2
$\begingroup$

I am working on an attack that involves changing a constant inside a loop. Consider the simplified example is as below,

For i=1 to n :
    j=constant;
    for i=1 to n':
        Use J here
        .
        .
    exit for;
exit for;

In my case, I don't want to j to get the correct value of constant.

  1. If n is between 60 to 80, how feasible is to mount a fault attack such that j gets 0 (or other small value) instead of the constant?

  2. If it is not possible to do it for all iterations, can I make this happen for some iterations? For simplicity, let's assume that all the compiler optimizations are turned off. Or the code is written in assembly to remove any interference from the compiler.

Please let me know if something is not clear or you need more information. Thanks in advance. :-)

EDIT 1: the Constant is not ZERO. But rather a 32 bit value.

EDIT 2: The platform is a microcontroller. Let's say, Cortex-M0 or Cortex-M4

$\endgroup$
  • 1
    $\begingroup$ I don't think that this can be decided upon with any certainty without hardware details, and fault attacks are all about hardware stuff. What's this running on? The program/memory storage differs significantly between a Xeon motherboard, a FPGA IP core or a tiny smart card... $\endgroup$ – Paul Uszak Apr 8 at 14:54
  • $\begingroup$ @PaulUszak Yes, it's true. Let's consider a microcontroller. For example, Cortex-M0 or Cortex-M4. I have edited the question. $\endgroup$ – Rick Apr 9 at 9:04
  • $\begingroup$ Not confident enough for an answer, but I'll say this - It seems unlikely that you can isolate and change only j with voltage spikes, temperature gradients and pin shorts. By induction (get it?) you'd then be able to alter the entire FOR/NEXT loop. That then leads to whole scale reprogramming of the device, not just crashing it. Ultimately, it ends in completely reprogrammed iPhones, cash machines and all other computer hardware. And we just don't see that in the world about us... $\endgroup$ – Paul Uszak Apr 9 at 14:15
  • $\begingroup$ Also, Cortex aren't hardware are they? They're just software themselves. So fault attacks would still be chiefly governed by the device it's burned into and it's surrounding architecture. $\endgroup$ – Paul Uszak Apr 9 at 14:18
  • 1
    $\begingroup$ @PaulUszak No. The Cortex-M series is a series of ARM processor cores (i.e. hardware). $\endgroup$ – forest Apr 11 at 5:20
1
$\begingroup$

This is rather implementation dependent.

If this is compiled code (and even slightly optimized), I would expect the compiler to perform 'constant propagation'; that is, it would notice that j always has the value of zero, and so remove j (and effectively replace all instances with 0); of course, those 0's would be subject to even more optimizations (for example, a statement of t := t + j may end up being omitted entirely).

If this is interpreted code, well, it might be possible (albeit unlikely); the interpreter would most likely place a 0 in the place where the current 'j' value resides; you might be able to disrupt that write and have it write another value (without disrupting anything else the interpreter is doing); I can't think that'd happen that often.

If it's JIT (just in time compiled) code, well, it's even more complex; you might disrupt the compilation process (that is, when the JIT compiler reads it, it reads something other than j = 0, and compiles it accordingly), or you might disrupt the execution process (which, depending on how much the JIT compiler tries to optimize, might look like either of the above two cases).

However, even at the best, I would be skeptical about the practicality of introducing a fault that has the sole affect of modifying j, and has no other changes.

$\endgroup$
  • $\begingroup$ Thank you for your comment. I am sorry but I think there is a small misunderstanding. J is not ZERO initially. I want to make j to zero or small number by introducing faults. As these faults will occur in runtime the compiler cannot perform optimizations. $\endgroup$ – Rick Apr 8 at 14:25
  • $\begingroup$ @Rick: actually, if this is compiled code, the compiler will have already done optimizations (and the faults will need to be injected on the optimized code) - if that is the case, how the optimizer transforms the code is quite relevant. $\endgroup$ – poncho Apr 8 at 15:02
  • $\begingroup$ For simplicity let's say we turn off all the optimization option for the compiler. Or, we have written the code in assembly such that there is optimization from the compiler. My concern is whether it is possible to inject faults inside a loop. $\endgroup$ – Rick Apr 9 at 9:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.