Éteindre votre composant électronique ne le protège pas !

Paul Grandamme, Lilian Bossuet, Jean-Max Dutertre

<figure><img src="image_1.png" /></figure>

LABORATOIRE
HUBERT CURIEN

UMR • CNRS • 5516 • SAINT-ETIENNE

<figure><img src="image_2.png" /></figure>

<figure><img src="image_3.png" /></figure>

MINES
Saint-Étienne

Une école de FIMT

<figure><img src="image_4.png" /></figure>

1er Octobre 2024
# Context

## State of the art

Almost all of the attacks performed on powered devices

<figure><img src="image_5.png" /></figure>
# Context

## State of the art

Almost all of the attacks performed on powered devices

<figure><img src="image_6.png" /></figure>
# Context

## State of the art

Almost all of the attacks performed on powered devices

<figure><img src="image_7.png" /></figure>
# Context

## State of the art

Almost all of the attacks performed on powered devices

<figure><img src="image_8.png" /></figure>
# Context

## Problem

How to bypass the sensors?
# Context

## Problem

How to bypass the sensors?

## Solution

Attack unpowered devices
# Context

## Problem

How to bypass the sensors?

## Solution

Attack unpowered devices

## Ideas

* Damage the device: break the sensors

* Corrupt stored information: Non-Volatile Memories (Flash)
# Floating gate transistors in Flash memories

<figure><img src="image_9.png" /><figcaption>Discharged cell.</figcaption></figure>

<figure><img src="image_10.png" /><figcaption>Charged cell.</figcaption></figure>
# Read mechanism

<figure><img src="image_11.png" /></figure>

Convention:

* Charged = '0'

* Discharged = '1'

<figure><img src="image_12.png" /><figcaption>I-V characteristics.</figcaption></figure>
# Read mechanism

<figure><img src="image_13.png" /></figure>

<figure><img src="image_14.png" /></figure>

Convention:

* Charged = ‘0’

* Discharged = ‘1’

I-V characteristics.

<figure><img src="image_15.png" /></figure>

Read operation of a Flash memory.
Abstraction levels

<figure><img src="image_16.png" /></figure>
## Physical level

* Laser beam energy $\Rightarrow$ Temperature increase
  $\Rightarrow$ Floating gate discharge

Intensity of the laser beam:

$$I(r) = I_0 \cdot e^{-\frac{2r^2}{\omega_0^2}} \quad (1)$$

with:

$$\omega_0 = \frac{2\lambda}{\pi \times NA} \quad (2)$$

Full-Width-at-Half-Maximum
criterion $\Rightarrow$

$$d_0 = \omega_0 \sqrt{\frac{\ln 2}{2}} \approx 5 \, \mu\text{m} \quad (3)$$

<figure><img src="image_17.png" /></figure>

Heatmap induced by the laser
exposition (numerical simulation
with $\lambda = 1,064$ nm and $NA = 0.16$).
# Abstraction levels

<figure><img src="image_18.png" /></figure>
From the physical level:

<figure><img src="image_19.png" /></figure>

To the logical level:

<figure><img src="image_20.png" /></figure>

⇒ Unidirectional and data-dependent fault model

⇒ Bitsets for our target

⇒ Persistent faults (possible to reprogram the memory)
Abstraction levels

<figure><img src="image_21.png" /></figure>
## Code corruption (ARMv7 ISA)

<table><tr><td>31</td><td>30</td><td>29</td><td>28</td><td>27</td><td>26</td><td>25</td><td>24</td><td>23</td><td>22</td><td>21</td><td>20</td><td>19</td><td>18</td><td>17</td><td>16</td><td>15</td><td>14</td><td>13</td><td>12</td><td>11</td><td>10</td><td>9</td><td>8</td><td>7</td><td>6</td><td>5</td><td>4</td><td>3</td><td>2</td><td>1</td><td>0</td></tr></table>

Generic MOVW

<table><tr><td>1</td><td>1</td><td>1</td><td>1</td><td>0</td><td>1</td><td>1</td><td>0</td><td>0</td><td>1</td><td>0</td><td>0</td><td>imm4</td><td>0</td><td>imm3</td><td>Rd</td><td>imm8</td></tr></table>

MOVW_RO,0

<table><tr><td>1</td><td>1</td><td>1</td><td>1</td><td>0</td><td>0</td><td>1</td><td>0</td><td>0</td><td>1</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td></tr></table>

Examples of possible corruptions on a MOVW instruction<fnref n="1" />.

