Fault Injection
Deliberately pushing a chip outside its operating envelope so it computes something wrong, then using that wrong result. Voltage glitching, clock glitching, EM pulses and laser.
Fault injection attacks a chip by briefly forcing it outside the conditions it was designed for, so that a single instruction or memory read goes wrong. The attacker does not need to control what goes wrong; they only need it to go wrong at the right moment, and to be able to try many times.
Why it works
A CPU is a synchronous machine with timing margins. Every instruction has to settle before the next clock edge. Shrink the margin, and something fails: an instruction is skipped, a fetched value is corrupted, a register does not update, a branch is not taken. The classic effects worth aiming for are:
- Instruction skip. The most useful. A
bnethat would have rejected a wrong password simply does not execute. - Corrupted data. A byte read from flash comes back wrong, which is the basis of differential fault analysis against a cipher.
- Corrupted control flow. A return address or loop counter takes a wrong value, which can jump execution into somewhere unintended.
The injection methods
- Voltage glitching. Drop the supply rail for tens to hundreds of nanoseconds. Cheapest, most accessible, needs only a fast switch on the power line. This is what
chipwhispererdoes out of the box. - Clock glitching. Insert an extra or shortened cycle on an externally supplied clock. Very precise, but only works on chips whose clock you provide.
- Electromagnetic fault injection. A tiny coil discharging near the die induces currents locally. Non-invasive, needs no electrical contact, and gives some spatial selectivity.
- Optical (laser). Light through the decapsulated die flips specific transistors. Highest precision and highest cost; requires decapsulation and a laser bench.
The parameters, and why this is a search
Every attempt is a point in a parameter space, and the useful region is small:
offset when to glitch, relative to a trigger (the dominant parameter)
width how long the disturbance lasts
depth how far the voltage drops / how strong the pulse
A campaign sweeps this space and records the outcome of each attempt. Outcomes fall into four buckets: normal (nothing happened), reset (the chip crashed), mute (no response at all, usually needs a power cycle), and success (the target behaved incorrectly but kept running). Success rates of well under one percent are entirely normal, which is why an automated rig with reliable reset and detection matters far more than the glitch hardware itself.
The trigger is what makes it tractable. Glitching at a random moment during a several-millisecond boot is hopeless; glitching 4.21 ms after a specific UART byte, or after an observable power-trace feature, turns an intractable search into a tight sweep.
What it is used for
- Bypassing a check. Secure boot signature verification, a debug-port lock, a password comparison, a lifecycle-state test. One skipped instruction is enough.
- Escaping readout protection. Fault the check that gates flash reads and dump the firmware.
- Differential fault analysis. Fault one byte in a late AES round, collect the faulty ciphertext alongside the correct one, and recover the key from a handful of pairs. See
differential-fault-analysis.
Countermeasures
Redundant checks separated in time, so one skipped instruction is not enough. Random delays, so a fixed offset no longer lands. Voltage and clock monitors that reset the chip on an out-of-range condition. Control-flow integrity counters checked at the end of a sensitive routine. Storing a security decision as a multi-bit pattern rather than a single flag, so a corrupted value is invalid rather than permissive.
None of these are absolute. They raise the number of attempts required, which is the actual currency of this attack.
Pitfalls
- No reliable reset means no campaign. If recovering from a mute state needs a human, the sweep is over.
- Detecting success is half the work. You need an automatic, unambiguous signal that the glitch worked, or you will step past the good parameters without noticing.
- Physical access is required, and often a modified board. Decoupling capacitors have to come off for voltage glitching to bite.
- Reproducibility is statistical. A parameter set that worked once may need a hundred attempts to work again. Report a success rate, not a success.
What it pairs with
chipwhisperer is the standard rig for both glitching and the power analysis that finds the trigger. power-analysis and side-channel are the passive counterparts, differential-fault-analysis is the cryptographic exploitation, and secure-boot is the usual target.