Hacking A Chip With A Wave of Your Hand

When you think of a standard hacker toolkit, software vulnerabilities and malware come to mind. But a pair of researchers are testing a different type of instrument: a physical tool that can break into devices with a wave of your hand.

At the recent REcon computer security conference, Red Balloon Security founder Ang Cui and research scientist Rick Housley presented a new approach to hacking a processor that uses electro-magnetic pulses to produce specific glitches in hardware. By disrupting normal activity at precise intervals, the technique can defeat the Secure Boot protection that keeps processors from running untrusted code.

Researchers have experimented with “fault injection attacks”, hacks that cause a strategic glitch, which in turn triggers abnormal, exploitable computer behavior, for decades. Those attacks, though, typically require physical access to a target's components.
“The advantage of this technique is that it’s physically non-invasive. You don’t have to touch the device, and you don’t leave any physical marks behind,” Cui says. “There’s no exchange of data at the electro-magnetic pulse stage, so this would never be caught by a firewall.”
Insecure Boot

Red Balloon specialises in Internet-of-Things Intrusion Defense; think of it as antivirus software for IoT. But the company has run into problems putting its security tool on IoT devices guarded by Secure Boot. Red Balloon's products don't undermine this safeguard; the company works with vendors to make its software compatible. But the dilemma got Cui and Housley interested in the theoretical question of whether a fault-injection attack could circumvent Secure Boot on locked-down IoT devices.

They started experimenting with the Cisco 8861 VoIP phone model that they had tried and failed to equip with their security product. (Cui also has a history of hacking Cisco phones.) 

The two found that if they poked the phone’s flash memory with a charged wire at the right moment while it booted up, they could cause a glitch that stopped the boot process. Instead, the phone surfaced access to a command-line interface that Cisco normally uses for debugging. Consumers are never supposed to see it. Cui and Housley also found vulnerabilities in the TrustZone security scheme of the phone's processor that allowed them to write code on processor memory that was supposed to be protected. (They disclosed these bugs to Cisco in April 2016.) Once they had access to the troubleshooting portal during boot, the researchers could load and execute their own code in a secure part of the processor to override Secure Boot.

Invisible Touch

All of which makes for a complicated hack, and one that requires cracking a phone open when you have a charged wire handy. But Cui and Housley wanted to take the attack a step farther, and realised that a well-timed EMP blast could trigger the same fault. They could execute the whole hack without needing to tamper with the components of the phone.
Lab-grade EM pulsing equipment costs hundreds of thousands of dollars, so instead the researchers built their own system for about $350 using a 3-D printer and readily available components. They plan to release open source schematics of the setup so other researchers can use it too.

Eventually, Cui and Housley worked out that delivering a 300 Volt pulse to the phone's RAM 4.62 seconds into startup reliably created the glitch they wanted. With access to the debugging portal, they could use the phone’s console port, an auxiliary port on the back of the phone, to load in and run their Secure Boot override protocol within five seconds.
"The attack’s principle is clever," says Jean-Max Dutertre, a hardware security researcher at École Nationale Supérieure des Mines de Saint-Étienne in France. "Finding a way to bypass timing and spatial resolution issues is always highly effective."
The system can currently deliver the pulse from 3 millimeters away from the phone, so while the hack doesn't require physical contact, it does need proximity. Still, an attacker could cause the crucial fault by, say, waving their hand over the device while holding a tiny electromagnetic pulse generator, a subtler action than opening up the phone and sticking a wire into it.
“With any hardware attack you need to be physically present, so that’s already a huge barrier,” says Jasper van Woudenberg, the chief technology officer of Riscure North America, a firm that tests hardware and software security. “But this is a nice proof of concept to show that if you don’t take care of these attacks, they could actually happen.”

Who's Down with EMP

What makes the attack so challenging is, in part, the Broadcom multicore 1Ghz ARM processor it targets. Modern processors pack transistors in densely and have high clock speeds, making it difficult to discharge EM pulses quickly and accurately enough to impact one specific process on a chip without collateral damage.

But by thinking of the interconnected components in a device (like the processor, flash memory, and RAM) as a network of computers in and of themselves, researchers can create fault injection strategies that are more like network hacking, attacking a system's weakest point to compromise the real target, in this case the powerful processor.
“We wanted to look at the second-order effects of an electro-magnetic pulse, as it affects not just a single machine but a complex network of interdependent components,” Cui says. “So that allows us to sidestep the traditional electro-magnetic fault injection limitations, and use electromagnetic pulses to predictably change the way computers compute.”

