02 Travel Differently with Ecomantra - north west & central rajasthan differently
They tried to think differently - Sooner or later€¦ · What's common in Oracle and Samsung? They...
Transcript of They tried to think differently - Sooner or later€¦ · What's common in Oracle and Samsung? They...
![Page 1: They tried to think differently - Sooner or later€¦ · What's common in Oracle and Samsung? They tried to think differently... László Tóth, Ferenc Spala 28/09/2013 @ DerbyCon](https://reader035.fdocuments.us/reader035/viewer/2022062607/60544469214aad130b62e58e/html5/thumbnails/1.jpg)
What's common in Oracle and Samsung? They tried to think differently...
László Tóth, Ferenc Spala
28/09/2013 @ DerbyCon 3.0
1Saturday, September 28, 13
![Page 2: They tried to think differently - Sooner or later€¦ · What's common in Oracle and Samsung? They tried to think differently... László Tóth, Ferenc Spala 28/09/2013 @ DerbyCon](https://reader035.fdocuments.us/reader035/viewer/2022062607/60544469214aad130b62e58e/html5/thumbnails/2.jpg)
Capital Budapest
Area 35 919 sq mi
Population 9.9 million
Language Hungarian
Internet TDL .hu
Worth reading:http://9gag.com/gag/
6832266
2Saturday, September 28, 13
![Page 3: They tried to think differently - Sooner or later€¦ · What's common in Oracle and Samsung? They tried to think differently... László Tóth, Ferenc Spala 28/09/2013 @ DerbyCon](https://reader035.fdocuments.us/reader035/viewer/2022062607/60544469214aad130b62e58e/html5/thumbnails/3.jpg)
Who are we?
• @Work: Pentest, Vuln. assessment, Security audits ...
• László
• 12+ years ITSec
• Ferenc
• 6+ years ITSec
• Speakers @ DerbyCon 2.0
• Members of Hacktivity Team
• Co-founders of Hekkcamp
3Saturday, September 28, 13
![Page 4: They tried to think differently - Sooner or later€¦ · What's common in Oracle and Samsung? They tried to think differently... László Tóth, Ferenc Spala 28/09/2013 @ DerbyCon](https://reader035.fdocuments.us/reader035/viewer/2022062607/60544469214aad130b62e58e/html5/thumbnails/4.jpg)
Where does the fun begin?
• Samsung phone encryption
• Samsung SD card encryption
• Introduction of a new framework
• Oracle link password encryption
Android world
Android world
TOOL world
Odd-one-out
Sorry we have not played with Knox yet.
4Saturday, September 28, 13
![Page 5: They tried to think differently - Sooner or later€¦ · What's common in Oracle and Samsung? They tried to think differently... László Tóth, Ferenc Spala 28/09/2013 @ DerbyCon](https://reader035.fdocuments.us/reader035/viewer/2022062607/60544469214aad130b62e58e/html5/thumbnails/5.jpg)
Samsung phone encryption
It is Android but... “We are different than the others!”
Part 1
5Saturday, September 28, 13
![Page 6: They tried to think differently - Sooner or later€¦ · What's common in Oracle and Samsung? They tried to think differently... László Tóth, Ferenc Spala 28/09/2013 @ DerbyCon](https://reader035.fdocuments.us/reader035/viewer/2022062607/60544469214aad130b62e58e/html5/thumbnails/6.jpg)
WARNING!!!
When we mention S2, S3 and S4, we mean:
• Samsung S2 -> 4.0.3 -> IML74K.XWLP7
• Samsung S3 -> 4.1.2 -> JZO54K.I9300XXEMC2
• Samsung S4 -> 4.2.2 -> JDQ.I9505XXUBMEA
6Saturday, September 28, 13
![Page 7: They tried to think differently - Sooner or later€¦ · What's common in Oracle and Samsung? They tried to think differently... László Tóth, Ferenc Spala 28/09/2013 @ DerbyCon](https://reader035.fdocuments.us/reader035/viewer/2022062607/60544469214aad130b62e58e/html5/thumbnails/7.jpg)
What’s the point?
• Android supports disk encryption from version 3
• In case of phones it supports from version 4
• The algorithm is known...
7Saturday, September 28, 13
![Page 8: They tried to think differently - Sooner or later€¦ · What's common in Oracle and Samsung? They tried to think differently... László Tóth, Ferenc Spala 28/09/2013 @ DerbyCon](https://reader035.fdocuments.us/reader035/viewer/2022062607/60544469214aad130b62e58e/html5/thumbnails/8.jpg)
What’s the point?
• Android supports disk encryption from version 3
• In case of phones it supports from version 4
• The algorithm is known...
boring
The
logo
is a
regi
ster
ed tr
adem
ark
of K
FC
7Saturday, September 28, 13
![Page 9: They tried to think differently - Sooner or later€¦ · What's common in Oracle and Samsung? They tried to think differently... László Tóth, Ferenc Spala 28/09/2013 @ DerbyCon](https://reader035.fdocuments.us/reader035/viewer/2022062607/60544469214aad130b62e58e/html5/thumbnails/9.jpg)
What’s the point?
• Android supports disk encryption from version 3
• In case of phones it supports from version 4
• The algorithm is known...
boring
The
logo
is a
regi
ster
ed tr
adem
ark
of K
FC
But Samsung thinks differently
7Saturday, September 28, 13
![Page 10: They tried to think differently - Sooner or later€¦ · What's common in Oracle and Samsung? They tried to think differently... László Tóth, Ferenc Spala 28/09/2013 @ DerbyCon](https://reader035.fdocuments.us/reader035/viewer/2022062607/60544469214aad130b62e58e/html5/thumbnails/10.jpg)
Normal way
8Saturday, September 28, 13
![Page 11: They tried to think differently - Sooner or later€¦ · What's common in Oracle and Samsung? They tried to think differently... László Tóth, Ferenc Spala 28/09/2013 @ DerbyCon](https://reader035.fdocuments.us/reader035/viewer/2022062607/60544469214aad130b62e58e/html5/thumbnails/11.jpg)
Normal way
password
8Saturday, September 28, 13
![Page 12: They tried to think differently - Sooner or later€¦ · What's common in Oracle and Samsung? They tried to think differently... László Tóth, Ferenc Spala 28/09/2013 @ DerbyCon](https://reader035.fdocuments.us/reader035/viewer/2022062607/60544469214aad130b62e58e/html5/thumbnails/12.jpg)
Normal way
password PBKDF2
8Saturday, September 28, 13
![Page 13: They tried to think differently - Sooner or later€¦ · What's common in Oracle and Samsung? They tried to think differently... László Tóth, Ferenc Spala 28/09/2013 @ DerbyCon](https://reader035.fdocuments.us/reader035/viewer/2022062607/60544469214aad130b62e58e/html5/thumbnails/13.jpg)
Normal way
partition footer
/efs/metadata
password PBKDF2
or
8Saturday, September 28, 13
![Page 14: They tried to think differently - Sooner or later€¦ · What's common in Oracle and Samsung? They tried to think differently... László Tóth, Ferenc Spala 28/09/2013 @ DerbyCon](https://reader035.fdocuments.us/reader035/viewer/2022062607/60544469214aad130b62e58e/html5/thumbnails/14.jpg)
Normal way
partition footer
/efs/metadata
password PBKDF2
AES128
or
8Saturday, September 28, 13
![Page 15: They tried to think differently - Sooner or later€¦ · What's common in Oracle and Samsung? They tried to think differently... László Tóth, Ferenc Spala 28/09/2013 @ DerbyCon](https://reader035.fdocuments.us/reader035/viewer/2022062607/60544469214aad130b62e58e/html5/thumbnails/15.jpg)
Normal way
partition footer
/efs/metadata
password PBKDF2
AES128
orEDK
8Saturday, September 28, 13
![Page 16: They tried to think differently - Sooner or later€¦ · What's common in Oracle and Samsung? They tried to think differently... László Tóth, Ferenc Spala 28/09/2013 @ DerbyCon](https://reader035.fdocuments.us/reader035/viewer/2022062607/60544469214aad130b62e58e/html5/thumbnails/16.jpg)
Normal way
partition footer
/efs/metadata
password PBKDF2
AES128 dmcrypt
orEDK
DEK
8Saturday, September 28, 13
![Page 17: They tried to think differently - Sooner or later€¦ · What's common in Oracle and Samsung? They tried to think differently... László Tóth, Ferenc Spala 28/09/2013 @ DerbyCon](https://reader035.fdocuments.us/reader035/viewer/2022062607/60544469214aad130b62e58e/html5/thumbnails/17.jpg)
Normal way
partition footer
/efs/metadata
password PBKDF2
AES128 dmcrypt
or
c=2000
EDK
DEK
8Saturday, September 28, 13
![Page 18: They tried to think differently - Sooner or later€¦ · What's common in Oracle and Samsung? They tried to think differently... László Tóth, Ferenc Spala 28/09/2013 @ DerbyCon](https://reader035.fdocuments.us/reader035/viewer/2022062607/60544469214aad130b62e58e/html5/thumbnails/18.jpg)
Normal way
partition footer
/efs/metadata
password PBKDF2
AES128 dmcrypt
or
c=2000
aes-cbc-essiv:sha256keylen=128
EDK
DEK
8Saturday, September 28, 13
![Page 19: They tried to think differently - Sooner or later€¦ · What's common in Oracle and Samsung? They tried to think differently... László Tóth, Ferenc Spala 28/09/2013 @ DerbyCon](https://reader035.fdocuments.us/reader035/viewer/2022062607/60544469214aad130b62e58e/html5/thumbnails/19.jpg)
Normal way
partition footer
/efs/metadata
password PBKDF2
AES128 dmcrypt
or
c=2000
aes-cbc-essiv:sha256keylen=128
EDK
DEK
http://xelusprime.wix.com/ettiennev
8Saturday, September 28, 13
![Page 20: They tried to think differently - Sooner or later€¦ · What's common in Oracle and Samsung? They tried to think differently... László Tóth, Ferenc Spala 28/09/2013 @ DerbyCon](https://reader035.fdocuments.us/reader035/viewer/2022062607/60544469214aad130b62e58e/html5/thumbnails/20.jpg)
Normal way
9Saturday, September 28, 13
![Page 21: They tried to think differently - Sooner or later€¦ · What's common in Oracle and Samsung? They tried to think differently... László Tóth, Ferenc Spala 28/09/2013 @ DerbyCon](https://reader035.fdocuments.us/reader035/viewer/2022062607/60544469214aad130b62e58e/html5/thumbnails/21.jpg)
Normal way
Key length
9Saturday, September 28, 13
![Page 22: They tried to think differently - Sooner or later€¦ · What's common in Oracle and Samsung? They tried to think differently... László Tóth, Ferenc Spala 28/09/2013 @ DerbyCon](https://reader035.fdocuments.us/reader035/viewer/2022062607/60544469214aad130b62e58e/html5/thumbnails/22.jpg)
Normal wayEDKKey length
9Saturday, September 28, 13
![Page 23: They tried to think differently - Sooner or later€¦ · What's common in Oracle and Samsung? They tried to think differently... László Tóth, Ferenc Spala 28/09/2013 @ DerbyCon](https://reader035.fdocuments.us/reader035/viewer/2022062607/60544469214aad130b62e58e/html5/thumbnails/23.jpg)
