# Practical, Low-Cost Fault Injection Attacks on Personal Smart Devices
## 4 Discussion
### Related Work  
The use of fault attacks against cryptographic operations first appeared in [14; 15], which suggested how an attacker injecting faults to a device running a cryptographic operation may be able to extract the symmetric secret key or the asymmetric private key. [PERSON] and [PERSON] [16] showed an extremely low-cost fault injection lab setup, in which EMFI was performed by a spark gap generator constructed from a simple gas lighter. That spark gap generator was only able to be operated mechanically, and the target discussed in that work was a simple 8-bit microcontroller. In the current work, we show how a low-cost fault injection device is able to disrupt the execution of a powerful processor running Linux. [PERSON] et al. describe in [1] several common methods that have been studied for fault injection, and could be considered as alternatives for designing our fault injection device: clock glitches, optical and thermal attacks, voltage glitching and electromagnetic fault injections (EMFI). Figure 6: Cartography results overlaid with a photograph of the chip. In this work, we were interested in selecting an attack method that was both simple and inexpensive enough to be incorporated into a malicious FRU, while remaining accurate and effective enough to launch practical attacks. Therefore, we chose to use EMFI attacks, since they combine high locality and accuracy and do not require the DUT to be prepared using lab methods. Since FRUs are placed very close to the DUT, often inside the device's external EM shielding, the attack is feasible even with a limited power budget. Exposure of the DUT's IC to an external electromagnetic field can cause the internal registers, as well as the memory, to change their state even for an encapsulated chip. An example was shown in [16], where a lab setup incorporating a low-cost spark gap generator was used to inject EM fault attacks to a microcontroller. This method is completely non-invasive, allowing the injection of faults using only physical proximity to the targeted device, and has the advantage of a relatively high spatial and temporal locality. [PERSON] et al. [5] thoroughly analyzed EM fault injection on an ARMv7 microcontroller, analyzing how an instruction skip may occur on the chip when an EM fault attack takes place, by studying the changes in the data and instruction caches of the microprocessor. That work demonstrated how a high-end lab setup can be used to induce highly reliable EM faults, but was out of the reach of attackers without access to a high-end equipped laboratory. In our work, we showed how EMFI can be conducted outside of laboratory settings, and with low-cost equipment available to virtually anybody. In 2019, [PERSON] [17] demonstrated an EMFI attack using the ChipSHOUTER [18] device to attack a critical part of the code in the USB stack of a cryptocurrency wallet. The attach let the attacker extract more bytes from the memory than legally allowed, thereby breaking the security of various cryptocurrency wallets. Since the attack was done using EMFI, the attack left no physical evidence on the device for the victim to be able to tell they had been attacked. At the time of writing this paper, the price of the ChipSHOUTER device used for [PERSON] attack was USD 3200. In this work, we presented a device which can be easily assembled with low-cost components costing no more than USD 10. In the last few years, fault injection attacks have also been demonstrated using software-based techniques. These works, starting with [19], exploit the energy management mechanisms found in smart phones, PCs and other smart devices, allowing them to be deployed by a remote attacker. By controlling the voltage and the operating frequency of the CPU cores of the device, an attacker can cause faults in the main processing unit. Recent works [20; 21; 22] have extended this attack to ARM processors, demonstrating the extraction of secret keys from the ARM TrustZone enclave [23], as well as Intel's Software Guard Extensions (SGX).