Chip.Fail - Glitching the Silicon of the Connected World
summary
Voltage glitching reliably breaks modern IoT chips using cheap gear: the team builds an open $100 kit and a $5 ATTiny85 variant, combines an FPGA + analog switch + DPS3003 with Python/Jupyter control, and runs automated delay/pulse sweeps. Targets: nRF52 (successful, ~100 attempts), ESP32 (stable after ~10,000 attempts), SAM L11 (bypassed secure boot quickly), and STM32F2 (downgrade RDP with delay 17900 cycles pulse 50 cycles), proving practical, reproducible exploits.
AI-written summary · about
chapters (32)
- 0:00Intro
- 1:10Takeaways
- 2:11Why is this getting important?
- 4:28Voltage glitching: Flash reads
- 4:56Voltage glitching: RAM reads
- 5:37Three steps to success
- 6:05Power domains
- 11:14Removing capacitors: Problem...
- 17:39The chip.fail glitcher
- 18:39Digilent Cmod A7
- 18:59MAX PMOD
- 20:28Hooking it up
- 21:21The glitcher
- 21:50FPGA Bitstream
- 22:15Host control: Jupyter Notebook
- 22:29Host control: Example glitcher
- 26:31nRF52840: Test firmware
- 26:43Glitching results
- 28:54ESP32: Glitching
- 31:47The 5$ Glitcher...
- 33:05Previous work
- 35:32STM32 Read-out Protection (RDP)
- 36:27Dumping the bootrom
- 37:14Let's apply our methodology
- 37:26Bootrom Glitching
- 38:05STM32F2 Boot process (1.4ms)
- 39:35Power consumption after reset (200)
- 41:13Parameters
- 42:11Dumping the money!
- 42:41The STM32F2 Glitcher
- 43:09Options for defense
- 44:26Conclusion
related talks
43mImplementing Practical Electrical Glitching Attacks
30mAffordable EMFI Attacks Against Modern IoT Chips
44mSilicon Under Attack Physical Exploitation Of Modern Chips
44mPractical Software Countermeasures 4 Hardware Glitch Attacks
48mFatal Fury on ESP32: Time to Release Hardware Exploits
04mBridging the Glitch Gap: Hash Salehi on Making Professional Fault Injection Accessible
21mGlitchGlück: Enabling Software Vulnerabilities through Guided Hardware Fault Injection
38mHow to Hack Any Micro-controller with a Raspberry Pi Pico…