Secure Boot Under Attack: Simulation to Enhance Fault Attacks & Defenses
summary
Claims that a carefully modeled voltage-glitch simulation finds concrete bypass points in Secure Boot by flipping instruction or data bits, and that those points often boil down to single bit flip changes to comparison or return values. Built an open-source simulation that injects many realistic fault models against the binary and maps which instructions diverge, then reproduces attacks with inexpensive power-glitch hardware and profiling to achieve a real tablet bypass of Secure Boot.
AI-written summary · about
chapters (17)
- 0:00Secure Boot attacks intro
- 1:26Secure Boot firmware loading
- 3:12Why break Secure Boot early
- 5:18Secure Boot flaws and surfaces
- 7:24Power glitching techniques
- 10:12Live demo: Secure Boot bypass
- 14:07Simulation to find glitches
- 17:56Single-bit flips bypass auth
- 22:13Simulating hardware challenges
- 26:50Simulation to find glitchable code
- 30:45Hardware modeling limits
- 34:55Disabling Secure Boot dev/testing
- 38:25Exploiting weak auth checks
- 42:16Glitching impact on security
- 43:42Simulation vs real hardware
- 46:56Countermeasures against glitching
- 48:24Q&A
related talks
01h 07mPEW PEW PEW: Designing Secure Boot Securely
47mTop 10 Secure Boot Mistakes
39mTOCTOU Attacks Against Secure Boot And BootGuard
24mSecurity through Transparency: Tales from the RP2350 Hacking Challenge
40mHardware Security Is Hard: How Hardware Boundaries Define Platform Security
44mSilicon Under Attack Physical Exploitation Of Modern Chips
49mBreaking Hardware-Enforced Security With Hypervisors
22mAchilles Heel in Secure Boot: Breaking RSA Authentication and Bitstream Recovery from...