The ideal professional group to review this material is Senior Hardware Security Researchers and Penetration Testers.
Abstract:
This presentation details a rapid, four-day hardware security analysis conducted by Sergei Volokitin during HardPwn NL 2024, targeting Xiaomi consumer devices. Initial reconnaissance on an Outdoor Camera revealed cleartext storage of user footage and backend authentication tokens, which were reported. The primary focus shifted to the Xiaomi S3 Smartwatch, a device employing robust security mechanisms including a Trusted Execution Environment (TEE) for PIN verification and hardware isolation. Physical analysis involved dismantling the device, extracting the 8 GB eMMC flash memory, and performing forensic analysis of the file system. The central vulnerability identified was the persistent, unencrypted logging of precise touchscreen coordinates related to user PIN entry within the non-secure core dump partition. By correlating these coordinates with successful authentication messages, an attacker with brief physical access and soldering equipment can recover the user's PIN, thereby achieving full compromise and bypassing the watch's primary security measure. The presentation concludes with a discussion regarding the inadequate severity scoring (CVSS) often applied to complex physical-access exploits.
Exploitation Against the Clock: Xiaomi S3 Smartwatch
0:55 HardPwn Event Context: The research was executed during the HardPwn NL 2024 event, an accelerated vulnerability discovery competition sponsored by vendors (in this case, Xiaomi/Huami) to improve device security within a tight deadline (four days).
3:53 Hardware Attack Relevance: Hardware attacks are critical for DRM bypass, serving as a necessary stepping stone for discovering remote vulnerabilities in closed systems (encrypted updates, no shell/debug access), and defending against physical theft of portable devices (smartwatches, smartphones).
6:07 Xiaomi Outdoor Camera Findings: The initial target provided two distinct vulnerabilities: unencrypted storage of user video content and the local storage of two backend security tokens on the file system, both reported to the vendor.
8:33 Xiaomi S3 Smartwatch Assets: The watch stores highly sensitive data including text notifications, calendar information, health metrics, NFC payment secure elements, and features phone unlock capabilities, protected by a PIN/pattern lock and on-wrist detection.
11:18 Physical Teardown and Acquisition: The S3 watch was opened using heat, revealing multiple PCBs connected via flexible cables. The main component, an 8 GB eMMC flash memory chip, was physically removed and read out to access the file system partitions.
13:21 Architectural Discovery: Log analysis from the plaintext core dump partition indicated the concurrent execution of at least four Real-Time Operating Systems (RTOSs): Audio DSP, Communications Processor (CP), Application Processor (AP), and the Trusted Execution Environment (TEE).
16:03 TEE Pin Verification Logic: The TEE executes a specific trusted application (ta_pin) responsible for receiving user PIN input, verifying it, and enforcing rate limiting (throttling) after multiple incorrect attempts. TEE log messages were found to be obfuscated (likely via CRC or hashing) to prevent easy interpretation by an attacker.
19:11 Critical Information Leakage: Although the TEE logs were obfuscated and the PIN was not printed, the non-trusted Application Processor logged the unencrypted X and Y coordinates of all touch events (19:28).
20:06 PIN Reconstruction Exploit: By extracting the sequence of six touch coordinates immediately preceding the successful PIN verification message in the historical core dump logs, the six-digit user PIN could be accurately mapped to the on-screen keypad positions.
21:01 Full Compromise Scenario: The attack requires an adversary to acquire the physical device, extract the eMMC memory, read the logged coordinates, reassemble the watch, and input the recovered PIN to gain full control, bypassing all lock screen security mechanisms.
21:47 CVSS Scoring Critique: The researcher noted that this high-impact, physical compromise exploit is often assigned a lower CVSS score than remote exploits due to the requirement for physical access, potentially leading vendors to improperly prioritize remediation.
26:24 Remediation Status: The vulnerabilities were reported in November 2024, but the fix for the Smartwatch vulnerability was still in progress approximately six months later due to unexpected implementation complexities.