Normal wayEDK
IV
Key length
9Saturday, September 28, 13
![Page 24: They tried to think differently - Sooner or later€¦ · What's common in Oracle and Samsung? They tried to think differently... László Tóth, Ferenc Spala 28/09/2013 @ DerbyCon](https://reader035.fdocuments.us/reader035/viewer/2022062607/60544469214aad130b62e58e/html5/thumbnails/24.jpg)
Normal wayEDK
IV
Key length Padding
9Saturday, September 28, 13
![Page 25: They tried to think differently - Sooner or later€¦ · What's common in Oracle and Samsung? They tried to think differently... László Tóth, Ferenc Spala 28/09/2013 @ DerbyCon](https://reader035.fdocuments.us/reader035/viewer/2022062607/60544469214aad130b62e58e/html5/thumbnails/25.jpg)
Samsung way
10Saturday, September 28, 13
![Page 26: They tried to think differently - Sooner or later€¦ · What's common in Oracle and Samsung? They tried to think differently... László Tóth, Ferenc Spala 28/09/2013 @ DerbyCon](https://reader035.fdocuments.us/reader035/viewer/2022062607/60544469214aad130b62e58e/html5/thumbnails/26.jpg)
Samsung way
password PBKDF2
partition footer
/efs/metadata
or
10Saturday, September 28, 13
![Page 27: They tried to think differently - Sooner or later€¦ · What's common in Oracle and Samsung? They tried to think differently... László Tóth, Ferenc Spala 28/09/2013 @ DerbyCon](https://reader035.fdocuments.us/reader035/viewer/2022062607/60544469214aad130b62e58e/html5/thumbnails/27.jpg)
Samsung way
password PBKDF2
HEX1
HEX2
partition footer
/efs/metadata
or
10Saturday, September 28, 13
![Page 28: They tried to think differently - Sooner or later€¦ · What's common in Oracle and Samsung? They tried to think differently... László Tóth, Ferenc Spala 28/09/2013 @ DerbyCon](https://reader035.fdocuments.us/reader035/viewer/2022062607/60544469214aad130b62e58e/html5/thumbnails/28.jpg)
Samsung way
password PBKDF2
HEX1
HEX2
AES256
AES256
partition footer
/efs/metadata
or
10Saturday, September 28, 13
![Page 29: They tried to think differently - Sooner or later€¦ · What's common in Oracle and Samsung? They tried to think differently... László Tóth, Ferenc Spala 28/09/2013 @ DerbyCon](https://reader035.fdocuments.us/reader035/viewer/2022062607/60544469214aad130b62e58e/html5/thumbnails/29.jpg)
Samsung way
password PBKDF2
HEX1
HEX2
AES256
AES256
partition footer
/efs/metadata
or
10Saturday, September 28, 13
![Page 30: They tried to think differently - Sooner or later€¦ · What's common in Oracle and Samsung? They tried to think differently... László Tóth, Ferenc Spala 28/09/2013 @ DerbyCon](https://reader035.fdocuments.us/reader035/viewer/2022062607/60544469214aad130b62e58e/html5/thumbnails/30.jpg)
Samsung way
password PBKDF2
HEX1
HEX2
AES256
AES256
XOR
XOR
partition footer
/efs/metadata
or
10Saturday, September 28, 13
![Page 31: They tried to think differently - Sooner or later€¦ · What's common in Oracle and Samsung? They tried to think differently... László Tóth, Ferenc Spala 28/09/2013 @ DerbyCon](https://reader035.fdocuments.us/reader035/viewer/2022062607/60544469214aad130b62e58e/html5/thumbnails/31.jpg)
Samsung way
password PBKDF2
HEX1
HEX2
AES256
AES256
XOR
XOR
partition footer
/efs/metadata
or
1st half of EDK
2nd half of EDK
10Saturday, September 28, 13
![Page 32: They tried to think differently - Sooner or later€¦ · What's common in Oracle and Samsung? They tried to think differently... László Tóth, Ferenc Spala 28/09/2013 @ DerbyCon](https://reader035.fdocuments.us/reader035/viewer/2022062607/60544469214aad130b62e58e/html5/thumbnails/32.jpg)
Samsung way
password PBKDF2
HEX1
HEX2
AES256
AES256
XOR
XOR
partition footer
/efs/metadata
orDEK
1st half of EDK
2nd half of EDK
10Saturday, September 28, 13
![Page 33: They tried to think differently - Sooner or later€¦ · What's common in Oracle and Samsung? They tried to think differently... László Tóth, Ferenc Spala 28/09/2013 @ DerbyCon](https://reader035.fdocuments.us/reader035/viewer/2022062607/60544469214aad130b62e58e/html5/thumbnails/33.jpg)
Samsung way
password PBKDF2
HEX1
HEX2
AES256
AES256
XOR
XOR
partition footer
/efs/metadata
orDEK
1st half of EDK
2nd half of EDK
1st h
alf o
f DEK
2nd
half o
f DEK
10Saturday, September 28, 13
![Page 34: They tried to think differently - Sooner or later€¦ · What's common in Oracle and Samsung? They tried to think differently... László Tóth, Ferenc Spala 28/09/2013 @ DerbyCon](https://reader035.fdocuments.us/reader035/viewer/2022062607/60544469214aad130b62e58e/html5/thumbnails/34.jpg)
Samsung way
password PBKDF2
HEX1
HEX2
AES256
AES256
XOR
XOR
partition footer
/efs/metadata
orDEK
1st half of EDK
2nd half of EDK
1st h
alf o
f DEK
2nd
half o
f DEK
dmcrypt
10Saturday, September 28, 13
![Page 35: They tried to think differently - Sooner or later€¦ · What's common in Oracle and Samsung? They tried to think differently... László Tóth, Ferenc Spala 28/09/2013 @ DerbyCon](https://reader035.fdocuments.us/reader035/viewer/2022062607/60544469214aad130b62e58e/html5/thumbnails/35.jpg)
Samsung way
password PBKDF2
HEX1
HEX2
AES256
AES256
XOR
XOR
partition footer
/efs/metadata
orDEK
1st half of EDK
2nd half of EDK
1st h
alf o
f DEK
2nd
half o
f DEK
dmcrypt
aes-cbc-essiv:sha256
10Saturday, September 28, 13
![Page 36: They tried to think differently - Sooner or later€¦ · What's common in Oracle and Samsung? They tried to think differently... László Tóth, Ferenc Spala 28/09/2013 @ DerbyCon](https://reader035.fdocuments.us/reader035/viewer/2022062607/60544469214aad130b62e58e/html5/thumbnails/36.jpg)
Samsung way
password PBKDF2
HEX1
HEX2
AES256
AES256
XOR
XOR
partition footer
/efs/metadata
orDEK
1st half of EDK
2nd half of EDK
1st h
alf o
f DEK
2nd
half o
f DEK
dmcrypt
aes-cbc-essiv:sha256
c=4096
10Saturday, September 28, 13
![Page 37: They tried to think differently - Sooner or later€¦ · What's common in Oracle and Samsung? They tried to think differently... László Tóth, Ferenc Spala 28/09/2013 @ DerbyCon](https://reader035.fdocuments.us/reader035/viewer/2022062607/60544469214aad130b62e58e/html5/thumbnails/37.jpg)
Samsung way
password PBKDF2
HEX1
HEX2
AES256
AES256
XOR
XOR
partition footer
/efs/metadata
orDEK
1st half of EDK
2nd half of EDK
1st h
alf o
f DEK
2nd
half o
f DEK
dmcrypt
aes-cbc-essiv:sha256
c=4096
FIPS documentation helped 140sp1632.pdf
10Saturday, September 28, 13
![Page 38: They tried to think differently - Sooner or later€¦ · What's common in Oracle and Samsung? They tried to think differently... László Tóth, Ferenc Spala 28/09/2013 @ DerbyCon](https://reader035.fdocuments.us/reader035/viewer/2022062607/60544469214aad130b62e58e/html5/thumbnails/38.jpg)
Samsung way
password PBKDF2
HEX1
HEX2
AES256
AES256
XOR
XOR
partition footer
/efs/metadata
orDEK
1st half of EDK
2nd half of EDK
1st h
alf o
f DEK
2nd
half o
f DEK
dmcrypt
aes-cbc-essiv:sha256
c=4096
FIPS documentation helped 140sp1632.pdf
http://hammerheadgraphics.iwarp.com/
10Saturday, September 28, 13
![Page 39: They tried to think differently - Sooner or later€¦ · What's common in Oracle and Samsung? They tried to think differently... László Tóth, Ferenc Spala 28/09/2013 @ DerbyCon](https://reader035.fdocuments.us/reader035/viewer/2022062607/60544469214aad130b62e58e/html5/thumbnails/39.jpg)
Samsung way
11Saturday, September 28, 13
![Page 40: They tried to think differently - Sooner or later€¦ · What's common in Oracle and Samsung? They tried to think differently... László Tóth, Ferenc Spala 28/09/2013 @ DerbyCon](https://reader035.fdocuments.us/reader035/viewer/2022062607/60544469214aad130b62e58e/html5/thumbnails/40.jpg)
Samsung way
Key length
11Saturday, September 28, 13
![Page 41: They tried to think differently - Sooner or later€¦ · What's common in Oracle and Samsung? They tried to think differently... László Tóth, Ferenc Spala 28/09/2013 @ DerbyCon](https://reader035.fdocuments.us/reader035/viewer/2022062607/60544469214aad130b62e58e/html5/thumbnails/41.jpg)
Samsung wayEDKKey length
11Saturday, September 28, 13
![Page 42: They tried to think differently - Sooner or later€¦ · What's common in Oracle and Samsung? They tried to think differently... László Tóth, Ferenc Spala 28/09/2013 @ DerbyCon](https://reader035.fdocuments.us/reader035/viewer/2022062607/60544469214aad130b62e58e/html5/thumbnails/42.jpg)
Samsung wayEDK
IV
Key length
11Saturday, September 28, 13
![Page 43: They tried to think differently - Sooner or later€¦ · What's common in Oracle and Samsung? They tried to think differently... László Tóth, Ferenc Spala 28/09/2013 @ DerbyCon](https://reader035.fdocuments.us/reader035/viewer/2022062607/60544469214aad130b62e58e/html5/thumbnails/43.jpg)
Samsung wayEDK Padding
IV
Key length
11Saturday, September 28, 13
![Page 44: They tried to think differently - Sooner or later€¦ · What's common in Oracle and Samsung? They tried to think differently... László Tóth, Ferenc Spala 28/09/2013 @ DerbyCon](https://reader035.fdocuments.us/reader035/viewer/2022062607/60544469214aad130b62e58e/html5/thumbnails/44.jpg)
Samsung way
12Saturday, September 28, 13
![Page 45: They tried to think differently - Sooner or later€¦ · What's common in Oracle and Samsung? They tried to think differently... László Tóth, Ferenc Spala 28/09/2013 @ DerbyCon](https://reader035.fdocuments.us/reader035/viewer/2022062607/60544469214aad130b62e58e/html5/thumbnails/45.jpg)
Samsung way
AndroidSamsung
12Saturday, September 28, 13
![Page 46: They tried to think differently - Sooner or later€¦ · What's common in Oracle and Samsung? They tried to think differently... László Tóth, Ferenc Spala 28/09/2013 @ DerbyCon](https://reader035.fdocuments.us/reader035/viewer/2022062607/60544469214aad130b62e58e/html5/thumbnails/46.jpg)
Samsung way
PBKDF2 AndroidSamsung
12Saturday, September 28, 13
![Page 47: They tried to think differently - Sooner or later€¦ · What's common in Oracle and Samsung? They tried to think differently... László Tóth, Ferenc Spala 28/09/2013 @ DerbyCon](https://reader035.fdocuments.us/reader035/viewer/2022062607/60544469214aad130b62e58e/html5/thumbnails/47.jpg)
