Attacking Hardware Systems Using Resonance and the Laws of Physics
summary
Finds that tiny mixed‑signal logic can be forced into a resonance — observed around 23.236 MHz resonant peak — producing an analog AC on outputs that charge‑pumps a FET gate and re-enables a USB power switch so cameras/mics turn on despite a hardware mute. Reproduces attack with a carrier board, FTDI USB‑serial, signal generator, oscilloscope and SDR, and delivers the trigger from peripheral PWM configured by a 128-byte exploit injected via a buffer overflow; activation takes ~5–12 µs. Simple fixes: inline resistors to slow slew, non‑remappable pins, or one‑time fuses.
AI-written summary · about
chapters (25)
- 0:00Introduction
- 0:31Title
- 2:50Recap
- 3:02The Ware Report
- 3:58A Simple Case Study
- 7:19Security Comes From Process
- 8:05Design With Assumptions
- 9:32Software Hacking
- 10:28Failsafe Logic
- 11:27Mixed Signal Logic
- 14:35Manufacturing Bell Curve
- 16:57Voltage Delta Time
- 18:10Analog Switch
- 18:39Charge Pump
- 19:08Scope Trace
- 21:09The Target
- 23:29Configuration Tools
- 23:42Frameworks Make It Easy
- 24:43Privacy Mode
- 25:42Demonstration
- 27:40Theories
- 35:14Summary
- 36:10Hardware State Machines
- 37:00Hardware Security
- 40:06Hardware Security Summary
related talks
43mThe Tao of Hardware the Te of Implants
46mChip.Fail - Glitching the Silicon of the Connected World
45mAnalogy Cyber Security—From 0101 to Mixed Signals
27mCracking With Automated USB Fuzz
48mFatal Fury on ESP32: Time to Release Hardware Exploits
43mImplementing Practical Electrical Glitching Attacks
44mSilicon Under Attack Physical Exploitation Of Modern Chips
26mUSB Snooping Made Easy: Crosstalk Leakage Attacks on USB Hubs