Flash [Re]Loaded: Body Bias Injection on Flash Memory
summary
Claims that body bias injection (BBI) can both permanently program flash while powered off and transiently flip reads with DC bias; attacker builds a custom 320 V probe on an XYZ stage and a simple DC setup (0–32 V) and targets external flash, STM32 and MSP430. Offline negative pulses program clusters (hundreds–thousands of bits, bank-confined), achieving >80% downgrade success on STM32 with worst-case damage ~27 KB; MSP430 needs ~10^7 pulses offline but fully unlocks via the online DC method that forces reads to all ones.
AI-written summary · about
chapters (12)
- 0:00Flash security risks
- 0:54Body bias injection on chips
- 2:18Flash memory cell basics
- 3:47Flash attack scenarios
- 4:50Offline attack setup
- 6:33STM32 flash fault analysis
- 8:17Downgrading STM32 debug
- 9:21MSP430 unlocking limits
- 10:03Online attack with voltage
- 11:48Results and device limits
- 12:30Debug locks bypass
- 13:15Conclusion
related talks
19mBe Write Back: An in-depth Study of Fault Injection Effects on FRAM Technology
39mBackdooring Hardware Devices by Injecting Malicious Payloads on Microcontrollers
45mReverse Engineering Flash Memory for Fun and Benefit
21mBreaking Espressif’s ESP32 V3: Program Counter Control with Computed Values using...
48mReverse-Engineering the Supra iBox: Exploitation of a Hardened MSP430-Based Device
25mBreaking Bootloaders on the Cheap
01h 07mPEW PEW PEW: Designing Secure Boot Securely
44mSilicon Under Attack Physical Exploitation Of Modern Chips