Hand Me Your SECRET, MCU! Microarchitectural Timing Attacks on Microcontrollers are Practical
summary
Researchers expose a new bus arbitration timing side channel on ARM Cortex‑M MCUs that leaks secrets by measuring delays when CPU and DMA/peripherals contend for the same memory bank. They build hardware gadgets from timers, DMA and peripherals to monitor contention without CPU concurrency, profile victim code, then exploit a SmartLock reference to recover a 4‑digit PIN in real time, bypassing isolation primitives (TrustZone/TFM) across multiple Cortex‑M devices.
AI-written summary · about
chapters (10)
- 0:00Introduction to MCU attacks
- 1:11Overview of microcontrollers
- 8:14Side channel attacks basics
- 13:35The MCU bus interconnect
- 16:06Simple attack example
- 20:09The Busted attack
- 25:59Attack execution details
- 32:53Live demo of the attack
- 34:11Disclosure and conclusions
- 39:14Q&A and mitigation strategies
related talks
14mProtecting cryptography code from timing vulnerabilities
42mAre Microarchitectural Attacks still possible on ...
01h 01mTutorial: Side-Channel Attacks and Transient Execution Vulnerab...
27mCLKSCREW: Exposing the Perils of Security-Oblivious Energy Management
01h 02mCryptographic Side-Channels on Embedded Devices
25mDRAMA: Exploiting DRAM Addressing for Cross-CPU Attacks
28mComplexity Killed Security
41mIs Your Memory Protected? Uncovering Vul In Automotive MPU