Intro to Electromagnetic Fault Injection (EMFI) Attacks

A Beginner-Friendly Introduction to Fault Injection Attacks: Demystifying Electromagnetic Fault Injection (EMFI)

Table of Contents

• Introduction to Fault Injection Attacks
• What is Electromagnetic Fault Injection (EMFI)?
• How EMFI Works: From Theory to Practice
  • Understanding Electromagnetic Interference
  • EMFI Impact on Integrated Circuits (ICs)
• A Compact EMFI Setup: Components and Assembly
  • Required Equipment
  • Typical Setup Diagram
  • Safety Considerations
• EMFI in Action: Real-World Attack Scenarios
  • Case Study 1: Extracting Cryptographic Keys
  • Case Study 2: Fault Attacks on Secure Microcontrollers
  • Case Study 3: EMFI on Embedded System-on-Chip (SoC)
• Detecting Vulnerabilities Using EMFI
  • Scanning for Fault Response
  • Automating Fault Injection Testing with Python and Bash
• Mitigating Fault Injection Attacks: Defensive Measures
• Advancing Your Knowledge: Resources and Community
• Conclusion
• References

Introduction to Fault Injection Attacks

Fault Injection Attacks are a class of hardware attacks wherein an adversary intentionally induces errors (faults) in the functioning of a device, with the goal of bypassing security checks, extracting sensitive data, or generally undermining the trustworthiness of a system. This technique is especially relevant with the proliferation of secure applications running on embedded systems—from smart cards to IoT devices.

Fault injections can be performed using various methods:

• Voltage/Clock Glitching
• Laser Fault Injection
• Electromagnetic Fault Injection (EMFI)
• Temperature/Environmental Manipulation

Among these, EMFI stands out as a flexible, contactless technique, leveraging short pulses of electromagnetic (EM) energy to disrupt targeted regions of silicon, leading to transient faults. This post focuses on EMFI as used in cybersecurity research and practical attacks.

What is Electromagnetic Fault Injection (EMFI)?

Electromagnetic Fault Injection (EMFI) is an advanced technique in which a controlled burst of electromagnetic energy is directed at a specific part of an integrated circuit (IC) or microcontroller. The intention is to disturb the device’s correct operation by inducing faults, such as bit flips, timing violations, or instruction skips.

Key Characteristics:

• Non-invasive: No need to open the package or physically contact internal silicon.
• Precise: Can target specific functional units inside a chip (e.g., CPU core, I/O).
• Repeatable: Proper setups can allow for consistent, reproducible fault injection.
• Powerful: Especially potent against chips with security features like secure boot, cryptographic engines, or tamper resistance.

Concept Overview

Figure: Principle of Electromagnetic Fault Injection (simplified)

The EMFI technique typically:

• Uses a coil-based probe (homemade or commercial) to concentrate EM fields.
• Employs an EM pulse generator to generate nanosecond-scale high-voltage pulses.
• Synchronizes with the system clock to maximize the probability of causing meaningful faults during sensitive computation phases.

Source: arXiv:2509.18341v1, Ledger Blog on Compact EMFI

How EMFI Works: From Theory to Practice

Understanding Electromagnetic Interference

Electromagnetic Interference (EMI) occurs when an external electromagnetic field perturbs the normal operation of electronic circuits. In the context of fault injection, the attack is focused, intentional, and highly controlled.

Physics behind EMFI:

• Maxwell’s equations dictate how EM fields propagate and interact with materials.
• Fast, high-energy transients induce unwanted currents in victim circuitry.
• In digital systems, these can cause voltage (or current) surges at critical gates or memory cells at precise moments, causing faults.

EMFI Impact on Integrated Circuits (ICs)

When a carefully crafted EM pulse is fired at a device, several attack effects are possible:

• Timing Violations: Data is not latched correctly, or control sequences go out of order.
• Instruction Skipping: CPU inadvertently skips instructions.
• Bit Flips: Bits in memory or registers are flipped due to induced currents.
• Bypassing Security: Security checks or conditional branches can be subverted.

Example:
A microcontroller is executing a code that checks if a password is correct. An EMFI attack could flip the result of this check, bypassing authentication and granting unauthorized access.

A Compact EMFI Setup: Components and Assembly

Before launching an attack, let's understand how a typical EMFI setup looks in a security lab.

