Combined fault injection and real-time side-channel analysis for Android Secure-Boot bypassing - Archive ouverte HAL Access content directly
Journal Articles Lecture Notes in Computer Science Year : 2023

Combined fault injection and real-time side-channel analysis for Android Secure-Boot bypassing

Abstract

The Secure-Boot is a critical security feature in modern devices based on System-on-Chips (SoC). It ensures the authenticity and integrity of the code before its execution, avoiding the SoC to run malicious code. To the best of our knowledge, this paper presents the first bypass of an Android Secure-Boot by using an Electromagnetic Fault Injection (EMFI). Two hardware characterization methods are combined to conduct this experiment. A real-time Side-Channel Analysis (SCA) is used to synchronize an EMFI during the Linux Kernel authentication step of the Android Secure-Boot of a smartphone-grade SoC. This new synchronization method is called Synchronization by Frequency Detection (SFD). It is based on the detection of the activation of a characteristic frequency in the target electromagnetic emanations. In this work we present a proof-of-concept of this new triggering method. By triggering the attack upon the activation of this characteristic frequency, we successfully bypassed this security feature, effectively running Android OS with a compromised Linux Kernel with one success every 15 minutes.
Fichier principal
Vignette du fichier
Combined_FI_and_Real-Time_SCA_for_Android_Secure-Boot_Bypassing.pdf (13.14 Mo) Télécharger le fichier
Origin Files produced by the author(s)

Dates and versions

cea-04536513 , version 1 (08-04-2024)

Identifiers

Cite

Clément Fanjas, Clément Gaine, Driss Aboulkassimi, Simon Pontié, Olivier Potin. Combined fault injection and real-time side-channel analysis for Android Secure-Boot bypassing. Lecture Notes in Computer Science, 2023, 13820, pp.25-44. ⟨10.1007/978-3-031-25319-5_2⟩. ⟨cea-04536513⟩
19 View
20 Download

Altmetric

Share

Gmail Mastodon Facebook X LinkedIn More