Skill: hardware-side-channel-advanced

Summary

Advanced hardware side-channel attacks covering power analysis (SPA/DPA), electromagnetic emanation, timing attacks, cache-timing attacks (Spectre/Meltdown variants), glitching (voltage/clock), optical fault injection, and countermeasure evaluation.

Tools: garak, PyRIT, promptfoo, custom harnesses

Domain: hardware

MITRE: T1041-Physical Attacks; emerging hardware-specific

Description

Advanced hardware side-channel attacks covering power analysis (SPA/DPA), electromagnetic emanation, timing attacks, cache-timing attacks (Spectre/Meltdown variants), glitching (voltage/clock), optical fault injection, and countermeasure evaluation.

This skill covers the offensive side of side-channel security, including reconnaissance, vulnerability discovery, exploitation, persistence, and reporting. Aligned with OWASP Top 10, MITRE ATT&CK, and industry-specific compliance frameworks.

---

Use Cases

1. Smart card / HSM key extraction: Recover AES/RSA keys via power analysis.
2. SGX enclave attack: Steal secrets from Intel SGX enclaves via cache-timing.
3. Glitching for code execution: Bypass secure boot via voltage glitch.
4. Side-channel evaluation: Assess hardware countermeasures (masking, hiding, dual-rail).
5. Optical fault injection: Inject faults via laser for Differential Fault Analysis (DFA).

---

Core Tools

| ChipWhisperer | Power analysis / glitching | chipwhisperer-capture | | glitchcat | Glitching framework | Various hardware | | sgax | SGX attack framework | SGX side-channel | | Inspector | SCA tool (Riscure) | Commercial | | Picoscope | Oscilloscope for power analysis | Hardware | | H-Probe | EM probe | Hardware | | Laser FI Station | Optical fault injection | Hardware |

---

Methodology

Attack Chain

[1] Reconnaissance        [2] Side-channel Setup     [3] Trace Acquisition
  - Identify chip            - Power measurement       - 10K-1M traces
  - Clock frequency            - EM probe placement      - Triggered on crypto op
  - Power supply             - Glitch injection            |
  - Physical access            |                          v
        |                       v            [4] Statistical Analysis
        v             [2.5] Trigger Setup   - DPA / CPA
[1.5] Countermeasure   - Crypto operation   - Template attacks
  - Masking              identification        - Machine learning
  - Hiding                 |                      |
  - Random delay           v                      v
                          [5] Key Recovery   [6] Reporting
                          - AES key bits    - Countermeasure evaluation
                          - RSA private     - Practical impact
                          - ECC scalar

Defense Perspective

Defense Layer	Measures	Key Points
Masking	Randomize intermediate values; first-order / higher-order masking	Masking breaks correlation between power and data
Hiding	Make power consumption constant (dual-rail logic); randomize execution order	Hiding reduces signal-to-noise ratio
Noise Injection	Add random noise to power supply; dummy operations	Increases traces needed for attack
Physical Tamper Detection	Anti-tamper mesh; light sensors; voltage monitors	Detect physical access attempts
Secure Boot	Verify firmware signature; prevent downgrade	Blocks exploit persistence
Constant-time Implementation	Avoid data-dependent branches; avoid data-dependent memory access	Defeats timing attacks
Cache Partitioning	Per-process cache; CAT (Cache Allocation Technology)	Defeats cache-timing attacks

---

Practical Steps

See payloads.md for detailed payloads and test-cases.md for the complete test checklist.

1. Reconnaissance

Identify target infrastructure; fingerprint products; enumerate attack surface.

2. Vulnerability Discovery

Run automated scanners (garak, PyRIT); manual testing per OWASP Top 10.

3. Exploitation

Chain vulnerabilities for maximum impact; document PoC.

4. Persistence

Establish persistence via configuration changes, scheduled tasks, or backdoors.

5. Reporting

Map findings to MITRE ATT&CK, OWASP, regulatory frameworks; include concrete remediation.

---

Detection Methods

Hardware Attack Indicators

• JTAG/SWD access: Debug interface activity on production hardware.
• Glitch detection: Voltage/clock glitching signatures in power monitoring.
• Side-channel anomalies: Unusual power consumption patterns during crypto operations.
• Physical tamper: Anti-tamper mesh break; chassis intrusion switch activation.

SIEM Detection Rules

• Splunk SPL (IoT): index=iot event_type="jtag_access" | stats count by device_id
• Hardware security modules (HSM): Audit log monitoring for tamper events.
• TPM measurements: Verify boot measurements against golden baseline.

Defense Evasion Techniques

Physical Exploitation Stealth

• Non-invasive attacks first: Use power/clock glitching before invasive (decapping); preserves device.
• Laser fault injection: Use IR laser through backside of die; minimal physical evidence.
• Cold boot attacks: Freeze RAM to preserve keys; minimal trace.
• Glitch detection bypass: Find devices without glitch detectors (older models).

Side-Channel Stealth

• Tolerated side-channels: Use Spectre/Meltdown variant that's "tolerated" (allowed by design).
• Slow acquisition: Pace power analysis over long period; reduces pattern detection.
• Cross-device averaging: Use multiple identical devices; average noise to recover key.

---

Common Pitfalls

• Testing in unauthorized environments
• Ignoring rate limiting (will get blocked)
• Single-shot testing (real attacks are sustained)
• Neglecting supply chain
• Forgetting monitoring/alerting

Reporting and Documentation

Reports should include CVSS scores, MITRE ATT&CK mapping, concrete PoC, business impact, and specific remediation.

Legal and Ethical Considerations

Ensure proper authorization before testing. Document scope in engagement letter. Some attack techniques may violate local laws (e.g., radio transmission without license).

Hacker Laws

Law	Application
Trust but Verify	Verify all outputs; verify all sources
First Principles	Understand underlying protocols before attacking
Defense in Depth	Multiple layers required for robust defense
Assume Breach	Design assuming attacker already inside
Minimize Attack Surface	Reduce unnecessary features/exposure

---

Learning Resources

Skill supplementary files: payloads.md, test-cases.md

External Resources:

• OWASP Top 10
• MITRE ATT&CK
• Industry-specific compliance frameworks