|21 Nov||Sunday||0900-13:00 GST/GMT+4||8 Hours – Presentations & Hands-on exercises|
|22 Nov||Monday||0900-13:00 GST/GMT+4||8 Hours – Presentations & Hands-on exercises|
|23 Nov||Tuesday||0900-13:00 GST/GMT+4||8 Hours – Presentations & Hands-on exercises|
|24 Nov||Wednesday||0900-13:00 GST/GMT+4||8 Hours – Hands-on Exercises|
The 4th day is an optional day, which may be used by the attendees to complete the left-over exercises. During this day, only online support is available via Discord. No in-person presence is available from the trainers nor required by the attendees.
A Trusted Execution Environments (TEE) is notoriously hard to secure due to the interaction between complex hardware and a large Trusted Code Base (TCB). The security provided by different TEE implementations has been broken on a wide variety of devices, including mobile phones, smart TVs and even modern vehicles.
The TEEPwn experience takes an offensive perspective and dives into the darker corners of TEE security. It’s designed with a system-level approach, where you will experience exploitation of powerful vulnerabilities specific for TEE technology. Moreover, it’s hands-on, well-guided and driven by an exciting jeopardy-style game format.
Your journey starts with achieving a comprehensive understanding of TEE technology. You will learn how hardware and software cooperate in order to enforce effective security boundaries. You will then use this understanding for identifying interesting vulnerabilities across the entire TEE attack surface. You will be challenged to exploit these vulnerabilities using multiple realistic scenarios. All practical exercises are performed on our emulated attack platform which is using ARM TrustZone to implement multiple TEE implementations.
You will take on different roles, as an attacker in control of:
You will be guided towards an unexpected range of TEE-specific attack vectors and vulnerabilities, which can be leveraged for novel and creative exploits, allowing you to refine your skills to a new level.
Do not worry if your reverse engineering or exploiting skills are rusty or non-existing. You do not need to be an software security expert nor do we aim to make you one. Nevertheless, many exercises can be completed in complex way which keeps the exercises interesting to experienced attendees as well.
During the training we will provide you with the following:
We will also provide you the following in order to continue with the exercises after the training:
This TEEPwn experience will be given in a hybrid format where attendees are able to join in-person and online at the same time. Attendees need to select the desired format before the start of the training.
Both formats include an optional 4th day which may be used by the attendees to complete the left-over exercises. During this day, for both formats, only online support is available via Discord. No in-person presence is available from the trainers nor required by the attendees.