  A major security challenge for modern Internet of Things (IoT) deployments is
to ensure that the devices run legitimate firmware free from malware. This
challenge can be addressed through a security primitive called attestation
which allows a remote backend to verify the firmware integrity of the devices
it manages. In order to accelerate broad attestation adoption in the IoT domain
the Trusted Computing Group (TCG) has introduced the Device Identifier
Composition Engine (DICE) series of specifications. DICE is a hardware-software
architecture for constrained, e.g., microcontroller-based IoT devices where the
firmware is divided into successively executed layers.
  In this paper, we demonstrate a remote Time-Of-Check Time-Of-Use (TOCTOU)
attack on DICE-based attestation. We demonstrate that it is possible to install
persistent malware in the flash memory of a constrained microcontroller that
cannot be detected through DICE-based attestation. The main idea of our attack
is to install malware during runtime of application logic in the top firmware
layer. The malware reads the valid attestation key and stores it on the
device's flash memory. After reboot, the malware uses the previously stored key
for all subsequent attestations to the backend. We conduct the installation of
malware and copying of the key through Return-Oriented Programming (ROP). As a
platform for our demonstration, we use the Cortex-M-based nRF52840
microcontroller. We provide a discussion of several possible countermeasures
which can mitigate the shortcomings of the DICE specifications.
