Instructors: Cristofaro Mune
Dates: June 23 to 26 2025
Capacity: 20
Fault Injection is often the weapon of choice for breaking into devices when exploitable software
vulnerabilities are not known or absent. While Fault Injection attacks are nowadays common, typical
concepts,
methodologies, techniques, and attacks are often not sufficiently understood. While achieving success by
simply glitching a target can yield results, it's important to note that this approach alone doesn't
facilitate
the creation of innovative attacks.
In this training, students will experience and appreciate the Art of Fault Injection (TAoFI) to exploit
the full potential of Fault Injection attacks.
This training assumes, though it is not strictly mandatory, that students possess prior experience with
Fault Injection attacks, either obtained at work, at home, or at a previously attended training (e.g.,
from Colin, Joe, or Thomas). Students are encouraged to work together in teams of two, sharing their
experiences, to tackle the challenges together more efficiently. Even though not recommended, students
may work individually as well.
Students will be using advanced techniques to characterize the effects of voltage glitches on the
Espressif ESP32 System-on-Chip (SoC). The faults resulting from these voltage glitches are carefully
analyzed and described to build a thorough understanding of the target’s susceptibility to voltage
glitches. This enables the students to create powerful Fault Injection exploits. During this training,
rather than focusing on a specific
set of tools, the students will focus more on the concepts, methodologies, techniques, and attacks
relevant to Fault Injection attacks.
Students will experience, with guidance from experts, performing real-world Fault Injection attacks,
that were either disclosed by Raelize or other security researchers. Students will be using the NewAE
ChipWhisperer-Husky, typical hardware lab tooling like an oscilloscope and a hardware debugger. Students
are provided with a virtual machine (VM) with all the required tooling installed, as well as access to
the
required hardware.
Upon completing the training, students will be proficient in executing sophisticated Fault Injection
attacks
on real-world targets using commercially available tooling. The knowledge gained from understanding the
underlying concepts, methodologies, techniques, and attacks, can be used by the students to perform
novel
Fault Injection attacks on other targets of interest.
The course is 75% practical exercises and 25% presentations. Most exercises are use a custom development
board based on the Espressif ESP32 System-on-Chip (SoC).
This training starts by building up a solid understanding of the typical concepts and methodologies used
in Fault Injection. Then, students dive straight into advanced techniques and attacks used in Fault
Injection exploits.
Important: The required tooling is only tested on x86-64-based systems. ARM based systems (e.g., Apple
Silicon M1, M2 or M3), or systems based on other architectures, are not supported.
Note, that the Fault Injection tooling will be attached to the VM that Raelize provides. Please, make
sure that forwarding different types of USB devices to the VM works as expected. In our experience, this
works best using VMware products (e.g., VMware Workstation Player).
The students of this training are expected to bring a modern x86-64 based laptop or workstation:
Click here to register.