Samsung way
PBKDF2 AndroidSamsung
4096 2000*2VS
12Saturday, September 28, 13
![Page 48: They tried to think differently - Sooner or later€¦ · What's common in Oracle and Samsung? They tried to think differently... László Tóth, Ferenc Spala 28/09/2013 @ DerbyCon](https://reader035.fdocuments.us/reader035/viewer/2022062607/60544469214aad130b62e58e/html5/thumbnails/48.jpg)
Samsung way
AndroidSamsung
13Saturday, September 28, 13
![Page 49: They tried to think differently - Sooner or later€¦ · What's common in Oracle and Samsung? They tried to think differently... László Tóth, Ferenc Spala 28/09/2013 @ DerbyCon](https://reader035.fdocuments.us/reader035/viewer/2022062607/60544469214aad130b62e58e/html5/thumbnails/49.jpg)
Samsung way
Key Length AndroidSamsung
13Saturday, September 28, 13
![Page 50: They tried to think differently - Sooner or later€¦ · What's common in Oracle and Samsung? They tried to think differently... László Tóth, Ferenc Spala 28/09/2013 @ DerbyCon](https://reader035.fdocuments.us/reader035/viewer/2022062607/60544469214aad130b62e58e/html5/thumbnails/50.jpg)
Samsung way
Key Length AndroidSamsung
256 128VS
13Saturday, September 28, 13
![Page 51: They tried to think differently - Sooner or later€¦ · What's common in Oracle and Samsung? They tried to think differently... László Tóth, Ferenc Spala 28/09/2013 @ DerbyCon](https://reader035.fdocuments.us/reader035/viewer/2022062607/60544469214aad130b62e58e/html5/thumbnails/51.jpg)
Samsung way
AndroidSamsung
14Saturday, September 28, 13
![Page 52: They tried to think differently - Sooner or later€¦ · What's common in Oracle and Samsung? They tried to think differently... László Tóth, Ferenc Spala 28/09/2013 @ DerbyCon](https://reader035.fdocuments.us/reader035/viewer/2022062607/60544469214aad130b62e58e/html5/thumbnails/52.jpg)
Samsung way
Padding AndroidSamsung
14Saturday, September 28, 13
![Page 53: They tried to think differently - Sooner or later€¦ · What's common in Oracle and Samsung? They tried to think differently... László Tóth, Ferenc Spala 28/09/2013 @ DerbyCon](https://reader035.fdocuments.us/reader035/viewer/2022062607/60544469214aad130b62e58e/html5/thumbnails/53.jpg)
Samsung way
Padding AndroidSamsung
HMAC-SHA256(EDK, PBKDF2(pwd))
All zeroVS
14Saturday, September 28, 13
![Page 54: They tried to think differently - Sooner or later€¦ · What's common in Oracle and Samsung? They tried to think differently... László Tóth, Ferenc Spala 28/09/2013 @ DerbyCon](https://reader035.fdocuments.us/reader035/viewer/2022062607/60544469214aad130b62e58e/html5/thumbnails/54.jpg)
Samsung way
Padding AndroidSamsung
HMAC-SHA256(EDK, PBKDF2(pwd))
All zeroVS
On Samsung phones the vold does not have to decrypt the
key to verify the password
14Saturday, September 28, 13
![Page 55: They tried to think differently - Sooner or later€¦ · What's common in Oracle and Samsung? They tried to think differently... László Tóth, Ferenc Spala 28/09/2013 @ DerbyCon](https://reader035.fdocuments.us/reader035/viewer/2022062607/60544469214aad130b62e58e/html5/thumbnails/55.jpg)
Samsung way
15Saturday, September 28, 13
![Page 56: They tried to think differently - Sooner or later€¦ · What's common in Oracle and Samsung? They tried to think differently... László Tóth, Ferenc Spala 28/09/2013 @ DerbyCon](https://reader035.fdocuments.us/reader035/viewer/2022062607/60544469214aad130b62e58e/html5/thumbnails/56.jpg)
Samsung way
Wrong password
15Saturday, September 28, 13
![Page 57: They tried to think differently - Sooner or later€¦ · What's common in Oracle and Samsung? They tried to think differently... László Tóth, Ferenc Spala 28/09/2013 @ DerbyCon](https://reader035.fdocuments.us/reader035/viewer/2022062607/60544469214aad130b62e58e/html5/thumbnails/57.jpg)
Samsung way
Wrong password
Good password
15Saturday, September 28, 13
![Page 58: They tried to think differently - Sooner or later€¦ · What's common in Oracle and Samsung? They tried to think differently... László Tóth, Ferenc Spala 28/09/2013 @ DerbyCon](https://reader035.fdocuments.us/reader035/viewer/2022062607/60544469214aad130b62e58e/html5/thumbnails/58.jpg)
Samsung way
Wrong password
Good password
Wrong password
15Saturday, September 28, 13
![Page 59: They tried to think differently - Sooner or later€¦ · What's common in Oracle and Samsung? They tried to think differently... László Tóth, Ferenc Spala 28/09/2013 @ DerbyCon](https://reader035.fdocuments.us/reader035/viewer/2022062607/60544469214aad130b62e58e/html5/thumbnails/59.jpg)
Samsung way
Wrong password
Good password
Wrong password
This does not work on S2 and S3, but works on S415Saturday, September 28, 13
![Page 60: They tried to think differently - Sooner or later€¦ · What's common in Oracle and Samsung? They tried to think differently... László Tóth, Ferenc Spala 28/09/2013 @ DerbyCon](https://reader035.fdocuments.us/reader035/viewer/2022062607/60544469214aad130b62e58e/html5/thumbnails/60.jpg)
Samsung way
AndroidSamsung S4
16Saturday, September 28, 13
![Page 61: They tried to think differently - Sooner or later€¦ · What's common in Oracle and Samsung? They tried to think differently... László Tóth, Ferenc Spala 28/09/2013 @ DerbyCon](https://reader035.fdocuments.us/reader035/viewer/2022062607/60544469214aad130b62e58e/html5/thumbnails/61.jpg)
Samsung way
function AndroidSamsung S4
16Saturday, September 28, 13
![Page 62: They tried to think differently - Sooner or later€¦ · What's common in Oracle and Samsung? They tried to think differently... László Tóth, Ferenc Spala 28/09/2013 @ DerbyCon](https://reader035.fdocuments.us/reader035/viewer/2022062607/60544469214aad130b62e58e/html5/thumbnails/62.jpg)
Samsung way
function AndroidSamsung S4
verify_EDKin libsec_km.so
cryptfs_verify_passwdin cryptfs.cVS
16Saturday, September 28, 13
![Page 63: They tried to think differently - Sooner or later€¦ · What's common in Oracle and Samsung? They tried to think differently... László Tóth, Ferenc Spala 28/09/2013 @ DerbyCon](https://reader035.fdocuments.us/reader035/viewer/2022062607/60544469214aad130b62e58e/html5/thumbnails/63.jpg)
Android
} else { decrypt_master_key(passwd, salt, encrypted_master_key, decrypted_master_key); if (!memcmp(decrypted_master_key, saved_master_key, crypt_ftr.keysize)) { /* They match, the password is correct */ rc = 0; } else { /* If incorrect, sleep for a bit to prevent dictionary attacks */ sleep(1); rc = 1; } }
return rc;
saved_master_key
decrypt_master_key
decrypted_master_key
17Saturday, September 28, 13
![Page 64: They tried to think differently - Sooner or later€¦ · What's common in Oracle and Samsung? They tried to think differently... László Tóth, Ferenc Spala 28/09/2013 @ DerbyCon](https://reader035.fdocuments.us/reader035/viewer/2022062607/60544469214aad130b62e58e/html5/thumbnails/64.jpg)
Android
} else { decrypt_master_key(passwd, salt, encrypted_master_key, decrypted_master_key); if (!memcmp(decrypted_master_key, saved_master_key, crypt_ftr.keysize)) { /* They match, the password is correct */ rc = 0; } else { /* If incorrect, sleep for a bit to prevent dictionary attacks */ sleep(1); rc = 1; } }
return rc;
saved_master_key
decrypt_master_key
decrypted_master_key
17Saturday, September 28, 13
![Page 65: They tried to think differently - Sooner or later€¦ · What's common in Oracle and Samsung? They tried to think differently... László Tóth, Ferenc Spala 28/09/2013 @ DerbyCon](https://reader035.fdocuments.us/reader035/viewer/2022062607/60544469214aad130b62e58e/html5/thumbnails/65.jpg)
Android
} else { decrypt_master_key(passwd, salt, encrypted_master_key, decrypted_master_key); if (!memcmp(decrypted_master_key, saved_master_key, crypt_ftr.keysize)) { /* They match, the password is correct */ rc = 0; } else { /* If incorrect, sleep for a bit to prevent dictionary attacks */ sleep(1); rc = 1; } }
return rc;
saved_master_key
decrypt_master_key
decrypted_master_key
sleep(1);
17Saturday, September 28, 13
![Page 66: They tried to think differently - Sooner or later€¦ · What's common in Oracle and Samsung? They tried to think differently... László Tóth, Ferenc Spala 28/09/2013 @ DerbyCon](https://reader035.fdocuments.us/reader035/viewer/2022062607/60544469214aad130b62e58e/html5/thumbnails/66.jpg)
Android
static unsigned char saved_master_key[KEY_LEN_BYTES];
18Saturday, September 28, 13
![Page 67: They tried to think differently - Sooner or later€¦ · What's common in Oracle and Samsung? They tried to think differently... László Tóth, Ferenc Spala 28/09/2013 @ DerbyCon](https://reader035.fdocuments.us/reader035/viewer/2022062607/60544469214aad130b62e58e/html5/thumbnails/67.jpg)
Android
static unsigned char saved_master_key[KEY_LEN_BYTES];
The vold porcess memory contains the decrypted disk
encryption key.
18Saturday, September 28, 13
![Page 68: They tried to think differently - Sooner or later€¦ · What's common in Oracle and Samsung? They tried to think differently... László Tóth, Ferenc Spala 28/09/2013 @ DerbyCon](https://reader035.fdocuments.us/reader035/viewer/2022062607/60544469214aad130b62e58e/html5/thumbnails/68.jpg)
Samsung way
19Saturday, September 28, 13
![Page 69: They tried to think differently - Sooner or later€¦ · What's common in Oracle and Samsung? They tried to think differently... László Tóth, Ferenc Spala 28/09/2013 @ DerbyCon](https://reader035.fdocuments.us/reader035/viewer/2022062607/60544469214aad130b62e58e/html5/thumbnails/69.jpg)
Samsung way
pbkdf
SECKM_HMAC_SHA256
memcmp
19Saturday, September 28, 13
![Page 70: They tried to think differently - Sooner or later€¦ · What's common in Oracle and Samsung? They tried to think differently... László Tóth, Ferenc Spala 28/09/2013 @ DerbyCon](https://reader035.fdocuments.us/reader035/viewer/2022062607/60544469214aad130b62e58e/html5/thumbnails/70.jpg)
Samsung way
GREAT! Samsung does not store the clear text key in the vold process memory!
