31–40 of 78 posts
Earlier quoted context omitted.
>You don’t use that stuff in high-security settings anyway. Forgive my ignorance, but what would one use? i.e. what's the high-sec equivalent of a esp32?
https://www.arm.com/products/silicon-ip-security https://www.arm.com/products/silicon-ip-cpu/securcore/sc300
Props for the effort, but who expects a cheap china MCU for consumer products to be resilient against glitching attacks? You don’t use that stuff in high-security settings anyway. For consumers products resilient to advanced hardware attacks, I can only think of the iPhone and some consoles. Anything else?
>You don’t use that stuff in high-security settings anyway. Forgive my ignorance, but what would one use? i.e. what's the high-sec equivalent of a esp32?
Disclaimer: used to work there but this is all public information
This is an interesting attack, and certainly looks highly successful in terms of allowing a determined hardware hacker to gain root/bootloader access to a device that the manufacturer has attempted to lock them out of. Glitching with a 6V supply on a 3.3V bus is certainly something I'd want to be a little cautious of if the hardware was more expensive than a $10 dev board - I wouldn't buy a $800 IoT fridge and use th…
If I'm not mistaken, buying one of a device and tearing it down like this would yield keys that would let you create "official" firmwares for all of the other ones of their kind and set up a fake update site allowing you to remote exploit all of the others, yes? If so this is a fairly serious hack especially for devices that auto-update OTA.
Earlier quoted context omitted.
It's used on most consumer devices simply to slow down clone devices being created.
Here's one that definitely did not: > Vulnerability n*2: No security settings (at all) https://limitedresults.com/2019/01/pwn-the-lifx-mini-white/
Earlier quoted context omitted.
One user's self is another user's attacker. This attack isn't one-time; if I can break into the hardware and change the keys such that I now control it, then someone else with temporary physical access can then break into my hardware and change the keys again , suborning "my" IoT device into e.g. a subtle wiretap. A computer anyone—not just the owner —can root given physical access, is like a lock that anyone—not jus…
Almost all computing devices are broken when given physical access. And if they aren't it's just because someone hasn't worked it out yet or is broken secretly by governments.
Security isn’t all or nothing, it’s about understanding what the different threats are and adequately protecting against them. Not everyone is trying to protect against attackers with millions of dollars at their disposal. There is plenty of value to deterring 99% of attackers with physical access.
The idea of security as all or nothing, and that physical access thus defeats all security measures, are security tropes that need to die. You can see how obviously wrong they are when you consider that just about every security system depends on proper behavior by trusted human beings, who are never 100% reliable.
Synopsis: Secret keys are embedded in the device's e-fuses and are not readable by normal means because of a protection e-fuse. By measuring current draw during power up an interval is determined to be the time when the CPU is reading the e-fuses. At that time the power supplies are "glitched" from 3.3v to 6v using unspecified patterns from a signal generator. This causes errors in the e-fuse reading, one of which is…
My guess is that the e-fuse is checked on every bit-read, so sometimes you don’t get the true value because your glitch isn’t precise enough.
Possibly there’s some randomization in the timing of each read, but there’s a signature current draw before each read that you can use to trigger your glitch.
Synopsis: Secret keys are embedded in the device's e-fuses and are not readable by normal means because of a protection e-fuse. By measuring current draw during power up an interval is determined to be the time when the CPU is reading the e-fuses. At that time the power supplies are "glitched" from 3.3v to 6v using unspecified patterns from a signal generator. This causes errors in the e-fuse reading, one of which is…
This is an interesting attack, and certainly looks highly successful in terms of allowing a determined hardware hacker to gain root/bootloader access to a device that the manufacturer has attempted to lock them out of. Glitching with a 6V supply on a 3.3V bus is certainly something I'd want to be a little cautious of if the hardware was more expensive than a $10 dev board - I wouldn't buy a $800 IoT fridge and use th…
I think most people are assuming that the user breaking this device is the owner and therefore don't see the potential threats this hack realizes. A perfect example of how this could be a problem would be the modification of a utility providers smart meter. The home owner hacks the firmware of their electicity meter to show a 10% reduction of power consumption. Im sure there are several more applications of this expl…
In general most people are honest, most of the others are deterred by stiff penalties, and these issues are kept in check at "human scale". DRM schemes are more likely to be used to erode long-held precepts, rather than being needed to enforce them.
I'm wondering, how many companies that use ESP32 actually use the firmware security feature?
This is an interesting attack, and certainly looks highly successful in terms of allowing a determined hardware hacker to gain root/bootloader access to a device that the manufacturer has attempted to lock them out of. Glitching with a 6V supply on a 3.3V bus is certainly something I'd want to be a little cautious of if the hardware was more expensive than a $10 dev board - I wouldn't buy a $800 IoT fridge and use th…
If you're the sort of person who buys wifi-based-internet-enabled door bells, but you don't want someone who steals your doorbell to (a) be able to extract your wifi password or (b) be able to get the thing to work at all, you might appreciate resistance to the thief's attacks.
Of course, you can also address this security concern by just not buying an internet-enabled doorbell.