Security Researcher Publishes How-To Guide To Crack Android Full Disk Encryption (thehackernews.com)

An anonymous reader writes: Google first implemented Full Disk Encryption in Android by default with Android 5.0 Lollipop in an effort to prevent criminals or government agencies from gaining unauthorized access to one's data. What it does is it encodes all the data on a user's Android device before it's ever written to disk using a user's authentication code. Once it is encrypted, it can only be decrypted if the user enters his/her password. However, security researcher Gal Beniamini has discovered issues with the full disk encryption. He published a step-by-step guide on how one can break down the encryption protections on Android devices powered by Qualcomm Snapdragon processors. The source of the exploit is posted on GitHub. Android's disk encryption on devices with Qualcomm chips is based only on your password. However, Android uses your password to create a 2048-bit RSA key (KeyMaster) derived from it instead. Qualcomm specifically runs in the Snapdragon TrustZone to protect critical functions like encryption and biometric scanning, but Beniamini discovered that it's possible to exploit a security flaw and retrieve the keys from TrustZone. Qualcomm runs a small kernel in TrustZone to offer a Trusted Execution Environment known as Qualcomm Secure Execution Environment (QSEE), which allows small apps to run inside of QSEE away from the main Android OS. Beniamini has detailed a way for attackers to exploit an Android kernel security flaw to load their own QSEE app inside this secure environment, thereby exploiting privilege escalation flaw and hijacking of the complete QSEE space, including the keys generated for full disk encryption. The researcher also said Qualcomm or OEMs can comply with government or law enforcement agencies to break the FDE: "Since the key is available to TrustZone, Qualcomm and OEMs [Original Equipment Manufacturers] could simply create and sign a TrustZone image which extracts the KeyMaster keys and flash it to the target device," Beniamini wrote. "This would allow law enforcement to easily brute force the FDE password off the device using the leaked keys."

Comments

Unlocked access still required

[NotInHere]

From reading TFA, I conclude that you still need unlocked access to the phone? so if somebody gets hold of your turned off phone, they can't use it.

Re:Unlocked access still required

[AmiMoJo]

Yep, it's an attack on a running system. The encryption key is derived from your password and stored in secure memory for use. If someone can get hold of your unlocked device they can potentially access that memory.

Similar to attacks on encryption on running PCs etc, only harder because PCs don't usually have secure memory to hold the key in.

The solution is horribly obvious

[Anonymous Coward]

Don't use TrustZone; store the stuff as a proper LUKS volume and stop using "trusted" proprietary crap. People complain about how these hypervisor sideband processors are not open or auditable and are always dismissed as paranoid fools by naysayers (it can't POSSIBLY happen!) then this kind of thing happens and the hand-wavers desperately try to do some damage control so they won't be wrong somehow. It's the same story with Intel ME. Can we just admit already that having supervisory-processor-within-a-processor stuff is inherently insecure?

Re:The solution is horribly obvious

[Opportunist]

"Trusted" stuff cannot be trusted. It's called "trusted" because its maker trusts it to keep you from doing anything its maker didn't intend you to.

Why the fuck should I trust something like that?

Re:The solution is horribly obvious

[JohnFen]

That's a nice, specific little clarification of the larger life rule: never trust anyone who says "trust me".

Re:The solution is horribly obvious

[swillden]

Don't use TrustZone; store the stuff as a proper LUKS volume and stop using "trusted" proprietary crap

TrustZone isn't proprietary; it's part of the standard ARM feature set. In many cases (not all[*]) the software running in it is. As for using an LUKS volume, the problem with that is that it's no more secure than the Linux kernel, which is popped by another security researcher every week. The kernel is so large and complex that hardening it is really difficult.

Can we just admit already that having supervisory-processor-within-a-processor stuff is inherently insecure?

No, because it's not.

The purpose of having TrustZone isn't that it's inherently more secure. It's still just software, and subject to all of the same kinds of problems as any other software. The reason we have it is because by keeping it very small and simple we can reasonably expect it to have fewer problems. It can still have vulnerabilities (as we see here), and it still needs to be updated. In fact the vulnerabilities used by this researcher have already been patched, and the updates already pushed out to devices.

The fact that TrustZone code isn't immune to bugs doesn't mean that there's no value in having a smaller, simpler, and isolated execution environment. In fact it highlights just why it's so important, because as vulnerable as it may be, the vastly larger amount of code running in the regular execution environment has orders of magnitude more attack surface, and orders of magnitude more bugs.

