Hardware: fault injection and side channels
Fault injection
Techniques
- Clock glitching
- Voltage glitching
- Electromagnetic fault injection (EMFI)
- Laser
Effects
- Skip instructions
- Incorrect data fetch
- Incorrect instruction fetch or decode
- Failed writeback
Countermeasures
- Redundancy and integrity checks
- Fault-resistant design
Side-channel analysis
Attacks that observe the physical implementation instead of the algorithm, by measuring timing, power (SPA/DPA), electromagnetic emission, cache behavior, acoustics or leftover data (remanence). Countermeasures: masking and hiding.
Examples
- Meltdown and Spectre
- RowHammer and subsequently GPUHammer
- Cold boot
- TEMPEST (also known as Van Eck phreaking)
Interfaces and acquisition
- UART: console capture (root shells, boot logs)
- CAN: capture and replay
- SPI: reading and rewriting flash
- SWD/JTAG: debugging and reflashing targets (e.g. J-Link, Black Magic Probe)
- Wireless sniffing (e.g. with a software-defined radio like HackRF)
Firmware analysis
- First pass:
strings(strings -elfor UTF-16) - Classify each region: plaintext vs compressed/encrypted
- Watch endianness: big endian is more common than I thought!
- Single-byte XOR is recoverable via padding leak, known plaintext or frequency analysis
- Extract with binwalk or unblob, then reverse with Ghidra, IDA Pro, Binary Ninja or radare2. Use signatures to find and apply names to symbols.
Tools
Start with the least invasive tool: verify power and signal levels before connecting anything, and escalate from multimeter -> oscilloscope -> logic analyzer -> debugger/programmer.
Hardware security
- ChipWhisperer
- Logic 2 (Saleae)
- sigrok / PulseView
- Multimeter, oscilloscope and bench power supply