Ops! It is JTAG's Fault: Journey to Unlocking Automotive Grade IC

Ops! It is JTAG's Fault: Journey to Unlocking Automotive Grade IC

Speakers: Unknown (representing "Google" security company)

Conference: Black Hat USA

YouTube: https://www.youtube.com/watch?v=FBlpBLT64c4

Overview

This talk delves into the critical security challenges surrounding JTAG (Joint Test Action Group) interfaces in automotive-grade microcontrollers (MCUs), specifically focusing on the STMicroelectronics SPC58 series. Presented by a team of researchers from a security company identifying itself as "Google," the session outlines their journey to reverse engineer, analyze, and ultimately bypass the JTAG password authentication mechanism implemented in these MCUs. The speakers underscore the importance of understanding attack methodologies to build robust defenses, especially in the context of complex automotive systems where vulnerabilities discovered late in the lifecycle can be costly or impossible to fix.

The research highlights a significant gap in current hardware security practices, demonstrating that even sophisticated password protection schemes for debug interfaces can be vulnerable to physical attacks. By combining protocol analysis with voltage fault injection, the researchers successfully circumvented the authentication process, gaining unauthorized access to the MCU. This work provides crucial insights for automotive OEMs, suppliers, and chip manufacturers, urging them to re-evaluate their security-by-design principles and comprehensive validation strategies against advanced physical threats.

Background

▶ Watch: Introduction and session takeaways (0:00)

The automotive industry faces escalating cybersecurity threats, driven by the increasing complexity and connectivity of modern vehicles. A significant challenge lies in securing embedded systems, particularly their debug interfaces like JTAG. JTAG ports, while essential for development, testing, and diagnosis, can become a critical attack vector if not adequately protected, allowing unauthorized access to internal chip functions, memory, and intellectual property. Chip manufacturers and end-users are keen to prevent such abuse.

Commonly applied security measures for JTAG interfaces include:

• Physical Concealment: Hiding debug signal traces in inner PCB layers and scattering test pads instead of using easily accessible connectors. However, specialized tools and experienced attackers can often circumvent these measures.
• Permanent Disablement: Some chips offer the option to permanently disable JTAG. This, however, poses significant limitations for post-deployment diagnosis and troubleshooting. Moreover, not all chips provide this functionality.
• Readout Protection: Features like the "severe readout protection" found in some STM32 series MCUs prevent flash memory reads while the debug core is disabled. Yet, this is not a universal feature, and determined hardware attackers may find ways around such software-dependent restrictions.
• Password Authentication: As seen in the SPC58 series, the most common method to secure the debug port itself is through password authentication. This typically involves a debugger supplying a password that the MCU compares against an internally stored value.

The talk notes that the theoretical "most secure" method, a challenge-response schematic with asymmetric cryptography, is rarely implemented due to its high hardware cost.

Beyond these basic protections, the realm of hardware security analysis also considers physical attacks, which directly target the semiconductor device. Two prominent categories are:

• Side-Channel Analysis: This involves exploiting information inadvertently leaked by the chip during its operation, such as power consumption, electromagnetic radiation, or processing time. Attackers can analyze these "side channels" to infer confidential data, like encryption keys. An example shown was the power consumption trace of an AES processor, where the 20 rounds of operation were clearly visible, potentially allowing key reconstruction.
• Fault Injection (FI) Attacks: These attacks physically disrupt the normal operation of a semiconductor device to induce errors or unexpected behavior. Methods include manipulating supply rail voltage, injecting strong electromagnetic pulses, altering input clock frequency, or pulling the reset line for an abnormally short period. FI attacks are often used to bypass secure boot environments or unlock features. Notable examples cited include the Tesla IVI hack (using voltage boot injection to break secure boot) and the Starlink dish hack (using fault injection to run custom code).