[*] Google's Trusty is a free, open source implementation of a TrustZone trusted OS. The F/LOSS Genode OS has also been used in TrustZone. There's no technical reason TZ code must be secret or proprietary. The makers of the most widely-used versions keep theirs proprietary, but that's a business decision, not something inherent to the concept of a trusted execution environment.

Re:The solution is horribly obvious

[swillden]

"Trusted" stuff cannot be trusted. It's called "trusted" because its maker trusts it to keep you from doing anything its maker didn't intend you to.

No, the only thing that makes it "trusted" is that it's small, and isolated. Those characteristics reduce its attack surface and reduce the number of bugs it has, on average.

I'll grant that the primary purpose of TrustZone in Android devices, historically, has been DRM, which is absolutely something the maker doesn't want you to muck with. That's not the case with Keymaster. If you want to know what it does, there's a full open source reference implementation in AOSP. That's not the implementation used in Qualcomm devices; they wrote their own and it's closed -- but it does as close to the same thing as what the reference implementation does as the engineers involved could make it. Some other devices do use the code from AOSP.

Re:The solution is horribly obvious

[sjames]

There is an important distinction though. If I do not control the code running in that processor (or trust zone), it *IS* inherently insecure for me. If I do control it, it may improve security or it might be neutral WRT security.

Re:The solution is horribly obvious

[mlts]

IIRC, CyanogenMod doesn't touch TZ... it just uses dm-crypt, prompts for the passphrase that unlocks the /data volume key, then goes from there.

Re:The solution is horribly obvious

[davester666]

You shouldn't. In this case "trusted" means that the processor/ram/rom/code can be trusted to not be altered by YOU. Only the corporations that paid the cpu manufacturer for access to it can 'trust' it...

Re:The solution is horribly obvious

[arglebargle_xiv]

No, the only thing that makes it "trusted" is that it's small, and isolated. Those characteristics reduce its attack surface and reduce the number of bugs it has, on average.

No, what makes it "trusted" is that ARM and/or the chip vendor repeatedly tell you it is in press releases. There have been several attacks on TrustZone devices which take advantage of the fact that it's often very poorly implemented, and much less secure than the non-TrustZone stuff. The classic example of this was the rooting of a Motorola phone which hacked the insecure TrustZone, then attacked the secure non-TrustZone stuff from inside the "trusted" environment. It was the presence of TrustZone that allowed the device to be rooted.

Re:The solution is horribly obvious

[marcansoft]

The problem is not "trusting" the proprietary crap, the problem is trusting it to improve security in any measurable way.

Android full disk encryption is just as secure as LUKS (in fact, under the hood it's dm-crypt just like LUKS, the key derivation is just different). This doesn't break the FDE. You still need the passphrase. What this does is break the "you need the hardware to access the FDE and we're going to impose additional non-provable restrictions such that you can keep using your 4-digit PIN and it'll be secure, promise" bunch of hot air that vendors like to sell you. Just like the FBI cracked that iPhone's FDE - by bruteforcing the passcode. This lets you bruteforce Android's FDE offline after a one-time attack on the hardware.

I use CyanogenMod on my phone. I have my FDE passphrase set to a long string, independent of my (shorter) unlock code. This attack doesn't affect me because my FDE passphrase is not bruteforceable in a reasonable amount of time. This only affects people who still think using a 4-digit PIN to secure FDE on their phone is a good idea because Apple and Qualcomm pinkie-promise that their secure tamperproof hardware can limit bruteforce attempts enough to make that a reality.

Re:The solution is horribly obvious

[marcansoft]

CyanogenMod still uses TZ/QSEE on phones where that is used in the original firmware.

However, that never reduces security, only increases it. If your passphrase is long enough not to be at risk of a bruteforce, then this attack does not affect you.

Re:The solution is horribly obvious

[Opportunist]

I prefer to be able to determine myself what I consider bad things and good things. History is rife with examples how allowing other entities, especially such you have no control over whatsoever, define what "good" and what "bad" is leads to them defining them in a way you would not agree with and clashes with your interests.

Because, by definition, these entities will define it in such a way that it benefits them. If your interests are the same, you're lucky, but relying on it is stupid.

