book

The Hardware Hacking Handbook

Name: The Hardware Hacking Handbook
Author: Colin O'Flynn
ISBN: 9781593278748

by Colin O'Flynn

December 2021

Intermediate to advanced

300 pages

15h 39m

English

No Starch Press

Read now

Unlock full access

Title Page
Copyright
Dedication
About the Authors
Foreword
Acknowledgments
Introduction
What Embedded Devices Look LikeWays of Hacking Embedded DevicesWhat Does Hardware Attack Mean?Who Should Read This Book?About This Book
Chapter 1: Dental Hygiene: Introduction to Embedded Security
Hardware ComponentsSoftware ComponentsInitial Boot CodeBootloaderTrusted Execution Environment OS and Trusted ApplicationsFirmware ImagesMain Operating System Kernel and ApplicationsHardware Threat ModelingWhat Is Security?The Attack TreeProfiling the AttackersTypes of AttacksSoftware Attacks on HardwarePCB-Level AttacksLogical AttacksNoninvasive AttacksChip-Invasive AttacksAssets and Security ObjectivesConfidentiality and Integrity of Binary CodeConfidentiality and Integrity of KeysRemote Boot AttestationConfidentiality and Integrity of Personally Identifiable InformationSensor Data Integrity and ConfidentialityContent Confidentiality ProtectionSafety and ResilienceCountermeasuresProtectDetectRespondAn Attack Tree ExampleIdentification vs. ExploitationScalabilityAnalyzing the Attack TreeScoring Hardware Attack PathsDisclosing Security IssuesSummary
Chapter 2: Reaching Out, Touching Me, Touching You: Hardware Peripheral Interfaces
Electricity BasicsVoltageCurrentResistanceOhm’s LawAC/DCPicking Apart ResistancePowerInterface with ElectricityLogic LevelsHigh Impedance, Pullups, and PulldownsPush-Pull vs. Tristate vs. Open Collector or Open DrainAsynchronous vs. Synchronous vs. Embedded ClockDifferential SignalingLow-Speed Serial InterfacesUniversal Asynchronous Receiver/Transmitter SerialSerial Peripheral InterfaceInter-IC InterfaceSecure Digital Input/Output and Embedded Multimedia CardsCAN BusJTAG and Other Debugging InterfacesParallel InterfacesMemory InterfacesHigh-Speed Serial InterfacesUniversal Serial BusPCI ExpressEthernetMeasurementMultimeter: VoltMultimeter: ContinuityDigital OscilloscopeLogic AnalyzerSummary
Chapter 3: Casing the Joint: Identifying Components and Gathering Information
Information GatheringFederal Communications Commission FilingsPatentsDatasheets and SchematicsInformation Search Example: The USB Armory DeviceOpening the CaseIdentifying ICs on the BoardSmall Leaded Packages: SOIC, SOP, and QFPNo-Lead Packages: SO and QFNBall Grid ArrayChip Scale PackagingDIP, Through-Hole, and OthersSample IC Packages on PCBsIdentifying Other Components on the BoardMapping the PCBUsing the JTAG Boundary Scan for MappingInformation Extraction from the FirmwareObtaining the Firmware ImageAnalyzing the Firmware ImageSummary

