解码电磁干扰攻击：从 GigaDevice GD32F407 故障中吸取的教训.pdf

1、#BHEU BlackHatEventsDecoding EMDecoding EM-FI Attacks:FI Attacks:Lessons Learned from Glitching Lessons Learned from Glitching the GigaDevice GD32F407the GigaDevice GD32F407Jonathan Andersson&Thanos Kaliyanakis#BHEU BlackHatEventsJonathan AnderssonSr.ManagerAdvanced Security Research GroupTrend Micr

2、o ZDIThanos KaliyanakisVulnerability Researcher Advanced Security Research GroupTrend Micro ZDI#BHEU BlackHatEventsInformation Classification:GeneralAgendaIntroduction&BackgroundThe RigGetting StartedThe AttackCalibrationPerfecting the GlitchAttack ResultsMitigationsConclusions#BHEU BlackHatEventsIn

3、troduction&BackgroundIntroduction&Background#BHEU BlackHatEventsInformation Classification:GeneralIntroductionWhy the GD32F407?Why fault injection?Why EM-FI?Autel MaxiCharger#BHEU BlackHatEventsInformation Classification:GeneralGigaDevice vs STMicro-32F407 John McMasterST32F407 GD32F407#BHEU BlackHa

4、tEventsInformation Classification:GeneralRead Out Protection LevelsNone/RDP 0No restrictionsLow/RDP 1Flash accessible only in flash boot modeFlash disabled when SWD attachedCan be reverted to None/RDP 0 but flash gets erasedHigh/RDP 2SWD cannot attachOnly flash mode boot allowedNo reversion back to

5、lower security levels possibleLock by Puspa Kusuma CC BY 3.0/blue with shadow#BHEU BlackHatEventsThe RigThe Rig#BHEU BlackHatEventsInformation Classification:GeneralThe Rig($600 USD)ChipSHOUTER PicoEMP with firmware additionsManaged USB hub with individual power controlXYZ table(G-Code)Programmable

6、power supplySWD debugger(OpenOCD/GDB)USB to serial(console)3D printed parts(PicoEMP&PCB mounts)Custom python code driving the rig#BHEU BlackHatEventsInformation Classification:GeneralThe Rig#BHEU BlackHatEventsInformation Classification:GeneralThe Rig Purchase Links XYZ Table$137SWD Debugger$10Manag