PEW PEW PEW: Designing Secure Boot Securely
summary
Live fault injection on an STM32F4 using a Riscure Spider and a Python harness shows a single voltage glitch—found after ~2,000 trials—can hijack a memcopy, load a pointer into PC and turn encrypted secure boot into plain unprotected boot with no key knowledge. Countermeasures that actually help are concrete: copy into internal SRAM before use, make copied region non‑executable until after double verification, add randomized delays and repeated checks, and stack cheap mitigations (even a €5 PCB prototype works) to force infeasible attack runtimes.
AI-written summary · about
chapters (5)
- 0:00Start
- 10:03FAULT INJECTION SETUP
- 12:12FAULT INJECTION FAULT MODEL
- 14:04ENCRYPTED SECURE BOOT DESIGN
- 24:53SECURE BOOT FUNDAMENTALS
related talks
21mBreaking Espressif’s ESP32 V3: Program Counter Control with Computed Values using...
51mSecure Boot Under Attack: Simulation to Enhance Fault Attacks & Defenses
27mProtecting Data In-Use from Firmware and Physical Attacks
39mTOCTOU Attacks Against Secure Boot And BootGuard
24mSecurity through Transparency: Tales from the RP2350 Hacking Challenge
25mBreaking Bootloaders on the Cheap
48mFatal Fury on ESP32: Time to Release Hardware Exploits
42mBecoming a tyrant: Implementing secure boot in embedded devices