BAM BAM!! On Reliability of EMFI for in-situ Automotive ECU Attacks

Sun, 08 Nov 2020 21:50:11 +0000

This post is a summary of some work on an accepted paper for ESCAR EU 2020. This work was demonstration on certain NXP chips & GM ECUs, but the idea of both the attack & understanding how portable results are is applicable across the entire domain.

NOTE TO CAR TUNERS: I won’t perform this for hire on your ECU, please don’t email me asking this. The cost for me to do this type of work under hire would also be many times the HPTuners fee, and without any of of the actual tuning interface (I’m only attacking the bootloader, I never ever built a reflash tool that would be needed, yet alone the mapping work etc).

Glitching Trezor using EMFI Through The Enclosure

Wed, 06 Mar 2019 15:13:45 +0000

As mentioned on the Trezor blog post, their latest security patch fixes a flaw I disclosed to them in Jan 2019. This flaw meant an attacker with physical access to the wallet can find the recovery seed stored in FLASH, and leave no evidence of tampering.

This work was heavily inspired by the wallet.fail disclosure - I’m directly dumping FLASH instead of forcing the flash erase then dumping from SRAM, so the results are the same but with a different path. It also has the same limitations - if you used a password protected recovery seed you can’t dump that.

Emfi on Colin O'Flynn

BAM BAM!! On Reliability of EMFI for in-situ Automotive ECU Attacks

Glitching Trezor using EMFI Through The Enclosure