Fault Injection Workshop at DEF CON

The Embedded Systems Village invited us back to DEF CON to teach hundreds of visitors the basics of voltage glitching. Unlike traditional workshops that require dedicated time slots, we just gave attendees the hardware and provided video instructions via our course platform hextree.io. This way, we could scale the teaching to a much larger crowd.

Fault Injection

In our self-paced workshop, participants would learn the basics of voltage glitching, which is a type of fault injection where you take away the power supply to a chip for a very short moment. The glitch has to be short enough not to reset the target chip, but long enough to cause miscalculations due to transistors inside the chip not operating correctly. If this is targeted at very precise moments, like a security check, it can be used to skip over those checks.

For the attack, we have designed our own fault injection tool called Faultier. It’s based on the Raspberry Pi Pico, and with some clever use of the PIO feature, it’s possible to achieve up to 4 ns of precision when glitching. This is plenty for lots of real targets such as the Apple AirTag. To perform the glitch on the Apple AirTag, you have to solder very small wires. So for our lab, we designed the Glitch Tag, which uses the same nRF52832 chip. This board makes it more convenient to connect the wires for the workshop, but the attendees perform the real attack used on the original AirTag to dump the firmware.

Returning to DEF CON

We have been running the self-paced workshop booth at DEF CON for the past three years now. And every year, we get new data on where participants are struggling, which allows us to improve our instructions and teaching methodologies.

Despite doing it for the third year in a row, the number of people doing the lab has remained constant. This shows us that there are still a lot of people with an interest in learning hardware hacking.

Thanks so much to everybody who came by, and we hope to see you apply what you learned to other chips and devices.

Learn Fault Injection Online

If you want to practice fault injection yourself, you can use the same Faultier and Glitch Tag from our workshop. Both are available from our partner 1bitsquared, with buying options for the US and EU on each product page.

If you would also like to go through the self-paced courses, start with our Introduction to Fault Injection, then try glitching the nRF52’s APPROTECT protection. The hardware works independently of the courses, and course access is separate from the hardware purchase.