Hacker cracks Raspberry Pi's RP2350 secure boot with a €30 engraving tool and a laser
Laser Fault Injection on a Budget: RP2350 Edition
Raspberry Pi's RP2350 Hacking Challenge asked researchers to extract a secret from a locked-down Pico 2. After deciding voltage glitching was no match for the chip's glitch detectors, the author built a budget laser fault injection platform: the die backside is exposed with a cheap rotary tool, mounted on custom boards costing under €25, and hit with a focused infrared beam. A single well-timed fault bypasses Secure Boot and leaks the secret.
The idea behind LFI is reasonably simple: a focused laser beam is directed at the silicon die of the target component, and the emitted light can be enough to induce temporary faults or malfunctions.
- PowerElectronix
The GaN hemt would make sense for a second board iteration where you drive the 75V straight through the diode with a very short (variable) pulse like in this EPC reference design:
https://epc-co.com/epc/products/evaluation-boards/epc9172
That way the 1.4 Ohm resistor doesn't eat like 60-80% of the energy (40amps drop around 60V for an instant 240W in the resistor vs the foward voltage of the diode which is like 1.5V or so for the 60W peak).
- SubiculumCode
I did not know that about laser fault injection, at all. What practical uses has this technique found? Analysis of foreign military hardware? Cracking into secured systems?
- crtasm
Just watched a talk on this topic from last December:
https://media.ccc.de/v/39c3-of-boot-vectors-and-double-glitc...