Dear viewer, these subtitles were generated by a machine via the service YouTube and therefore are (very) buggy. If you are capable, please help us to create good quality subtitles: https://c3subtitles.de/talk/2677 Thanks!
[Music]
okay hello everybody and uh welcome back
to the Millie way stage here we will
have your presentation starting at 2
o'clock shortly just got some general
announcements and information for you
all uh don't forget to wash your hands
be healthy be safe uh basic covid
precautions unfortunately we haven't had
zero incidences uh there are masks and
tex test kits available at the info desk
if anybody feels like they would like to
make use of them uh but just uh be safe
and wonderful and excellent people and
uh washing your hands goes a long way uh
also General announcement if anybody has
any unused but still usable items that
they're packing down and not going to be
taking home they are taking donations at
the info desk as well if you want to
drop off things like extra tents or food
as long as it's non- perishable they'll
be taking collections there so you have
a little bit less to uh pack in and take
with you uh one other thing I hope uh
anybody have you all seen a talk here
yet at milliways anybody enjoy the movie
last night or see some good stuff well
hopefully uh you'll enjoy a couple more
here what was that car oh who was here
for karaoke last
night okay well yeah you weren't here
this morning but uh I could still hear
you at 6: am. so uh yeah thanks for that
and and so speaking of uh this stage is
being put on by Millie ways which is the
camp just behind us and also has the
restaurant at course at the end of the
universe you're all welcome to join hang
out have some food always appreciate
donations and things like like that but
uh if you really want to chip in and be
excellent and join us in the solidarity
of not losing too much money doing all
of this we do still have some challenge
coins available so milliways creates
these cool coins every year there's a
milliways on one side and a 2023 on the
flip and uh this is a pretty cool silver
edition and there are a now limited
edition blackcoin as well so uh €30 or
better donations are much appreciated
you can hit me up here or the info desk
right behind us also has more coins
including ones from previous years so if
you were at say 2017 or 2019 Congress
camps or otherwise and uh really miss
one of those coins you can get one for
an extra special offering so uh yeah
hope everybody enjoys their evening and
uh we'll go ahead and get going here
with what yall came for which is to see
Mark surpriser that's not Mark uh this
is is the unlock the door to my secrets
but don't forget to glitch uh
unfortunately uh Mark is recovering and
not able to physically get themselves
here but has given silven all the
information and you've fantastically
offered to come and give it so we don't
have an empty stage so with that uh I
would like to thank and welcome silven
to the stage presenting Mark's talk on
unlock the door to my secrets but don't
forget to glitch the stage is yours
thank you thank you
okay uh first of all let's give a good
recovery to Mark um he's he would have
loved to be here um but I hope I can
represent him well enough um first of
all the about me slides it's not about
me it's about Mark uh we both work at
frova so the first part is still still
the same uh we do Hardware security um
Markus focused on embeded system
security security and does fault and
sight Channel analysis but he's also an
open source contributor to open OCD the
well L debuger lip [ __ ] and others and
if you want to know more about Mark if
you don't know him yet you can follow
his blog um but um about me very quickly
uh I also do fault and side Channel
analysis but I'm more on the analysis
side so I hope I can answer your
questions if you have any um um well
enough but my focus is not so much on
the emited part but more on the analysis
part
after um but about the microcontrollers
that we'll be looking at today um first
of all we have microc controls we have
one here but they're omnipresent they're
everywhere you have them in your in your
tokens in your crypto wallets you have
them also in your smart thermostats you
have them pretty much in all emitted
devices but they might contain some
secrets in the tokens and crypto wallets
it's easy thing they have cryptographic
keys but also the others they have some
some intellectual properties that you
might want to use that you might want to
alter that you might want to read out uh
but of course the manufacturer the
producer of of such uh a device doesn't
want you to um so our research is trying
to find new attack vectors for this new
hardware attacks but uh our our goal is
not only just to break them but to make
things more secure so we have a
responsible disclosure process still
running on um about all these things in
order for the manufacturers to make
things better hopefully
um on this specific one um we have
Hardware faults that are there uh so
it's hard uh to improve on the already
out there product but we'll come to that
later first of all what's this talk
about is about theb protection you have
