CLKSCREW: Exposing the Perils of Security-Oblivious Energy Management
summary
Demonstrates that software-controlled DVFS on commodity ARM/Android phones (Nexus 6) has no enforced limits, allowing a kernel-level attacker to push frequency/voltage into timing faults that cross TrustZone boundaries; uses cache profiling, cycle counters and precise no-op delays to inject a one-byte fault in AES round 7, typically needing 20 attempts and about 12 minutes of DFA to recover the key; shows both extracted AES key and TrustZone code-loading exploits.
AI-written summary · about
chapters (13)
- 0:00Intro
- 0:32Today's systems cannot exist without Energy Management
- 1:40Exploiting software interfaces to
- 3:54Dynamic Voltage and Frequency Scaling (DVFS)
- 4:46Hardware & Software Support for DVFS
- 5:31Hardware Regulators and Software Interfaces
- 9:28How do faults occur (due to over-raising frequency)?
- 11:54CLKSCREW Challenges & Solutions
- 14:57Key Inference Attack:Threat Model
- 16:15Key Inference Attack: CLKSCREW Parameters
- 16:33Key Inference Attack: Timing Profiling
- 17:45Key Inference Attack: Fault Model
- 18:42Key Inference Attack: Results
related talks
54mCLKscrew: Exposing The Perils of Security-Oblivious Energy Management
29mARMageddon: Cache Attacks on Mobile Devices
39mReflections on Trusting TrustZone
43mBreaking Samsung's ARM TrustZone
51mExploiting Hardware Glitches And Side Channels In Perfect Software
28mComplexity Killed Security
34mCore Escalation: Unleashing the Power of Cross-Core Attacks on Heterogeneous System
48mFatal Fury on ESP32: Time to Release Hardware Exploits