Hacking A Chip With A Wave of Your Hand

When you think of a standard hacker toolkit, software vulnerabilities and malware come to mind. But a pair of researchers are testing a different type of instrument: a physical tool that can break into devices with a wave of your hand.

At the recent REcon computer security conference, Red Balloon Security founder Ang Cui and research scientist Rick Housley presented a new approach to hacking a processor that uses electro-magnetic pulses to produce specific glitches in hardware. By disrupting normal activity at precise intervals, the technique can defeat the Secure Boot protection that keeps processors from running untrusted code.

Researchers have experimented with “fault injection attacks”, hacks that cause a strategic glitch, which in turn triggers abnormal, exploitable computer behavior, for decades. Those attacks, though, typically require physical access to a target's components.
“The advantage of this technique is that it’s physically non-invasive. You don’t have to touch the device, and you don’t leave any physical marks behind,” Cui says. “There’s no exchange of data at the electro-magnetic pulse stage, so this would never be caught by a firewall.”
Insecure Boot

Red Balloon specialises in Internet-of-Things Intrusion Defense; think of it as antivirus software for IoT. But the company has run into problems putting its security tool on IoT devices guarded by Secure Boot. Red Balloon's products don't undermine this safeguard; the company works with vendors to make its software compatible. But the dilemma got Cui and Housley interested in the theoretical question of whether a fault-injection attack could circumvent Secure Boot on locked-down IoT devices.

They started experimenting with the Cisco 8861 VoIP phone model that they had tried and failed to equip with their security product. (Cui also has a history of hacking Cisco phones.) 

The two found that if they poked the phone’s flash memory with a charged wire at the right moment while it booted up, they could cause a glitch that stopped the boot process. Instead, the phone surfaced access to a command-line interface that Cisco normally uses for debugging. Consumers are never supposed to see it. Cui and Housley also found vulnerabilities in the TrustZone security scheme of the phone's processor that allowed them to write code on processor memory that was supposed to be protected. (They disclosed these bugs to Cisco in April 2016.) Once they had access to the troubleshooting portal during boot, the researchers could load and execute their own code in a secure part of the processor to override Secure Boot.

Invisible Touch

All of which makes for a complicated hack, and one that requires cracking a phone open when you have a charged wire handy. But Cui and Housley wanted to take the attack a step farther, and realised that a well-timed EMP blast could trigger the same fault. They could execute the whole hack without needing to tamper with the components of the phone.
Lab-grade EM pulsing equipment costs hundreds of thousands of dollars, so instead the researchers built their own system for about $350 using a 3-D printer and readily available components. They plan to release open source schematics of the setup so other researchers can use it too.

Eventually, Cui and Housley worked out that delivering a 300 Volt pulse to the phone's RAM 4.62 seconds into startup reliably created the glitch they wanted. With access to the debugging portal, they could use the phone’s console port, an auxiliary port on the back of the phone, to load in and run their Secure Boot override protocol within five seconds.
"The attack’s principle is clever," says Jean-Max Dutertre, a hardware security researcher at École Nationale Supérieure des Mines de Saint-Étienne in France. "Finding a way to bypass timing and spatial resolution issues is always highly effective."
The system can currently deliver the pulse from 3 millimeters away from the phone, so while the hack doesn't require physical contact, it does need proximity. Still, an attacker could cause the crucial fault by, say, waving their hand over the device while holding a tiny electromagnetic pulse generator, a subtler action than opening up the phone and sticking a wire into it.
“With any hardware attack you need to be physically present, so that’s already a huge barrier,” says Jasper van Woudenberg, the chief technology officer of Riscure North America, a firm that tests hardware and software security. “But this is a nice proof of concept to show that if you don’t take care of these attacks, they could actually happen.”

Who's Down with EMP

What makes the attack so challenging is, in part, the Broadcom multicore 1Ghz ARM processor it targets. Modern processors pack transistors in densely and have high clock speeds, making it difficult to discharge EM pulses quickly and accurately enough to impact one specific process on a chip without collateral damage.

But by thinking of the interconnected components in a device (like the processor, flash memory, and RAM) as a network of computers in and of themselves, researchers can create fault injection strategies that are more like network hacking, attacking a system's weakest point to compromise the real target, in this case the powerful processor.
“We wanted to look at the second-order effects of an electro-magnetic pulse, as it affects not just a single machine but a complex network of interdependent components,” Cui says. “So that allows us to sidestep the traditional electro-magnetic fault injection limitations, and use electromagnetic pulses to predictably change the way computers compute.”

