Talk Title:

Flippin' fake flops for fun, fame and fortune

Abstract:

Fault injection (FI) is an increasingly important attack vector on hardware. Little to no work is done on analysis of faults during chip design or software design, because pre-silicon analysis techniques are lacking. We'll show techniques making it possible to take a hardware design and simulate relevant faults. There are several performance/precision tradeoffs, and we'll explain how the selection of fault models plays into this. Finally, we'll simulate the open-source PicoRV32 core, and show we can find both FI vulnerabilities in the core as well as in the software running on it, and show how some basic countermeasures can reduce the number of FI possibilities. People interested in hardware design and fault injection security (though not necessarily with background in these fields) can expect an interesting deep-dive into what chip designs look like and how pre-silicon security can help reduce future FI vulnerabilities.

Speaker Bio:

Jasper (@jzvw) currently is CTO for Riscure North America, working with the SF based team to improve embedded device security through innovation.

As CTO of Riscure North America, Jasper is principal security analyst and ultimately responsible for Riscure North America's technical and innovation activities.

Jasper's interest in security matters was first sparked in his mid-teens by reverse engineering software. During his studies for a master's degree in both CS and AI, he worked for a penetration testing firm, where he performed source code review, binary reverse engineering and tested application and network security.

At Riscure, Jasper's expertise has grown to include various aspects of hardware security;from design review and logical testing, to side channel analysis and perturbation attacks. He leads Riscure North America's pentesting teams and has a special interest in combining AI with security research.

Jasper's eagerness to share knowledge is reflected by regular speaking appearances, specialized client training sessions, student supervision and academic publications.

Jasper has spoken at many security conferences including Hardwear.io, BlackHat briefings and trainings, Intel Security Conference, RWC, RSA, EDSC, BSides SF, Shakacon, ICMC, Infiltrate, has presented scientific research at SAC, WISSEC, CT-RSA, FDTC, ESC Design {West,East}, ARM TechCon, has reviewed papers for CHES and JC(rypto)EN, and has given invited talks at Stanford, NPS, GMU and the University of Amsterdam.

Specialties: embedded security, side channel analysis, fault injection, binary code analysis, security evaluations of {mobile phones, smart cards, set-top-boxes}, network penetration testing, code reviews.