Combined fault injection and real-time side-channel analysis for Android Secure-Boot bypassing

Clément Fanjas (1) , Clément Gaine (1) , Driss Aboulkassimi (1) , Simon Pontié (1) , Olivier Potin (2)

1 CEA-LETI - Commissariat à l'énergie atomique et aux énergies alternatives - Laboratoire d'Electronique et de Technologie de l'Information
2 Mines Saint-Étienne MSE - École des Mines de Saint-Étienne

The Secure-Boot is a critical security feature in modern devices based on System-on-Chips (SoC). It ensures the authenticity and integrity of the code before its execution, avoiding the SoC to run malicious code. To the best of our knowledge, this paper presents the first bypass of an Android Secure-Boot by using an Electromagnetic Fault Injection (EMFI). Two hardware characterization methods are combined to conduct this experiment. A real-time Side-Channel Analysis (SCA) is used to synchronize an EMFI during the Linux Kernel authentication step of the Android Secure-Boot of a smartphone-grade SoC. This new synchronization method is called Synchronization by Frequency Detection (SFD). It is based on the detection of the activation of a characteristic frequency in the target electromagnetic emanations. In this work we present a proof-of-concept of this new triggering method. By triggering the attack upon the activation of this characteristic frequency, we successfully bypassed this security feature, effectively running Android OS with a compromised Linux Kernel with one success every 15 minutes.

Mots clés: Secure-boot; Synchronization; Frequency detection; Fault injection

Domaines: Electronique; Architectures Matérielles [cs.AR]; Cryptographie et sécurité [cs.CR]; Systèmes embarqués; Système d'exploitation [cs.OS]; Micro et nanotechnologies/Microélectronique; Electronique

Clément Fanjas, Clément Gaine, Driss Aboulkassimi, Simon Pontié, Olivier Potin. Combined fault injection and real-time side-channel analysis for Android Secure-Boot bypassing. Lecture Notes in Computer Science, 2023, 13820, pp.25-44. ⟨10.1007/978-3-031-25319-5_2⟩. ⟨cea-04536513⟩