SRAM Data Remanence In SoCs: Covert Storage And Exfiltration Risks In TEE

on YouTube ↗42m

" summary

Shows that SRAM startup remnants can be written into and read out by accelerating transistor aging with elevated voltage and temperature (oven or overvolting via probe), implemented on Cortex-A and microcontroller silicon with a power-supply probe and firmware/coproc dumps. Raw retrieval accuracy ranges 79–97% and with simple ECC becomes negligible error; a full L1-cache AES key exfiltration hits 93%+ recovery and precharacterization cuts key search to ~8k. Detection via power‑on stats is possible but obfuscated by encryption/complementation.

AI-written summary · about

" chapters (5)

1. 0:00Introduction to SRAM remanence
2. 1:50Volatile memory data retention
3. 3:36Covert communication via SRAM
4. 15:54Attacking Trusted Execution Environments
5. 25:30Q&A session

" related talks

• 20mAuthenticate everythingGeert Jan Schrijen · IoTSF Conference 2016
• 27mProtecting Data In-Use from Firmware and Physical AttacksSteve Weis · Black Hat USA 2014
• 01h 01mTutorial: Side-Channel Attacks and Transient Execution Vulnerab...Allison Randal, Giorgos Christou · RISC-V Summit 2022
• 28mComplexity Killed SecurityDaniel Gruss · Black Hat Asia 2020
• 19mBe Write Back: An in-depth Study of Fault Injection Effects on FRAM TechnologyValentin Huber, Marc Schink · 19th USENIX WOOT Conference on Offensive Technologies (WOOT '25)
• 27mTranslation Leak-aside Buffer: Defeating Cache Side-channel ProtectionsBen Gras · USENIX Security '18
• 35mTalk by Adria Gascon (Google)Adria Gascon · Federated and Collaborative Learning Boot Camp 2026
• 25mDRAMA: Exploiting DRAM Addressing for Cross-CPU AttacksDaniel Gruss, Michael Schwarz, Stefan Mangard, Clémentine Maurice, Peter Pessl · USENIX Security '16