6 ms·

so how does this voltage glitching stuff work exactly? are caps to ground/buffers removed/defeated? is it timing dependent? (sounds like they're sending i2c mes

by a-dub 5y ago

so how does this voltage glitching stuff work exactly? are caps to ground/buffers removed/defeated? is it timing dependent? (sounds like they're sending i2c messages to the power circuitry here?) do people do things like setup precise triggers or hook up function generators to kick the supply voltage around and just wait to get lucky?

pjc50 5y ago
Hilariously it appears you can just direct the system to turn down its own supply voltage for you (I2C to the PMIC, as you spotted), and that one of the levels has a bit error rate that's low enough to run programs most of the time but triggers a bit flip in AES often enough to leak the key.
- bradfa 5y ago
  A properly designed crypto subsystem that cared about security would detect the voltage drop and either refuse to operate or would have its own local power regulation circuits such that a system level voltage reduction wouldn't impact it. I presume the CPU here was VERY cost conscious and so trade-offs were made. I have no background in gaming but have worked with flawed "security" solutions. Often the business does not care that the engineers explain how flawed some security thing is before release, if there's more money to be made by not fixing it then it won't get fixed. Often doing all of the right things is MUCH too expensive, either in dollars, size, or power.
  - baybal2 5y ago
    > would have its own local power regulation circuits such that a system level voltage reduction wouldn't impact it. How do you know if external voltage is low if you check it against... a voltage derived from it?
    - thebruce87m 5y ago
      Isn’t that what bandgap voltages are for? https://en.m.wikipedia.org/wiki/Bandgap_voltage_reference https://en.m.wikipedia.org/wiki/Bandgap_voltage_reference
    - joshvm 5y ago
      Almost all micros have brown out detection so you can tell if the device undervolts, and typically you can force the device to auto shut down/reset if that condition trips using an onboard programmable fuse. I don't know how much of an attack surface your typical BOD circuit is though. https://microchipdeveloper.com/8avr:bod https://microchipdeveloper.com/8avr:bod
    - pjc50 5y ago
      This is called brownout detection, and it's a common feature even on low-end microcontrollers. As the other commenter says, it's derivable from a bandgap reference. In re "properly secured system": it's a cost-sensitive games console for children, while there's a big incentive against piracy ultimately there's a limit to how much you can defend. And this is the second line of defense, the bootloader having been breached earlier.
      - baybal2 5y ago
        Bandgap reference can't tell anything about body bias voltage, unless it itself built on top of insulator
        pjc50 5y ago
        Could you elaborate? Isn't the substrate usually tied to ground so we can ignore it in modelling? Or are you saying that it could be floated separately to ground in order to attack the chip?
        baybal2 5y ago
        Yes, and normally it is. I think on every moderately modern CMOS IC, body bias is controlled. > What is body bias? > Body bias is used to dynamically adjust the threshold voltage (Vt) of a CMOS transistor. While CMOS transistors are usually thought of as having three terminal devices, with terminals for the source, gate, and drain, it’s increasingly common to have a fourth terminal connected to the body (substrate). Because the voltage difference between the source voltage (Vs) and body voltage (Vb) affects the Vt, the body can be thought of as a second gate that helps determine how a transistor turns on and off. https://semiengineering.com/body-bias-what-it-is-and-why-you-should-care/ https://semiengineering.com/body-bias-what-it-is-and-why-you...
      - floatboth 5y ago
        The whole "games console" context also comes waaaay after the chip was made — it's not a custom for-Nintendo chip! tegra210 was previously used in the Nvidia Shield 2015, then the Google Pixel C (also from 2015) and the Jetson TX1 dev board.
  - Mindwipe 5y ago
    > I presume the CPU here was VERY cost conscious and so trade-offs were made. It was also more intended as a media chipset and they managed to flog it to Nintendo, and was an early effort by the team involved.
Retr0spectrum 5y ago
More commonly, voltage glitching does rely on removing capacitors etc., and extremely precise timing (nanosecond resolution, or below). However, the fun part about this particular attack is that it does not require quite the same level of precision. The voltage is dropped incrementally until the CPU starts to make faulty calculations. It just so happens that AES is one of the most complex operations, and thus, the first to start faulting.
blincoln 5y ago
Yes to all of your questions. A lot of it can be automated with e.g. a ChipWhisperer.
dbuder 5y ago
Yes and after a while it isn't luck. Reportedly state actors and bigcorp even go so far as to decap chips, laser off security features/caps/whatever and do stuff like inspect the memory with a microscope. There is another youtube channel that is even more impressive but Liveoverflow https://www.youtube.com/watch?v=FktI4qSjzaE https://www.youtube.com/watch?v=FktI4qSjzaE has some videos defeating AES with device that makes it much easier.
- zwirbl 5y ago
  Now I'm curious, which channel is even more impressive? LiveOverflow is definitely great
  - dbuder 5y ago
    Can't find it, however you might be interested in this article from HN earlier in the year. Written/done by an intern. https://research.nccgroup.com/2020/10/15/theres-a-hole-in-your-soc-glitching-the-mediatek-bootrom/ https://research.nccgroup.com/2020/10/15/theres-a-hole-in-yo...
- amboar 5y ago
  One of my favourite talks is Decapping Chips the Hard Way by Adam Laurie and Zac Franken: https://youtu.be/0Z4aF-qiziM https://youtu.be/0Z4aF-qiziM That was 8 years ago
  - sannysanoff 5y ago
    how long before they will introduce special bad sectors on floppy disks, - sorry, wrong epoch, - special half-faulty components required for proper execution in chips to disable chip simulation/reverse engineering.
    - Semaphor 5y ago
      I’ll never forget the crack that I downloaded back in the days. It came with a PDF or image of a CD you were supposed to print, so you could drill through the burned CD at exactly the proper position. This was supposed to defeat the hardware dongle the software otherwise required. Can’t remember what software it was and never tried it to find out if this was a prank or actually worked, but I loved that as a kid :D
bonzini 5y ago
See here: https://yifan.lu/2019/02/22/attacking-hardware-aes-with-dfa/ https://yifan.lu/2019/02/22/attacking-hardware-aes-with-dfa/
voxadam 5y ago
If you're interested in voltage glitching and other power analysis attacks you should take a look the excellent open source ChipWhisper. https://chipwhisperer.readthedocs.io/en/latest/tutorials/courses_fault101_soln_fault%202_1%20-openadc-cwlitearm.html# https://chipwhisperer.readthedocs.io/en/latest/tutorials/cou... https://chipwhisperer.readthedocs.io https://chipwhisperer.readthedocs.io https://www.newae.com/chipwhisperer https://www.newae.com/chipwhisperer https://embedded.fm/episodes/286 https://embedded.fm/episodes/286 (podcast interview)

