Clock Glitch Attacks in the Presence of Heating

Abstract

Fault attacks have been widely studied in the past but most of the literature describes only individual fault-injection techniques such as power/clock glitches, EM pulses, optical inductions, or heating/cooling. In this work, we investigate combined fault attacks by performing clock-glitch attacks under the impact of heating. We performed practical experiments on an 8-bit AVR microcontroller which resulted in the following findings. First, we identified that the success rate of glitch attacks performed at an ambient temperature of 100 • C is higher than under room temperature. We were able to induce more faults and significantly increase the time frame when the device is susceptible to glitches which makes fault attacks easier to perform in practice. Second, and independently of the ambient temperature, we demonstrate that glitches cause individual instructions to repeat, we are able to add new random instructions, and we identified that opcode gets modified such that address registers of individual instructions get changed. Beside these new results, this is the first work that reports results of combined glitch and thermo attacks.

A Review on Evaluation and Configuration of Fault Injection Attack Instruments to Design Attack Resistant MCU-Based IoT Applications

“…These factors for the clock and voltage fault attacks include accuracy, development expenses, complexity of the system set-up, and user expertise. Below, we identify a list of features regarded in the literature as being the main ones for a hardware-based fault generator [11,19,27,29,[37][38][39][40][41]]:…”

“…There are various practical techniques for generating a faulty clock signal [11,17,19,27,29,[37][38][39][40][41]48,49]. All of the proposed methods call for a high-frequency clock signal, the so-called 'Nominal Clock' on the clock fault generator side.…”

“…Regarding this feature, the faulty signal should be reproducible and validated by a third party if the same hardware is used (for example, the same FPGA). This parameter becomes more important when a unique evaluation platform is designed and used for faulty signal generation [11,19,27,29,37,40,41].…”

“…Randomness in faulty signal: Many of the faulty signal-generating methods presented, such as [7,9,10,18,19,27,28,37], are deterministic methods. To set up a fault generator and to apply an attack with high accuracy, all the output parameters must be prepared and calculated.…”

Fault Attacks on Secure Embedded Software: Threats, Design, and Evaluation

“…4) Combination of Voltage, Frequency, and Temperature Fault Injection: Zussa et al [16] demonstrated that overclocking, clock glitching, voltage glitching, underfeeding, and overheating exploit the same fault injection mechanism, which is the violation of a device's setup-time constraints. In addition, Korak et al [17], [25] showed overheating and voltage glitching improves the efficiency of clock glitching.…”