Hardware: fault injection and side channels

Fault injection

Techniques

  • Clock glitching
  • Voltage glitching
  • Electromagnetic fault injection (EMFI)
  • Laser

Effects

  • Skip instructions
  • Incorrect data fetch
  • Incorrect instruction fetch or decode
  • Failed writeback

Countermeasures

  • Redundancy and integrity checks
  • Fault-resistant design

Side-channel analysis

Attacks that observe the physical implementation instead of the algorithm, by measuring timing, power (SPA/DPA), electromagnetic emission, cache behavior, acoustics or leftover data (remanence). Countermeasures: masking and hiding.

Examples

Interfaces and acquisition

  • UART: console capture (root shells, boot logs)
  • CAN: capture and replay
  • SPI: reading and rewriting flash
  • SWD/JTAG: debugging and reflashing targets (e.g. J-Link, Black Magic Probe)
  • Wireless sniffing (e.g. with a software-defined radio like HackRF)

Firmware analysis

  • First pass: strings (strings -el for UTF-16)
  • Classify each region: plaintext vs compressed/encrypted
  • Watch endianness: big endian is more common than I thought!
  • Single-byte XOR is recoverable via padding leak, known plaintext or frequency analysis
  • Extract with binwalk or unblob, then reverse with Ghidra, IDA Pro, Binary Ninja or radare2. Use signatures to find and apply names to symbols.

Tools

Start with the least invasive tool: verify power and signal levels before connecting anything, and escalate from multimeter -> oscilloscope -> logic analyzer -> debugger/programmer.

Hardware security

Design toolchain

Resources