Re:The solution is horribly obvious

[swillden]

No, what makes it "trusted" is that ARM and/or the chip vendor repeatedly tell you it is in press releases. There have been several attacks on TrustZone devices which take advantage of the fact that it's often very poorly implemented, and much less secure than the non-TrustZone stuff.

Utter nonsense. Go take a look at the CVE reports of vulnerabilities in the Linux kernel, and compare them to the CVE reports of TrustZone OS vulnerabilities. The kernel is two orders of magnitude worse. That's not because it's bad, or TZ code is good... I'll readily concede that kernel code is almost certainly higher in quality than closed-source TZ OSes. But it's also vastly larger and more complex, with so much more attack surface.

Re:The solution is horribly obvious

[swillden]

There is an important distinction though. If I do not control the code running in that processor (or trust zone), it *IS* inherently insecure for me. If I do control it, it may improve security or it might be neutral WRT security.

There's lots of code that you do not control running in every computing device you use. If you insist on that exceedingly strict definition, you should just avoid them entirely. Also, your assertion that if you do control it it's either neutral or positive is patently false. It is entirely possible to exercise control in ways that decrease your security. It's pretty common, for example, for people who root their Android devices to believe that they're improving their device security by taking control over it, when they've actually just poked gaping holes in the security model designed to protect them.

Code that you do not control may be good, bad or neutral from a security perspective. It depends both on the goals of the people who do control it, and on their ability to achieve their goals. Code that you do control may be good, bad or neutral. You know what goals you're trying to achieve, but there's still the question of your ability to achieve them.

Re:The solution is horribly obvious

[sjames]

There's not actually a lot on the machines I am using. That doesn't mean that I have written or even audited every line myself, just that it is open for me to do so.

Of course, in embedded devices the code is less open for my audit or modification, but those devices also don't have much exposure to my personal data.

Re:The solution is horribly obvious

[swillden]

You're using some very unusual machines, then. Or you're mistaken about how many binary firmware blobs there are.

Re:The solution is horribly obvious

[sjames]

There was even less when I was working on coreboot.

Keep in mind, the BIOS is a nasty pile of hair but it IS open to audit.

The ME, OTOH loads an encrypted and signed blob.

Re:The solution is horribly obvious

[swillden]

Just to be clear, I don't like or support the presence of opaque binaries in systems. One of the things I'm trying to achieve in the Android ecosystem is to move OEMs to using open source code in TrustZone. There is tremendous security value in having a trusted execution environment which is small and isolated, because making full consumer OSes secure is simply impossible, but having the code in that TEE be closed doesn't add anything to the security proposition, and arguably reduces it. That's why Google has Trusty, and why the OS and apps are developed directly in AOSP.

One of the things on my to-do list (far down the list at the moment, given that hardly any devices use Trusty) is to find ways to enable (technically-capable) users to verify that the TEE software running on their device matches the source code. In addition, users should be able to sign and install their own TEE software, as well as their own non-secure world software. The Nexus devices have always allowed the latter, but the TEE has been solely controlled by the SoC vendor. The only exception to that, as far as I know, is the Pixel C tablet from Google. It uses a hardware switch analogous to (and based on) the "dev screw" in Chromebooks. If you flip that switch then you can install your own verification keys for both system and TEE. Your TEE OS won't have access to the DRM keys baked into the hardware, of course, but outside of that limitation you can do whatever you want in the TEE.

Of course, there are a lot of other opaque, highly-privileged binaries in mobile devices. Almost all of the firmware for radios, GPUs, GPS, etc., etc., is all closed, proprietary code written by the component manufacturer and kept secret even from the OEMs. I don't have any idea how we can fix that.

Re:The solution is horribly obvious

[sjames]

In a cellphone, the radio is the worst of the bunch. It has the ability to snoop on the main CPU and controls the boot process. that's why rooting many Android phones involves re-flashing the radio. An actual free and open radio probably isn't permitted by the FCC and other nation's equivalents around the world, but I would like to see it demoted to just another component with a narrow interface to the main system. Preferably it would require the cpu to feed it digitized audio rather than having a direct connect to the microphone.

Re:The solution is horribly obvious

[swillden]

In a cellphone, the radio is the worst of the bunch. It has the ability to snoop on the main CPU and controls the boot process.

I've heard that said by many people, but as far as I can tell by examining the architecture of the devices I've worked on, it's not true. The baseband radio does have DMA access, like most every peripheral, but it doesn't have any special sort of access to the CPU.