<footnote n="1">¹Brice Colombier et al. “Laser-induced Single-bit Faults in Flash Memory: Instructions Corruption on a 32-bit Microcontroller”. In: *IEEE International Symposium on Hardware Oriented Security and Trust, HOST 2019, McLean, VA, USA, May 5-10, 2019*. IEEE.</footnote>
Memory level

Code corruption (ARMv7 ISA)

<table><tbody><tr><td>31</td><td>30</td><td>29</td><td>28</td><td>27</td><td>26</td><td>25</td><td>24</td><td>23</td><td>22</td><td>21</td><td>20</td><td>19</td><td>18</td><td>17</td><td>16</td><td>15</td><td>14</td><td>13</td><td>12</td><td>11</td><td>10</td><td>9</td><td>8</td><td>7</td><td>6</td><td>5</td><td>4</td><td>3</td><td>2</td><td>1</td><td>0</td></tr><tr><td colspan="2">Generic MOVW</td><td>1</td><td>1</td><td>1</td><td>1</td><td>0</td><td>1</td><td>1</td><td>0</td><td>0</td><td>1</td><td>0</td><td>0</td><td>imm4</td><td>0</td><td>imm3</td><td>Rd</td><td>imm8</td></tr><tr><td colspan="2">MOVW,RO,0</td><td>1</td><td>1</td><td>1</td><td>1</td><td>0</td><td>0</td><td>1</td><td>0</td><td>0</td><td>1</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td></tr><tr><td colspan="2">MOVW,RO,4</td><td>1</td><td>1</td><td>1</td><td>1</td><td>0</td><td>0</td><td>1</td><td>0</td><td>0</td><td>1</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td></tr></tbody></table>

Examples of possible corruptions on a MOVW instruction<fnref n="1" />.

<footnote n="1">¹Brice Colombier et al. “Laser-induced Single-bit Faults in Flash Memory: Instructions Corruption on a 32-bit Microcontroller”. In: *IEEE International Symposium on Hardware Oriented Security and Trust, HOST 2019, McLean, VA, USA, May 5-10, 2019*. IEEE.</footnote>
# Memory level

## Code corruption (ARMv7 ISA)

<table><tr><td>31</td><td>30</td><td>29</td><td>28</td><td>27</td><td>26</td><td>25</td><td>24</td><td>23</td><td>22</td><td>21</td><td>20</td><td>19</td><td>18</td><td>17</td><td>16</td><td>15</td><td>14</td><td>13</td><td>12</td><td>11</td><td>10</td><td>9</td><td>8</td><td>7</td><td>6</td><td>5</td><td>4</td><td>3</td><td>2</td><td>1</td><td>0</td></tr><tr><td colspan="31">Generic MOVW</td></tr><tr><td>1</td><td>1</td><td>1</td><td>1</td><td>0</td><td>1</td><td>1</td><td>0</td><td>0</td><td>1</td><td>0</td><td>0</td><td>0</td><td>imm4</td><td>0</td><td>imm3</td><td>Rd</td><td>imm8</td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td></tr><tr><td colspan="31">MOVW,RO,0</td></tr><tr><td>1</td><td>1</td><td>1</td><td>1</td><td>0</td><td>0</td><td>1</td><td>0</td><td>0</td><td>1</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td></tr><tr><td colspan="31">MOVW,RO,4</td></tr><tr><td>1</td><td>1</td><td>1</td><td>1</td><td>0</td><td>0</td><td>1</td><td>0</td><td>0</td><td>1</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td></tr><tr><td colspan="31">MOVW,R1,0</td></tr><tr><td>1</td><td>1</td><td>1</td><td>1</td><td>0</td><td>0</td><td>1</td><td>0</td><td>0</td><td>1</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td></tr></table>

Examples of possible corruptions on a MOVW instruction<fnref n="1" />.