a device you're programming you're
developing it you have foldback access
of course so you have access to
everything and of course are able to
read out and right to the flash
memory um once you want to ship this
product you want to make it ready for
release you want to switch to limited
debug access um so during this in this
phase you have no access to the flash
memory you can't read or write to it but
you can still access some of the debug
features in order for for a device um to
see if it's still running if there's
some some some other problems with it
that you um could like do some checks uh
on the memory and stuff if it's still
working or if there's some Hardware
fault uh some devices also have a full
debug lockdown full debu disable the
full debug access however that's not
very common in most microcontrol they
only have this limited debug access and
this is essentially the the path that
we're looking at today how to get back
from this limited debug access to full
debug access without losing the content
so you have the limited de accesses
you're able to to um for example use the
SRAM to write a program to the device to
run it but you can't run the flash at
the same time but you can do a Flash and
uh uh unlock an erase function in order
to get back
and that's the actually the problem if
you go back you raise all the memory
content and that's the goal of the
today's um Talk was how to access this
secret how to unlock the secret with a
glitch so the glitch comes in exactly
here trying to glitch this Mass Ras
function uh how do we do that uh we
first of all looked at the timing of how
this Flash and eras function works so
you're able to access the debug axis uh
during the through the debug Port you're
able to access the device you're able to
tell it okay I want to reset you I want
to FL Flash and erase the whole um
device unlock it at the same time and
this process is is a s SLE command you
give to the chip and it takes about 50
milliseconds and what we have here it's
uh um an activity profile of the chip
it's essentially over time how much
power how much activity we have on the
chip how much power consumption we have
on the chip so you see in the the areas
where there's lots of Peaks there's a
lot of h a lot of stuff happening and at
the end and front you have nothing
happening and you have a small Gap in
between and so we analyzed this and
looked at what are the timings on
this we have first at the beginning uh
we have a small part which we um derive
to be the the part where essentially the
erase function is triggered so that's
where the memory is actually
erased and then we have a larger block
where there's something happening but
that doesn't delete the memory further
we have another erase function part
that's very similar you see the two
parts are very much alike but it's a
little shorter that's the part where the
settings are deleted so that's where the
bit is deleted that essentially locks
the device
down then we have a similar large Block
doing some recovery parts and then we
have five write operations which would
included this is essentially where you
write the five setting bytes again
setting the initial setting to the chip
writing what essentially this chip is
from factory mode so essentially open
the buck access being able to read flash
memory so what is our goal our goal was
to hinder the first operation hinder
this erase
function with a
glitch um so for this um we tested
different devices so I have one device
with me here today and on this device I
want to show you what we do for for the
simple setup so we have a small
developer board in
stm32 chip and first of all of course we
connect it to
power and then we want to make be able
to glitch the power supply so the first
thing is remove some capacitors adjust
the capacitance so you can actually
adjust the power supply with completely
without completely killing the chip but
without all the capacitance just
smoothing out your your glitch
signal then you want the tip chip to be
more sensitive so you lower the supply
voltage to the lower end of of the specs
so instead of 3.3 volts you go down to
1.9
volts and then of course we want the Deb
AIS so we take out the debug ports we
also will feed out a trigger signal so
we will write a small command to the
Chip saying okay pull up the trigger
signal do the Flash and raise function
and then we have a perfect timing for
our glitch to happen at the right time
so we will take the glitch which is
essentially just shortening the power
supply for a very short time in a
specific shape uh for this we use uh um
um a a device that just Alters the the
power Just shortens this for a very
short
time and that's essentially the the
setup for the demo I have here um let's
switch to the
demo here we have the chip whisper board
which essentially
Alters I hope you can see it um which
essentially Alters the um which is my
debug interface which I have USB
connection to and here I have the stm32
board that I just showed you I have all
the wires connected as I just showed you
in the previous
slide and now you see the three LEDs let
me go back you have three LEDs on the
