Electromagnetic Fault Injection as a New Forensic Approach for SoCs

Clément Gaine (1, 2) , Driss Aboulkassimi (1) , Simon Pontie (1) , Jean-Pierre Nikolovski (1) , Jean-Max Dutertre (3)

1 CEA-LETI - Commissariat à l'énergie atomique et aux énergies alternatives - Laboratoire d'Electronique et de Technologie de l'Information
2 DPACA [Gardanne]
3 ENSM ST-ETIENNE - Ecole Nationale Supérieure des Mines de St Etienne

Smartphones have a complex hardware and software architecture. Having access to their full memory space can help solve judicial investigations. We propose a new privilege escalation technique in order to access hidden contents and execute sensitive operations. While classical forensic tools mostly exploit software vulnerabilities, it is based on a hardware security evaluation technique. Electromagnetic fault injection is such a technique usually used for microcontrollers or FPGA security characterization. A security function running at 1.2 GHz on a 64-bit SoC with a Linux-based OS was successfully attacked. The Linux authentication module uses this function to verify the password correctness by comparing two hash values. Hence, this work constitutes a step towards smartphones privilege escalation through electromagnetic fault injection. This approach is interesting for addressing forensic issues on smartphones.

Mots clés: Electromagnetic Fault Injection; SoC; Forensic; Smartphones

Domaines: Micro et nanotechnologies/Microélectronique; Cryptographie et sécurité [cs.CR]

Clément Gaine, Driss Aboulkassimi, Simon Pontie, Jean-Pierre Nikolovski, Jean-Max Dutertre. Electromagnetic Fault Injection as a New Forensic Approach for SoCs. 2020 IEEE International Workshop on Information Forensics and Security (WIFS), Dec 2020, New York, United States. pp.1-6, ⟨10.1109/WIFS49906.2020.9360902⟩. ⟨cea-03155307⟩