Photon-Emission-Guided Laser Fault Injection Enables RP2350 Secure Debug (donjon.ledger.com)
191 points by synack 16 hours ago
BitBangingBytes 14 hours ago
I appreciate all the details they provide in the post. The $250k in lab gear is useful when initially discovering, exploiting and documenting attacks like this.
Definitely doable in a home lab for under $25k in equipment, likely under $10k.
Same as my replicating Colin O’Flynn’s BAM BAM attack on a MPC5566 chip, he used a ChipShouter ($5,000) and I used a PicoEMP ($50).
throwaway81523 12 hours ago
Nice, thanks. I had wondered whether the $250K in lab gear is something that a serious HW security lab would already have on hand, as opposed to specialized expenditure for just this attack. I mean I rode in a $250K(?) motor vehicle a few days ago (the #2 SF Muni bus towards the Marina) but I didn't have to spend a lot to ride it, since it was already deployed. Nobody had to go out and buy it.
junofan 3 hours ago
Hah, our new ones are $1.3 million. https://www.sfmta.com/media/44081
Perhaps driven by restrictions on federal grants? https://media.api.sf.gov/documents/Briefing_Book_-_Muni_Fund...
Some cool tech. Wonder if we optioned the inductive charging system. https://www.gillig.com/buses/battery-electric/#1731934845437...
SV_BubbleTime 7 hours ago
I have an application on an SPC58 that I really want to know more about. But unfortunately; it’s a dual core with lockstep. So if it could be done; I think that automatically double-pluses the budget.
byb 14 hours ago
The RP2350's secure enclave made it particularly attractive for use as a Yubikey alternative.
There will always be an arms race between safe-crackers and safe-builders. Presumably the lessons learned will help make the next generation tougher to break into.
mitxela 9 hours ago
In this case the safe belongs to the person who's trying to crack it.
octoberfranklin 12 hours ago
There will always be an arms race between safe-crackers and safe-builders.
This is dismissive and glib. And it's the wrong lesson.
You wouldn't say this about symmetric cryptography. AES-encrypted ciphertexts from 25 years ago are still secure today, and nothing on the horizon is likely to change that. No arms race.
The "arms race" exists because the security model for trusted hardware is intrinsically flawed. If the attacker has physical posession of the device, your security is transient and at the mercy of the arms race. So stop doing this! Trusted hardware also has extremely negative externalities on the whole computing ecosystem.
(*) or 45 years, if you exclude cryptosystems (56bit single-DES) used only because of silly export laws.
vexed_vulpine 5 hours ago
I tend to agree that there are issues in the realm of hardware token based security but they largely lie in the failure modes, with substantially increased difficulty of recovery.
For the average user these approaches make data loss MUCH more likely simply because you need a corporate IT department level of competency to consistently avoid data loss with them.
The glib exaggeration of this is that in not being permitted to manage and back up your own keys you actually create the situation where you have to hire someone to extract your keys for you and break into the device you own because of the failings of the technology!
zephen 10 hours ago
> This is dismissive and glib.
As is your comment.
> And it's the wrong lesson.
It's only the wrong lesson if you believe that making it more difficult for governments to seize and decrypt their own citizens' mobile phones with impunity is not a valid goal.
> the security model for trusted hardware is intrinsically flawed.
It's only intrinsically flawed if you expect absolute perfection.
The fact that some math-based protections may be theoretically better than physical protections does not obviate the utility of physical protections, whether we are discussing computers or phones, or houses or cars.
It has been accepted since before any of us were born that there is no such thing as perfect physical security. Even your putative perfect cryptographic security still relies on the physical security of the plant holding the keys.
octoberfranklin 9 hours ago
rkagerer 3 hours ago
The RP2350 is Raspberry Pi’s dual-core microcontroller: each processor socket can select either an Arm Cortex-M33 or a RISC-V Hazard3 core at boot.
