Physical tampering techniques are composed of three main families from non-invasive (clock and VCC glitches, side channel analysis, etc) and semi-invasive (laser fault injection, photo-emission, etc) to fully-invasive methods requiring the use of equipments such as deprocessing tools, Scanning Electron Microscope, Focused Ion Beam, etc.
The latter class is known to be the most potent. On top of that, it also often brings sufficient knowledge about the target for the creation of easier-to-perform methods (non- and semi-invasive) to exploit weaknesses found in the embedded firmware and the hardware itself.
This training is designed to give to Integrated Circuit professionals as well as newcomers a deep understanding of the complete Reverse-Engineering and Exploitation chain for various purposes such as building more secure designs, choosing the right device for a given application, improving the security risk assessment by taking the embedded firmware into consideration but also to find vulnerabilities in « Secure Elements » so as to conduct forensics analysis.
Students who complete this course will be familiar with all important classes of low-level hardware attacks (shield and hardware counter-measures bypass – ROM and Flash/EEPROM dump – bus passive and active probing – …) through real world examples covering the entire analysis workflow from the lab to the data analysis.
An introduction to non- and semi-invasive attacks will be given so as to be able to exploit the results of the IC RE and code dump results.
This training will be a mixture of theoretical lectures and practical assignments which will give the attendees all the key knowledge to perform such complete hardware + software analysis to reach their specific needs from in depth security evaluation to forensics data extraction.
When it comes to encrypted devices, one may want to gather embedded evidences while another would like to be able to check if a hardware backdoor is present or if the component and / or its embedded firmware (boot ROM / user code) contain intrinsic breaches, that could be exploited by a pirate.
• Integrated Circuits Structure • Transistors, CMOS logic and associated weaknesses • Digital logic and Memories • Failure Analysis and Reverse-Engineering Methods • Embedded Firmware and Secret Data Dump: ROM & Flash Dump > Analytical and Invasive ROM Dumps > Linear Code Extraction Based Methods • Automating the Entire Process • How to use the RE and code extraction results • Using scripting language to extract useful information • Writing VHDL model to simulate part of the circuit • Choosing the right types of attacks for a given study • Non-, semi- and fully invasive attacks with a focus on the latter • RE based attacks