2024-12-14 –, Track 2
Embedded systems are everywhere, automating more and more of our everyday lives. Our cars, phones, games consoles, industrial controllers and IoT devices increasingly require security mechanisms to protect their security configurations, and in some cases, stored secrets, such as cryptographic keys, debug/flash protection access mechanisms, firmware images, and AI models. For a long time, local, physical attacks on general purpose microcontrollers were considered out of scope during threat analysis, but the increase in value of breaking the device security protections, the decrease in cost of the attacks, and the increase in awareness of such attacks, means that we’re in a transitional state regarding protection against fault-injection.
This talk will introduce attendees to fault-injection, a local attack category which is often used as the first step in the attack chain for embedded systems, and in some cases can also lead to remote attacks. It will cover the techniques which attackers use to generate security violations such as bypassing read protection, secure boot, or debug protection in embedded systems, even when the code is completely free of bugs. You will learn about the attacker motivations, tools and techniques, as well as the methods used to harden devices against these attacks, and how increased public awareness, certification, and regulation is changing the landscape. You will see how the cost of the equipment needed is often very low, and learn how you can begin your “glitching” journey for under £20.
We will look at the fault-injection mitigations added in the Raspberry Pi Pico 2, and consider their efficacy - there is currently a $20,000 bug bounty available for breaking these protections leading to recovery of a secret stored in the One-Time-Programmable flash memory.
We shall also touch upon side-channel analysis, which can recover cryptographic keys in use through measurement and analysis of tiny power fluctuations, or even by using a coil to pick up electro-magnetic emanations.
Keywords/phrases:
- Embedded Systems
- Microcontrollers
- Hardware Attacks
- Fault-Injection
- Voltage Fault Injection (VFI)
- Electro-Magnetic Faul Injection (EMFI)
- Clock Fault Injection (CFI)
- Risk Assessment
- Threat Modelling
- Automotive
- Industrial Control Systems
- IoT
- Mitigation Strategies
- Raspberry Pi Pico 2
- Side-Channel Analysis
After around 15 years of working on embedded systems, including writing ROM based secure bootloaders, I switched hats; now I try to ruin other people's release schedules by exploiting the security goals of microcontrollers, primarily using non-invasive physical attacks.