Required Equipment

1. Pulse Generator — Generates fast, precise high-voltage pulses (often up to several hundred volts, with widths as small as a few nanoseconds).
2. EM Injection Probe — Typically a small coil (loop probe) positioned just above the target chip.
3. Oscilloscope/Logic Analyzer — Monitors the system’s response and helps with timing calibration.
4. Trigger and Synchronization Gear — Ensures the fault is injected at exactly the right time.
5. Target Device — The embedded system, microcontroller, or SoC to be tested.
6. Positioning System — XYZ micro-positioner for precise probe alignment.
7. Shielding and Safety Equipment — Preventing collateral interference and injuries.

Note: Some advanced setups use motorized stages, computer-controllable delays, and even machine learning for automating the process.

Typical Setup Diagram

+---------------------+    Coaxial Cable     +-----------------------+
| Pulse Generator     |--------------------->| EM Probe (loop/coil)  |
+---------------------+                      +-----------------------+
                                                        |
                                                        V
                                                 +-----------+
                                                 |   Target  |
                                                 |   Device  |
                                                 +-----------+
                                                        |
                                                        v
      +---------+     Trigger/Sync      +-------------+   USB/Serial   +-----------+
      | Host PC |<--------------------->| Oscilloscope|--------------->| Host PC   |
      +---------+                      +-------------+                +-----------+
    (Control, Timing)               (Monitor Response)

Safety Considerations

• High Voltage: Pulse generators can deliver dangerous voltages; handle with extreme care.
• EM Fields: Shielding is needed to localize the attack and minimize emission.
• Device Damage: Repeated, high-energy pulses can permanently damage target ICs.

EMFI in Action: Real-World Attack Scenarios

Case Study 1: Extracting Cryptographic Keys

Attack Concept

Many devices rely on cryptographic keys stored internally (e.g., AES, RSA keys). By disturbing the execution during cryptographic computation (like multiplication in RSA), attackers can induce faults resulting in faulty outputs from which secret keys can be mathematically recovered.

Example

• Target: Smartcard running RSA signature computation.
• Process: Apply EMFI during private key calculation to selectively fault crucial bits.
• Result: Use multiple faulty outputs and the original cryptogram to reconstruct keys using a technique known as Differential Fault Analysis.

Differential Fault Analysis Flow

flowchart TD
    A[Device executes cryptographic algorithm] --> B[EMFI induces fault in computation]
    B --> C[Output is captured (faulty cipher/signature)]
    C --> D[Attacker uses known equations and multiple faulty outputs]
    D --> E[Key recovery via algebraic techniques]

Case Study 2: Fault Attacks on Secure Microcontrollers

Modern microcontrollers used in payment cards, TPMs, or authentication tokens include security features—but EMFI can bypass these, exposing their secrets.

Example: Skipping Authentication Checks

Suppose a target code segment performs password check:

if (input_hash == stored_hash) {
    grant_access();
}

An EMFI pulse, well-timed during the comparison, can corrupt the CPU's control flow register or flags, skipping the conditional and forcing access to be erroneously granted.

Demonstration: Visualizing Control Flow Manipulation

Case Study 3: EMFI on Embedded System-on-Chip (SoC)

With SoCs (e.g., ARM Cortex-M, A53), EMFI opens a broad attack surface:

• Boot ROM
• Secure enclave(s)
• On-the-fly code decryption
• Runtime data authentication

Example: Attack on Secure Boot

An SoC may check firmware integrity at boot. An attacker synchronizes an EMFI pulse to the CRC verification routine, causing it to skip or miscompute the verification. The device then boots an attacker-modified (malicious) firmware.

Real-World Reference:
In a Creach Labs Seminar, researchers showed how SoCs running Trusted Execution Environments could be compromised with EMFI.

Detecting Vulnerabilities Using EMFI

Security researchers often use EMFI to characterize vulnerabilities in new devices. The process involves systematic probing, fault-injection, and observing device responses.

Scanning for Fault Response

Step-by-step Process:

1. Identify Sensitive Code: Where should you target (e.g., password compare, cryptographic routines)?
2. Synchronize Pulse: Use GPIO, serial output, or debugging lines to ensure accurate timing.
3. Vary Parameters: Explore pulse width, amplitude, timing offset, and probe position.
4. Collect Outputs: Store device responses, faulty cryptograms, or debug logs for analysis.
5. Classify Faults: Use scripts to parse outputs and categorize by fault type—skipped instructions, bit-flips, total device reset, etc.

Scanning Script Example (Bash + Python):

Suppose your device outputs diagnostic info via UART and you want to automate fault classification.

