Attacking Secure-Element-Hardened MCUboot Using a Low-Cost Fault Injection Toolkit

The bootloader is a critical part of a device’s secure startup, and its interactions with firmware images require cryptographic operations. Instead of storing keys for authentication and encryption in the bootloader, one can harden the system by offloading the key storage and all cryptographic operations to a secure element. This paper analyzes the susceptibility of MCUboot used in conjunction with a secure element to voltage fault injection during firmware image verification. We designed and built a low-cost voltage fault injection tool using a Cortex-M7 MCU and an analog switch, which can achieve a timing resolution of 6.67 ns. We found vulnerable instructions in the glue code between the bootloader and the secure element library. By targeting these vulnerable instructions, we showed how an attacker could bypass a signature verification performed by a secure element by faulting a Nordic nRF52840 host MCU. While secure elements are still suited for securely storing keys and other sensitive data, a holistic approach is required to secure a device against fault injection. Otherwise, the threat of fault injection could diminish the benefits of secure bootloaders and secure elements.