Fault Attacks on Secure Embedded Software: Threats, Design, and Evaluation

Abstract

Embedded software is developed under the assumption that hardware execution is always correct. Fault attacks break and exploit that assumption. Through the careful introduction of targeted faults, an adversary modifies the controlflow or data-flow integrity of software. The modified program execution is then analyzed and used as a source of information leakage, or as a mechanism for privilege escalation. Due to the increasing complexity of modern embedded systems, and due to the difficulty of guaranteeing correct hardware execution even under a weak adversary, fault attacks are a growing threat. For example, the assumption that an adversary has to be close to the physical execution of software, in order to inject an exploitable fault into hardware, has repeatedly been shown to be incorrect. This article is a review on hardware-based fault attacks on software, with emphasis on the context of embedded systems. We present a detailed discussion of the anatomy of a fault attack, and we make a review of fault attack evaluation techniques. The paper emphasizes the perspective from the attacker, rather than the perspective of countermeasure development. However, we emphasize that improvements to countermeasures often build on insight into the attacks.

The State of Fault Injection Vulnerability Detection

“…In [26,42] the authors present a survey of the different hardware based approach techniques used to inject a fault. The authors also refer to relevant works where the various fault injection techniques are used.…”

Taxonomy and Challenges of Out-of-Band Signal Injection Attacks and Defenses

“…The first property of out-of-band signal injection attacks is that they aim to change values processed by a system, rather than infer them. This fact distinguishes them from the side-channel [1] and fault-injection attacks [2]- [4] mentioned in the introduction.…”

“…This set contains recent studies whose novelty and potential has not yet received mainstream attention. 4 For example, the techniques proposed by Tu et al to overcome ADC sampling rate drifts should be applicable to other methods of injection, and against different types of targets. We place the work by Bolton et al [12] in the same category, as it managed to bridge research on HDD attacks (e.g., [53]) with attacks on MEMS sensors, and contained significant insights into why resonance attacks against hard drives work.…”

“…Despite the amount of research conducted on out-of-band signal injection attacks, there is no common methodology to evaluate how susceptible systems are to them. This is in contrast to related disciplines, such as side-channel analysis [75], direct power injection and near-field scan immunity [59], fault injection attacks [4], and IEMI attacks [191]. Indeed, although many papers sweep through frequencies to find the resonant ones [5], [13], some do not adopt this terminology [10], [12], [53], and do not specify how wide the frequency steps should be.…”

Hiding a fault enabled virus through code construction

“…Faults can be induced into the chip by using physical perturbations in its execution environment. Several techniques have been successfully demonstrated in the literature [4], [32], [47], [62]. Commonly used ones include:…”