Bash: Launching a fault scan, capturing serial logs for each injection:

for delay in $(seq 0 100 5000); do
    echo "Injecting at delay $delay ns"
    ./trigger_pulsegen --delay $delay --width 10 --voltage 200
    cat /dev/ttyUSB0 > log_${delay}.txt &
    sleep 0.5
    pkill -f "cat /dev/ttyUSB0"
done

Python: Parsing logs for fault patterns (e.g., looking for 'FAULT DETECTED'):

import glob

for logfile in glob.glob("log_*.txt"):
    with open(logfile) as f:
        content = f.read()
        if "FAULT DETECTED" in content:
            print(f"{logfile}: Fault observed")
        elif "RESET" in content:
            print(f"{logfile}: Device reset detected")
        else:
            print(f"{logfile}: No fault")

Automating Fault Injection Testing with Python and Bash

Larger-scale research involves integrating all equipment with software automation:

• Automate probe positioning (via motors)
• Programmatically control pulse parameters
• Real-time data collection and processing
• Adaptive targeting based on observed results

Simple Python Automation Example:

Assume you have an API for your pulse generator and oscilloscope:

import pulsegen
import oscilloscope

# Connect devices
pulse = pulsegen.connect("COM4")
scope = oscilloscope.connect("USB0::0x1AB1::0x0588::DS1ET141904883")

delays = range(1000, 5000, 200)  # in ns

for d in delays:
    pulse.setup(delay=d, width=10, voltage=250)  # set injection params
    pulse.fire()   # inject!
    trace = scope.capture()
    # Save, analyze, or visualize the captured trace:
    filename = f"trace_{d}ns.csv"
    with open(filename, "w") as f:
        f.write(trace)

Note: Real-life automation may involve complex libraries, error handling, and integration with probe positioners.

Mitigating Fault Injection Attacks: Defensive Measures

As EMFI matures, so do countermeasures—hardware makers now design in fault resistance:

• Sensors: On-chip detectors for strong EM fields or voltage anomalies.
• Redundant Computation: Critical logic is duplicated, and results are compared (Dual Modular Redundancy, DMR).
• Random Delays/Obfuscation: Adds noise to execution timeliness, making precise targeting harder.
• Physical Shielding: Adds conductive, EM-absorbing barriers over sensitive IC areas.
• Software Sensing: Software monitors for impossible states (e.g., impossible jump in logic).

Software example: Triplicate execution for verification:

// Pseudocode
result1 = calc_hash(input);
result2 = calc_hash(input);
result3 = calc_hash(input);

if ((result1 == result2) && (result2 == result3))
    use(result1);
else
    trigger_alert();

Advancing Your Knowledge: Resources and Community

If you’re eager to go beyond the basics, the following resources and communities are invaluable:

• Research Papers:
  • arXiv:2509.18341v1
• Seminar and Workshops:
  • Creach Labs EMFI Seminar
• Open-source Tools:
  • ChipWhisperer
• Blogs and Tutorials:
  • Ledger Blog - Compact Electromagnetic Fault Injection Setup
• Conferences:
  • CHES (Cryptographic Hardware and Embedded Systems)
  • COSADE (Constructive Side Channel Analysis and Secure Design)
  • RECON, Hardwear.io

Conclusion

Electromagnetic Fault Injection (EMFI) is a fascinating—albeit formidable—tool in the field of hardware security research. What began as an exotic academic curiosity now forms a critical risk that any designer of secure microcontrollers or chips must consider. With even basic equipment and scripting, attackers (and researchers) can mount precise, repeatable, and highly disruptive hardware-level intrusions.

As you’ve seen:

• EMFI can bypass, downgrade, or extract cryptographic secrets.
• A practical setup is within the reach of many labs and professionals.
• Real-world vulnerabilities in SoC secure boot, smartcards, and secure elements demonstrate EMFI’s gravity.
• Defensive research and secure chip design must continually adapt.

For newcomers and veterans alike, EMFI represents both a threat to manage—and a powerful diagnostic for future-proofing our digital world.

References

1. A Beginner-Friendly Introduction to Fault Injection Attacks (arXiv:2509.18341v1)
2. A Compact Electromagnetic Fault Injection Setup — Ledger Blog
3. Do not Trust Modern System-on-Chips: Electromagnetic Fault Injection Against SoC — Creach Labs Seminar
4. ChipWhisperer Project
5. Maxwell's Equations and EMI Basics — Wikipedia
6. Fault Injection and Countermeasures — Embedded.com

Did you find this long-form guide helpful? If so, share it with your security team or hardware engineering peers! For more advanced techniques or examples, see resources above and the latest conference proceedings in hardware and embedded security.

[For feedback, corrections, or contributions, see the original ArXiv preprint and the open security research community.]