Hacker News Reader

Comment by a-dub | Hacker News Reader

so how does this voltage glitching stuff work exactly? are caps to ground/buffers removed/defeated? is it timing dependent? (sounds like they're sending i2c messages to the power circuitry here?) do people do things like setup precise triggers or hook up function generators to kick the supply voltage around and just wait to get lucky?

View on HN

More commonly, voltage glitching does rely on removing capacitors etc., and extremely precise timing (nanosecond resolution, or below).

However, the fun part about this particular attack is that it does not require quite the same level of precision. The voltage is dropped incrementally until the CPU starts to make faulty calculations. It just so happens that AES is one of the most complex operations, and thus, the first to start faulting.

Hilariously it appears you can just direct the system to turn down its own supply voltage for you (I2C to the PMIC, as you spotted), and that one of the levels has a bit error rate that's low enough to run programs most of the time but triggers a bit flip in AES often enough to leak the key.

A properly designed crypto subsystem that cared about security would detect the voltage drop and either refuse to operate or would have its own local power regulation circuits such that a system level voltage reduction wouldn't impact it.

I presume the CPU here was VERY cost conscious and so trade-offs were made.

I have no background in gaming but have worked with flawed "security" solutions. Often the business does not care that the engineers explain how flawed some security thing is before release, if there's more money to be made by not fixing it then it won't get fixed. Often doing all of the right things is MUCH too expensive, either in dollars, size, or power.

> I presume the CPU here was VERY cost conscious and so trade-offs were made.

It was also more intended as a media chipset and they managed to flog it to Nintendo, and was an early effort by the team involved.

> would have its own local power regulation circuits such that a system level voltage reduction wouldn't impact it.

How do you know if external voltage is low if you check it against... a voltage derived from it?

Isn’t that what bandgap voltages are for?

https://en.m.wikipedia.org/wiki/Bandgap_voltage_reference

Almost all micros have brown out detection so you can tell if the device undervolts, and typically you can force the device to auto shut down/reset if that condition trips using an onboard programmable fuse. I don't know how much of an attack surface your typical BOD circuit is though.

https://microchipdeveloper.com/8avr:bod

This is called brownout detection, and it's a common feature even on low-end microcontrollers. As the other commenter says, it's derivable from a bandgap reference.

In re "properly secured system": it's a cost-sensitive games console for children, while there's a big incentive against piracy ultimately there's a limit to how much you can defend. And this is the second line of defense, the bootloader having been breached earlier.

Bandgap reference can't tell anything about body bias voltage, unless it itself built on top of insulator

Could you elaborate? Isn't the substrate usually tied to ground so we can ignore it in modelling? Or are you saying that it could be floated separately to ground in order to attack the chip?

Yes, and normally it is. I think on every moderately modern CMOS IC, body bias is controlled.

> What is body bias?

> Body bias is used to dynamically adjust the threshold voltage (Vt) of a CMOS transistor. While CMOS transistors are usually thought of as having three terminal devices, with terminals for the source, gate, and drain, it’s increasingly common to have a fourth terminal connected to the body (substrate). Because the voltage difference between the source voltage (Vs) and body voltage (Vb) affects the Vt, the body can be thought of as a second gate that helps determine how a transistor turns on and off.

https://semiengineering.com/body-bias-what-it-is-and-why-you...

The whole "games console" context also comes waaaay after the chip was made — it's not a custom for-Nintendo chip! tegra210 was previously used in the Nvidia Shield 2015, then the Google Pixel C (also from 2015) and the Jetson TX1 dev board.

Yes and after a while it isn't luck. Reportedly state actors and bigcorp even go so far as to decap chips, laser off security features/caps/whatever and do stuff like inspect the memory with a microscope. There is another youtube channel that is even more impressive but Liveoverflow https://www.youtube.com/watch?v=FktI4qSjzaE has some videos defeating AES with device that makes it much easier.

Now I'm curious, which channel is even more impressive? LiveOverflow is definitely great

Can't find it, however you might be interested in this article from HN earlier in the year. Written/done by an intern.

https://research.nccgroup.com/2020/10/15/theres-a-hole-in-yo...

One of my favourite talks is Decapping Chips the Hard Way by Adam Laurie and Zac Franken: https://youtu.be/0Z4aF-qiziM

That was 8 years ago

how long before they will introduce special bad sectors on floppy disks, - sorry, wrong epoch, - special half-faulty components required for proper execution in chips to disable chip simulation/reverse engineering.

I’ll never forget the crack that I downloaded back in the days. It came with a PDF or image of a CD you were supposed to print, so you could drill through the burned CD at exactly the proper position. This was supposed to defeat the hardware dongle the software otherwise required. Can’t remember what software it was and never tried it to find out if this was a prank or actually worked, but I loved that as a kid :D

That sounds unlikely to work. I had a professor at the university who started his lecture on ECC by saying he always drilled a hole in all his CDs since he knew it would work anyway.

Or perhaps the ECC simply works well enough that there's no perceptible data loss for audio?

Wouldn't the CD explode soon after it got to speed? This happened plenty to discs that were just not made uniformly enough.

i think your leg was being pulled.

that said, one of the first copy protection schemes involved writing specific sectors to a magnetic disk with an invalid checksum. when the program would start, it would verify that reading those sectors would return an error, but if you used a regular disk copy program it would not copy the invalid sectors- either resulting in an aborted copy or a copy that would zero out the bad sectors on the target which would not produce the expected read errors on startup telling the program it had been copied.

There is no angle position sensor on the CD, and only one continuous track. This could work if you burned multisession CD, scratched at some specific radius of the first session, followed by coding that information into executable burned in the second session.

https://scarybeastsecurity.blogspot.com/2020/06/weak-bits-fl...

http://dmweb.free.fr/?q=node/210

http://dmweb.free.fr/?q=node/1429

https://scarybeastsecurity.blogspot.com/2020/07/turning-400-...

This one describes very similar floppy protection - encoding physical disk parameters in the executable per every individual disk. https://scarybeastsecurity.blogspot.com/2020/12/the-cleveres...

This effectively already exists. The Xbox One SOC apparently monitors its own voltage and shuts down / doesn't function if it falls out of spec [1] as part of a totally OTT suite of anti-engineer techniques.

As an aside, I hate all of this. If someone made an open console, I'd buy it in a second. I realise that's probably my computer running linux next to me, but still...

[1] https://www.youtube.com/watch?v=U7VwtOrwceo

Almost all microcontrollers have a feature like that - chiefly because at power-on the voltage rises gradually, and if it started running before there was a high enough voltage for it to run correctly you get a bunch of reliability issues.

> If someone made an open console,

Steam Deck?

What is OTT?

over the top

Yes, there are schemes that deliberately exploit difficult-to-reproduce manufacturing defects, for things like fingerprinting / making hard-to-clone things.

The general field is called PUF (physically uncloneable functions)

https://en.m.wikipedia.org/wiki/Physical_unclonable_function

The Z80 had deceptively-designed transistors designed to throw off reverse engineers: https://twitter.com/kenshirriff/status/1331425858268012545

If you're interested in voltage glitching and other power analysis attacks you should take a look the excellent open source ChipWhisper.

https://chipwhisperer.readthedocs.io/en/latest/tutorials/cou...

https://chipwhisperer.readthedocs.io

https://www.newae.com/chipwhisperer

https://embedded.fm/episodes/286 (podcast interview)

See here: https://yifan.lu/2019/02/22/attacking-hardware-aes-with-dfa/

Yes to all of your questions. A lot of it can be automated with e.g. a ChipWhisperer.

Reply on news.ycombinator.com