Re:The solution is horribly obvious

[sjames]

If there isn't an IOMMU, DMA access is enough to overwrite any code in the system, and so control the CPU.

Re:The solution is horribly obvious

[swillden]

There is an IOMMU. Among other things, TrustZone relies on it.

Re:The solution is horribly obvious

[sjames]

I should be more specific, an IOMMU exclusively controlled by the CPU. In this case, the secure side necessarily controls it (or it wouldn't be secure), not the user side. This makes the user side at the secure side's mercy. A narrow interface would leave the radio secure, but would also make the user side secure from the radio.

Re:The solution is horribly obvious

[swillden]

I should be more specific, an IOMMU exclusively controlled by the CPU. In this case, the secure side necessarily controls it (or it wouldn't be secure), not the user side. This makes the user side at the secure side's mercy. A narrow interface would leave the radio secure, but would also make the user side secure from the radio.

The IOMMU is controlled by the CPU, by which I mean the AP (application processor). The non-secure mode software (EL0 and EL1) controls most of its configuration, including allocating DMA pages for the baseband, though it can't override the configuration provided by the secure mode (EL3). That's my understanding, anyway. Most of my work is at a slightly higher level.

Re:The solution is horribly obvious

[sjames]

The difference may just be the phones we're dealing with. Do the ones you've worked with/on do locked bootloader/network? The ones I've seen do, and use the processor in the radio to lock it down. It may be the ones you know of simply don't do that. It could also be a matter of the generation of phone. My knowledge is a couple years out of date at this point.

There is still the question of the radio though. Does it have independent access to the microphone or does it depend on the AP for that? can it access the GPS without help?

This fella shopuld get a lawyer...

[bogaboga]

He published a step-by-step guide on how one can break down the encryption protections on Android devices powered by Qualcomm Snapdragon processors.

I do not think Qualcomm or Google will be impressed.

My advice to him: "Get a lawyer, quick!"

And this is why DRM is bad... mmmkay?

[WorBlux]

And exploit of the widevine DRM subsystem running in trust-zone. The second exploit is possible because you don't control the keys to the kingdom.

Not feasible against a good password.

[BitterOak]

I read the article and it looks like this exploit merely allows offline brute forcing of the password. Now, of course, many people choose short passwords on their portable devices, but if you choose a password with sufficient entropy (at least 100 bits, or better yet, 128) you should be safe from this attack. Note: that would require a fairly long and random alphanumeric password.

Re:Not feasible against a good password.

[AmiMoJo]

Additionally, they need to get to your phone in an unlocked state. As soon as you power off or reboot the key is lost.

Re: Not feasible against a good password.

[bill_mcgonigle]

Just MMS them a malformed mp4.

Re: Not feasible against a good password.

[nehumanuscrede]

not to point out the obvious, but no one is going to use a giant password they have to put in via the tiny little keyboard on the phone everytime they want to use it.

Great from a security standpoint, not so much from a convenience one.

Re: Not feasible against a good password.

[AmiMoJo]

If you are including old, long patched vulnerabilities then why not just steal the encrypted information directly from the victim's phone? Encryption doesn't mitigate that threat on any system, that's not what it's for.

Encrypted protects you from law enforcement and theft.

Re:Easier ways

[Shakrai]

That assumes you can get the user's device from them without their knowledge. Such an attack is feasible on desktops, and many laptops, but phones are the one electronic device even layman carry with them EVERYWHERE. When was the last time your phone was out of your immediate sight and direct control?

Already patched

[swillden]

For devices that get regular updates the Qualcomm TrustZone bug has already been fixed. It went out in the January 2016 updates: https://source.android.com/sec.... Check the patchlevel date on your device.

Of course the other part, that someone who can compel Qualcomm to sign TrustZone software images that intentionally compromise security, is still the case, and likely will be for some time. That's a threat model that hadn't been considered important until recently, and it's one that's not easy to mitigate. That's not restricted to Qualcomm, either. In every device with a trusted execution environment, there's some organization who holds the signing keys needed to load firmware in that environment, generally (but not always) the SoC vendor.

Re:Already patched

[hawguy]

For devices that get regular updates the Qualcomm TrustZone bug has already been fixed. It went out in the January 2016 updates: https://source.android.com/sec.... Check the patchlevel date on your device.

