. Secure world is accessible only to trusted applications used for security-sensitive functions such as encryption.
Matthew Green, associate professor of computer science at the Johns Hopkins Information Security Institute, reported in Twitter that Samsung built "serious flaws" into the way its phones encrypt key hardware in TrustZone.
Ugh god. Serious flaws in the way Samsung phones encrypt key material in TrustZone and it's embarrassingly bad. They used a single key and allowed IV re-use. https://t.co/XteB3kc8cH pic.twitter.com/4wxA6XBuN2
- Matthew Green (@matthew_d_green) February 22, 2022
Samsung phones at stake right now are all the models that were released from the Galaxy S8 of 2017 to the Galaxy S21 of last year.
For more information:
threatpost.com
CVE-2021-25444, CVE-2021-25490
