Oven Repair (The Hardware Hacking Way)
summary
A Samsung oven reports 325°F while running much cooler, so the bootloader on a 2012 TMP91 (TLCS-900/L1) microcontroller is extracted and attacked: power analysis recovers the password one byte at a time from aligned current traces, and fault injection (clock glitching via ChipWhisperer/Husky and a Raspberry Pi Pico high‑voltage glitcher) bypasses the protection bit. One board unintentionally erases during glitch calibration, a purchased replacement yields readable firmware, and the patched firmware changes the timed pulse heater logic so the oven actually returns to temperature (occasional reboot bug remains).
AI-written summary · about
chapters (11)
- 0:00Introduction to speaker
- 1:11The oven dilemma
- 3:24Analyzing the hardware
- 7:01Developing a hacking strategy
- 10:18Power analysis techniques
- 15:05Fault injection methodology
- 21:02Executing the attack
- 24:36Firmware analysis and patching
- 28:17Testing the patched firmware
- 32:42Validation and future work
- 36:55Conclusion on E-waste
related talks
01h 06mBackdoors in Back Doors
24mSecurity through Transparency: Tales from the RP2350 Hacking Challenge
48mFatal Fury on ESP32: Time to Release Hardware Exploits
50mSmart Nest Thermostat: A Smart Spy in Your Home
33mBreaking Into Chips By Reading The Datasheet
48mReverse-Engineering the Supra iBox: Exploitation of a Hardened MSP430-Based Device
37mOpen Sesame! The full story behind opening a smart lock
41mSecrets Of Simos18: REng The Secure Boot Mechanism Of An ECU