Of course the other part, that someone who can compel Qualcomm to sign TrustZone software images that intentionally compromise security, is still the case, and likely will be for some time. That's a threat model that hadn't been considered important until recently, and it's one that's not easy to mitigate. That's not restricted to Qualcomm, either. In every device with a trusted execution environment, there's some organization who holds the signing keys needed to load firmware in that environment, generally (but not always) the SoC vendor.

Can't this hole be closed by designing the trusted firmware so it requires that the passcode be entered before it will accept a firmware update?

Re:Already patched

[swillden]

Can't this hole be closed by designing the trusted firmware so it requires that the passcode be entered before it will accept a firmware update?

Yes, but it's tricky, particularly because it's not that hard to open the device and write an updated firmware blob to flash directly, bypassing any software-based gatekeeping checks. There are ways to address that, but they raise subtle issues in turn, and ways to address those, but they raise more issues. At root, the existence of Replay Protected Memory Blocks in eMMC controllers makes it feasible to have small amounts of non-volatile storage that an attacker probably can't write to, which I believe makes it feasible. But it's far from simple, especially within all of the other performance, cost, testability and other constraints.

Re:Already patched

[swillden]

Oh yeah Grandma: "check the patchlevel of your device".

Well, the right answer is to buy a device that has a published support policy that includes monthly security patches. Then you don't have to check the patchlevel (which actually isn't tough, even for Grandma: It's just a date and she's perfectly capable of understanding it), because you know it's good. Maybe someday consumers will demand that of all Android devices. At present, they don't, and manufacturers give them what they want.

Re:Already patched

[swillden]

Oh yeah grandma: "buy a device that has a published support policy". Christ. No wonder Apple is selling so many iPhones.

Well, she knows to look at the warranty when she buys a car.

Re: Already patched

[Anonymous Coward]

No, it's not JUST buy a device with a patch policy you trust, it is buy a device from a vendor you trust, with a patch policy you trust, and also go and do a bunch of research into the vendors to figure out which ones you can trust, and way MORE research to figure out the patch policy you can trust.

Or just buy and iPhone and skip the degree in this field that you don't have any interest in.

Re: Already patched

[sexconker]

Alternatively, don't store sensitive information on your phone.

Re:Already patched

[drinkypoo]

Well, she knows to look at the warranty when she buys a car.

Does she? And if she does, will she? Or will she just ask them a couple of questions about it like how long is it and what does it cover, and then move on? Legal contracts are difficult for anyone to understand, is your grandmother a lawyer?

To be fair, Apple's legalese is plenty long.

Re:Easier ways

[vux984]

When was the last time your phone was out of your immediate sight and direct control?

5-8 hours per night. plus the odd nap. plus when i leave it in the locker at the pool or gym. There are some other times too... like swimming at the beach.

That assumes you can get the user's device from them without their knowledge.

Just steal it from them when they are out and about. Sure they'll know its gone missing. So what? You want what's on it, it doesn't always matter if they know or not -- and most of us aren't paranoid enough to assume it was the men in black helicopters and not just some random theif. Phones get stolen ALL THE TIME.

Hell, you can even plant something on it, and then return it to them... turn it into the carrier or lost and found or the police or something; odds are they'll be so happy/surprised that it turned up again they won't even think that it was hacked.

Re:Easier ways

[swillden]

Why not just uncompressed the initramfs, load a binary or other tool to siphon off the users pw on key entry?

The kernel is unencrypted as the system needs to boot from it

If you modify the boot image on a Marshmallow device, the screen will notify the user during boot that verification failed. On a Nougat device I believe it will refuse to boot.

Re:Easier ways

[swillden]

Hell, you can even plant something on it, and then return it to them... turn it into the carrier or lost and found or the police or something; odds are they'll be so happy/surprised that it turned up again they won't even think that it was hacked.

Planting something on it isn't so easy if it's locked. But, really, you don't have to do that. Want to get into someone's phone? Here's how:

Buy an identical device. Get a good look at theirs so you can put similar scratches, cover, lockscreen background, etc. on it. Configure your device to send the password they enter to you. Steal theirs and leave yours in its place. When they enter your password, you get it and use it to get into their device. To keep it from being obvious that their device has been replaced, have it refuse to "unlock" no matter what they enter. This also helps you in the event they get their password wrong the first time, because they'll helpfully re-enter it. Meanwhile, they'll think their password on their phone has gotten messed up.

This works on *any* model... Android, iPhone, Windows phone, Blackberry... you name it.

