Building a Replicable EMFI Setup for Desktop and Server Hardware | Hacker News Reader

Building a Replicable EMFI Setup for Desktop and Server Hardware

arxiv.org

41 pointsbelter12 comments

EMFI: ElectroMagnetic Fault Injection

FI: Fault Injection

For the people looking first at the comments before reading the article ;-)

Hardware protection against this class of attacks seems relatively straightforward... simply have a few wire loops snaking around most of the die. Then measure the voltage on those wires, and if they ever go too high or too low, reset the CPU.

Also... The CPU needs to have brownout detection to detect people messing with the supply voltage, and clock glitch detection to detect inconsistent clocking inputs.

All that I think could be added with no major downsides (it wouldn't use a lot of silicon area or power).

How come this design didn't already have that?

I get the feeling it might not be as easy to implement as your comment makes it sound. Granted, I have no idea about hardware design, but it would be hilarious if you e.g. calibrated your EMI-detection a little too sensitively and your PC shuts down every time your colleague gets up from their office chair.

Not the first or last time that this kind of problem already happened in practice. My favorite is https://patrickthomson.tumblr.com/post/2499755681/the-best-d...

“Brown-out detection” is a pretty standard feature even in cheap microcontrollers (which, granted, are much more straightforward about their power). Don’t know how it holds up in an adversarial situation—not that well, probably. (You’re ultimately powering the comparators and voltage references off the same power supply, would be the first possible class of problems.)

Sadly it's not precise enough.

The only obvious downside I can see is that these protection limits have to be set within the operational envelope of the CPU to be effective. That effectively narrows the range of possible voltages and frequencies that the user can use the CPU at. Some types of overclocking would go out of the window.

On the other hand, such checks could be disable-able at runtime by sufficiently trusted code - although you obviously have to choose between security and overclockability.

There is also the issue that such things are decidedly 'analogue' things - and integrating them into a digital design toolchain sounds hard. Trying to tell EDA software 'send this wire all the way around the outside of the chip and back to where it started' is a bit like trying to tell a C compiler 'I want you to write all the code so all jumps go to prime numbered memory addresses'.

I think hardware protection against EMFI isn’t important for consumer electronics or even commercial servers.

1. It requires physical access.

2. Password based disk encryption would still protect against EMFI attacks for data exfiltration. There are easier methods to bypass TPM than EMFI.

Unless you're using a smart card or secure element, then your CPU is wide open to FI attacks. You can mitigate some types of FI attacks using software modifications, but doing so at the source level makes the codebase horrendous. Hardware solutions are not straightforward either. Once you add the cost of these solutions and add extensive security testing, you have to expect a substantial product price increase. If FI attacks continue to get cheaper, manufacturers will have no choice.

This article specifically targets an AMD-SP (Secure Processor); would you consider that a "secure element"?

Also, from the article: "The AMD Ryzen 5 2600 is equipped with a glued, indium-soldered nickel-plated copper heat spreader. This heat spreader shields the EM pulses and has to be disassembled, which is called delidding or decapsulation, and consists of three steps: First, the glue at the heat spreader’s border must be cut. Second, the processor and heat spreader have to be heated up to a temperature of 200°C."

If a regular CPU already contains an effective EM shield, is it fair to say it's "wide open to FI attacks"? (Or at least EMFI as discussed in this article.?)

> is it fair to say it's "wide open to FI attacks"?

By FI I was referring to the broad spectrum of FI, including clock glitching, voltage perturbation, in addition to UV and EMFI.

https://arxiv.org/pdf/2209.09835.pdf

Reply on news.ycombinator.com