Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

Keyless Entry: Breaking and Entering eMMC RPMB with EMFI

Aya Fukami, Richard Buurke

TL;DR

This work demonstrates that electromagnetic fault injection can bypass the RPMB authentication in eMMC devices, enabling arbitrary writes to the RPMB while preserving most non-volatile data. By profiling three devices, reverse engineering firmware, and timing EMFI to the HMAC computation window, the authors show that bypassing the HMAC check is feasible on two targets. The findings reveal practical attack paths against anti-rollback, bootloader lock state, and AVB keys, highlighting the importance of robust mitigations and constant-time validation. The research also discusses responsible disclosure and suggests hardware- and software-based defenses, with future work extending to other RPMB-enabled storage technologies.

Abstract

The Replay Protected Memory Block (RPMB) in modern storage systems provides a secure area where data integrity is ensured by authentication. This block is used in digital devices to store pivotal information that must be safeguarded against modification by potential attackers. This paper targets the authentication scheme of the RPMB in three different eMMCs from a major manufacturer. A glitch was injected by sending an electromagnetic pulse to the target chip. RPMB authentication was successfully glitched and the information stored in two target eMMCs was overwritten with arbitrary data, without affecting the integrity of other data.

Keyless Entry: Breaking and Entering eMMC RPMB with EMFI

TL;DR

This work demonstrates that electromagnetic fault injection can bypass the RPMB authentication in eMMC devices, enabling arbitrary writes to the RPMB while preserving most non-volatile data. By profiling three devices, reverse engineering firmware, and timing EMFI to the HMAC computation window, the authors show that bypassing the HMAC check is feasible on two targets. The findings reveal practical attack paths against anti-rollback, bootloader lock state, and AVB keys, highlighting the importance of robust mitigations and constant-time validation. The research also discusses responsible disclosure and suggests hardware- and software-based defenses, with future work extending to other RPMB-enabled storage technologies.

Abstract

The Replay Protected Memory Block (RPMB) in modern storage systems provides a secure area where data integrity is ensured by authentication. This block is used in digital devices to store pivotal information that must be safeguarded against modification by potential attackers. This paper targets the authentication scheme of the RPMB in three different eMMCs from a major manufacturer. A glitch was injected by sending an electromagnetic pulse to the target chip. RPMB authentication was successfully glitched and the information stored in two target eMMCs was overwritten with arbitrary data, without affecting the integrity of other data.

Paper Structure

This paper contains 24 sections, 8 figures, 3 tables.

Table of Contents

  1. Introduction
  2. Threat Model
  3. Related Work
  4. Experiment Setup
  5. Electromagnetic Fault Injection
  6. Target Selection
  7. Glitching Setup
  8. Characterization
  9. Device Identification
  10. Profiling
  11. Firmware Reverse Engineering
  12. Glitching RPMB Authentication
  13. Glitching Setup
  14. Results
  15. Integrity of Non-Volatile Data
  16. ...and 9 more sections

Figures (8)

  • Figure 1: RPMB write sequence block diagram
  • Figure 2: ARM Trusted Firmware-A secure boot overview
  • Figure 3: Target chip mounted to a custom PCB, using an adapter, while applying an EM pulse using a ChipSHOUTER (CW520)
  • Figure 4: Profiling results for each chip using the fault observer. The lighter the color, the more susceptible the chip is for the categorized result at that location.
  • Figure 5: X-ray inspection of target chips, highlighting the physical location of the controller
  • ...and 3 more figures