Electromagnetic Fault Injection (EMFI) has become an established technique for fault injection in embedded systems. EMFI has several advantages compared to other fault injection techniques and its effectiveness has been proven in practice. Currently, the application of non-trivial EMFI experiments is limited by the high cost of advanced lab equipment and therefore unavailable for broader security research. We propose AutoPulse, a cost-effective and complete EMFI research platform based on commercial 3D printer hardware and publish the project documentation and software as open source. We show that our platform significantly reduces the cost of EMFI in practice and conduct a comprehensive literature survey to conclude that our platform specifications are sufficient to attack even modern SoCs with high clock rates. We evaluate AutoPulse by characteriizing the ESP32 micro controller and reproducing an EMFI attack on the execution pipeline. Our key observations imply that the publication of faults and attacks requires careful assessment of the parameter space and the commonly published fault maps strongly depend on process parameters that should be specified.
Fault Injection Attacks (FIAs) pose significant security threats to embedded devices, compromising the security of critical systems. Although the implications of Fault Injection (FI) are well understood for embedded platforms exhibiting Reduced Instruction Set Computer (RISC) architectures, Complex Instruction Set Computer (CISC) platforms have received much less attention in security research. Modern x86 processors employ variable-length instructions spanning 1 to 15 bytes, creating unique vulnerability patterns that remain largely unexplored in existing FI research.We present the first systematic study of Electro-Magnetic Fault Injection (EMFI) attacks against variable-length Instruction Set Architectures (ISAs), highlighting misalignment effects. Our research introduces a novel fault model that demonstrates how strategically induced bit flips in instruction opcodes cause decoder misalignment, ultimately leading to the execution of completely different code sequences. We provide proof-of-concept evidence on Intel N100 hardware, showing how EMFI can transform a NOP instruction sequence into an equivalent-length ADD sequence, demonstrating novel misalignment vulnerabilities specific to variable-length ISAs.
Machine learning and neural networks experience growing usage in resource-constrained devices. However, moving neural networks to small devices also brings new requirements regarding the reliability and security of the networks and their hardware. In many areas, such as autonomous driving, the device must detect possible errors during execution to ensure safe functionality. Moreover, an adversary can gain physical access to the device, opening the door for hardware attacks like fault injections that target misclassification or parameter retrieval. This work proposes a fault detection mechanism for software implementations of neural networks running on a microcontroller to increase the reliability and security of the neural network. Our technique uses AN-codes, a type of error-detecting code, to detect errors in calculations within the neural network without any implications on the accuracy of protected networks. In addition, signature checking ensures the integrity of the control flow. Simulations and real-world testing show that our mechanism successfully detects faults in all possible locations in the neural network’s program code. Despite the robustness of our fault detection mechanism, it has an overhead in code size of only about 10%, independent of the implemented network. The memory usage increases by at most 232 bytes independently of the neural network size, ensuring that the mechanism is not overly burdensome for the memory.
Fault injection attacks pose a critical threat to embedded systems by intentionally inducing hardware-level disturbances that cause unintended program behavior. While software-based tools offer a fast and platform-independent approach for detecting such vulnerabilities, existing instruction set emulation (ISE)-based tools can produce misclassifications due to incomplete system emulation. Moreover, the lack of standardized benchmarks impedes fair evaluation of these tools. In this work, we address these limitations by introducing a rehosting technique that significantly improves the accuracy of ISE-based fault vulnerability detection. Our approach reconstructs memory and register states by executing the target binary in QEMU or native machine, capturing its runtime state, and importing it into the emulator. This enables accurate reproduction of system initialization, including ELF relocations, memory-mapped I/O, and architecture-specific alias regions. We conduct a comprehensive evaluation of seven open-source tools, including the state-of-the-art tool FaultFinder, using the Fault Injection and Simulation Secure Collection (FISSC) dataset and multiple fault models. Compared to the original FaultFinder, our rehosted version eliminates all false negatives related to state initialization and achieves 99%-100% recall while maintaining precision above 88%. Additionally, we construct a labeled benchmark dataset by aggregating and manually verifying the vulnerabilities detected by the tools, which reduces the manual inspection space-originally requiring full instruction coverage-by over 83%. Our findings establish a new baseline for fair and accurate evaluation of software-based fault vulnerability detection tools and demonstrate the effectiveness of rehosting in enhancing emulator fidelity.
In nonce-based authenticated encryption schemes, fault attacks such as differential fault analysis are not applicable to due to the uniqueness of the nonce. In this context, Dobraunig et al. (SAC 2018) showed that Statistical Ineffective Fault Attacks (SIFA) remain applicable and powerful. The authors proposed a SIFA-based attack strategy targeting the initialization in nonce-based authenticated encryption schemes and demonstrated its practicality using a common fault method: instruction skip.In this work, we provide a more in-depth analysis of this attack strategy, with a focus on instruction skip as the fault method. First, we model common instruction skip scenarios in practice and formalize the probability that a fault is ineffective. Our analysis reveals that this probability depends on the instruction type and the device architecture. Notably, we show that it is practically inefficient to obtain a sufficient number of ineffective faults for SIFA when skipping an XOR instruction on 32-bit or 64-bit systems, where register data tends to be uniformly distributed. Second, we prove that, in certain authenticated encryption implementations, the intermediate value targeted by the attack unexpectedly remains unbiased under ineffective faults, making SIFA inapplicable. As a case study, we demonstrate this behavior in an 8-bit Ascon implementation.
