A Titan M Odyssey

Explore the inner workings of Google's Titan M chip in this 35-minute Black Hat conference talk. Delve into the security features and architecture of this hardware security module introduced with the Pixel 3 in 2018. Learn about its role in reducing attack surfaces, mitigating hardware-level exploits, and providing critical security functions like StrongBox and Android Verified Boot. Discover the research status, specifications, memory layout, and operating system of Titan M. Examine firmware boot processes, updates, and security measures. Gain insights into static and dynamic analysis techniques, including Ghidra loader usage and communication sniffing. Uncover hardware reverse engineering methods, focusing on SPI communication. Investigate discovered vulnerabilities, including out-of-bounds read and downgrade issues. Explore post-exploitation possibilities and fuzzing techniques for Titan M. Conclude with remarks on the significance of this security chip in the Android ecosystem.