Chapter 4: Bull in a Porcelain Shop: Introducing Fault Injection
Faulting Security MechanismsCircumventing Firmware Signature VerificationGaining Access to Locked FunctionalityRecovering Cryptographic KeysAn Exercise in OpenSSH Fault InjectionInjecting Faults into C CodeInjecting Faults into Machine CodeFault Injection BullTarget Device and Fault GoalFault Injector ToolsTarget Preparation and ControlFault Searching MethodsDiscovering Fault PrimitivesSearching for Effective FaultsSearch StrategiesAnalyzing ResultsSummary
Chapter 5: Don’t Lick the Probe: How to Inject Faults
Clock Fault InjectionMetastabilityFault Sensitivity AnalysisLimitationsRequired HardwareClock Fault Injection ParametersVoltage Fault InjectionGenerating Voltage GlitchesBuilding a Switching-Based InjectorCrowbar Injected FaultsRaspberry Pi Fault Attack with a CrowbarVoltage Fault Injection Search ParametersElectromagnetic Fault InjectionGenerating Electromagnetic FaultsArchitectures for Electromagnetic Fault InjectionEMFI Pulse Shapes and WidthsSearch Parameters for Electromagnetic Fault InjectionOptical Fault InjectionChip PreparationFront-Side and Back-Side AttacksLight SourcesOptical Fault Injection SetupOptical Fault Injection Configurable ParametersBody Biasing InjectionParameters for Body Biasing InjectionTriggering Hardware FaultsWorking with Unpredictable Target TimingSummary
Chapter 6: Bench Time: Fault Injection Lab
Act 1: A Simple LoopA BBQ Lighter of PainAct 2: Inserting Useful GlitchesCrowbar Glitching to Fault a Configuration WordMux Fault InjectionAct 3: Differential Fault AnalysisA Bit of RSA MathGetting a Correct Signature from the TargetSummary
Chapter 7: X Marks the Spot: Trezor One Wallet Memory Dump
Trezor One Wallet InternalsUSB Read Request FaultingDisassembling CodeBuilding Firmware and Validating the GlitchUSB Triggering and TimingGlitching Through the CaseSetting UpReviewing the Code for Fault InjectionRunning the CodeConfirming a DumpFine-Tuning the EM PulseTuning Timing Based on USB MessagesSummary
Chapter 8: I’ve Got the Power: Introduction to Power Analysis
Timing AttacksHard Drive Timing AttackPower Measurements for Timing AttacksSimple Power AnalysisApplying SPA to RSAApplying SPA to RSA, ReduxSPA on ECDSA Summary
Chapter 9: Bench Time: Simple Power Analysis
The Home LabBuilding a Basic Hardware SetupBuying a SetupPreparing the Target CodeBuilding the SetupPulling It Together: An SPA AttackPreparing the TargetPreparing the OscilloscopeAnalysis of the SignalScripting the Communication and AnalysisScripting the AttackChipWhisperer-Nano ExampleBuilding and Loading FirmwareA First Glance at the CommunicationCapturing a TraceFrom Trace to AttackSummary
Chapter 10: Splitting the Difference: Differential Power Analysis
Inside the MicrocontrollerChanging the Voltage on a CapacitorFrom Power to Data and BackSexy XORy ExampleDifferential Power Analysis AttackPredicting Power Consumption Using a Leakage AssumptionA DPA Attack in PythonKnow Thy Enemy: An Advanced Encryption Standard Crash CourseAttacking AES-128 Using DPACorrelation Power Analysis AttackCorrelation CoefficientAttacking AES-128 Using CPACommunicating with a Target DeviceOscilloscope Capture SpeedSummary
Chapter 11: Gettin’ Nerdy with It: Advanced Power Analysis
The Main ObstaclesMore Powerful AttacksMeasuring SuccessSuccess Rate–Based MetricsEntropy-Based MetricsCorrelation Peak ProgressionCorrelation Peak HeightMeasurements on Real DevicesDevice OperationThe Measurement ProbeDetermining Sensitive NetsAutomated Probe ScanningOscilloscope SetupTrace Set Analysis and ProcessingAnalysis TechniquesProcessing TechniquesDeep Learning Using Convolutional Neural NetworksSummary
Chapter 12: Bench Time: Differential Power Analysis
Bootloader BackgroundBootloader Communications ProtocolDetails of AES-256 CBCAttacking AES-256Obtaining and Building the Bootloader CodeRunning the Target and Capturing TracesCalculating the CRCCommunicating with the BootloaderCapturing Overview TracesCapturing Detailed TracesAnalysisRound 14 KeyRound 13 KeyRecovering the IVWhat to CaptureGetting the First TraceGetting the Rest of the TracesAnalysisAttacking the SignatureAttack TheoryPower TracesAnalysisAll Four BytesPeeping at the Bootloader Source CodeTiming of Signature CheckSummary
Chapter 13: No Kiddin’: Real-Life Examples
Fault Injection AttacksPlayStation 3 HypervisorXbox 360Power Analysis AttacksPhilips Hue AttackSummary
Chapter 14: Think of the Children: Countermeasures, Certifications, and Goodbytes
CountermeasuresImplementing CountermeasuresVerifying CountermeasuresIndustry CertificationsGetting BetterSummary
Appendix A: Maxing Out Your Credit Card: Setting Up a Test Lab
Checking Connectivity and Voltages: $50 to $500Fine-Pitch Soldering: $50 to $1,500Desoldering Through-Hole: $30 to $500Soldering and Desoldering Surface Mount Devices: $100 to $500Modifying PCBs: $5 to $700Optical Microscopes: $200 to $2,000Photographing Boards: $50 to $2,000Powering Targets: $10 to $1,000Viewing Analog Waveforms (Oscilloscopes): $300 to $25,000Memory DepthSample RateBandwidthOther FeaturesViewing Logic Waveforms: $300 to $8,000Triggering on Serial Buses: $300 to $8,000Decoding Serial Protocols: $50 to $8,000CAN Bus Sniffing and Triggering: $50 to $5,000Ethernet Sniffing: $50Interacting Through JTAG: $20 to $10,000General JTAG and Boundary ScanJTAG DebugPCIe Communication: $100 to $1,000USB Sniffing: $100 to $6,000USB Triggering: $250 to $6,000USB Emulation: $100SPI Flash Connections: $25 to $1,000Power Analysis Measurements: $300 to $50,000Triggering on Analog Waveforms: $3,800+Measuring Magnetic Fields: $25 to $10,000Clock Fault Injection: $100 to $30,000Voltage Fault Injection: $25 to $30,000Electromagnetic Fault Injection: $100 to $50,000Optical Fault Injection: $1,000 to $250,000Positioning Probes: $100 to $50,000Target Devices: $10 to $10,000
Appendix B: All Your Base Are Belong to Us: Popular Pinouts
SPI Flash Pinout0.1-Inch Headers20-Pin Arm JTAG14-Pin PowerPC JTAG0.05-Inch HeadersArm Cortex JTAG/SWDEmber Packet Trace Port Connector
Index

Content preview from The Hardware Hacking Handbook

9 Bench Time: Simple Power Analysis

In this chapter, we’ll introduce a simple laboratory environment that allows you to experiment with some code samples. Rather than attack devices we know nothing about, we’ll start attacking real devices we have on hand in our lab with specific algorithms of our choosing. This practice will allow us to gain experience on these kinds of attacks rather than having to do a lot of guessing of what a “closed” device is up to. First, we’ll walk through the generics of building the simple power analysis (SPA) setup, and then we’ll program an Arduino with an SPA-vulnerable password verification and see whether ...

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.

Read now

Unlock full access

More than 5,000 organizations count on O’Reilly

O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.

Julian F.

Head of Cybersecurity

I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.

Addison B.

Field Engineer

I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.

Amir M.

Data Platform Tech Lead

I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.

Mark W.

Embedded Software Engineer

The Web Application Hacker's Handbook, 2nd Edition

Publisher Resources

ISBN: 9781098129835

Cloud Computing

Data Engineering

Data Science

AI & ML

Programming Languages

Software Architecture

IT/Ops

Security

Design

Business

Soft Skills

The Hardware Hacking Handbook

by Colin O'Flynn

9 Bench Time: Simple Power Analysis

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.