Protect modem certificate

RE: Protect modem certificate

Øyvind — Fri, 28 Jan 2022 08:22:13 GMT

Daniel, sounds good! Let us know if you have any issues with this solution.

Kind regards,
Øyvind

RE: Protect modem certificate

danielboe — Thu, 27 Jan 2022 12:45:43 GMT

Thanks for the response and investigation. We will consider this for our final product to close this attack weak point.

best regards

daniel

RE: Protect modem certificate

Øyvind — Thu, 27 Jan 2022 11:09:33 GMT

Hello again Daniel,

First of all, thank you for bringing this to our attention. The PSIRT team has assessed your PSIRT report. They write that the "official response to the DevZone request is to configure eraseprotect to mitigate this attack vector"

The team acknowledges the scenario, and will discuss further measures to counter similar scenarios in the future products. That said the ERASPROTECT should be the countermeasure to use in your scenario as this will prevent others from erasing the device and thus programming another custom FW.

Let me know if you have any further questions.

Kind regards,
Øyvind

RE: Protect modem certificate

Øyvind — Tue, 11 Jan 2022 15:22:47 GMT

Hi Daniel,

Yes, I believe that is the next step. Please link to this ticket as well.

Thank you!

Kind regards,
Øyvind

RE: Protect modem certificate

danielboe — Tue, 11 Jan 2022 14:35:56 GMT

Okay good we have a final answer here. Still I see this as a big security issue on device level. What is next? Is it usefull to open a ticket here:

https://www.nordicsemi.com/About-us/PSIRT

Best regards

Daniel

RE: Protect modem certificate

Øyvind — Mon, 10 Jan 2022 13:33:29 GMT

Hello,

This is the answer I got from one of our certificate experts:

The certificate is stored in the modem domain and the modem only acts based on commands it receives from the application. Modem does not validate the application, so even if the application is changed, the modem still responds to the commands it receives. Neither has the modem any way of detecting application ERASEALL.

Kind regards,
Øyvind

RE: Protect modem certificate

danielboe — Mon, 10 Jan 2022 07:34:51 GMT

Hi, are there any Ideas here how I can protect the certificate slot agains re-usage?. It would be great to close this door, even if its not that big

RE: Protect modem certificate

danielboe — Fri, 17 Dec 2021 10:04:45 GMT

Yep this works but I can recover the chip and then I can gain access to the certificate slot again and use it for auth with a new firmware. That is my "issue" I see

RE: Protect modem certificate

Øyvind — Fri, 17 Dec 2021 09:05:15 GMT

Daniel,
have a look at the APPROTECT and ERASEPROTECT are enabled chapter in nAN41, the Control Access Port chapter in the nRF9160 Product Specification, and the Debug and Trace chapter.

If Approtect is enabled it will block all debugger access, both secure and non-secure, and the secureapprotect will prevent debug on secure domain only.

Kind regards,
Øyvind

RE: Protect modem certificate

danielboe — Thu, 16 Dec 2021 10:29:26 GMT

jep exactly. I tried APPROTECT and after the needed wipe the certificate is still in the modem memory. Can it may work with SECUREAPPROTECT? but this sounds for me like a smaler version of APPROTECT and secure is included in APPROTECT ? Or am I wrong?

RE: Protect modem certificate

Øyvind — Wed, 15 Dec 2021 10:35:29 GMT

Hi Daniel, thanks for clarifying.

Have you looked at the Enabling device protection chapter in the application note: nAN41 - nRF9160 Production Programming?
This describes how to enable . Access Port Protection (APPROTECT), Erase Protection (ERASEPROTECT), and Secure Access Port Protection (SECUREAPPROTECT).

Kind regards,
Øyvind

RE: Protect modem certificate

danielboe — Tue, 14 Dec 2021 11:31:32 GMT

Hi, thanks for the response. I am not talking about reading the content. I am talking about using them. In my case I have a cloud certificate for AWS IoT. Even if I wipe the complete device because it is read protected it does not wipe the certificate. So everybody can flash a new firmware, only needs the certificate slot and can connect to my endpoint and send custom messages. This is the scenario I have in mind.

best regards

RE: Protect modem certificate

Øyvind — Fri, 10 Dec 2021 07:54:44 GMT

Hello Daniel,

Are you referring to the modem credential storage management? If so, the following are not readable after configuration:

1 – Client certificate (ASCII text).
2 – Client private key (ASCII text).
3 – PSK (ASCII text in hexadecimal string format).

Also, the read command is only available when modem is in offline mode.

Kind regards,
Øyvind