1 of 22

Warping Time: Hardware Hacking Essentials

By me (Zac)

2 of 22

What is hacking

  • What is ~hacking~ to begin with
    • Compromising security through bugs/flaws in technology

​

Professional Attire

Laptop - can work on the go

Keeps identity secret

3 of 22

What is hardware hacking

  • What is hardware hacking in particular tho
    • Focused on the same goal (compromise security)
    • Specifically targeting hardware as our means

​

  • Note:
    • ‘Hardware hacking’ has alternative meaning - modding tech

4 of 22

Compromising security (?) (???)

  • Running your own code
    • Some hardware protects itself from being replaced
  • Hidden functionality
  • Becoming the ‘admin’ for your computer
    • If you get admin on the UNSW computers - wow, ur WAM goes right to 100

5 of 22

Hardware components

  • The parts that make up your computer
  • CPU!
    • The part that runs all code/programs
  • Memory
    • The part that stores info for CPU

​

​

6 of 22

Bugs

  • What does a bug look like? - hardware misbehaving
  • We’d be interested in:
    • Skipping code (e.g an important safety check)
    • Altering memory (e.g health in game)

7 of 22

Fault Injection

  • ‘Fault’ is an error/bug for the hardware
  • ‘Injection’ means we are causing them

​

  • Playing jenga but ur trying to cause a spectacular fall

​

​

8 of 22

CPU jazz

  • CPU executes ‘instructions’
    • Little snippets of code
  • CPU has a clock in it
    • Each time clock ‘ticks’, run an instruction
    • Clock acts as a schedule for the CPU.

​

​

9 of 22

Clock injection

  • Where we replace the CPUs clock with our own (faster) one
  • CPU misbehaves - cant run code in time

Normal Clock

Our (evil) Clock

10 of 22

Clock injection deep-dive!

  • Imagine the calming analogy of a heart attack
  • Clock is the heart of the CPU - each tick as heartbeat
  • Blood (signal) propagates through body (CPU)

11 of 22

Clock injection deep-dive!

  • Injecting our own clock - like an illness
  • Irregular heartbeat - speeding up the clock
  • The body (CPU) cant keep up
  • Malfunctions - skipping instructions

The CPU�(or you in 20 years if you dont eat more vegetables)

12 of 22

Becoming admin in three easy slides

  • What can we do with the CPU not completing instructions?

​

  • Perform a task as admin -> asked for password
  • Boils down to one instruction - compare our input, admin password

Our garbage input

Admin password

13 of 22

Becoming admin in three easy slides

  • Enter garbage input
  • CPU runs code - normally denies us
  • Perform clock injection!

14 of 22

Becoming admin in three easy slides

  • Next instruction starts early
  • Compare ‘still’ happening
  • We lose the compare - essentially skipping it
  • Run command as admin

Becoming admin

Us gaslighting CPU

15 of 22

Fault Injection wrap-up

  • Bugs are CPU misbehaving
  • Fault injection - deliberately trigger misbehaviour
  • Clock injection - speed-up clock, skip instructions

16 of 22

Side channel analysis

  • Hardware has secrets!
    • Think passwords
  • It shouldnt disclose these freely (e.g just tell you passwords)
  • Instead, we use other factors of the hardware to gain info

​

17 of 22

Beating a PIN lock

  • Think of a PIN lock
  • Main ‘channel’ is access - granted or denied
    • Only tells whether whole pin is correct or not

18 of 22

Beating a PIN lock

  • Consider - the scenario:
    • password is 123456 - impossible to guess
    • Code that compares digit by digit

No money for better drip

19 of 22

Timing analysis

  • Input 000000 gets rejected immediately
  • Input 100000 gets rejected slightly later - first digit matched so we compared second digit
  • Repeat for each digit

​

  • Search space shrinks from 1000000 to 60
  • Its really just wordle 4head

20 of 22

Side-channel wrap up

  • ‘Secret’ we want to know
  • Dont cause any misbehaviour
  • Use aspects of hardware to leak information
  • Timing analysis - use time code takes to leak info
  • Beat a PIN lock!

21 of 22

Recap

  • What hardware hacking is
  • Goals of hardware hacking
  • Fault injection
  • Side channel analysis

22 of 22

Resources