chip here and you see them here blinking
should they should be blinking so that's
essentially the program that we're
running on here right now you have three
blinking LEDs and we want to read out
the memory content of The Flash that
runs this program
so first I will connect open OCD to the
chip and this should probably hold the
program because once you're in this
limited debu access mode you don't want
any interaction of the debu port to the
flash memory so the chip has a direct
the chip is locked right now um so once
I open the debu port the chip holds uh
program execution from flash I can do my
programming from from um from the debu
port but the flash memory is not used
anymore so now we'll connect here on the
left side I will connect to the open OCD
debugger and it will just try
to to read out the memory so it will
read out the flash memory here 256 bytes
and it fails I mean the chip is locked
right now so I'm not able to read out
the
memory and here I already have the
glitch setup this uh the glitch script
this script has tells this um debugger
uh this this uh chip Whisperer to send
the Flash and erase uh Flash and unlock
command to the chip it will run it and
just at that time I have here the glitch
connection which will trigger that
glitch and um interrupt the erase
function so let's try
this and it's
unlocked I can go
back
and I can read out the
memory and now if there's any secrets I
mean this secret code of how the Blinky
lights are
working um it's uh let's reset the chip
so it's running again now you see even
with the debug mode and debug access
activated the chip is running so it's
completely
unlocked
okay that's essentially the the demo
that brings me to the end of the talk
already
um the the glitch flash um um so I'm
able to glitch The Flash erase function
um to gain full debu access so switching
back from this limited debu access mode
while fling glitching at the right time
I'm able to access all the flash memory
content um I showed it to you on one
specific microcontroller here because um
this is a easy to bring setup for here
uh we also tested or my colleague Mark
tested multiple different
microcontrollers from different
manufacturers which um were all affected
by a similar attack um the results are
still um in the process of being
published uh with a responsible
disclosure everything in the paper right
now is under review so I I actually
don't know all the details about which
other ones but there's multiple and
maybe the most important thing about for
you is how to protect yourself um yeah
you can apply specific mitigations for
example don't use the flash for very
sensitive content and but the problem is
you cannot really mitigate this attack
because it's essentially Hardware attack
it's in the in the hardware of the
device yeah that's essentially the end
of the talk already if you have any
questions anybody here with questions uh
if you'd go ahead and uh line up over
here at the mic and we'll take some
questions first uh let's think uh not
mark svin for fantastic talking
today and we've got the first question
for you yeah yeah you said that the
erase function is prepended to the
function where the bits uh which do the
protection are reset yes so what is your
power supply timing to disable the erase
function but enable the um it's a very
short glitch and then it just jumps over
the chip arrays to resetting the bits
where the so you have you have I think
you see it again you have the three
three three parts
essentially and in the first part it's
very difficult to see that's so we'll
we'll mention here in the audience the
screen is a bit difficult to see but
this is being recorded so just keep in
mind you can go back to uh media.ccc.de
and pull up the talk and get Crystal
Clear HD on the slides that may or may
not be washed out okay uh about your
question it's like essentially it's a 50
millisecond time frame where did you go
it's a 50 millisecond time frame and you
just do the glitch at the very beginning
where the memory content is erased and
that's just you just drop the power
supply for a very short time that's
essentially what this chip whisper is
able to you just set settings
essentially this short and this this
very specific timing and you just hinder
the chip from erasing the memory but
essentially the bug here is that it
it still continues even though it didn't
erase like it says okay erase function
didn't work anyways let's just unlock
anyways so it should just um uh if the
erase doesn't work it shouldn't unlock
but unfortunately it erases it doesn't
erase but it still unlocks so that's
what what
is yeah it doesn't check that it's
actually worked
yeah uh are there not uh Brown out
detection circuits that will prevent
this could the erase function it detect
the brown out and try again or it could
yeah it could but it
[Laughter]
[Music]
doesn't uh how can we reproduce this
attack
ourselves
um I don't know if the scripts are
online or what what the details in the
the paper are um but this chip whisper
is is ready available and then it's just
trying to figure out the exact
timings but I guess you just have to
wait for the for the paper which which
information we are able to publish here
