SRAM Has No Chill: Exploiting Power Domain Separation to Steal On-Chip Secrets

https://cacm.acm.org/research-highlights/sram-has-no-chill-exploiting-power-domain-separation-to-steal-on-chip-secrets/

by zdw • 12 months ago

71 25 12 months ago

cacm.acm.org

Gualdrapo• 12 months ago

Oh, that SRAM. I once again forgot about the other SRAM and was imagining Bauke Mollema going through HN, reading this and cursing them one more time.

[0] https://www.youtube.com/watch?v=Tsk3zAZyLaQ

cycomanic• 12 months ago

Ha, I was trying to parse the headline thinking about the same SRAM.

davidw• 12 months ago

Or Andy Schleck https://www.youtube.com/shorts/fRWHIKE-aHM

and I'm in the same boat. Or bike, as it were, what with hours of watching the Tour this month.

NoPicklez2• 12 months ago

I'm pretty upset the tour has finished

motorest4• 12 months ago

I don't know why you are being downvoted. I also clicked on the link expecting another article on exploits being found on cycling gear. Last week I posted one about Shimano. The top comment was a joke about SRAM.

https://news.ycombinator.com/item?id=44614837

NoPicklez2• 12 months ago

I immediately thought it was cycling SRAM as well, thinking it was related to a post I saw once where Shimano's Di2 was vulnerable to attack

Scoundreller2• 12 months ago

Cool article;

Layman’s article: https://cacm.acm.org/research-highlights/technical-perspecti...

Also seems like ACM republished the author’s paper from 2022? https://dl.acm.org/doi/pdf/10.1145/3503222.3507710

My summary:

DRAM is not a safe place to store your secrets due to cold boots, so it gets stored in SRAM (which includes registers and L1/L2 cache) instead.

Buuuuut, you might be able to dump SRAM across boots with this technique.

If I understand correctly: SRAM/cache/registers all require a lower voltage to maintain their state than the cpu requires to run.

So attach that intermediate voltage on the VCC pin closest to/running the SRAM and pull the plug on everything else. I guess they’re either not cross-connected internally or the choice of voltage stops that from being a problem. Just don’t let your voltage sag lower than required to maintain the SRAM.

Now your cache/registers/SRAM are maintained. Power up with JTAG or a custom/debugging bootrom/mode that hopefully doesn’t overwrite much/any and dump away.

Our experiments across various devices reveal that hardware SRAM resets during boot are uncommon. Most boot with undefined SRAM states, persisting until overwritten by software.

Oops.

ajb2• 12 months ago

Chips often have multiple VCC pins exactly because otherwise there is voltage drop across the chip. This is a hard problem. For chips where this is a security issue, I guess one answer may be to do voltage distribution on the interposer, since fewer attackers can deal with a raw die.

Scoundreller2• 12 months ago

If I understood the article correctly; the different on-chip elements have separate power supplies.

Makes sense: you might want to turn off the CPU but keep the SRAM/cache/etc running for hibernation, and that’s controlled externally for some reason (?)

nine_k• 12 months ago

Put a pair of large MOSFETs at the power line that leads to the SRAM on the crystal; force-connect it to ground on reset or CPU power-up.

hulitu• 12 months ago

So attach that intermediate voltage on the VCC pin closest to/running the SRAM and pull the plug on everything else.

Isn't easier to just read the password from the hard drive ? You already have access.

alex-robbins• 12 months ago

The use case for this is similar to the cold boot attack, e.g. disk is encrypted but memory is not. (And I don't know how encrypted DRAM works, but I wouldn't be surprised if some implementations put the key in SRAM that can be dumped using this technique.) Anyway, there may be valuable secrets that exist in SRAM but but not on disk.

https://en.wikipedia.org/wiki/Cold_boot_attack

serendipitous• 12 months ago

Now your cache/registers/SRAM are maintained. Power up with JTAG or a custom/debugging bootrom/mode that hopefully doesn’t overwrite much/any and dump away.

If you care about security, you'd be disabling these. Every product I've worked on disables JTAG and other debug features on production boards and enables secure boot.

userbinator• 12 months ago

This looks like another extremely obscure attack vector which is largely leveraged only to secure devices against their rightful owners.

Physical access to these devices leads to a wide range of security exploits

Physical ownership = real ownership. That's how it's always been and should've stayed that way, if it weren't for the greedy megacorps. Valid exceptions to this level of paranoia are state secrets and other military-adjacent applications.

motorest4• 12 months ago

Physical ownership = real ownership. That's how it's always been and should've stayed that way, if it weren't for the greedy megacorps.

Playing devil's advocate, what are your security expectation when someone steals your device? Is it acceptable that they immediately gain control of all services available through your them, such as email address, bank accounts, and investment portfolios?

dataflow2• 12 months ago

Playing devil's advocate, what are your security expectation when someone steals your device? Is it acceptable that they immediately gain control of all services available through your them, such as email address, bank accounts, and investment portfolios?

Legally they have no right to anything. Physically, they access whatever they access. That's how it's been forever. I don't get the point of the question.

MattPalmer1086• 12 months ago

It's an attack vector that means some of the protection you thought you had if your device is lost or stolen can be bypassed.

You seem to feel there is no benefit to this protection (from non-owners of the device), and instead is protecting the device from the owner. Would you care to expand on that?

ACCount36• 12 months ago

DRM keys.

This is exactly the kind of attack that's used to extract DRM keys, which are normally made completely inaccessible to the user by malicious device vendors.

SRAM Has No Chill: Exploiting Power Domain Separation to Steal On-Chip Secrets

Related Stories