Fatal Fury on ESP32: Time to Release Hardware Exploits
summary
Methodical, hands-on account of breaking ESP32 hardware security: uses low-cost rigs (glitcher based on MAX4619, USB FTDI JTAG, oscilloscope, Python automation) to perform voltage glitching and analog power analysis, modify PCB traces, and reverse the ROM to time attacks. Demonstrates reproducible bypass of secure boot (temporary code execution) and, via faulted power trace of the fuse controller, statistical extraction of OTP contents to extract secure boot and flash keys and decrypt firmware. Also describes failed CPA on SPI noise and recommends hardware revision; reproducible in days.
AI-written summary · about
chapters (15)
- 0:00Intro
- 0:43About ESP32
- 10:47Code review
- 15:48Secure Boot
- 22:32Reverse Boot
- 28:40Flash Encryption
- 32:22OTP Fuses
- 35:35ReadWrite Protection
- 36:14Power Analysis
- 36:46Results
- 37:59Decryption
- 40:09Conclusion
- 41:04Vendors Responsible Disclosure
- 42:12The Impact
- 43:05Final Conclusion
related talks
21mBreaking Espressif’s ESP32 V3: Program Counter Control with Computed Values using...
24mSecurity through Transparency: Tales from the RP2350 Hacking Challenge
46mChip.Fail - Glitching the Silicon of the Connected World
43mImplementing Practical Electrical Glitching Attacks
48mReverse-Engineering the Supra iBox: Exploitation of a Hardened MSP430-Based Device
01h 46mTutorial: Introduction to Reverse Engineering
30mAffordable EMFI Attacks Against Modern IoT Chips
33mEmbedded Device Exploitation 101: An Introduction to Firmware Hacking