20Saturday, September 28, 13
![Page 71: They tried to think differently - Sooner or later€¦ · What's common in Oracle and Samsung? They tried to think differently... László Tóth, Ferenc Spala 28/09/2013 @ DerbyCon](https://reader035.fdocuments.us/reader035/viewer/2022062607/60544469214aad130b62e58e/html5/thumbnails/71.jpg)
Samsung way
GREAT! Samsung does not store the clear text key in the vold process memory!
20Saturday, September 28, 13
![Page 72: They tried to think differently - Sooner or later€¦ · What's common in Oracle and Samsung? They tried to think differently... László Tóth, Ferenc Spala 28/09/2013 @ DerbyCon](https://reader035.fdocuments.us/reader035/viewer/2022062607/60544469214aad130b62e58e/html5/thumbnails/72.jpg)
Samsung way
GREAT! Samsung does not store the clear text key in the vold process memory!
DEMO
20Saturday, September 28, 13
![Page 73: They tried to think differently - Sooner or later€¦ · What's common in Oracle and Samsung? They tried to think differently... László Tóth, Ferenc Spala 28/09/2013 @ DerbyCon](https://reader035.fdocuments.us/reader035/viewer/2022062607/60544469214aad130b62e58e/html5/thumbnails/73.jpg)
Samsung way
21Saturday, September 28, 13
![Page 74: They tried to think differently - Sooner or later€¦ · What's common in Oracle and Samsung? They tried to think differently... László Tóth, Ferenc Spala 28/09/2013 @ DerbyCon](https://reader035.fdocuments.us/reader035/viewer/2022062607/60544469214aad130b62e58e/html5/thumbnails/74.jpg)
Samsung way
• Yes! You saw the password there
21Saturday, September 28, 13
![Page 75: They tried to think differently - Sooner or later€¦ · What's common in Oracle and Samsung? They tried to think differently... László Tóth, Ferenc Spala 28/09/2013 @ DerbyCon](https://reader035.fdocuments.us/reader035/viewer/2022062607/60544469214aad130b62e58e/html5/thumbnails/75.jpg)
Samsung way
• Yes! You saw the password there
• This works on S2 (4.0.3) and S3 (4.1.2)
21Saturday, September 28, 13
![Page 76: They tried to think differently - Sooner or later€¦ · What's common in Oracle and Samsung? They tried to think differently... László Tóth, Ferenc Spala 28/09/2013 @ DerbyCon](https://reader035.fdocuments.us/reader035/viewer/2022062607/60544469214aad130b62e58e/html5/thumbnails/76.jpg)
Samsung way
• Yes! You saw the password there
• This works on S2 (4.0.3) and S3 (4.1.2)
• You need adb and root on the phone (vold runs as root)
21Saturday, September 28, 13
![Page 77: They tried to think differently - Sooner or later€¦ · What's common in Oracle and Samsung? They tried to think differently... László Tóth, Ferenc Spala 28/09/2013 @ DerbyCon](https://reader035.fdocuments.us/reader035/viewer/2022062607/60544469214aad130b62e58e/html5/thumbnails/77.jpg)
Samsung way
• Yes! You saw the password there
• This works on S2 (4.0.3) and S3 (4.1.2)
• You need adb and root on the phone (vold runs as root)
• Probably several other method can be developed to get these as root
21Saturday, September 28, 13
![Page 78: They tried to think differently - Sooner or later€¦ · What's common in Oracle and Samsung? They tried to think differently... László Tóth, Ferenc Spala 28/09/2013 @ DerbyCon](https://reader035.fdocuments.us/reader035/viewer/2022062607/60544469214aad130b62e58e/html5/thumbnails/78.jpg)
Samsung way
• Yes! You saw the password there
• This works on S2 (4.0.3) and S3 (4.1.2)
• You need adb and root on the phone (vold runs as root)
• Probably several other method can be developed to get these as root
• BUT now you have one...
21Saturday, September 28, 13
![Page 79: They tried to think differently - Sooner or later€¦ · What's common in Oracle and Samsung? They tried to think differently... László Tóth, Ferenc Spala 28/09/2013 @ DerbyCon](https://reader035.fdocuments.us/reader035/viewer/2022062607/60544469214aad130b62e58e/html5/thumbnails/79.jpg)
Samsung way
22Saturday, September 28, 13
![Page 80: They tried to think differently - Sooner or later€¦ · What's common in Oracle and Samsung? They tried to think differently... László Tóth, Ferenc Spala 28/09/2013 @ DerbyCon](https://reader035.fdocuments.us/reader035/viewer/2022062607/60544469214aad130b62e58e/html5/thumbnails/80.jpg)
Samsung way
• But, what if we do not have that access
22Saturday, September 28, 13
![Page 81: They tried to think differently - Sooner or later€¦ · What's common in Oracle and Samsung? They tried to think differently... László Tóth, Ferenc Spala 28/09/2013 @ DerbyCon](https://reader035.fdocuments.us/reader035/viewer/2022062607/60544469214aad130b62e58e/html5/thumbnails/81.jpg)
Samsung way
• But, what if we do not have that access
• Create a recovery image that runs the adb, have root and dd
22Saturday, September 28, 13
![Page 82: They tried to think differently - Sooner or later€¦ · What's common in Oracle and Samsung? They tried to think differently... László Tóth, Ferenc Spala 28/09/2013 @ DerbyCon](https://reader035.fdocuments.us/reader035/viewer/2022062607/60544469214aad130b62e58e/html5/thumbnails/82.jpg)
Samsung way
• But, what if we do not have that access
• Create a recovery image that runs the adb, have root and dd
• Get the partition footer from the phone
22Saturday, September 28, 13
![Page 83: They tried to think differently - Sooner or later€¦ · What's common in Oracle and Samsung? They tried to think differently... László Tóth, Ferenc Spala 28/09/2013 @ DerbyCon](https://reader035.fdocuments.us/reader035/viewer/2022062607/60544469214aad130b62e58e/html5/thumbnails/83.jpg)
Samsung way
• But, what if we do not have that access
• Create a recovery image that runs the adb, have root and dd
• Get the partition footer from the phone
• Try to crack it
22Saturday, September 28, 13
![Page 84: They tried to think differently - Sooner or later€¦ · What's common in Oracle and Samsung? They tried to think differently... László Tóth, Ferenc Spala 28/09/2013 @ DerbyCon](https://reader035.fdocuments.us/reader035/viewer/2022062607/60544469214aad130b62e58e/html5/thumbnails/84.jpg)
Samsung way
• But, what if we do not have that access
• Create a recovery image that runs the adb, have root and dd
• Get the partition footer from the phone
• Try to crack it
DEMO
22Saturday, September 28, 13
![Page 85: They tried to think differently - Sooner or later€¦ · What's common in Oracle and Samsung? They tried to think differently... László Tóth, Ferenc Spala 28/09/2013 @ DerbyCon](https://reader035.fdocuments.us/reader035/viewer/2022062607/60544469214aad130b62e58e/html5/thumbnails/85.jpg)
Samsung way
23Saturday, September 28, 13
![Page 86: They tried to think differently - Sooner or later€¦ · What's common in Oracle and Samsung? They tried to think differently... László Tóth, Ferenc Spala 28/09/2013 @ DerbyCon](https://reader035.fdocuments.us/reader035/viewer/2022062607/60544469214aad130b62e58e/html5/thumbnails/86.jpg)
Samsung way
• Yes we developed a john the ripper module, but just for demonstration purposes (no optimization)
23Saturday, September 28, 13
![Page 87: They tried to think differently - Sooner or later€¦ · What's common in Oracle and Samsung? They tried to think differently... László Tóth, Ferenc Spala 28/09/2013 @ DerbyCon](https://reader035.fdocuments.us/reader035/viewer/2022062607/60544469214aad130b62e58e/html5/thumbnails/87.jpg)
Samsung way
• Yes we developed a john the ripper module, but just for demonstration purposes (no optimization)
• It is slow because of the 4096 cycle in the PBKDF2
23Saturday, September 28, 13
![Page 88: They tried to think differently - Sooner or later€¦ · What's common in Oracle and Samsung? They tried to think differently... László Tóth, Ferenc Spala 28/09/2013 @ DerbyCon](https://reader035.fdocuments.us/reader035/viewer/2022062607/60544469214aad130b62e58e/html5/thumbnails/88.jpg)
Samsung way
• Yes we developed a john the ripper module, but just for demonstration purposes (no optimization)
• It is slow because of the 4096 cycle in the PBKDF2
• Samsung requires at least 6 character password with one number
23Saturday, September 28, 13
![Page 89: They tried to think differently - Sooner or later€¦ · What's common in Oracle and Samsung? They tried to think differently... László Tóth, Ferenc Spala 28/09/2013 @ DerbyCon](https://reader035.fdocuments.us/reader035/viewer/2022062607/60544469214aad130b62e58e/html5/thumbnails/89.jpg)
Samsung way
• Yes we developed a john the ripper module, but just for demonstration purposes (no optimization)
• It is slow because of the 4096 cycle in the PBKDF2
• Samsung requires at least 6 character password with one number
• The dictionary attack is feasible
23Saturday, September 28, 13
![Page 90: They tried to think differently - Sooner or later€¦ · What's common in Oracle and Samsung? They tried to think differently... László Tóth, Ferenc Spala 28/09/2013 @ DerbyCon](https://reader035.fdocuments.us/reader035/viewer/2022062607/60544469214aad130b62e58e/html5/thumbnails/90.jpg)
Samsung way
• Yes we developed a john the ripper module, but just for demonstration purposes (no optimization)
• It is slow because of the 4096 cycle in the PBKDF2
• Samsung requires at least 6 character password with one number
• The dictionary attack is feasible
• We did not test it, but with GPU the 6 character all lower case might be feasible also
23Saturday, September 28, 13
![Page 91: They tried to think differently - Sooner or later€¦ · What's common in Oracle and Samsung? They tried to think differently... László Tóth, Ferenc Spala 28/09/2013 @ DerbyCon](https://reader035.fdocuments.us/reader035/viewer/2022062607/60544469214aad130b62e58e/html5/thumbnails/91.jpg)
Samsung way
• Yes we developed a john the ripper module, but just for demonstration purposes (no optimization)
• It is slow because of the 4096 cycle in the PBKDF2
• Samsung requires at least 6 character password with one number
• The dictionary attack is feasible
• We did not test it, but with GPU the 6 character all lower case might be feasible also
• And users tends to use even weaker password on a mobile device than an a PC
23Saturday, September 28, 13
![Page 92: They tried to think differently - Sooner or later€¦ · What's common in Oracle and Samsung? They tried to think differently... László Tóth, Ferenc Spala 28/09/2013 @ DerbyCon](https://reader035.fdocuments.us/reader035/viewer/2022062607/60544469214aad130b62e58e/html5/thumbnails/92.jpg)
Samsung way
Why does not this work on S4?