Re:Easier ways

[Shakrai]

and most of us aren't paranoid enough to assume it was the men in black helicopters and not just some random theif.

The point is that the people who do have something to hide are apt to be that paranoid, so this attack vector isn't as useful as it might seem. Then again, I suppose that many criminals are idiots, and I could see some of them being stupid enough to enter a passphrase even if the device was handed back to them by the detective running their case. Hell, they'd probably unlock it on their way out of the station to text their buddies about how they beat the system. That's pretty low hanging fruit though.

Personally, I have little worth hiding, but I would not key a FDE passphrase into any device that I had reason to believe was no longer trustworthy. At the very least a lost and found device is getting a full reset and ROM reload. It's the same approach to dealing with malware; it never ceases to amaze me how many otherwise smart IT folks think they can "clean" a compromised system. There is no "cleaning" a compromised system, you blow it away and rebuild it. Anything short of this invites disaster and should it strike you deserve what you get.

This just in...

[vbguyny]

All encryption can be eventually cracked. More at 11.

Re:This just in...

[sexconker]

Not NULL encryption.

It may not be so bad afterall...

[mlts]

The original Android implementation of dm-crypt generates a -random- key in Android 5.0, which is the key used for encryption. It then encrypts that key with the user's passphrase/PIN/whatever. This implementation is pretty secure, because other than active RAM attacks, when the phone starts up, it will ask for the decryption key for /data, and no key, no decryption.

From what I have looked at with CyanogenMod, this ROM uses the "old fashioned way". No TrustZone, no fancy footwork with keys... just a relatively simple prompt for the passphrase at the phone startup so /data can be mounted and used. From there, the VEK (volume encryption key) is in RAM, and the screen lock is used. This is simple, but effective.

Re:It may not be so bad afterall...

[hankwang]

"CyanogenMod (...) uses the "old fashioned way". No TrustZone, no fancy footwork with keys... just a relatively simple prompt for the passphrase at the phone startup so /data can be mounted and used."

I'm using CM13 (Android 6/Marshmallow), which uses FDE, yet can boot without password prompt, just like stock Android 6. It will present the lock screen though. Leaving aside the security of a booted and connected phone with only the lock screen as a protection, the only way to do this seems to be to use some kind of trusted execution environment. Otherwise, you could pull the entire encrypted data partition over USB from the (obviously non-stock) boot loader and have all the necessary data to decrypt it offline.

Make the manufacturer key replaceable

[cciechad]

Seems like the solution would be to allow users to wipe the manufacturer key and install their own. Although they probably don't want to do this with all their signed bootloaders and code.

Backdoors are always bad

[markdavis]

>" The researcher also said Qualcomm or OEMs can comply with government or law enforcement agencies to break the FDE: "Since the key is available to TrustZone, Qualcomm and OEMs could simply create and sign a TrustZone image which extracts the KeyMaster keys and flash it to the target device," Beniamini wrote. "This would allow law enforcement to easily brute force the FDE password off the device using the leaked keys." "

Which also means ANYONE it was leaked to can do the same thing- criminals, spies, malware, other governments, etc. Which is why having backdoors is always bad.

Surprised

[nehumanuscrede]

this was made public knowledge before the FBI could classify it as a National Security secret.

Explain something to me.

[chasm22]

From the article in The Hacker News, "Once getting hold of this key, an attacker could perform a brute-force attack to grab the user password, PIN or lock, cracking Android's full disk encryption."

Why not just get the user password by brute force attack to begin with since it will unlock the encrypted files for you? I know I'm missing something. If you go through this process only to wind up having to mount a brute force attack, what is gained?

Re:Explain something to me.

[JesseMcDonald]

Why not just get the user password by brute force attack to begin with since it will unlock the encrypted files for you?

Because the user's password won't let you unlock the encrypted files, at least not on its own. The password works in conjunction with a much stronger key randomly generated by the device itself. To decrypt the files you need both the device key and the user's password. The key is normally only available to software running inside the TrustZone, which limits the number and frequency of authentication attempts. This exploit allows an attacker to retrieve the device-specific key from the TrustZone, but they still need the password to use it. Fortunately for the attacker, human-memorable passwords are comparitively simple to break. The alternative would be brute-forcing the decryption key directly, which is effectively impossible—the human race would probably go extinct first, even assuming theoretically ideal computers and the dedication of every resource at our disposal with single-minded focus toward breaking this one key.