by a-dub 5y ago

pjc50 5y ago

Hilariously it appears you can just direct the system to turn down its own supply voltage for you (I2C to the PMIC, as you spotted), and that one of the levels has a bit error rate that's low enough to run programs most of the time but triggers a bit flip in AES often enough to leak the key.

bradfa 5y ago
A properly designed crypto subsystem that cared about security would detect the voltage drop and either refuse to operate or would have its own local power regulation circuits such that a system level voltage reduction wouldn't impact it. I presume the CPU here was VERY cost conscious and so trade-offs were made. I have no background in gaming but have worked with flawed "security" solutions. Often the business does not care that the engineers explain how flawed some security thing is before release, if there's more money to be made by not fixing it then it won't get fixed. Often doing all of the right things is MUCH too expensive, either in dollars, size, or power.
- baybal2 5y ago
  > would have its own local power regulation circuits such that a system level voltage reduction wouldn't impact it. How do you know if external voltage is low if you check it against... a voltage derived from it?
  - thebruce87m 5y ago
    Isn’t that what bandgap voltages are for? https://en.m.wikipedia.org/wiki/Bandgap_voltage_reference https://en.m.wikipedia.org/wiki/Bandgap_voltage_reference
  - joshvm 5y ago
    Almost all micros have brown out detection so you can tell if the device undervolts, and typically you can force the device to auto shut down/reset if that condition trips using an onboard programmable fuse. I don't know how much of an attack surface your typical BOD circuit is though. https://microchipdeveloper.com/8avr:bod https://microchipdeveloper.com/8avr:bod
  - pjc50 5y ago
    This is called brownout detection, and it's a common feature even on low-end microcontrollers. As the other commenter says, it's derivable from a bandgap reference. In re "properly secured system": it's a cost-sensitive games console for children, while there's a big incentive against piracy ultimately there's a limit to how much you can defend. And this is the second line of defense, the bootloader having been breached earlier.
    - baybal2 5y ago
      Bandgap reference can't tell anything about body bias voltage, unless it itself built on top of insulator
      - pjc50 5y ago
        Could you elaborate? Isn't the substrate usually tied to ground so we can ignore it in modelling? Or are you saying that it could be floated separately to ground in order to attack the chip?
        baybal2 5y ago
        Yes, and normally it is. I think on every moderately modern CMOS IC, body bias is controlled. > What is body bias? > Body bias is used to dynamically adjust the threshold voltage (Vt) of a CMOS transistor. While CMOS transistors are usually thought of as having three terminal devices, with terminals for the source, gate, and drain, it’s increasingly common to have a fourth terminal connected to the body (substrate). Because the voltage difference between the source voltage (Vs) and body voltage (Vb) affects the Vt, the body can be thought of as a second gate that helps determine how a transistor turns on and off. https://semiengineering.com/body-bias-what-it-is-and-why-you-should-care/ https://semiengineering.com/body-bias-what-it-is-and-why-you...
    - floatboth 5y ago
      The whole "games console" context also comes waaaay after the chip was made — it's not a custom for-Nintendo chip! tegra210 was previously used in the Nvidia Shield 2015, then the Google Pixel C (also from 2015) and the Jetson TX1 dev board.
- Mindwipe 5y ago
  > I presume the CPU here was VERY cost conscious and so trade-offs were made. It was also more intended as a media chipset and they managed to flog it to Nintendo, and was an early effort by the team involved.

