This is a blog.
In Security and Trust in Open Source Security Tokens , we presented an attack vector that exploits a feature which allows to disable the debug interface protection of a microcontroller under the condition that its entire flash memory is erased first. With the help of fault injection, the erase operation can be suppressed which ultimately allows access to the entire flash memory. Our publication…
Hardware security tokens effectively prevent most password-related security issues and improve security indisputably. However, there are new threats from attackers with physical access which need to be discussed. Supply chain adversaries may manipulate devices on a large scale and install backdoors before they even reach end users. In evil maid scenarios, specific devices may even be attacked…
After Exception(al) Failure , we bought a bunch of drop-in replacement chips for the STM32F1 series and analyzed them with respect to their firmware security features. We found lots of severe vulnerabilities and even encountered counterfeited devices. The results of this research will be published in form of a scientific paper at the 14th USENIX Workshop on Offensive Technologies on 11 August 2020…
The firmware of microcontrollers usually contains valuable data such as intellectual property and, in some cases, even cryptographic material. In order to protect the confidentiality of these assets, most microcontrollers feature some kind of firmware read-out protection. This security feature shall prevent adversaries with physical access to a device from reading out the internal flash memory.…
We identified a vulnerability in the read-out protection (RDP) mechanism of the STM32F1 series from STMicroelectronics. CVE-2020-8004 has been assigned to this issue. An attacker with access to the debug interface can exploit this vulnerability and extract large amount of data from the flash memory. If you rely on this security feature, we highly recommend you to take appropriate action. The only…