Google Reimagined a Phone. It was Our Job to Red Team and Secure it.

Security

A team of ethical hackers red teamed the Google Pixel 6, discovering and exploiting vulnerabilities in the Android bootloader, Titan M2 chip, and firmware stack, highlighting the importance of fuzzing and continuous testing in securing devices.

Key takeaways

Red Team engagement aimed to secure the Google Pixel 6 phone, focusing on the Android bootloader, Titan M2 chip, and firmware stack.
Red Team’s goal was to find vulnerabilities, exploit them, and develop proof-of-concepts to test the device’s security.
The team discovered several vulnerabilities, including a high-severity issue that allowed for arbitrary code execution on the Titan M2 chip.
The team used fuzzing techniques, including host-based fuzzing and emulator-based fuzzing, to identify vulnerabilities.
The fuzzers were able to identify several vulnerabilities, including a bug in the Pixel 6’s bootloader that allowed for arbitrary code execution.
The team developed a custom shellcode to exploit the vulnerability and demonstrate the impact.
The team worked closely with the Google Pixel and Android feature teams to develop mitigations and fix the identified issues.
The Red Team engagement helped to identify and fix several security issues, making the Pixel 6 a more secure device.
The engagement also highlighted the importance of fuzzing and continuous testing in identifying and fixing vulnerabilities.
The team’s work demonstrated the value of having an offensive security program, which can help identify and fix vulnerabilities before they are exploited by attackers.

Google Reimagined a Phone. It was Our Job to Red Team and Secure it.

More talks