Be Write Back: An in-depth Study of Fault Injection Effects on FRAM Technology
summary
Presents a practical attack that leverages the FRAM write-back exploitation to corrupt rows and reactivate MSP430FR JTAG, demonstrated on external chips (FM25, CY15, M45 — MV85 resists). Uses ChipWhisperer for timing and an MFI setup with a 4 mm coil @500 V to induce faults; glitch window is ~30 ns and some scan locations show up to 100% success. Row granularity matches physical row size (64, 16, 46 bits), SECDED corrects single-bit flips so a few seconds of retries unlocks JTAG in under a minute.
AI-written summary · about
chapters (10)
- 0:00FRAM and fault injection intro
- 1:35FRAM data storage and read
- 5:51FRAM read operation flaws
- 7:38Testing external FRAM memories
- 11:32Memory row and bit line analysis
- 12:15Attacking FRAM microcontrollers
- 13:59Glitching MSP430 FR challenges
- 15:48Fault injection on CPU instructions
- 16:10JTAG unlock via signature read
- 18:38Summary and security implications
related talks
44mSilicon Under Attack Physical Exploitation Of Modern Chips
28mComplexity Killed Security
25mMINimum Failure - Stealing Bitcoins with Electromagnetic Fault Injection
32mSecSi Product Development
14mFlash [Re]Loaded: Body Bias Injection on Flash Memory
48mFatal Fury on ESP32: Time to Release Hardware Exploits
33mBreaking Into Chips By Reading The Datasheet
44mPractical Software Countermeasures 4 Hardware Glitch Attacks