<footnote n="1">¹Brice Colombier et al. “Laser-induced Single-bit Faults in Flash Memory: Instructions Corruption on a 32-bit Microcontroller”. In: IEEE International Symposium on Hardware Oriented Security and Trust, HOST 2019, McLean, VA, USA, May 5-10, 2019. IEEE.</footnote>
Memory level

Code corruption (ARMv7 ISA)

<table><tbody><tr><td>31</td><td>30</td><td>29</td><td>28</td><td>27</td><td>26</td><td>25</td><td>24</td><td>23</td><td>22</td><td>21</td><td>20</td><td>19</td><td>18</td><td>17</td><td>16</td><td>15</td><td>14</td><td>13</td><td>12</td><td>11</td><td>10</td><td>9</td><td>8</td><td>7</td><td>6</td><td>5</td><td>4</td><td>3</td><td>2</td><td>1</td><td>0</td></tr><tr><td colspan="31">Generic MOVW</td></tr><tr><td>1</td><td>1</td><td>1</td><td>1</td><td>0</td><td>1</td><td>1</td><td>0</td><td>0</td><td>1</td><td>0</td><td>0</td><td>imm4</td><td>0</td><td>imm3</td><td>Rd</td><td>imm8</td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td></tr><tr><td colspan="31">MOVW,RO,0</td></tr><tr><td>1</td><td>1</td><td>1</td><td>1</td><td>0</td><td>0</td><td>1</td><td>0</td><td>0</td><td>1</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td></tr><tr><td colspan="31">MOVW,RO,4</td></tr><tr><td>1</td><td>1</td><td>1</td><td>1</td><td>0</td><td>0</td><td>1</td><td>0</td><td>0</td><td>1</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td></tr><tr><td colspan="31">MOVW,R1,0</td></tr><tr><td>1</td><td>1</td><td>1</td><td>1</td><td>0</td><td>0</td><td>1</td><td>0</td><td>0</td><td>1</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td></tr><tr><td colspan="31">MOVWT,RO,0</td></tr><tr><td>1</td><td>1</td><td>1</td><td>1</td><td>0</td><td>0</td><td>1</td><td>0</td><td>1</td><td>1</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td></tr></tbody></table>

Examples of possible corruptions on a MOVW instruction<fnref n="1" />.

<footnote n="1">¹Brice Colombier et al. “Laser-induced Single-bit Faults in Flash Memory: Instructions Corruption on a 32-bit Microcontroller”. In: *IEEE International Symposium on Hardware Oriented Security and Trust, HOST 2019, McLean, VA, USA, May 5-10, 2019*. IEEE.</footnote>
# Memory level

## Code corruption (ARMv7 ISA)

<table><thead><tr><th>31</th><th>30</th><th>29</th><th>28</th><th>27</th><th>26</th><th>25</th><th>24</th><th>23</th><th>22</th><th>21</th><th>20</th><th>19</th><th>18</th><th>17</th><th>16</th><th>15</th><th>14</th><th>13</th><th>12</th><th>11</th><th>10</th><th>9</th><th>8</th><th>7</th><th>6</th><th>5</th><th>4</th><th>3</th><th>2</th><th>1</th><th>0</th></tr></thead><tbody><tr><td colspan="32">Generic MOVW</td></tr><tr><td>1</td><td>1</td><td>1</td><td>1</td><td>0</td><td>i</td><td>1</td><td>0</td><td>0</td><td>1</td><td>0</td><td>0</td><td>0</td><td>imm4</td><td>0</td><td>imm3</td><td>Rd</td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td></tr><tr><td colspan="32">MOVW_RO,0</td></tr><tr><td>1</td><td>1</td><td>1</td><td>1</td><td>0</td><td>0</td><td>1</td><td>0</td><td>0</td><td>1</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td></tr><tr><td colspan="32">MOVW_RO,4</td></tr><tr><td>1</td><td>1</td><td>1</td><td>1</td><td>0</td><td>0</td><td>1</td><td>0</td><td>0</td><td>1</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td></tr><tr><td colspan="32">MOVW_R1,0</td></tr><tr><td>1</td><td>1</td><td>1</td><td>1</td><td>0</td><td>0</td><td>1</td><td>0</td><td>0</td><td>1</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td></tr><tr><td colspan="32">MOVW_RO,0</td></tr><tr><td>1</td><td>1</td><td>1</td><td>1</td><td>0</td><td>0</td><td>1</td><td>0</td><td>1</td><td>1</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td></tr></tbody></table>

Examples of possible corruptions on a MOVW instruction<fnref n="1" />.

