Please note: the training ticket does not include access to the conference. Similarly, the conference ticket does not grant access to the trainings. If you have any questions, reach out to us.

Training Objectives:

Have you ever encountered a device and wanted to dump its firmware, only to find out that the debug interfaces are locked? Have you ever tried to bypass a firmware signature verification without having to find a bootloader vulnerability first?

In this training you will learn how to use fault-injection to do just that. You will learn how to use techniques such as crowbar glitching, spiking and electro-magnetic fault injection to bypass a diverse set of protections, including re-enabling the debug interfaces on microcontrollers, bypassing firmware security measures and recovering AES keys by glitching AES rounds.

A diverse set of targets ensures that you will be well equipped to perform these attacks on your own in the future, and a focus on real-world applicability ensures that the attacks do not just apply to artificial targets.

In the end, we will also look at and test som fault-injection counter measures: If and how devices can be protected against this class of attacks.

What to Expect? | Key Learning Objectives:

The training is based all around hands-on practical exercises: The attacks are performed on real, physical hardware, and students will be well equipped to perform the attacks on new targets in the future.

Students will learn how to:

• Identify whether a chip is susceptible to certain types of fault-injection attacks
• Build their own glitchers
• Perform different types of fault-injection attacks on targets
• Learn how to use reverse engineering to find fault-injection vulnerable code

Training Detailed Description:

Day 1

On day one we will dive into the world of fault-injection: What is it, how does it work, what are famous examples of it? What can we achieve using fault-injection?

After the basic theory is covered, we will dive right into the deep end: The students will perform their first fault-injection: Using just a paper-clip! Next we will look at performing a fault-injection attack without any external hardware at all: We will use the power-management features of a dual-core microcontroller to attack code running on the second core.

With the basics covered, it’s time to look at performing our first crowbar glitch: By using a MOSFET and a glitch generator we will interrupt the power supply to a chip for a very short amount of time, analyzing what this causes on the chip, what the effect of pulse-duration and timing is, and learning to quantify glitches.

We will also look at how we can use reverse engineering to find code vulnerable to fault injection.

Day 2

Day 2 is all about bypassing protections on microcontrollers: We will use fault-injection to re-enable the debugging interfaces on different microcontrollers (such as nRF52 & STM32), and will learn how to attempt this on new, not yet hacked microcontrollers. We will learn how the same approach was used to hack Bitcoin wallets and even dump the Apple AirTags.

We will also take a look how certain common firmware protections can be bypassed using fault-injection, and how we can recover AES keys by skipping rounds of the AES algorithm.

Day 3

On day 3 we will look at other types of fault-injection attacks beyond crowbar glitching: Spiking and electro-magnet fault injection. We will use a simple electric lighter to cause faults in a chip, and then use dedicated electro-magnetic fault injectors to perform attacks on chips.

We will also take a look at glitching processors beyond microcontrollers: We will look at glitching SoCs (such as the Tegra used in the Nintendo Switch) and the challenges involved with doing so.

Finally we will look at firmware and hardware based countermeasures: Chips with glitch monitors, and firmware patterns that help mitigate fault-injection attacks.

Who Should Attend? | Target Audience:

• Hardware Hackers
• Embedded Developers
• Forensic Investigators

What to Bring? | Software and Hardware Requirements:

Students need to bring a laptop capable of running a virtual machine in either VMware Player/Workstation/Fusion or VirtualBox. Windows 10 & 11 as well as macOS >12 are supported. If you use Linux, please make sure you have a good understanding on how to forward different types of USB devices to your VM.

The laptop must have at least two (free) USB-A ports (or a USB-C dongle providing at least two USB-A ports)

What to Bring? | Prerequisite Knowledge and Skills:

• Basic embedded programming experience in C
• Basic Python knowledge
• Basic electronic understanding (Transistors & resistors shouldn’t scare you!)
• Basic reverse-engineering knowledge

Resources Provided at the Training | Deliverables:

The students will receive a lab manual as well as a basic glitching device to keep after the course.

ABOUT THE TRAINERS

Thomas Roth, also known as stacksmashing, is a security researcher with focus on embedded systems. His published research includes research on vulnerabilities in microcontrollers, hardware wallets, industrial systems, TrustZone and mobile devices. He is also well known for publishing educational material on his YouTube channel “stacksmashing”, and released a lot of open-source hardware security tools, such as the chip.fail glitcher.t