24Saturday, September 28, 13
![Page 93: They tried to think differently - Sooner or later€¦ · What's common in Oracle and Samsung? They tried to think differently... László Tóth, Ferenc Spala 28/09/2013 @ DerbyCon](https://reader035.fdocuments.us/reader035/viewer/2022062607/60544469214aad130b62e58e/html5/thumbnails/93.jpg)
Samsung S4 phone encryption
It is Android, but... “We are even more different!”
Part 2
25Saturday, September 28, 13
![Page 94: They tried to think differently - Sooner or later€¦ · What's common in Oracle and Samsung? They tried to think differently... László Tóth, Ferenc Spala 28/09/2013 @ DerbyCon](https://reader035.fdocuments.us/reader035/viewer/2022062607/60544469214aad130b62e58e/html5/thumbnails/94.jpg)
Samsung way
26Saturday, September 28, 13
![Page 95: They tried to think differently - Sooner or later€¦ · What's common in Oracle and Samsung? They tried to think differently... László Tóth, Ferenc Spala 28/09/2013 @ DerbyCon](https://reader035.fdocuments.us/reader035/viewer/2022062607/60544469214aad130b62e58e/html5/thumbnails/95.jpg)
Samsung wayKey length
26Saturday, September 28, 13
![Page 96: They tried to think differently - Sooner or later€¦ · What's common in Oracle and Samsung? They tried to think differently... László Tóth, Ferenc Spala 28/09/2013 @ DerbyCon](https://reader035.fdocuments.us/reader035/viewer/2022062607/60544469214aad130b62e58e/html5/thumbnails/96.jpg)
Samsung wayKey length Length
26Saturday, September 28, 13
![Page 97: They tried to think differently - Sooner or later€¦ · What's common in Oracle and Samsung? They tried to think differently... László Tóth, Ferenc Spala 28/09/2013 @ DerbyCon](https://reader035.fdocuments.us/reader035/viewer/2022062607/60544469214aad130b62e58e/html5/thumbnails/97.jpg)
Samsung wayKey length Length Encrypted footer
26Saturday, September 28, 13
![Page 98: They tried to think differently - Sooner or later€¦ · What's common in Oracle and Samsung? They tried to think differently... László Tóth, Ferenc Spala 28/09/2013 @ DerbyCon](https://reader035.fdocuments.us/reader035/viewer/2022062607/60544469214aad130b62e58e/html5/thumbnails/98.jpg)
Samsung way
27Saturday, September 28, 13
![Page 99: They tried to think differently - Sooner or later€¦ · What's common in Oracle and Samsung? They tried to think differently... László Tóth, Ferenc Spala 28/09/2013 @ DerbyCon](https://reader035.fdocuments.us/reader035/viewer/2022062607/60544469214aad130b62e58e/html5/thumbnails/99.jpg)
Samsung way
TEE27Saturday, September 28, 13
![Page 100: They tried to think differently - Sooner or later€¦ · What's common in Oracle and Samsung? They tried to think differently... László Tóth, Ferenc Spala 28/09/2013 @ DerbyCon](https://reader035.fdocuments.us/reader035/viewer/2022062607/60544469214aad130b62e58e/html5/thumbnails/100.jpg)
Samsung way
mobicorekernel
TEE27Saturday, September 28, 13
![Page 101: They tried to think differently - Sooner or later€¦ · What's common in Oracle and Samsung? They tried to think differently... László Tóth, Ferenc Spala 28/09/2013 @ DerbyCon](https://reader035.fdocuments.us/reader035/viewer/2022062607/60544469214aad130b62e58e/html5/thumbnails/101.jpg)
Samsung way
mobicorekernel
TEE
trustlet
trustlet
trustlet
27Saturday, September 28, 13
![Page 102: They tried to think differently - Sooner or later€¦ · What's common in Oracle and Samsung? They tried to think differently... László Tóth, Ferenc Spala 28/09/2013 @ DerbyCon](https://reader035.fdocuments.us/reader035/viewer/2022062607/60544469214aad130b62e58e/html5/thumbnails/102.jpg)
Samsung way
mobicorekernel
TEE
trustlet
trustlet
trustlet
vold vdc/dev/socket/vold
partition footer
27Saturday, September 28, 13
![Page 103: They tried to think differently - Sooner or later€¦ · What's common in Oracle and Samsung? They tried to think differently... László Tóth, Ferenc Spala 28/09/2013 @ DerbyCon](https://reader035.fdocuments.us/reader035/viewer/2022062607/60544469214aad130b62e58e/html5/thumbnails/103.jpg)
Samsung way
mobicorekernel
TEE
trustlet
trustlet
trustletsecure_storage_daemon
vold vdc/dev/socket/vold
/dev/ashmem/secure_storage_ashmem
partition footer
27Saturday, September 28, 13
![Page 104: They tried to think differently - Sooner or later€¦ · What's common in Oracle and Samsung? They tried to think differently... László Tóth, Ferenc Spala 28/09/2013 @ DerbyCon](https://reader035.fdocuments.us/reader035/viewer/2022062607/60544469214aad130b62e58e/html5/thumbnails/104.jpg)
Samsung way
mobicorekernel
TEE
trustlet
trustlet
trustlet
mckernelapimcdrvmodule
Android kernel
secure_storage_daemon
vold vdc/dev/socket/vold
/dev/mobicore/dev/mobicor-user
libMcClient.so
/dev/ashmem/secure_storage_ashmem
partition footer
27Saturday, September 28, 13
![Page 105: They tried to think differently - Sooner or later€¦ · What's common in Oracle and Samsung? They tried to think differently... László Tóth, Ferenc Spala 28/09/2013 @ DerbyCon](https://reader035.fdocuments.us/reader035/viewer/2022062607/60544469214aad130b62e58e/html5/thumbnails/105.jpg)
Samsung way
mobicorekernel
TEE
trustlet
trustlet
trustlet
mckernelapimcdrvmodule
Android kernel
secure_storage_daemon
vold vdc/dev/socket/vold
/dev/mobicore/dev/mobicor-user
libMcClient.so
/dev/ashmem/secure_storage_ashmem
partition footer
27Saturday, September 28, 13
![Page 106: They tried to think differently - Sooner or later€¦ · What's common in Oracle and Samsung? They tried to think differently... László Tóth, Ferenc Spala 28/09/2013 @ DerbyCon](https://reader035.fdocuments.us/reader035/viewer/2022062607/60544469214aad130b62e58e/html5/thumbnails/106.jpg)
Samsung way
28Saturday, September 28, 13
![Page 107: They tried to think differently - Sooner or later€¦ · What's common in Oracle and Samsung? They tried to think differently... László Tóth, Ferenc Spala 28/09/2013 @ DerbyCon](https://reader035.fdocuments.us/reader035/viewer/2022062607/60544469214aad130b62e58e/html5/thumbnails/107.jpg)
Samsung way
28Saturday, September 28, 13
![Page 108: They tried to think differently - Sooner or later€¦ · What's common in Oracle and Samsung? They tried to think differently... László Tóth, Ferenc Spala 28/09/2013 @ DerbyCon](https://reader035.fdocuments.us/reader035/viewer/2022062607/60544469214aad130b62e58e/html5/thumbnails/108.jpg)
Samsung way
28Saturday, September 28, 13
![Page 109: They tried to think differently - Sooner or later€¦ · What's common in Oracle and Samsung? They tried to think differently... László Tóth, Ferenc Spala 28/09/2013 @ DerbyCon](https://reader035.fdocuments.us/reader035/viewer/2022062607/60544469214aad130b62e58e/html5/thumbnails/109.jpg)
Samsung way
28Saturday, September 28, 13
![Page 110: They tried to think differently - Sooner or later€¦ · What's common in Oracle and Samsung? They tried to think differently... László Tóth, Ferenc Spala 28/09/2013 @ DerbyCon](https://reader035.fdocuments.us/reader035/viewer/2022062607/60544469214aad130b62e58e/html5/thumbnails/110.jpg)
Samsung way
mcOpenDevice
mcMAllocWsm
mcMap
mcOpenSession
mcMap, mcMap, mcMap
mcNotify
mcWaitNotification
mcOpenSession
29Saturday, September 28, 13
![Page 111: They tried to think differently - Sooner or later€¦ · What's common in Oracle and Samsung? They tried to think differently... László Tóth, Ferenc Spala 28/09/2013 @ DerbyCon](https://reader035.fdocuments.us/reader035/viewer/2022062607/60544469214aad130b62e58e/html5/thumbnails/111.jpg)
Samsung way
mcOpenDevice
mcMAllocWsm
mcMap
mcOpenSession
mcMap, mcMap, mcMap
mcNotify
mcWaitNotification
mcOpenSession
29Saturday, September 28, 13
![Page 112: They tried to think differently - Sooner or later€¦ · What's common in Oracle and Samsung? They tried to think differently... László Tóth, Ferenc Spala 28/09/2013 @ DerbyCon](https://reader035.fdocuments.us/reader035/viewer/2022062607/60544469214aad130b62e58e/html5/thumbnails/112.jpg)
Samsung way
mcOpenDevice
mcMAllocWsm
mcMap
mcOpenSession
mcMap, mcMap, mcMap
mcNotify
mcWaitNotification
mcOpenSession #strings ffffffffd00000000000000000000004.tlbinUUID
29Saturday, September 28, 13
![Page 113: They tried to think differently - Sooner or later€¦ · What's common in Oracle and Samsung? They tried to think differently... László Tóth, Ferenc Spala 28/09/2013 @ DerbyCon](https://reader035.fdocuments.us/reader035/viewer/2022062607/60544469214aad130b62e58e/html5/thumbnails/113.jpg)
Samsung way
mcOpenDevice
mcMAllocWsm
mcMap
mcOpenSession
mcMap, mcMap, mcMap
mcNotify
mcWaitNotification
mcOpenSession #strings ffffffffd00000000000000000000004.tlbinUUID
29Saturday, September 28, 13
![Page 114: They tried to think differently - Sooner or later€¦ · What's common in Oracle and Samsung? They tried to think differently... László Tóth, Ferenc Spala 28/09/2013 @ DerbyCon](https://reader035.fdocuments.us/reader035/viewer/2022062607/60544469214aad130b62e58e/html5/thumbnails/114.jpg)
Samsung way
WOW! This can be a very nice research!
30Saturday, September 28, 13
![Page 115: They tried to think differently - Sooner or later€¦ · What's common in Oracle and Samsung? They tried to think differently... László Tóth, Ferenc Spala 28/09/2013 @ DerbyCon](https://reader035.fdocuments.us/reader035/viewer/2022062607/60544469214aad130b62e58e/html5/thumbnails/115.jpg)
Samsung way
WOW! This can be a very nice research!
