Defend code from the Hardware Fault Attacks
In order to defend the code from the Hardware Fault Attacks during the execution of the program or its behavior change, the profound knowledge of these attacks is necessary. These attacks are a threat to electronic devices needed to be secure in a hostile environment. Therefore, this paper first describes Fault Injection, covering the principle, methods, impact, and practical application.
Here is an example of three common exploitation mechanisms known:
1. Dump
By changing memory pointers and/or loop termination, it is possible to make a chip transmit other than the intended data at any given data communication event. This way, it may be possible to leak secrets, such as passwords and keys, but also a complete code base. The latter can be handy for an attacker seeking logical vulnerabilities.
2. Privilege escalation
By changing critical decisions, it may be possible to escalate privileges and bypass an authentication mechanism, such as a password verification or a secure boot verification. The
attacker uses this to gain unauthorized control over a device.
3. Key extraction
Many protected devices use cryptographic keys for security. This helps to keep data confidential and to protect the integrity of a device and its data. When a computational error
is introduced during a cryptographic calculation, it may be possible for an attacker to derive the secret key by comparing the corrupted result with the expected result. When the key is
compromised, the device can no longer protect itself or its user.
Fault resistance requires pervasive protection throughout the code. That is why Riscure recommends mitigation patterns by three categories to IoT developers. The fault mitigation patterns are divided according to categories: resist, recover, and respond. They can be applied throughout the code and require little adaption for repeated applications.
All of the fault mitigation and prevention methods are costly, however, the costs can be limited to be efficient. The expenses include such spending as repair of broken products, brand damage, and penalties. To better illustrate the potential costs for fault, real-life examples are introduced considering different stages like designing and deploying.
Do you want to learn more about The Price We Pay for Fault Injection?
Register to download the paper below.
