Photon-Emission-Guided Laser Fault Injection Enables RP2350 Secure Debug

BitBangingBytes•about 2 hours ago

I appreciate all the details they provide in the post. The $250k in lab gear is useful when initially discovering, exploiting and documenting attacks like this.

Definitely doable in a home lab for under $25k in equipment, likely under $10k.

Same as my replicating Colin O’Flynn’s BAM BAM attack on a MPC5566 chip, he used a ChipShouter ($5,000) and I used a PicoEMP ($50).

https://youtu.be/URmI1VVilek

throwaway81523•19 minutes ago

Nice, thanks. I had wondered whether the $250K in lab gear is something that a serious HW security lab would already have on hand, as opposed to specialized expenditure for just this attack. I mean I rode in a $250K(?) motor vehicle a few days ago (the #2 SF Muni bus towards the Marina) but I didn't have to spend a lot to ride it, since it was already deployed. Nobody had to go out and buy it.

byb•about 2 hours ago

The RP2350's secure enclave made it particularly attractive for use as a Yubikey alternative.

There will always be an arms race between safe-crackers and safe-builders. Presumably the lessons learned will help make the next generation tougher to break into.

jacquesm•about 3 hours ago

That's reminiscent of when we first found out that if you opened up dram chips you could use them for imaging. Of course the scale at which this is done is extremely impressive.

xattt•about 1 hour ago

For the curious: https://hackaday.com/2014/04/05/taking-pictures-with-a-dram-...

jacquesm•about 1 hour ago

A lot earlier than that.

https://www.cs.uaf.edu/2007/fall/cs441/support/dram_sensor_1...

stackghost•about 4 hours ago

> The attack requires physical access, destructive preparation, and approximately $250,000 of laboratory equipment.

Not super practical, but neat attack

mrlambchop•about 3 hours ago

250k is not a bad investment for a company doing "reverse engineering as a service" - say 1k a pop to extract the firmware. Naturally, a good business idea for somewhere in the world with less regulations...

stickfigure•about 3 hours ago

That is peanuts for a nation-state actor.

stackghost•about 2 hours ago

Sure, but if you’re defending against a nation state actor hopefully you aren’t expecting a raspberry pi to keep you secure.

palmotea•about 2 hours ago

> Sure, but if you’re defending against a nation state actor hopefully you aren’t expecting a raspberry pi to keep you secure.

Is there anything about these techniques that are raspberry pi specific? It seems like they're using lasers to identify and flip particular bits in registers.

ssl-3•about 2 hours ago

The RP2350 is an inexpensive microcontroller IC with reasonable performance and some very useful (and somewhat unusual) features in its PIO blocks.

Why wouldn't a person build that into the heart of something important?

_trampeltier•about 3 hours ago

Some people have such and other toys just at work and can use it in spare time.

paulnpace•about 3 hours ago

> $250,000 of laboratory equipment

*currently

stavros•about 3 hours ago

$300,000 next year.

TeMPOraL•about 2 hours ago

In 5 years, either $400,000 or $50 and a hammer, depending on whether the core piece of the process aligns with the needs of some fast-growing consumer tech product like e.g. drones.

k12sosse•about 2 hours ago

We're already up to 400,000 just today.

TZubiri•about 3 hours ago

It reads as impressive defense. Meaning that it's presumably not possible to get root with physical access on a live 50$ device without 250k capital

Rohansi•about 2 hours ago

This is for a $1 microcontroller. I'm assuming you're talking about the Raspberry Pi computers based on the $50 cost and root.

Fred27•about 4 hours ago

There's always an XKCD... https://xkcd.com/538/

orbital-decay•about 3 hours ago

It needs to be updated. Modern evil planners don't even need a wrench since they already have most keys given to them in advance by everyone, including nerds

junon•about 2 hours ago

Care to expand?

brcmthrowaway•about 3 hours ago

Now it can be done for Apple iPhone. Apple is cooked.

Photon-Emission-Guided Laser Fault Injection Enables RP2350 Secure Debug

⚡ Community Insights

Discussion (36 Comments)Read Original on HackerNews