Gal Beniamini
More info
- Known for
- Exploits against TrustZone and Broadcom Wi-Fi chips
- Affiliation
- Google Project Zero
Israeli security researcher who showed that the most trusted parts of a phone are often the least examined.
On his blog Bits, Please! Beniamini published a 2016 series of attacks on Qualcomm's TrustZone environment, ending with the extraction of the key material behind Android's full-disk encryption. The secure world turned out to have memory bugs just like the normal one; it simply had fewer people looking.
At Google Project Zero in 2017 he went after Broadcom's Wi-Fi chips, found in both Nexus phones and iPhones. He got code execution inside the chip's own firmware purely over the air, then pivoted from there into the host kernel. The point was as much architectural as technical: peripherals with their own processors and no ASLR are attack surface the operating system can't see.