Security through Transparency: Tales from the RP2350 Hacking Challenge
summary
Demonstrates five practical attacks that break RP2350 secure-boot guarantees: voltage, EM and laser fault injection to skip signature checks and re-enable disabled cores and debug ports, an EM double-glitch that defeats OTP page locks to read a 128‑bit secret, and direct antifuse extraction via focused ion beam passive voltage contrast; attackers build low‑cost laser and EM rigs, calibrate glitch timing around the detector’s clock domains, and successfully extract secrets.
AI-written summary · about
chapters (10)
- 0:00Introduction
- 1:18RP2350 challenge context
- 2:44RP2350 security features
- 8:05Secure boot chain
- 9:51Discovered attacks overview
- 12:40Fault injection boot vector
- 17:37OTP readout double glitch
- 20:49Mitigations in A4 revision
- 21:53Challenge lessons
- 23:20Conclusion
related talks
48mFatal Fury on ESP32: Time to Release Hardware Exploits
07mThe "Last Mile" of Security: Roman Korkikikan on Hacking TPMs with Budget Hardware
49mBreaking Hardware-Enforced Security With Hypervisors
43mThe Tao of Hardware the Te of Implants
48mEverybody be Cool, This is a Robbery!
51mExploiting Hardware Glitches And Side Channels In Perfect Software
44mSilicon Under Attack Physical Exploitation Of Modern Chips
22mAchilles Heel in Secure Boot: Breaking RSA Authentication and Bitstream Recovery from...