Уровень 0 · материалов: 4
В кластер входят документы об обходе встроенных механизмов защиты и извлечении кода из микроконтроллеров, но не входят документы об использовании микроконтроллеров в качестве инструментов для внешних атак на компьютерные системы.
Общие признаки: обход аппаратной защиты, извлечение прошивки, физические атаки на железо, уязвимости микроконтроллеров
Группа выше: Безопасность IoT и встраиваемых устройств
Смысл: The main idea is to demonstrate a physical hardware attack using UV light and optical manipulation to reset the security bits of a microcontroller without erasing its stored firmware, thereby enabling unauthorized reading of the code.
The author explains how to use a UV eraser and a custom tape mask to selectively erase protection fuse bits on a PIC microcontroller to unlock its firmware.
Смысл: The text demonstrates how a side-channel timing attack can be used to bypass password protection in embedded systems, specifically targeting the bootloader of a Renesas microcontroller to recover protected firmware.
The author successfully extracted firmware from a locked Renesas M16C microcontroller by using a timing attack via the SPI interface to crack the bootloader's 7-byte password.
Смысл: The main idea is to demonstrate that hardware-level encryption and secure boot mechanisms in popular microcontrollers like the ESP32 can be bypassed using side-channel attacks and fault injection. By analyzing the MIG Switch, the author proves that no hardware product is entirely 'unhackable' and reveals the true origin of the device.
An expert reverses the MIG Switch by using power analysis and voltage glitching to break ESP32 encryption, proving the device was made by Team Xecuter.
Смысл: The main idea is that the hardware-level security protections (Readout Protection) in GigaDevice GD32 microcontrollers are insufficient, as they can be bypassed using timing attacks, race conditions, and peripheral manipulation to steal protected firmware.
Researchers found three vulnerabilities in GigaDevice GD32 microcontrollers that allow bypassing high-level readout protection to dump protected firmware and SRAM.