30Saturday, September 28, 13
![Page 116: They tried to think differently - Sooner or later€¦ · What's common in Oracle and Samsung? They tried to think differently... László Tóth, Ferenc Spala 28/09/2013 @ DerbyCon](https://reader035.fdocuments.us/reader035/viewer/2022062607/60544469214aad130b62e58e/html5/thumbnails/116.jpg)
Samsung way
31Saturday, September 28, 13
![Page 117: They tried to think differently - Sooner or later€¦ · What's common in Oracle and Samsung? They tried to think differently... László Tóth, Ferenc Spala 28/09/2013 @ DerbyCon](https://reader035.fdocuments.us/reader035/viewer/2022062607/60544469214aad130b62e58e/html5/thumbnails/117.jpg)
Samsung way
• Yes, it will be in the future
31Saturday, September 28, 13
![Page 118: They tried to think differently - Sooner or later€¦ · What's common in Oracle and Samsung? They tried to think differently... László Tóth, Ferenc Spala 28/09/2013 @ DerbyCon](https://reader035.fdocuments.us/reader035/viewer/2022062607/60544469214aad130b62e58e/html5/thumbnails/118.jpg)
Samsung way
• Yes, it will be in the future
• But now we just would like to be able to - at least - offline brute-force the password
31Saturday, September 28, 13
![Page 119: They tried to think differently - Sooner or later€¦ · What's common in Oracle and Samsung? They tried to think differently... László Tóth, Ferenc Spala 28/09/2013 @ DerbyCon](https://reader035.fdocuments.us/reader035/viewer/2022062607/60544469214aad130b62e58e/html5/thumbnails/119.jpg)
Samsung way
• Yes, it will be in the future
• But now we just would like to be able to - at least - offline brute-force the password
We have a much simpler way!!
31Saturday, September 28, 13
![Page 120: They tried to think differently - Sooner or later€¦ · What's common in Oracle and Samsung? They tried to think differently... László Tóth, Ferenc Spala 28/09/2013 @ DerbyCon](https://reader035.fdocuments.us/reader035/viewer/2022062607/60544469214aad130b62e58e/html5/thumbnails/120.jpg)
Samsung way
32Saturday, September 28, 13
![Page 121: They tried to think differently - Sooner or later€¦ · What's common in Oracle and Samsung? They tried to think differently... László Tóth, Ferenc Spala 28/09/2013 @ DerbyCon](https://reader035.fdocuments.us/reader035/viewer/2022062607/60544469214aad130b62e58e/html5/thumbnails/121.jpg)
Samsung way
• Change the recovery image of a samsung firmware to start the mobicore environment (vold, secure_storage_daemon, mcDriverDaemon)
32Saturday, September 28, 13
![Page 122: They tried to think differently - Sooner or later€¦ · What's common in Oracle and Samsung? They tried to think differently... László Tóth, Ferenc Spala 28/09/2013 @ DerbyCon](https://reader035.fdocuments.us/reader035/viewer/2022062607/60544469214aad130b62e58e/html5/thumbnails/122.jpg)
Samsung way
• Change the recovery image of a samsung firmware to start the mobicore environment (vold, secure_storage_daemon, mcDriverDaemon)
• Put a break point in vold to the verify_EDK function
32Saturday, September 28, 13
![Page 123: They tried to think differently - Sooner or later€¦ · What's common in Oracle and Samsung? They tried to think differently... László Tóth, Ferenc Spala 28/09/2013 @ DerbyCon](https://reader035.fdocuments.us/reader035/viewer/2022062607/60544469214aad130b62e58e/html5/thumbnails/123.jpg)
Samsung way
• Change the recovery image of a samsung firmware to start the mobicore environment (vold, secure_storage_daemon, mcDriverDaemon)
• Put a break point in vold to the verify_EDK function
• Run vdc cryptfs verifypw pwd
32Saturday, September 28, 13
![Page 124: They tried to think differently - Sooner or later€¦ · What's common in Oracle and Samsung? They tried to think differently... László Tóth, Ferenc Spala 28/09/2013 @ DerbyCon](https://reader035.fdocuments.us/reader035/viewer/2022062607/60544469214aad130b62e58e/html5/thumbnails/124.jpg)
Samsung way
• Change the recovery image of a samsung firmware to start the mobicore environment (vold, secure_storage_daemon, mcDriverDaemon)
• Put a break point in vold to the verify_EDK function
• Run vdc cryptfs verifypw pwd
• Dump the first parameter
32Saturday, September 28, 13
![Page 125: They tried to think differently - Sooner or later€¦ · What's common in Oracle and Samsung? They tried to think differently... László Tóth, Ferenc Spala 28/09/2013 @ DerbyCon](https://reader035.fdocuments.us/reader035/viewer/2022062607/60544469214aad130b62e58e/html5/thumbnails/125.jpg)
Samsung way
• Change the recovery image of a samsung firmware to start the mobicore environment (vold, secure_storage_daemon, mcDriverDaemon)
• Put a break point in vold to the verify_EDK function
• Run vdc cryptfs verifypw pwd
• Dump the first parameter
DEMO
32Saturday, September 28, 13
![Page 126: They tried to think differently - Sooner or later€¦ · What's common in Oracle and Samsung? They tried to think differently... László Tóth, Ferenc Spala 28/09/2013 @ DerbyCon](https://reader035.fdocuments.us/reader035/viewer/2022062607/60544469214aad130b62e58e/html5/thumbnails/126.jpg)
Samsung way
33Saturday, September 28, 13
![Page 127: They tried to think differently - Sooner or later€¦ · What's common in Oracle and Samsung? They tried to think differently... László Tóth, Ferenc Spala 28/09/2013 @ DerbyCon](https://reader035.fdocuments.us/reader035/viewer/2022062607/60544469214aad130b62e58e/html5/thumbnails/127.jpg)
Samsung way
• And you will have the encrypted DEK
33Saturday, September 28, 13
![Page 128: They tried to think differently - Sooner or later€¦ · What's common in Oracle and Samsung? They tried to think differently... László Tóth, Ferenc Spala 28/09/2013 @ DerbyCon](https://reader035.fdocuments.us/reader035/viewer/2022062607/60544469214aad130b62e58e/html5/thumbnails/128.jpg)
Samsung way
• And you will have the encrypted DEK
• In the same format that is used by S2 and S3
33Saturday, September 28, 13
![Page 129: They tried to think differently - Sooner or later€¦ · What's common in Oracle and Samsung? They tried to think differently... László Tóth, Ferenc Spala 28/09/2013 @ DerbyCon](https://reader035.fdocuments.us/reader035/viewer/2022062607/60544469214aad130b62e58e/html5/thumbnails/129.jpg)
Samsung way
• And you will have the encrypted DEK
• In the same format that is used by S2 and S3
• You can start the offline cracking
33Saturday, September 28, 13
![Page 130: They tried to think differently - Sooner or later€¦ · What's common in Oracle and Samsung? They tried to think differently... László Tóth, Ferenc Spala 28/09/2013 @ DerbyCon](https://reader035.fdocuments.us/reader035/viewer/2022062607/60544469214aad130b62e58e/html5/thumbnails/130.jpg)
Samsung way
You have offline brute-force attack, despite of the TrustZone and mobicore magic!!
34Saturday, September 28, 13
![Page 131: They tried to think differently - Sooner or later€¦ · What's common in Oracle and Samsung? They tried to think differently... László Tóth, Ferenc Spala 28/09/2013 @ DerbyCon](https://reader035.fdocuments.us/reader035/viewer/2022062607/60544469214aad130b62e58e/html5/thumbnails/131.jpg)
Samsung SD card encryption
It is secure! You cannot use it in a different phone or in computer
Part 3
35Saturday, September 28, 13
![Page 132: They tried to think differently - Sooner or later€¦ · What's common in Oracle and Samsung? They tried to think differently... László Tóth, Ferenc Spala 28/09/2013 @ DerbyCon](https://reader035.fdocuments.us/reader035/viewer/2022062607/60544469214aad130b62e58e/html5/thumbnails/132.jpg)
Samsung SD card encryption
36Saturday, September 28, 13
![Page 133: They tried to think differently - Sooner or later€¦ · What's common in Oracle and Samsung? They tried to think differently... László Tóth, Ferenc Spala 28/09/2013 @ DerbyCon](https://reader035.fdocuments.us/reader035/viewer/2022062607/60544469214aad130b62e58e/html5/thumbnails/133.jpg)
Samsung SD card encryption
• On Samsung phones the SD card can be encrypted
36Saturday, September 28, 13
![Page 134: They tried to think differently - Sooner or later€¦ · What's common in Oracle and Samsung? They tried to think differently... László Tóth, Ferenc Spala 28/09/2013 @ DerbyCon](https://reader035.fdocuments.us/reader035/viewer/2022062607/60544469214aad130b62e58e/html5/thumbnails/134.jpg)
Samsung SD card encryption
• On Samsung phones the SD card can be encrypted
• After the encryption you cannot use it in other phones or in a computer
36Saturday, September 28, 13
![Page 135: They tried to think differently - Sooner or later€¦ · What's common in Oracle and Samsung? They tried to think differently... László Tóth, Ferenc Spala 28/09/2013 @ DerbyCon](https://reader035.fdocuments.us/reader035/viewer/2022062607/60544469214aad130b62e58e/html5/thumbnails/135.jpg)
Samsung SD card encryption
• On Samsung phones the SD card can be encrypted
• After the encryption you cannot use it in other phones or in a computer
• Let’s see what is happening there...
