Fault Injection And The Supply Chain
summary
Researchers demonstrate that storage-based eMMC shorting against Amlogic Chromecasts reliably interrupts U-Boot, exposes a shell and triggers an upgrade_step=3 AV bypass, and then achieves persistence by writing commands into the MK/BCB partition so the device rewrites the same env on reboot (BCB persistence via setenv in MK partition). The method works on 30M Chromecast with Google TV and roughly 100M Amlogic devices, needs physical access, uses UART/PC‑based tooling, is temperamental but automatable, and was patched December 2023.
AI-written summary · about
chapters (21)
- 0:00Introduction and speakers
- 1:28What is fault injection
- 2:30Types of fault injection
- 4:57Chromecast targets and history
- 5:59Android security model
- 7:04Getting a foot in the door
- 8:29Force lock bypass research
- 10:37Bypassing verified boot
- 12:43Persistent root access
- 14:33Mitigations and fixes
- 15:41Vulnerable devices overview
- 17:49Supply chain impact
- 18:10Trust validate verify model
- 21:20Supply chain nightmares
- 23:07Personal experiences with attacks
- 24:32Targeted vs wide-net attacks
- 25:57Business mitigation strategies
- 26:38Live demonstration setup
- 28:06Fault injection demo on Chromecast
- 31:08Demo on Pixel Tablet Dock
- 32:10Q&A session
related talks
36mPhysical Attacks Against Smartphones
31mThe Bootloader: An Underestimated Risk To Embedded Linux Security
29mDataEngBytes 2023 - MEL-T3-04 - Sarah Young
34mCore Escalation: Unleashing the Power of Cross-Core Attacks on Heterogeneous System
41mPrison Break Season 6: Defeating the Mitigations Adopted by Android OEMs
27mProtecting Data In-Use from Firmware and Physical Attacks
39mBackdooring Hardware Devices by Injecting Malicious Payloads on Microcontrollers
40mUnlocking the Drive: Exploiting Tesla Model 3