71–78 of 78 posts
> I quickly identify a pure HW processing 500us before the beginning of the UART ascii strings ‘ets June 2018’ corresponding to the BootROM process.
> This HW activity is probably the eFuses Controller initialisation, and a load of the eFuses values in some dedicated buffer memory, to be used by the Flash controller for further steps).
How one would come to this specific conclusion without having any prior knowledge of the boot rom ?
From the article: > I quickly identify a pure HW processing 500us before the beginning of the UART ascii strings ‘ets June 2018’ corresponding to the BootROM process. > This HW activity is probably the eFuses Controller initialisation, and a load of the eFuses values in some dedicated buffer memory, to be used by the Flash controller for further steps). How one would come to this specific conclusion without having an…
And, the way all of those things work is by setting registers so that they're visible in the software either _still_ in a register, or mapped into the address space.
Edit: I checked your profile and see that you're an embedded engineer, so I must have missed some nuance in your question, because power glitching the boot sequence to mess with hardware init it a really popular vector for attacking embedded devices. Please feel free to disregard my reply.
Earlier quoted context omitted.
So how do Chinese Entrepreneurs maintain competitive advantage and profit ?
Think a bit yourself. If you struck gold, you have zero chance not being cloned. 1. Do not strike gold — look for an easily entrechable position in niche market, like a lot of companies in US do 2. Economies of scale — works until your competitor bribes a banker for a giant loan 3. Be one step ahead — look at FAB business. In microelectronics fabrication, everybody copy each other, and you can't do anything about it,…
But there's a big difference between being cloned in a month, and being cloned in a year.
Within a year, maybe you could build a brand, create v2, have some economies of scale in dealing with your suppliers(harder to bribe), create some internal expertise.
The last situation is somewhat similar to the fabless companies.
Earlier quoted context omitted.
This is kind of a myth. There is such thing as tamperproof hardware components and they can protect against plenty of threats. Security isn’t all or nothing, it’s about understanding what the different threats are and adequately protecting against them. Not everyone is trying to protect against attackers with millions of dollars at their disposal. There is plenty of value to deterring 99% of attackers with physical a…
I don't disagree with other parts of your post, but I still think protecting against the scenario where an attacker has physical access to your computer is basically pointless. Especially if it comes with a very significant loss of freedom. If a malicious person has entered your home or workplace, access to your computer should be low on the list of worries.
ATMs. Parking meters. Building security/intercom systems. Digital billboards and transit information signage.
These are the IoT devices that need to be hardened against physical access.
Earlier quoted context omitted.
> Isn't that a good thing for me as a consumer? I like the ability to decrypt and modify my own devices. If you're the sort of person who buys wifi-based-internet-enabled door bells, but you don't want someone who steals your doorbell to (a) be able to extract your wifi password or (b) be able to get the thing to work at all, you might appreciate resistance to the thief's attacks. Of course, you can also address this…
This could still be addressed by not putting the wifi part of the doorbell into the doorbell itself or alternatively using something like LoRaWAN where at worst someone could compromise the device keys (which you can reprovision) so your Wifi isn't compromised at all. Another solution is to use a second gateway inside the house that manages the Wifi part and secure communication with the doorbell via short range radi…
Earlier quoted context omitted.
I have a product in the field, Chinese clones are on the market using my firmware that was pulled via voltage glitch. Two things, 1. You know you’ve made it when there is a Chinese clone of your product. 2. I’ll never use that chip again.
What chip (family) would you use instead if firmware protection is important to your application?
I could tell you about hardware security modules (HSM) or the new ARM trustzone for small micros, but I’m designing new products so that if I handed you the source - you still can’t clone a board. That requires a connection to a better trusted device.
Some additional info is in Espressif's notification (CVE-2019-17391) which is linked to in the write up: https://www.espressif.com/en/news/Security_Advisory_Concerni... The fix is in ESP32-D0WD-V3 and ESP32-WROVER-E, but of course that doesn't do you any good if you've already shipped product.
I wonder why they weren't using Public-Private crypto in the first place? Perhaps because it would use up more space in the ROM? If so, I wonder what functionality they dropped from the ROM to add it now? I somehow doubt they made the ROM bigger - that would be very expensive at this stage of the chips lifecycle.
At some point, the software has to be decrypted on the physical device to run. The best you can ever do is put enough physical hoops in the way to make it impractical to defeat.
Something about e-fuses seems quite mystical. The idea of a computer program deliberately and permanently damaging its own hardware (or hardware it is attached to) using a mechanism so close to regular operation (current flowing in memory) but for a good reason rather than to cause harm, and in such an information rich way. Different to say a robotic tool using its tooltip to maim itself and different to one robot bu…
Another way to think of it is, a memory-mapped set of wires that are made too thin, and when read, correspond to ones. If ones are written to that region, they become zeroes every time they are read afterward. This is kind of the reverse of how memory normally works. Of course the actual mechanism used in OTP memory is different...