hey can you mention again which board is
doing what here uh this board here on
the left that's a chip whisper that's an
off-the-shelf device for these kinds of
Hardware attacks this essentially shapes
the glitch and this is just a voltage
conversion this small board just to get
this 1.9 volts and that's just an stm32
uh developer board just off the shelf
developer board which we removed and
adjusted some of the capacitors to have
the the right power supply so if you
would have have a product you would
maybe have to desol or adjust the um
capacitance but of course you can also
as it's in the power supply the
capacitance you could also adjust it
while with adding uh capacitors here
which we also did we have one that's
plugged in here sorry for moving all
right looks like we got a few more
questions for you yeah yeah you you said
you've done this with multiple devices
I'm just curious how difficult is it to
find uh a level to sort of drop it out
to that doesn't Brown out the chip so it
stops executing code but still stops The
Flash erasing and how hard is it to find
the right timings like an easy attack uh
I'm always outside of the lab so Mark is
doing the the real work there and it's
it does take some time so for example
what we have what we H we have um the
advantage to be able to record and
analyze the chip very detailed so we
actually have an uh a probe that we can
set on top to measure the
electromagnetic emanation of the Chip
and analyze what exactly is it doing or
guess what it's doing and so we were
able to look at these traces and see
what what the timing is we tried it with
different data we tried it with an empty
chip first of all to understand what's
actually happening there and then once
you know what which operation is then
you can adjust these timings and then of
course you have a frame of you try short
long intense glitches different shapes
and you just have a script run overnight
and it'll try
everything do you have uh any idea which
process you are exactly affecting uh the
erase function but I mean uh like which
part of the erase function like is it
maybe charging up power or something
like this or it's already erasing or my
guess like from from the discussion um
with my colleague it seems like it's
essentially we dropping the power like
you know how a flashh cell in order to
race it um you need power to essentially
um get electrons out of the this
floating gate there and that needs a lot
of power and essentially when you take
off the power at that time it might not
pull the electrons out the charge out
and then you you don't have an erase I
think that's that's the guess but it's
just an educated guess from a
blackbox how many Dev boards did you
need uh to figure out like the right
timing and all that I don't
know like 10 100 or probably around 10 I
would say I don't I don't think we have
a big pile now I don't
know and do we have any questions from
the
internet and we have any other questions
uh we got just another uh minute or two
here if uh there's a follow-up
question and what should we do if if for
example such an eror exists in a chip
should
we choose another chip to prevent this
or is it just an error that's so
difficult to to reu produce that we can
ignore it uh it depends what you want to
protect um if you have have an open
source project on this there's not many
assets unless you if you have an open
source project without any keys on there
there's no asset that you're
protecting um but if you have uh uh
intellectual properties that you don't
want to go out get get distributed uh
for example for the cryptographic keys
you can use an Hardware um chip extra
protected secure chip um but for the
others the problem is we only have
limited research I don't know if there
was any chip that they couldn't succeed
but of course that just means okay they
didn't find the glitch um so it's hard
to say okay use this chip instead so
yeah all right so what do you think um
about glitching I I imagine everybody
here is somewhat famar with glitch but
we're talking all kinds of things
glitching Brown out Etc if we're trying
to talk somebody who maybe doesn't have
a chip whisper at home or whatever else
do you have a way to summarize like what
is glitching in not too technical a way
okay uh glitching it's
essentially um just like flickering the
light while while it's running so like
just F flickering with the power supply
why the why the program runs and giving
some faulty operation doing the with
this essentially and the idea is if you
do this dozens of times millions of
times eventually you'll get lucky and
flipping that switch it'll think oh I
totally got a valid command to do this
other thing that I shouldn't have access
to do but I'm going to do it anyways
because I don't know better yeah exactly
exactly but like when you have this
specific timing you don't have to get
lucky like this is has essentially runs
every time now once we have the timing
right gotcha very good well thank you so
much and uh really appreciate the talk
so once again I retitle this slightly uh
silvin and Mark's talk on unlock the
door to my secrets thank you so much
thank
you
l