Abstract:Voltage Fault Injection (VFI), also known as power glitching, has proven to be a severe threat to real-world systems. In VFI attacks, the adversary disturbs the power-supply of the target-device forcing the device to illegitimate behavior. Various countermeasures have been proposed to address different types of fault injection attacks at different abstraction layers, either requiring to modify the underlying hardware or software/firmware at the machine instruction level. Moreover, only recently, individual chip manufacturers have started to respond to this threat by integrating countermeasures in their products. Generally, these countermeasures aim at protecting against single fault injection (SFI) attacks, since Multiple Fault Injection (MFI) is believed to be challenging and sometimes even impractical. In this paper, we present {\mu}-Glitch, the first Voltage Fault Injection (VFI) platform which is capable of injecting multiple, coordinated voltage faults into a target device, requiring only a single trigger signal. We provide a novel flow for Multiple Voltage Fault Injection (MVFI) attacks to significantly reduce the search complexity for fault parameters, as the search space increases exponentially with each additional fault injection. We evaluate and showcase the effectiveness and practicality of our attack platform on four real-world chips, featuring TrustZone-M: The first two have interdependent backchecking mechanisms, while the second two have additionally integrated countermeasures against fault injection. Our evaluation revealed that {\mu}-Glitch can successfully inject four consecutive faults within an average time of one day. Finally, we discuss potential countermeasures to mitigate VFI attacks and additionally propose two novel attack scenarios for MVFI.

Experimental evaluation of two software countermeasures against fault attacks

Electromagnetic fault injection: towards a fault model on a 32-bit microcontroller

Electromagnetic fault injection against a System-on-Chip, toward new micro-architectural fault models

A Micro Architectural Events Aware Real-Time Embedded System Fault Injector

Software countermeasures against the multiple instructions skip fault model

Fault Injection on Embedded Neural Networks: Impact of a Single Instruction Skip

Node Monitoring as a Fault Detection Countermeasure against Information Leakage within a RISC-V Microprocessor

Against Double Fault Attacks: Injection Effort Model, Space and Time Randomization Based Countermeasures for Reconfigurable Array Architecture

Cross-layer analysis of clock glitch fault injection while fetching variable-length instructions

Self-Assertion-Based Countermeasures Within a RISC-V Microprocessor for Coverage of Information Leakage Faults

Countermeasures Against High-Order Fault-Injection Attacks on CRT-RSA

Fault Injection Attacks Utilizing Waveform Pattern Matching against Neural Networks Processing on Microcontroller

Rewrite to Reinforce: Rewriting the Binary to Apply Countermeasures against Fault Injection

Fiddling the Twiddle Constants - Fault Injection Analysis of the Number Theoretic Transform.

FaultMorse: an Automated Controlled-Channel Attack Via Longest Recurring Sequence

Faulting original McEliece's implementations is possible: How to mitigate this risk?

Bypassing Isolated Execution on RISC-V using Side-Channel-Assisted Fault-Injection and Its Countermeasure

Novel Fault Injection Attack without Artificial Trigger

MAFIA: Protecting the Microarchitecture of Embedded Systems Against Fault Injection Attacks

A Hierarchical Fault Injection System for RISC-V Processors Targeting Single Event Upsets in Flip-Flops

Oops..! I Glitched It Again! How to Multi-Glitch the Glitching-Protections on ARM TrustZone-M