CLKscrew: Exposing The Perils of Security-Oblivious Energy Management
summary
A new software-only fault class called CLKSCREW manipulates DVFS by writing the memory-mapped regulator registers exposed to drivers/debugfs to push frequency/voltage beyond safe operating points. On a Nexus 6 prototype a userland driver and timing via no-op loops plus I-cache prime+probe produce single-byte AES faults (targeting the 7th round), yielding differential-fault analysis with ~3,600 key candidates in ~12 minutes before brute force. A second exploit corrupts RSA modulus bytes to load a self-signed app; vendors rate the issues critical and supply mitigations.
AI-written summary · about
chapters (19)
- 0:00Introduction
- 11:00Timing Faults
- 15:09Challenges
- 25:38MDG File
- 26:45Signature Verification
- 29:54Code Emulation
- 32:49Faulting Implementation
- 35:23Faulting Sketch
- 36:23Timing Anchor
- 36:56Track Fault
- 37:25Scatter Plot
- 38:24Adaptive Delay
- 40:15Summary
- 40:49Remarks
- 41:50Roundup
- 46:47Disclosures
- 47:34Intel SGX
- 48:22RSA Attack
- 50:01Why is it not random
related talks
27mCLKSCREW: Exposing the Perils of Security-Oblivious Energy Management
48mFatal Fury on ESP32: Time to Release Hardware Exploits
28mComplexity Killed Security
51mExploiting Hardware Glitches And Side Channels In Perfect Software
44mSilicon Under Attack Physical Exploitation Of Modern Chips
48mEverybody be Cool, This is a Robbery!
24mSecurity through Transparency: Tales from the RP2350 Hacking Challenge
35mPatterns and Anti-Patterns in Embedded Development: What Security Incidents...