Today’s standard embedded technology is not resilient against basic hardware fault injection attacks. Such attacks alter the intended behavior of a chip by manipulating its environmental conditions. Typically this is done by manipulating the power supply voltage, but more advanced techniques use electro-magnetic or optical pulses.
Code bases which are executed at the highest privilege level are of special interest to attackers, because modified behavior can have much impact on the security of the whole system. Whereas common software vulnerabilities are very powerful, such code is typically well protected against pure logical attacks. An example is secure boot, a common embedded system security feature to assure the integrity and confidentiality of all code executed after power-on reset. With fault injection it is possible to override restrictions or skip protective code, which enables a hostile takeover of the system.
This talk provides an introduction to fault injection attacks on embedded systems and explains their impact on secure boot using multiple practical examples. As a key take away from this talk we present practical mitigation techniques for implementers of secure boot to lower the probability of a successful attack.
Niek Timmers
Albert Spruyt