JTAG Fault Injection Attack

Fabien Majeric (1, 2) , Benoit Gonzalvo (1, 2) , Lilian Bossuet (2)

1 GEMALTO - GEMALTO
2 LHC - Laboratoire Hubert Curien

Fault injection attacks are widespread in the domain of smart cards and microcontrollers but have not been yet democratized on complex embedded microprocessors such as systems-on-chip (SoC) that can be found in smart phones, tablets and automotive systems. The main explanation is the difficulty involved in injecting a fault at the right place and at the right time to make these attacks effective on such devices. However for development and debugging, these devices provide new tools that could be considered as possibly enabling attacks. One such tool, the JTAG debug tool is present on most electronic devices today. In this paper, we present the first fault injection attack based on JTAG. Using the example of a privilege escalation attack, we detail how this tool can be used either to check the feasibility of this attack by fault injection or to perform an actual attack.

Mots clés: JTAG; SoC; fault injection attack

Domaines: Electronique

Fabien Majeric, Benoit Gonzalvo, Lilian Bossuet. JTAG Fault Injection Attack. IEEE Embedded Systems Letters, 2018, 10 (3), pp.65-68. ⟨10.1109/LES.2017.2771206⟩. ⟨hal-01632975⟩