36Saturday, September 28, 13
![Page 136: They tried to think differently - Sooner or later€¦ · What's common in Oracle and Samsung? They tried to think differently... László Tóth, Ferenc Spala 28/09/2013 @ DerbyCon](https://reader035.fdocuments.us/reader035/viewer/2022062607/60544469214aad130b62e58e/html5/thumbnails/136.jpg)
Samsung SD card encryption
37Saturday, September 28, 13
![Page 137: They tried to think differently - Sooner or later€¦ · What's common in Oracle and Samsung? They tried to think differently... László Tóth, Ferenc Spala 28/09/2013 @ DerbyCon](https://reader035.fdocuments.us/reader035/viewer/2022062607/60544469214aad130b62e58e/html5/thumbnails/137.jpg)
Samsung SD card encryption
• It uses the ecryptfs file based encryption
37Saturday, September 28, 13
![Page 138: They tried to think differently - Sooner or later€¦ · What's common in Oracle and Samsung? They tried to think differently... László Tóth, Ferenc Spala 28/09/2013 @ DerbyCon](https://reader035.fdocuments.us/reader035/viewer/2022062607/60544469214aad130b62e58e/html5/thumbnails/138.jpg)
Samsung SD card encryption
• It uses the ecryptfs file based encryption
• The key is stored in the following file:
37Saturday, September 28, 13
![Page 139: They tried to think differently - Sooner or later€¦ · What's common in Oracle and Samsung? They tried to think differently... László Tóth, Ferenc Spala 28/09/2013 @ DerbyCon](https://reader035.fdocuments.us/reader035/viewer/2022062607/60544469214aad130b62e58e/html5/thumbnails/139.jpg)
Samsung SD card encryption
• It uses the ecryptfs file based encryption
• The key is stored in the following file:
/data/system/edk_p_sd
37Saturday, September 28, 13
![Page 140: They tried to think differently - Sooner or later€¦ · What's common in Oracle and Samsung? They tried to think differently... László Tóth, Ferenc Spala 28/09/2013 @ DerbyCon](https://reader035.fdocuments.us/reader035/viewer/2022062607/60544469214aad130b62e58e/html5/thumbnails/140.jpg)
Samsung SD card encryption
• It uses the ecryptfs file based encryption
• The key is stored in the following file:
/data/system/edk_p_sd
• The format of the file is the same as the partition footer or the /efs/metadata
37Saturday, September 28, 13
![Page 141: They tried to think differently - Sooner or later€¦ · What's common in Oracle and Samsung? They tried to think differently... László Tóth, Ferenc Spala 28/09/2013 @ DerbyCon](https://reader035.fdocuments.us/reader035/viewer/2022062607/60544469214aad130b62e58e/html5/thumbnails/141.jpg)
Samsung SD card encryption
• It uses the ecryptfs file based encryption
• The key is stored in the following file:
/data/system/edk_p_sd
• The format of the file is the same as the partition footer or the /efs/metadata
• and it is encrypted in the same way
37Saturday, September 28, 13
![Page 142: They tried to think differently - Sooner or later€¦ · What's common in Oracle and Samsung? They tried to think differently... László Tóth, Ferenc Spala 28/09/2013 @ DerbyCon](https://reader035.fdocuments.us/reader035/viewer/2022062607/60544469214aad130b62e58e/html5/thumbnails/142.jpg)
Samsung SD card encryption
What’s wrong with the following picture?S2 (4.0.3)
38Saturday, September 28, 13
![Page 143: They tried to think differently - Sooner or later€¦ · What's common in Oracle and Samsung? They tried to think differently... László Tóth, Ferenc Spala 28/09/2013 @ DerbyCon](https://reader035.fdocuments.us/reader035/viewer/2022062607/60544469214aad130b62e58e/html5/thumbnails/143.jpg)
Samsung SD card encryption
What’s wrong with the following picture?S2 (4.0.3)
38Saturday, September 28, 13
![Page 144: They tried to think differently - Sooner or later€¦ · What's common in Oracle and Samsung? They tried to think differently... László Tóth, Ferenc Spala 28/09/2013 @ DerbyCon](https://reader035.fdocuments.us/reader035/viewer/2022062607/60544469214aad130b62e58e/html5/thumbnails/144.jpg)
Samsung SD card encryption
39Saturday, September 28, 13
![Page 145: They tried to think differently - Sooner or later€¦ · What's common in Oracle and Samsung? They tried to think differently... László Tóth, Ferenc Spala 28/09/2013 @ DerbyCon](https://reader035.fdocuments.us/reader035/viewer/2022062607/60544469214aad130b62e58e/html5/thumbnails/145.jpg)
Samsung SD card encryption
• On S2 (4.0.3) it is world readable
39Saturday, September 28, 13
![Page 146: They tried to think differently - Sooner or later€¦ · What's common in Oracle and Samsung? They tried to think differently... László Tóth, Ferenc Spala 28/09/2013 @ DerbyCon](https://reader035.fdocuments.us/reader035/viewer/2022062607/60544469214aad130b62e58e/html5/thumbnails/146.jpg)
Samsung SD card encryption
• On S2 (4.0.3) it is world readable
• On S3 (4.1.2) and S4 (4.2.2) it is readable by root only
39Saturday, September 28, 13
![Page 147: They tried to think differently - Sooner or later€¦ · What's common in Oracle and Samsung? They tried to think differently... László Tóth, Ferenc Spala 28/09/2013 @ DerbyCon](https://reader035.fdocuments.us/reader035/viewer/2022062607/60544469214aad130b62e58e/html5/thumbnails/147.jpg)
Samsung SD card encryption
• On S2 (4.0.3) it is world readable
• On S3 (4.1.2) and S4 (4.2.2) it is readable by root only
• Wait! The first S3s came with 4.0.3...
39Saturday, September 28, 13
![Page 148: They tried to think differently - Sooner or later€¦ · What's common in Oracle and Samsung? They tried to think differently... László Tóth, Ferenc Spala 28/09/2013 @ DerbyCon](https://reader035.fdocuments.us/reader035/viewer/2022062607/60544469214aad130b62e58e/html5/thumbnails/148.jpg)
Samsung SD card encryption
• On S2 (4.0.3) it is world readable
• On S3 (4.1.2) and S4 (4.2.2) it is readable by root only
• Wait! The first S3s came with 4.0.3...
• If you encrypted your SD card before the upgrade...
39Saturday, September 28, 13
![Page 149: They tried to think differently - Sooner or later€¦ · What's common in Oracle and Samsung? They tried to think differently... László Tóth, Ferenc Spala 28/09/2013 @ DerbyCon](https://reader035.fdocuments.us/reader035/viewer/2022062607/60544469214aad130b62e58e/html5/thumbnails/149.jpg)
Samsung SD card encryption
• On S2 (4.0.3) it is world readable
• On S3 (4.1.2) and S4 (4.2.2) it is readable by root only
• Wait! The first S3s came with 4.0.3...
• If you encrypted your SD card before the upgrade...
39Saturday, September 28, 13
![Page 150: They tried to think differently - Sooner or later€¦ · What's common in Oracle and Samsung? They tried to think differently... László Tóth, Ferenc Spala 28/09/2013 @ DerbyCon](https://reader035.fdocuments.us/reader035/viewer/2022062607/60544469214aad130b62e58e/html5/thumbnails/150.jpg)
Samsung SD card encryption
• On S2 (4.0.3) it is world readable
• On S3 (4.1.2) and S4 (4.2.2) it is readable by root only
• Wait! The first S3s came with 4.0.3...
• If you encrypted your SD card before the upgrade...
39Saturday, September 28, 13
![Page 151: They tried to think differently - Sooner or later€¦ · What's common in Oracle and Samsung? They tried to think differently... László Tóth, Ferenc Spala 28/09/2013 @ DerbyCon](https://reader035.fdocuments.us/reader035/viewer/2022062607/60544469214aad130b62e58e/html5/thumbnails/151.jpg)
Samsung SD card encryption
40Saturday, September 28, 13
![Page 152: They tried to think differently - Sooner or later€¦ · What's common in Oracle and Samsung? They tried to think differently... László Tóth, Ferenc Spala 28/09/2013 @ DerbyCon](https://reader035.fdocuments.us/reader035/viewer/2022062607/60544469214aad130b62e58e/html5/thumbnails/152.jpg)
Samsung SD card encryption
40Saturday, September 28, 13
![Page 153: They tried to think differently - Sooner or later€¦ · What's common in Oracle and Samsung? They tried to think differently... László Tóth, Ferenc Spala 28/09/2013 @ DerbyCon](https://reader035.fdocuments.us/reader035/viewer/2022062607/60544469214aad130b62e58e/html5/thumbnails/153.jpg)
Samsung SD card encryption
40Saturday, September 28, 13
![Page 154: They tried to think differently - Sooner or later€¦ · What's common in Oracle and Samsung? They tried to think differently... László Tóth, Ferenc Spala 28/09/2013 @ DerbyCon](https://reader035.fdocuments.us/reader035/viewer/2022062607/60544469214aad130b62e58e/html5/thumbnails/154.jpg)
Samsung SD card encryption
...
40Saturday, September 28, 13
![Page 155: They tried to think differently - Sooner or later€¦ · What's common in Oracle and Samsung? They tried to think differently... László Tóth, Ferenc Spala 28/09/2013 @ DerbyCon](https://reader035.fdocuments.us/reader035/viewer/2022062607/60544469214aad130b62e58e/html5/thumbnails/155.jpg)
Samsung SD card encryption
...
40Saturday, September 28, 13
![Page 156: They tried to think differently - Sooner or later€¦ · What's common in Oracle and Samsung? They tried to think differently... László Tóth, Ferenc Spala 28/09/2013 @ DerbyCon](https://reader035.fdocuments.us/reader035/viewer/2022062607/60544469214aad130b62e58e/html5/thumbnails/156.jpg)
Samsung SD card encryption
...
40Saturday, September 28, 13
![Page 157: They tried to think differently - Sooner or later€¦ · What's common in Oracle and Samsung? They tried to think differently... László Tóth, Ferenc Spala 28/09/2013 @ DerbyCon](https://reader035.fdocuments.us/reader035/viewer/2022062607/60544469214aad130b62e58e/html5/thumbnails/157.jpg)
Samsung SD card encryption
41Saturday, September 28, 13
![Page 158: They tried to think differently - Sooner or later€¦ · What's common in Oracle and Samsung? They tried to think differently... László Tóth, Ferenc Spala 28/09/2013 @ DerbyCon](https://reader035.fdocuments.us/reader035/viewer/2022062607/60544469214aad130b62e58e/html5/thumbnails/158.jpg)
Samsung SD card encryption
• The firs 8 bytes of the key is in the mount output
41Saturday, September 28, 13
![Page 159: They tried to think differently - Sooner or later€¦ · What's common in Oracle and Samsung? They tried to think differently... László Tóth, Ferenc Spala 28/09/2013 @ DerbyCon](https://reader035.fdocuments.us/reader035/viewer/2022062607/60544469214aad130b62e58e/html5/thumbnails/159.jpg)
Samsung SD card encryption
• The firs 8 bytes of the key is in the mount output
• 256 --> 192
41Saturday, September 28, 13
![Page 160: They tried to think differently - Sooner or later€¦ · What's common in Oracle and Samsung? They tried to think differently... László Tóth, Ferenc Spala 28/09/2013 @ DerbyCon](https://reader035.fdocuments.us/reader035/viewer/2022062607/60544469214aad130b62e58e/html5/thumbnails/160.jpg)
Samsung SD card encryption
• The firs 8 bytes of the key is in the mount output
• 256 --> 192
• The mount command can run by everyone
41Saturday, September 28, 13
![Page 161: They tried to think differently - Sooner or later€¦ · What's common in Oracle and Samsung? They tried to think differently... László Tóth, Ferenc Spala 28/09/2013 @ DerbyCon](https://reader035.fdocuments.us/reader035/viewer/2022062607/60544469214aad130b62e58e/html5/thumbnails/161.jpg)
Samsung SD card encryption
• The firs 8 bytes of the key is in the mount output
• 256 --> 192
• The mount command can run by everyone
DEMO
41Saturday, September 28, 13
![Page 162: They tried to think differently - Sooner or later€¦ · What's common in Oracle and Samsung? They tried to think differently... László Tóth, Ferenc Spala 28/09/2013 @ DerbyCon](https://reader035.fdocuments.us/reader035/viewer/2022062607/60544469214aad130b62e58e/html5/thumbnails/162.jpg)
Samsung SD card encryption
• The firs 8 bytes of the key is in the mount output
• 256 --> 192
• The mount command can run by everyone
DEMO
41Saturday, September 28, 13
![Page 163: They tried to think differently - Sooner or later€¦ · What's common in Oracle and Samsung? They tried to think differently... László Tóth, Ferenc Spala 28/09/2013 @ DerbyCon](https://reader035.fdocuments.us/reader035/viewer/2022062607/60544469214aad130b62e58e/html5/thumbnails/163.jpg)
one more thing...
42Saturday, September 28, 13
![Page 164: They tried to think differently - Sooner or later€¦ · What's common in Oracle and Samsung? They tried to think differently... László Tóth, Ferenc Spala 28/09/2013 @ DerbyCon](https://reader035.fdocuments.us/reader035/viewer/2022062607/60544469214aad130b62e58e/html5/thumbnails/164.jpg)
Oracle
ORACLE1 ORACLE2
DB LINK
CREATE DATABASE LINK...
