Ledger Donjon Bypasses RP2350 Security with Laser Fault Injection
Ledger Donjon researchers successfully bypassed the security features of the Raspberry Pi RP2350 microcontroller using a laser fault injection attack. By targeting a specific register on the chip's die, they re-enabled debug access to the secure execution zone and extracted a 128-bit secret key. The attack required a specialized bench setup costing approximately 250,000 USD and involved decapping the chip to locate the target via photon-emission electron microscopy.
Key points
- The RP2350 chip features secure boot, ARMv8 TrustZone, and glitch detection to prevent traditional physical attacks.
- Ledger Donjon used a laser to flip bits in a specific register, restoring debug access to the secure zone.
- The attack required decapping the chip and using photon-emission electron microscopy to locate the target register.
- After resetting the chip, the team successfully read a 128-bit secret key hidden in memory.
- The specialized bench equipment used for the attack cost approximately 250,000 USD.
Background
This incident highlights the ongoing challenge of securing microcontrollers against physical attacks. While the RP2350 includes advanced protections like glitch detection, which thwarts simpler voltage glitching attacks, it remains vulnerable to more sophisticated techniques like laser fault injection. Previous coverage of laser communication, such as China's Earth-Moon laser link, demonstrates the precision and power of laser technology, which can be repurposed for hardware security breaches.
Why it matters
This breach demonstrates that even chips with robust security features like secure boot and glitch detection can be compromised by determined attackers with significant resources. It underscores the importance of designing hardware with physical attack resistance in mind, as software-level security alone may not be sufficient. The success of this attack could influence future chip designs to include more complex encoding for debug registers to prevent similar bypasses.
What to watch
Future iterations of the RP series may incorporate more complex register encodings, such as requiring specific bit patterns like '01' to enable debug, making laser attacks harder. Additionally, manufacturers may increase the number of debug-blocking registers to raise the barrier for physical attacks. This incident may also prompt further research into hardware security and the development of more resilient microcontrollers.
Want the full story? Read the original reporting
Read on Hackaday