Retr0spectrum 5y ago

More commonly, voltage glitching does rely on removing capacitors etc., and extremely precise timing (nanosecond resolution, or below). However, the fun part about this particular attack is that it does not require quite the same level of precision. The voltage is dropped incrementally until the CPU starts to make faulty calculations. It just so happens that AES is one of the most complex operations, and thus, the first to start faulting.

blincoln 5y ago

Yes to all of your questions. A lot of it can be automated with e.g. a ChipWhisperer.

dbuder 5y ago

Yes and after a while it isn't luck. Reportedly state actors and bigcorp even go so far as to decap chips, laser off security features/caps/whatever and do stuff like inspect the memory with a microscope. There is another youtube channel that is even more impressive but Liveoverflow https://www.youtube.com/watch?v=FktI4qSjzaE https://www.youtube.com/watch?v=FktI4qSjzaE has some videos defeating AES with device that makes it much easier.

zwirbl 5y ago
Now I'm curious, which channel is even more impressive? LiveOverflow is definitely great
- dbuder 5y ago
  Can't find it, however you might be interested in this article from HN earlier in the year. Written/done by an intern. https://research.nccgroup.com/2020/10/15/theres-a-hole-in-your-soc-glitching-the-mediatek-bootrom/ https://research.nccgroup.com/2020/10/15/theres-a-hole-in-yo...
amboar 5y ago
One of my favourite talks is Decapping Chips the Hard Way by Adam Laurie and Zac Franken: https://youtu.be/0Z4aF-qiziM https://youtu.be/0Z4aF-qiziM That was 8 years ago
- sannysanoff 5y ago
  how long before they will introduce special bad sectors on floppy disks, - sorry, wrong epoch, - special half-faulty components required for proper execution in chips to disable chip simulation/reverse engineering.
  - Semaphor 5y ago
    I’ll never forget the crack that I downloaded back in the days. It came with a PDF or image of a CD you were supposed to print, so you could drill through the burned CD at exactly the proper position. This was supposed to defeat the hardware dongle the software otherwise required. Can’t remember what software it was and never tried it to find out if this was a prank or actually worked, but I loved that as a kid :D

bonzini 5y ago

See here: https://yifan.lu/2019/02/22/attacking-hardware-aes-with-dfa/ https://yifan.lu/2019/02/22/attacking-hardware-aes-with-dfa/

voxadam 5y ago

If you're interested in voltage glitching and other power analysis attacks you should take a look the excellent open source ChipWhisper. https://chipwhisperer.readthedocs.io/en/latest/tutorials/courses_fault101_soln_fault%202_1%20-openadc-cwlitearm.html# https://chipwhisperer.readthedocs.io/en/latest/tutorials/cou... https://chipwhisperer.readthedocs.io https://chipwhisperer.readthedocs.io https://www.newae.com/chipwhisperer https://www.newae.com/chipwhisperer https://embedded.fm/episodes/286 https://embedded.fm/episodes/286 (podcast interview)