43Saturday, September 28, 13
![Page 165: They tried to think differently - Sooner or later€¦ · What's common in Oracle and Samsung? They tried to think differently... László Tóth, Ferenc Spala 28/09/2013 @ DerbyCon](https://reader035.fdocuments.us/reader035/viewer/2022062607/60544469214aad130b62e58e/html5/thumbnails/165.jpg)
Oracle
44Saturday, September 28, 13
![Page 166: They tried to think differently - Sooner or later€¦ · What's common in Oracle and Samsung? They tried to think differently... László Tóth, Ferenc Spala 28/09/2013 @ DerbyCon](https://reader035.fdocuments.us/reader035/viewer/2022062607/60544469214aad130b62e58e/html5/thumbnails/166.jpg)
Oracle
45Saturday, September 28, 13
![Page 167: They tried to think differently - Sooner or later€¦ · What's common in Oracle and Samsung? They tried to think differently... László Tóth, Ferenc Spala 28/09/2013 @ DerbyCon](https://reader035.fdocuments.us/reader035/viewer/2022062607/60544469214aad130b62e58e/html5/thumbnails/167.jpg)
Oracle
46Saturday, September 28, 13
![Page 168: They tried to think differently - Sooner or later€¦ · What's common in Oracle and Samsung? They tried to think differently... László Tóth, Ferenc Spala 28/09/2013 @ DerbyCon](https://reader035.fdocuments.us/reader035/viewer/2022062607/60544469214aad130b62e58e/html5/thumbnails/168.jpg)
Oracle
46Saturday, September 28, 13
![Page 169: They tried to think differently - Sooner or later€¦ · What's common in Oracle and Samsung? They tried to think differently... László Tóth, Ferenc Spala 28/09/2013 @ DerbyCon](https://reader035.fdocuments.us/reader035/viewer/2022062607/60544469214aad130b62e58e/html5/thumbnails/169.jpg)
Oracle
46Saturday, September 28, 13
![Page 170: They tried to think differently - Sooner or later€¦ · What's common in Oracle and Samsung? They tried to think differently... László Tóth, Ferenc Spala 28/09/2013 @ DerbyCon](https://reader035.fdocuments.us/reader035/viewer/2022062607/60544469214aad130b62e58e/html5/thumbnails/170.jpg)
Oracle
46Saturday, September 28, 13
![Page 171: They tried to think differently - Sooner or later€¦ · What's common in Oracle and Samsung? They tried to think differently... László Tóth, Ferenc Spala 28/09/2013 @ DerbyCon](https://reader035.fdocuments.us/reader035/viewer/2022062607/60544469214aad130b62e58e/html5/thumbnails/171.jpg)
Oracle
47Saturday, September 28, 13
![Page 172: They tried to think differently - Sooner or later€¦ · What's common in Oracle and Samsung? They tried to think differently... László Tóth, Ferenc Spala 28/09/2013 @ DerbyCon](https://reader035.fdocuments.us/reader035/viewer/2022062607/60544469214aad130b62e58e/html5/thumbnails/172.jpg)
Oracle
47Saturday, September 28, 13
![Page 173: They tried to think differently - Sooner or later€¦ · What's common in Oracle and Samsung? They tried to think differently... László Tóth, Ferenc Spala 28/09/2013 @ DerbyCon](https://reader035.fdocuments.us/reader035/viewer/2022062607/60544469214aad130b62e58e/html5/thumbnails/173.jpg)
Oracle
The python script is 83KB
47Saturday, September 28, 13
![Page 174: They tried to think differently - Sooner or later€¦ · What's common in Oracle and Samsung? They tried to think differently... László Tóth, Ferenc Spala 28/09/2013 @ DerbyCon](https://reader035.fdocuments.us/reader035/viewer/2022062607/60544469214aad130b62e58e/html5/thumbnails/174.jpg)
Oracle
The python script is 83KB
47Saturday, September 28, 13
![Page 175: They tried to think differently - Sooner or later€¦ · What's common in Oracle and Samsung? They tried to think differently... László Tóth, Ferenc Spala 28/09/2013 @ DerbyCon](https://reader035.fdocuments.us/reader035/viewer/2022062607/60544469214aad130b62e58e/html5/thumbnails/175.jpg)
Oracle
The python script is 83KB
It is not because of the complexity
47Saturday, September 28, 13
![Page 176: They tried to think differently - Sooner or later€¦ · What's common in Oracle and Samsung? They tried to think differently... László Tóth, Ferenc Spala 28/09/2013 @ DerbyCon](https://reader035.fdocuments.us/reader035/viewer/2022062607/60544469214aad130b62e58e/html5/thumbnails/176.jpg)
There is a 16K long constant!
48Saturday, September 28, 13
![Page 177: They tried to think differently - Sooner or later€¦ · What's common in Oracle and Samsung? They tried to think differently... László Tóth, Ferenc Spala 28/09/2013 @ DerbyCon](https://reader035.fdocuments.us/reader035/viewer/2022062607/60544469214aad130b62e58e/html5/thumbnails/177.jpg)
There is a 16K long constant!
48Saturday, September 28, 13
![Page 178: They tried to think differently - Sooner or later€¦ · What's common in Oracle and Samsung? They tried to think differently... László Tóth, Ferenc Spala 28/09/2013 @ DerbyCon](https://reader035.fdocuments.us/reader035/viewer/2022062607/60544469214aad130b62e58e/html5/thumbnails/178.jpg)
There is a 16K long constant!
48Saturday, September 28, 13
![Page 179: They tried to think differently - Sooner or later€¦ · What's common in Oracle and Samsung? They tried to think differently... László Tóth, Ferenc Spala 28/09/2013 @ DerbyCon](https://reader035.fdocuments.us/reader035/viewer/2022062607/60544469214aad130b62e58e/html5/thumbnails/179.jpg)
There is a 16K long constant!
48Saturday, September 28, 13
![Page 180: They tried to think differently - Sooner or later€¦ · What's common in Oracle and Samsung? They tried to think differently... László Tóth, Ferenc Spala 28/09/2013 @ DerbyCon](https://reader035.fdocuments.us/reader035/viewer/2022062607/60544469214aad130b62e58e/html5/thumbnails/180.jpg)
Oracle
49Saturday, September 28, 13
![Page 181: They tried to think differently - Sooner or later€¦ · What's common in Oracle and Samsung? They tried to think differently... László Tóth, Ferenc Spala 28/09/2013 @ DerbyCon](https://reader035.fdocuments.us/reader035/viewer/2022062607/60544469214aad130b62e58e/html5/thumbnails/181.jpg)
Oracle
• One constant changed in the algorithm from 11.2.0.3 to 12.0.1
49Saturday, September 28, 13
![Page 182: They tried to think differently - Sooner or later€¦ · What's common in Oracle and Samsung? They tried to think differently... László Tóth, Ferenc Spala 28/09/2013 @ DerbyCon](https://reader035.fdocuments.us/reader035/viewer/2022062607/60544469214aad130b62e58e/html5/thumbnails/182.jpg)
Oracle
• One constant changed in the algorithm from 11.2.0.3 to 12.0.1
• The link$ table is well protected
49Saturday, September 28, 13
![Page 183: They tried to think differently - Sooner or later€¦ · What's common in Oracle and Samsung? They tried to think differently... László Tóth, Ferenc Spala 28/09/2013 @ DerbyCon](https://reader035.fdocuments.us/reader035/viewer/2022062607/60544469214aad130b62e58e/html5/thumbnails/183.jpg)
Oracle
• One constant changed in the algorithm from 11.2.0.3 to 12.0.1
• The link$ table is well protected
• This is obfuscation, not encryption
49Saturday, September 28, 13
![Page 184: They tried to think differently - Sooner or later€¦ · What's common in Oracle and Samsung? They tried to think differently... László Tóth, Ferenc Spala 28/09/2013 @ DerbyCon](https://reader035.fdocuments.us/reader035/viewer/2022062607/60544469214aad130b62e58e/html5/thumbnails/184.jpg)
Summary
50Saturday, September 28, 13
![Page 185: They tried to think differently - Sooner or later€¦ · What's common in Oracle and Samsung? They tried to think differently... László Tóth, Ferenc Spala 28/09/2013 @ DerbyCon](https://reader035.fdocuments.us/reader035/viewer/2022062607/60544469214aad130b62e58e/html5/thumbnails/185.jpg)
Summary
• It is a good idea to cleanup the keys and passwords from the memory
50Saturday, September 28, 13
![Page 186: They tried to think differently - Sooner or later€¦ · What's common in Oracle and Samsung? They tried to think differently... László Tóth, Ferenc Spala 28/09/2013 @ DerbyCon](https://reader035.fdocuments.us/reader035/viewer/2022062607/60544469214aad130b62e58e/html5/thumbnails/186.jpg)
Summary
• It is a good idea to cleanup the keys and passwords from the memory
• TrustZone is not the final solution for everything
50Saturday, September 28, 13
![Page 187: They tried to think differently - Sooner or later€¦ · What's common in Oracle and Samsung? They tried to think differently... László Tóth, Ferenc Spala 28/09/2013 @ DerbyCon](https://reader035.fdocuments.us/reader035/viewer/2022062607/60544469214aad130b62e58e/html5/thumbnails/187.jpg)
Summary
• It is a good idea to cleanup the keys and passwords from the memory
• TrustZone is not the final solution for everything
• Now - after a proper backup - you can mount your encrypted SD card
50Saturday, September 28, 13
![Page 188: They tried to think differently - Sooner or later€¦ · What's common in Oracle and Samsung? They tried to think differently... László Tóth, Ferenc Spala 28/09/2013 @ DerbyCon](https://reader035.fdocuments.us/reader035/viewer/2022062607/60544469214aad130b62e58e/html5/thumbnails/188.jpg)
Summary
• It is a good idea to cleanup the keys and passwords from the memory
• TrustZone is not the final solution for everything
• Now - after a proper backup - you can mount your encrypted SD card
• Playing with Oracle is always fun
50Saturday, September 28, 13
![Page 189: They tried to think differently - Sooner or later€¦ · What's common in Oracle and Samsung? They tried to think differently... László Tóth, Ferenc Spala 28/09/2013 @ DerbyCon](https://reader035.fdocuments.us/reader035/viewer/2022062607/60544469214aad130b62e58e/html5/thumbnails/189.jpg)
References
• http://www.sensepost.com/blog/9114.html
• https://viaforensics.com/
• http://csrc.nist.gov/groups/STM/cmvp/documents/140-1/140sp/140sp1632.pdf
• https://hashcat.net/forum/thread-2270.html
• https://source.android.com/devices/tech/encryption/android_crypto_implementation.html
51Saturday, September 28, 13
![Page 190: They tried to think differently - Sooner or later€¦ · What's common in Oracle and Samsung? They tried to think differently... László Tóth, Ferenc Spala 28/09/2013 @ DerbyCon](https://reader035.fdocuments.us/reader035/viewer/2022062607/60544469214aad130b62e58e/html5/thumbnails/190.jpg)
Thank You!
László Tóth Ferenc Spala
donctl spala.ferenc
@donctl @FerencSpala
n/a spala.ferenc
László Tóth Ferenc Spala
[ DEBUG ]: Thx to Alex Kornbust, Pete Finnigen,Paul Wright, Zsombor Kovács and Ettienne Vorster!
[ INFO ]: Thx to the hekkcamp participants!
[ OK ]: See U at DerbyCon 4.0!
[ ERROR ]: More beer needed!
Get all the goodies from:http://soonerorlater.huhttps://github.com/donctl/sandy
52Saturday, September 28, 13