As electro-magnetic fault injection hacking becomes more robust, it will in turn become more important to protect components from physical, non-invasive hacks.

Some ultra secure devices already include such defenses, because further refinement would put not only IoT devices at risk but also full-service computers. "This kind of attack could be devastating because it is relatively easy to perform," Dutertre says.

And while Cui and Housley's research exists strictly as a proof of concept, they caution that other groups may have capabilities that far exceed academia's.
“We don’t think we’re the farthest along in this research,” Cui says. “We’ve been doing this on our off time as a side project. If somebody wanted to put significant resource into this, they would certainly be ahead of us."

Wired

You Might Also Read:

New IoT Chips See, Think & Act Autonomously:

 

« Ten Years Since The Outbreak Web War One
Three Ways To Prepare Your Business For GDPR »

CyberSecurity Jobsite
Check Point

Directory of Suppliers

XYPRO Technology

XYPRO Technology

XYPRO is the market leader in HPE Non-Stop Security, Risk Management and Compliance.

Resecurity

Resecurity

Resecurity is a cybersecurity company that delivers a unified platform for endpoint protection, risk management, and cyber threat intelligence.

Alvacomm

Alvacomm

Alvacomm offers holistic VIP cybersecurity services, providing comprehensive protection against cyber threats. Our solutions include risk assessment, threat detection, incident response.

Directory of Cyber Security Suppliers

Directory of Cyber Security Suppliers

Our Supplier Directory lists 8,000+ specialist cyber security service providers in 128 countries worldwide. IS YOUR ORGANISATION LISTED?

TÜV SÜD Academy UK

TÜV SÜD Academy UK

TÜV SÜD offers expert-led cybersecurity training to help organisations safeguard their operations and data.

Intelligence-sec

Intelligence-sec

Intelligence-Sec is a fully integrated Conferences and Exhibitions Company managing and producing topical events for the security industry.

Gurucul

Gurucul

Gurucul predictive security analytics protects against insider threats, account compromise and data exfiltration on-premises and in the cloud.

qSkills

qSkills

QSkills is an independent training provider specialized high-quality IT and IT management training courses including IT security.

Sysmosoft

Sysmosoft

Sysmosoft specializes in providing highly secured telecommunication solutions for mobile devices for companies requiring protected access to sensitive data remotely.

Inogesis

Inogesis

Inogesis helps blue-chip organisations harness disruptive technologies and thinking to drive new revenues or overcome challenges by connecting them with dynamic small companies.

NetKnights

NetKnights

NetKnights is an independent IT security company which offers services and products for strong authentication, identity management and encryption.

Aligned Technology Solutions (ATS)

Aligned Technology Solutions (ATS)

ATS manage, monitor, and maintain everything from your network and servers to your workstations and mobile devices, and we do it proactively to eliminate downtime and keep hackers at bay.

Pelta Cyber Security

Pelta Cyber Security

Pelta Cyber Security is the cyber security consulting and solutions division of Softworld Inc. We provide staffing and recruitment services as well as consulting and solutions for outsourced projects.

DatChat

DatChat

DatChat Inc. is a blockchain, cybersecurity, and social media company that focuses on protecting privacy on our devices and also protecting our information after we have shared it with others.

ClearVector

ClearVector

ClearVector is a leading provider of realtime, identity-driven security for the cloud.

Senteon

Senteon

Senteon is a turnkey cybersecurity platform designed to make securing confidential data affordable, understandable, and streamlined for small-to-mid sized businesses and MSPs.

Oligo Security

Oligo Security

Oligo aims to streamline the usage of open source by making it secure and easy to protect. Through focusing developers on the relevant vulnerabilities we make the fixing process significantly shorter.

RiverSafe

RiverSafe

RiverSafe is a professional services provider specialising in Cyber Security, Data Operations and DevOps, putting security at the heart of everything we do.

Hexiosec

Hexiosec

Hexiosec (formerly Red Maple Technologies) is a technical consultancy and product company founded and run by engineers from the UK Intelligence and Defence communities.

Gleam Cloud Security Solutions (GCSS)

Gleam Cloud Security Solutions (GCSS)

GCSS Security is an information security firm providing cyber security protection with a highly skilled and experienced team focused on technology that creates best-in-class customer experiences.

Executive Operations (EXOP)

Executive Operations (EXOP)

Executive Operations provides 24/7 cyber security staffing - SOC support, compliance, IT help desk & app development. Save 60% with skilled English-speaking teams.