New Academic Paper: Extraction of Secrets from 40nm CMOS Gate Dielectric Breakdown Antifuses by FIB Passive Voltage Contrast
In my previous blog post titled “Novel Invasive Attack on One-Time-Programmable Antifuse Memory,” and my post introducing IOActive’s silicon security eGuide titled “Threat Brief: Low-level Hardware Attacks,” I alluded to the fact that IOActive would be releasing a preprint academic paper on our novel attack technique for one-time-programmable (OTP) antifuse memory. The lead researcher on this topic, Dr. Andrew Zonenberg, is a keynote speaker at the Hardware Reverse Engineering Workshop (HARRIS 2025),…
Threat Brief: Low-level Hardware Attacks
Low-level Hardware Attacks: No Longer an Emerging Threat As organizations have improved their cybersecurity posture, motivated attackers compensate by looking for other attack vectors to continue to achieve their objectives. Efforts to improve system and device security have produced a greater availability and reliance on hardware security features, and as component and device designers continue to innovate with new security features, attackers continue to innovate and share new tools and attack techniques. Increasingly, this means that to provide solid security posture for a component, device, or system, a full-stack perspective…
Novel Invasive Attack on One-Time-Programmable Antifuse Memory
Antifuse-based OTP Memory Attack May Compromise Cryptographic Secrets Complementary metal-oxide semiconductor (CMOS) one-time programmable (OTP) memories based on antifuses are widely used for storing small amounts of data (such as serial numbers, keys, and factory trimming) in integrated circuits (ICs) because they are inexpensive and require no additional mask steps to fabricate. The RP2350 uses an off-the-shelf Synopsys antifuse memory block for storing secure boot keys and other sensitive configuration data. Despite antifuses being widely considered a ”high security” memory—which means they are significantly more difficult…
Understanding Logits And Their Possible Impacts On Large Language Model Output Safety
With AI technology moving forward at lightning speed, getting to grips with how language models work isn’t just for tech experts anymore—it’s becoming essential for everyone involved. As we explore AI, we come across terms and ideas that might seem complicated at first but are key to how these powerful systems behave. One such important concept is the “logit” But what exactly is a logit? In the context of large language models, a logit represents the raw, unprocessed output of a model before it’s turned into a probability. Coined by…
Red Teaming in 2025 & Why You Need One More Than Ever
Find out why you need a Red Team Service in 2025 and what to watch out for. New threat actors, AI attacks, and more. What’s on the horizon for 2025? The holidays are upon us, but threat actors won’t be giving any respite to the defenders tasked with protecting organizations, whether or not it is the season of good cheer. The last year has been incredibly challenging for many organizations with data breaches, global IT outages, new and dangerous vulnerability discoveries, and a persistent shortage of cybersecurity talent impacting business…
Building Management Systems: Latent Cybersecurity Risk
Manage the Cybersecurity Risks of your BMS Building management systems (BMS) and building automation systems (BAS) are great innovations, but present latent cybersecurity and operational risks to organizations. The consequences of a cyberattack on a BMS or BAS could result in operational disruption from the denial of use of the building. Over the past decade, there have been several examples of attacks on BMS and components. Weaponization and operationalization of vulnerabilities in BMS by threat actors with tools such as ransomware is likely to occur in the next three years….
Inside IOActive’s Innovative Key Fob Badge for DEF CON 2024’s Car Hacking Village – Part 3/3
This is Part-3 of a 3-Part Series. Check out Part-1 here and Part-2 here. This is the third in a series of three posts in which I break down the creation of a unique key fob badge for the 2024 Car Hacking Village (CHV). Part 1 is an overview of the project and the major components; I recommend that you begin there. In Part 2 I discussed some of the software aspects and the reasoning behind certain decisions. Background Before I discuss…
Inside IOActive’s Innovative Key Fob Badge for DEF CON 2024’s Car Hacking Village – Part 2/3
This is Part-2 of a 3-Part Series. Check out Part-1 here and Part-3 here. This is the second in a series of three posts in which I break down the creation of a unique key fob badge for the 2024 Car Hacking Village (CHV). Part 1 is an overview of the project and the major components; I recommend you begin there. In this post, I’ll discuss some of the software aspects and the reasoning behind certain decisions. This blog covers several high-level…
Tales from the Call-Gate: An SMM Supervisor Vulnerability
Introduction A few years ago we started analyzing the platform security of AMD systems. This research led to a number of blog posts and presentations at several technical security conferences. The presentations covered issues from SMM modules, the AMD SMM Supervisor and even a decades old CPU bug. The theme of the research was dubbed “Back to the Future”, this was tongue in cheek due to the types of vulnerabilities that we were finding for AMD systems that have not affected Intel…
Inside IOActive’s Innovative Key Fob Badge for DEF CON 2024’s Car Hacking Village – Part 1/3
This is Part-1 of a 3-Part Series. Check out Part-2 here and Part-3 here. IOActive recently sponsored the DEF CON 2024 Car Hacking Village (CHV) by designing one of the exclusive badges sold at the event. This took the form of a key fob badge that mirrors the functionality of everyday car key fobs, which support keyless entry and keyless start, also known as Passive Entry Passive Start (PEPS). This post kicks off a three-part series explaining the creation of this unique…