Description
Side-Channel Based Disassembly (SCBD) is a category of Side-Channel Analysis (SCA) that aims at recovering information on the code executed by a processor through the observation of physical side-channels such as power consumption or electromagnetic radiations. While traditional SCA often targets cryptographic keys, SCBD focuses on retrieving assembly code that can hardly be extracted via other means. A typical example is bootloader code, which is the first program executed by a processor at a device startup. Finding vulnerabilities in bootloader code could allow an attacker to compromise the entire device. SCBD has been shown feasible on microcontrollers with simple microachitectural complexity and small Instruction Sets Architecture (ISA). However, as System-on-Chips (SoCs) become ubiquitous in various systems such as smartphones, automotive or avionics, the threat posed by SCBD on these devices needs to be evaluated. In this presentation, we investigate the feasibility of SCBD on SoCs. We first study the impact of the microachitectural complexity of SoC's processors on existing SCBD techniques. This brings us to the observation that the latter struggle to provide accurate predictions on small-scale phenomena, leaving a high amount of uncertainty from an attacker's perspective. However, coarse-grained events, such as accesses to the main memory, can be accurately distinguished. In the second part of this presentation, we deal with the uncertainty inherent to SCBD on SoCs by developing a generic and flexible Soft-Analytical Side-Channel Attack (SASCA) framework. This tool leverages factor graphs and the Belief Propagation (BP) algorithm to efficiently handle probabilistic information. This framework allows us to introduce the concept of Soft-Analytical Side-Channel Based Disassembly (SASCBD), which leverages the aforementioned framework to efficiently aggregate imperfect predictions from SCBD. This new approach efficiently exploits the structure of ISA and supports the addition of rich knowledge, such as behaviors at the scale of full programs.
Practical infos
Next sessions
-
Covert Communication Channels Based On Hardware Trojans: Open-Source Dataset and AI-Based Detection
Speaker : Alan Díaz Rizo - Sorbonne Université Lip6
The threat of Hardware Trojan-based Covert Channels (HT-CCs) presents a significant challenge to the security of wireless communications. In this work, we generate in hardware and make open-source a dataset for various HT-CC scenarios. The dataset represents transmissions from a HT-infected RF transceiver hiding a CC that leaks information. It encompasses a wide range of signal impairments, noise[…]-
SemSecuElec
-
Machine learning
-
Hardware trojan
-
-
Measurement the thermal component of clock jitter used as entropy source by TRNGs
Speaker : Arturo GARAY - STMicroelectronics
Introduction Measuring the thermal component of clock jitter as an entropy source for True Random Number Generators (TRNGs) is compulsory for the security and evaluation of clock-jitter based TRNGs. However, identifying and isolating the local thermal noise component from other noise sources, particularly flicker noise, while performing a precise measurement remains a challenge. Current[…]-
SemSecuElec
-
TRNG
-
-
Cryptanalytical extraction of complex Neural Networks in black-box settings
Speaker : Benoit COQUERET - INRIA, Thales CESTI
With the widespread development of artifical intelligence, Deep Neural Networks (DNN) have become valuable intellectual property (IP). In the past few years, software and hardware-based attacks targetting at the weights of the DNN have been introduced allowing potential attacker to gain access to a near-perfect copy of the victim's model. However, these attacks either fail against more complex[…]-
SemSecuElec
-
Side-channel
-
Machine learning
-