YHK - yet another hacker news clone

Photon-Emission-Guided Laser Fault Injection Enables RP2350 Secure Debug

75 points synack 2 hours ago 20 comments

stackghost 1 hour ago | parent

> The attack requires physical access, destructive preparation, and approximately $250,000 of laboratory equipment.

Not super practical, but neat attack

paulnpace 1 hour ago | parent

> $250,000 of laboratory equipment

*currently

stavros 39 minutes ago | parent

$300,000 next year.

k12sosse 18 minutes ago | parent

We're already up to 400,000 just today.

TeMPOraL 18 minutes ago | parent

In 5 years, either $400,000 or $50 and a hammer, depending on whether the core piece of the process aligns with the needs of some fast-growing consumer tech product like e.g. drones.

_trampeltier 1 hour ago | parent

Some people have such and other toys just at work and can use it in spare time.

mrlambchop 1 hour ago | parent

250k is not a bad investment for a company doing "reverse engineering as a service" - say 1k a pop to extract the firmware. Naturally, a good business idea for somewhere in the world with less regulations...

stickfigure 45 minutes ago | parent

That is peanuts for a nation-state actor.

stackghost 29 minutes ago | parent

Sure, but if you’re defending against a nation state actor hopefully you aren’t expecting a raspberry pi to keep you secure.

ssl-3 16 minutes ago | parent

The RP2350 is an inexpensive microcontroller IC with reasonable performance and some very useful (and somewhat unusual) features in its PIO blocks.

Why wouldn't a person build that into the heart of something important?

sephamorr 13 minutes ago | parent

"Important" and "tamper proof against a determined adversary" are very different goals.

palmotea 8 minutes ago | parent

> Sure, but if you’re defending against a nation state actor hopefully you aren’t expecting a raspberry pi to keep you secure.

Is there anything about these techniques that are raspberry pi specific? It seems like they're using lasers to identify and flip particular bits in registers.

TZubiri 40 minutes ago | parent

It reads as impressive defense. Meaning that it's presumably not possible to get root with physical access on a live 50$ device without 250k capital

Rohansi 7 minutes ago | parent

This is for a $1 microcontroller. I'm assuming you're talking about the Raspberry Pi computers based on the $50 cost and root.

Fred27 1 hour ago | parent

There's always an XKCD... https://xkcd.com/538/

orbital-decay 1 hour ago | parent

It needs to be updated. Modern evil planners don't even need a wrench since they already have most keys given to them in advance by everyone, including nerds

junon 33 minutes ago | parent

Care to expand?

jacquesm 1 hour ago | parent

That's reminiscent of when we first found out that if you opened up dram chips you could use them for imaging. Of course the scale at which this is done is extremely impressive.

brcmthrowaway 40 minutes ago | parent

Now it can be done for Apple iPhone. Apple is cooked.

BitBangingBytes 3 minutes ago | parent

I appreciate all the details they provide in the post. The $250k in lab gear is useful when initially discovering, exploiting and documenting attacks like this.

Definitely doable in a home lab for under $25k in equipment, likely under $10k.

Same as my replicating Colin O’Flynn’s BAM BAM attack on a MPC5566 chip, he used a ChipShouter ($5,000) and I used a PicoEMP ($50).

https://youtu.be/URmI1VVilek