Does that mean there are four cores on the die? Is there crazy amounts of MUXing going on? Does the extra, semi-unused area give the chip a premium price tag? Or did I misinterpret this?
raphlinus 2 hours ago
Yes, four cores in the chip. And yes, there's additional muxing, but I think that adds a fairly small amount of chip area compared with the crossbar. In addition to the two core slots, there are a lot of peripherals contending for single cycle bus access.
jacquesm 15 hours ago
That's reminiscent of when we first found out that if you opened up dram chips you could use them for imaging. Of course the scale at which this is done is extremely impressive.
xattt 13 hours ago
For the curious: https://hackaday.com/2014/04/05/taking-pictures-with-a-dram-...
jacquesm 13 hours ago
A lot earlier than that.
https://www.cs.uaf.edu/2007/fall/cs441/support/dram_sensor_1...
buescher 10 hours ago
nullc 3 hours ago
I'm confused by a number of comments here and the article seemingly taking a position that a $250k lab instrument is required.
For one a similar instrument can be constructed from surplus parts for far less. Secondly, it's a single bit flip required. Now knowing the the technique works, a harness could be built that attempts it scattershot without the precise targeting and just has to try a lot of times. Using a different stimulus, e.g. xray it might well be possible without deencapsulating the part.
akoboldfrying 8 hours ago
Impressive work!
I have a side question. I looked into the linked Raspberry Pi hacking challenge, and there's something very basic I couldn't figure out: It looks like the relevant script in the repo just writes 0xc0ff 0xffee a few times to the OTP as the "secret" to unlock. But given that $20000 was up for grabs, this can't possibly be the genuine secret being sought to claim the prize. (Indeed, I can't think of a secure way to install a secret from a public GitHub repo unless it involves running on-device code that encrypts something using some other, factory-installed secret key, which is just kicking the can down the road.) And given that the OTP on a brand new RP23550 is initialised to all zeros, it can't be that the genuine secret is programmed in at the factory either.
What am I missing? How does the genuine secret get installed on a person's RP2350?
striking 5 hours ago
> If you think you have found a break email us at doh@raspberrypi.com with details - we will ship you a Pico2 with a custom secret hidden in it. If you manage to extract it, you win the $20,000!
akoboldfrying 3 hours ago
Thank you, don't know how I missed that!
stackghost 16 hours ago
> The attack requires physical access, destructive preparation, and approximately $250,000 of laboratory equipment.
Not super practical, but neat attack
mrlambchop 15 hours ago
250k is not a bad investment for a company doing "reverse engineering as a service" - say 1k a pop to extract the firmware. Naturally, a good business idea for somewhere in the world with less regulations...
stickfigure 15 hours ago
That is peanuts for a nation-state actor.
stackghost 14 hours ago
Sure, but if you’re defending against a nation state actor hopefully you aren’t expecting a raspberry pi to keep you secure.
palmotea 14 hours ago
ssl-3 14 hours ago
_trampeltier 15 hours ago
Some people have such and other toys just at work and can use it in spare time.
paulnpace 15 hours ago
> $250,000 of laboratory equipment
*currently
stavros 15 hours ago
$300,000 next year.
etdznots 2 minutes ago
TeMPOraL 14 hours ago
k12sosse 14 hours ago
TZubiri 15 hours ago
It reads as impressive defense. Meaning that it's presumably not possible to get root with physical access on a live 50$ device without 250k capital
Rohansi 14 hours ago
This is for a $1 microcontroller. I'm assuming you're talking about the Raspberry Pi computers based on the $50 cost and root.
Fred27 15 hours ago
There's always an XKCD... https://xkcd.com/538/
orbital-decay 15 hours ago
It needs to be updated. Modern evil planners don't even need a wrench since they already have most keys given to them in advance by everyone, including nerds
junon 14 hours ago
Care to expand?
mitxela 9 hours ago
brcmthrowaway 15 hours ago
Now it can be done for Apple iPhone. Apple is cooked.