⇒ Also possible to corrupt permanent data

<footnote n="1">¹Brice Colombier et al. “Laser-induced Single-bit Faults in Flash Memory: Instructions Corruption on a 32-bit Microcontroller”. In: IEEE International Symposium on Hardware Oriented Security and Trust, HOST 2019, McLean, VA, USA, May 5-10, 2019. IEEE.</footnote>
# Abstraction levels

<figure><img src="image_22.png" /></figure>
# Laser fault injection setup

<figure><img src="image_23.png" /></figure>

* Same setup as powered laser fault injection

* 1,064 nm laser source (near-IR)

* Pulse of 0.9 s

* 5 µm spot with a x20 magnifying lens

* Backside view with an IR camera
Hardware target

* STM32F1 open on the backside (32-bit microcontroller)

* Same device preparation as powered laser fault injection

* 128 pages of 1 kB of Flash memory

* 2,048 bitlines and 512 wordlines

* No memory protection mechanism

<figure><img src="image_24.png" /><figcaption>Board (left) and infrared image (right) of the hardware target.</figcaption></figure>
Power OFF mapping of injected faults

Require: $X_{min}, X_{max}, X_{step}, Y_{min}, Y_{max}, Y_{step}$

1: **for** $x \in range(X_{min}, X_{max}, X_{step})$ **do**

2: **for** $y \in range(Y_{min}, Y_{max}, Y_{step})$ **do**

3: **reset target memory**

4: **do**

5: **move laser to (x,y)**

6: **power target off**

7: **for** $i \in [0, ..., 999]$ **do**

8: **laser shot**

9: **power target on**

10: **dump target memory**

11: **while** \#faults == 0

12: **mapping[x][y] = \#faults**

13: **return** mapping[x][y]
Power OFF laser sensitivity map

* Memory initialized to 0x00000000 (programmed) before the laser exposure

<figure><img src="image_25.png" /></figure>

Mapping of obtained faults. $P_{laser} = 1$ W, $f_{laser} = 1$ Hz, $T_{pulse} = 0.9$ s.

⇒ Fault address and fault value known for each position

* bitsets obtained
Experimental distribution

<figure><img src="image_26.png" /></figure>

Experimental distribution of the number of injected
faults.

* 2.2 faulty bits on average on 0x00000000 data (median value of 2)

* Single bit faults in 33% of cases

* No correlation between #shots and #faults
<figure><img src="image_27.png" /></figure>

Reverse engineering of the Flash memory mapping: page-level.
<figure><img src="image_28.png" /></figure>

Reverse engineering of the Flash memory mapping: bit-level.
# Abstraction levels

<figure><img src="image_29.png" /></figure>
# Persistent Fault Analysis: Principle<fnref n="2" /> (CHES 2018)

* Persistent fault injection on the S-box

* Statistical study on the bytes of the ciphertexts

<figure><img src="image_30.png" /></figure>

<figure><img src="image_31.png" /></figure>

<figure><img src="image_32.png" /></figure>

Without fault.

<figure><img src="image_33.png" /></figure>

With one faulty byte.

<footnote n="2">²Fan Zhang et al. "Persistent Fault Analysis on Block Ciphers". In: *IACR Trans. Cryptogr. Hardw. Embed. Syst.* 2018.3 (2018), pp. 150-172.</footnote>
Appearance of byte values

<figure><img src="image_34.png" /></figure>

Number of appearance of byte values for byte 0.
Experimental results

* Firmware reverse engineering
  ⇒ S-box stored between 0x080012F4 and 0x080013F3

* From the previous mapping
  ⇒ the position (x,y) = (44.3,300) is in the S-box range

* Laser fault injection
  ⇒ fault 0x00000002 at the address 0x08001310
  32^nd^ value of S-box faulted (0xC2 instead of 0xC0)

⇒ Successful PFA
Abstraction levels

<figure><img src="image_35.png" /></figure>
Conclusion

* Switching Off your Device Does Not Protect Against Fault Attacks (TCHES 2024)

* Very realistic attack scenario of the PFA

* Semiconductor manufacturers must include systematically memory protection mechanisms

* Same countermeasures for Power ON and Power OFF
Thank you for your attention !

This work was supported by research grants of the projects POP (ANR-21-CE39-0004) and PROPHY (ANR-22-CE39-0008) from the french Agence Nationale de la Recherche

<figure><img src="image_36.png" /></figure>
Éteindre votre composant électronique ne le protège pas !

Paul Grandamme, Lilian Bossuet, Jean-Max Dutertre

<figure><img src="image_37.png" /></figure>

LABORATOIRE
HUBERT CURIEN

UMR • CNRS • 5516 • SAINT-ETIENNE

<figure><img src="image_38.png" /></figure>

<figure><img src="image_39.png" /></figure>

MINES
Saint-Étienne

Une école de FIMT

<figure><img src="image_40.png" /></figure>

1er Octobre 2024