Electromagnetic Fault Injection (EMFI)

Rent, buy or lease electromagnetic fault injection (EMFI) test equipment for IC susceptibility and security testing.

EMFI tests use an intense, localized EM pulse to induce a temporary malfunction, or "glitch," in an IC's operation. An attacker can exploit these glitches to bypass security mechanisms or extract secret information. 
  • Attack techniques:
    • Secure boot bypass: An EM pulse is timed to disrupt memory transfers or code-signing verification during startup, forcing the system to boot with unauthorized firmware.
    • Instruction skip: An attacker can disrupt the processor's program flow to skip critical security-related instructions, such as checks for authentication or cryptographic operations.
    • Data corruption: Injecting a fault can corrupt data in memory or registers, potentially allowing an attacker to manipulate system behavior.
    • JTAG protection bypass: For devices with debug interfaces like JTAG, an EM pulse can be used to temporarily disable security protections that prevent access.
  • Methodology:
    • An EMFI test setup includes a specialized tool (like a ChipSHOUTER) to generate a high-current, transient pulse, which is sent through a coil near the target IC.
    • Test operators use precise positioning systems and timing triggers to control the exact location and moment the EM pulse is delivered.
    • By carefully varying the pulse's intensity, duration, and timing, they can induce specific, desired faults.