As electro-magnetic fault injection hacking becomes more robust, it will in turn become more important to protect components from physical, non-invasive hacks.

Some ultra secure devices already include such defenses, because further refinement would put not only IoT devices at risk but also full-service computers. "This kind of attack could be devastating because it is relatively easy to perform," Dutertre says.

And while Cui and Housley's research exists strictly as a proof of concept, they caution that other groups may have capabilities that far exceed academia's.
“We don’t think we’re the farthest along in this research,” Cui says. “We’ve been doing this on our off time as a side project. If somebody wanted to put significant resource into this, they would certainly be ahead of us."

Wired

You Might Also Read:

New IoT Chips See, Think & Act Autonomously:

 

« Ten Years Since The Outbreak Web War One
Three Ways To Prepare Your Business For GDPR »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

CSI Consulting Services

CSI Consulting Services

Get Advice From The Experts: * Training * Penetration Testing * Data Governance * GDPR Compliance. Connecting you to the best in the business.

Clayden Law

Clayden Law

Clayden Law advise global businesses that buy and sell technology products and services. We are experts in information technology, data privacy and cybersecurity law.

IT Governance

IT Governance

IT Governance is a leading global provider of information security solutions. Download our free guide and find out how ISO 27001 can help protect your organisation's information.

LockLizard

LockLizard

Locklizard provides PDF DRM software that protects PDF documents from unauthorized access and misuse. Share and sell documents securely - prevent document leakage, sharing and piracy.

The PC Support Group

The PC Support Group

A partnership with The PC Support Group delivers improved productivity, reduced costs and protects your business through exceptional IT, telecoms and cybersecurity services.

OASIS Open

OASIS Open

OASIS Open is where individuals, organizations, and governments come together to solve some of the world’s biggest technical challenges through the development of open code and open standards.

Crosscheck Networks

Crosscheck Networks

Crosscheck products allow you to test your APIs across different protocols and message formats with functional automation, performance, and security testing capabilities.

Balbix

Balbix

Balbix BreachControl™ is the industry’s first system to leverage specialized AI to provide comprehensive and continuous predictive assessment of breach risk.

Cytomic

Cytomic

Cytomic is the business unit of Panda Security specialized in providing advanced cybersecurity solutions and services to large enterprises.

Banshie

Banshie

Banshie is an independent cyber security company with a small team of recognized specialist that are among the best in their field.

Prompt

Prompt

Prompt supports the creation of partnerships and the setting up of industrial-institutional applied R&D projects for all ICT sectors.

SpecterOps

SpecterOps

SpecterOps has unique insight into the cyber adversary mindset and brings the highest caliber, most experienced resources to assess your organizations defenses.

IP2Location

IP2Location

IP2Location provide services to identify geolocation by IP address, and to detect IP addresses associated with anonymous proxy servers, which are often used for fraud and spamming purposes.

Innefu Labs

Innefu Labs

Innefu is an Information Security R&D startup, providing cutting edge Information Security & Data Analytics solutions.

Vali Cyber

Vali Cyber

Vali Cyber was founded in 2020 with the mission of addressing the specific cybersecurity needs of Linux.

ProArch

ProArch

ProArch is a global team of multidisciplinary experts in cloud, infrastructure, data analytics, cybersecurity, compliance, and software development.

UM6P Ventures

UM6P Ventures

UM6P Ventures is an African based early-stage ventures firm operating two funds; a Digital Transformation fund and a Deeptech Ventures fund.

Sidcon International Consulting Company

Sidcon International Consulting Company

SIDCON International Consulting Company has been providing consulting services since 2002 for private and public organizations in Ukraine and other countries.

StrongBox.Academy

StrongBox.Academy

StrongBox.Academy provides cybersecurity training courses that are tailored to the specific needs and challenges of the industry.

Centre for Cyber Security Research & Innovation

Centre for Cyber Security Research & Innovation

The Centre for Cyber Security Research & Innovation is Nepal's First Academic Research Institute to focus on understanding the overall Information Security of Nepalese Organizations.

DuckDuckGoose

DuckDuckGoose

DuckDuckGoose offer advanced solutions to protect against manipulated videos, images, voices and texts.