The motivation for this research was to scrutinize the widely adopted practice of JTAG password protection. Despite its prevalence, there's a scarcity of research specifically on bypassing JTAG locks; most existing work focuses on using JTAG to introduce faults into chips, not on defeating the JTAG protection itself. The researchers aimed to understand the SPC5 JTAG authentication process, identify potential vulnerabilities, and exploit them, especially against the backdrop of physical attack methods.

Key Findings

▶ Watch: Introduction to physical attacks: side channel analysis (5:00)

The research team achieved several significant breakthroughs in their quest to unlock automotive-grade ICs, specifically the STMicroelectronics SPC58 automotive MCU:

1. Reverse Engineering of the SPC58 JTAG Protocol: The team successfully analyzed the proprietary communication protocol used by the SPC58 MCU and its official debugger. This involved sniffing the JTAG signals and interpreting the sequence of instructions and data transfers during the authentication process.
2. Partial Authentication Bypass via Protocol Analysis: By dissecting the communication flow, the researchers discovered that the official debugger typically performs two distinct rounds of authentication. Through careful analysis of the protocol, they were able to bypass one of these authentication rounds immediately, demonstrating a flaw in the multi-stage verification process.
3. Waveform Replication with Custom Hardware: To facilitate controlled experimentation and attack development, the team replicated the observed JTAG waveforms using an off-the-shelf FT4232HL dongle. This allowed them to precisely control the JTAG signals and interact with the MCU independently of the official debugger.
4. Complete Authentication Bypass via Voltage Fault Injection: The most critical finding was the successful bypass of the 256-bit password verification using voltage fault injection. By strategically disrupting the MCU's operation during the password comparison phase, the researchers were able to force the chip into reporting a "successfully connected" status code, even when an incorrect password was supplied. This effectively defeated the JTAG lock, granting unauthorized debug access.

These findings collectively reveal that while JTAG password protection is a common security measure, its implementation in the SPC58 series was susceptible to a combination of protocol-level analysis and sophisticated physical fault injection techniques.

Technical Deep Dive

▶ Watch: Understanding fault injection attacks with examples (6:20)

The technical journey began during a penetration test project on a customer's Body Control Module (BCM), where an SPC58 automotive microcontroller was identified. The JTAG interface was physically accessible but protected by a password, preventing debug access. To conduct their research without violating NDAs, the team acquired an STMicroelectronics SPC58 EC80E development kit, which included the official UDE debugger (comprising both hardware and software for debugging, reading, and flashing firmware).

The SPC58 MCU stores its 256-bit JTAG password in a One-Time Programmable (OTP) memory section, meaning it can only be written once. For analysis, the researchers first provisioned the MCU with a known password. When attempting to connect to a locked SPC58 MCU via the UDE debugger, a password must be provided. The UDE hardware then transmits this 256-bit password, which the MCU compares against the value stored in its OTP memory. A match grants debug access; a mismatch results in connection failure.

To analyze this authentication process, the researchers connected a logic analyzer to the JTAG connector, sniffing the five key signals: TDO (Test Data Out), TMS (Test Mode Select), TCK (Test Clock), and TRST (Test Reset).

The foundation of JTAG communication is the IEEE 1149.1 standard protocol, which describes a state machine governing signal changes based on the TMS line. Understanding this public specification was crucial for interpreting the observed JTAG activity. The logic analyzer's interface helped visualize the JTAG state changes over time, allowing the team to discern when the chip was receiving instructions versus exchanging data.

While the JTAG state machine is open, the specific instructions used by the SPC58 were largely proprietary. The team observed both 6-bit JTAG instructions, which were explained in official SPC58 series documentation, and 10-bit instructions, whose functions were unknown and required educated guesswork.

A critical step was capturing and comparing the JTAG authentication process under two scenarios:

1. Incorrect Password: When a wrong password was entered, the UDE debugger attempted connection multiple times, indicating repeated authentication failures.
2. Correct Password: With the correct password, the process proceeded directly to data transfer, signifying successful authentication.

The stark difference in these observed patterns — particularly the lack of repeated connection attempts with the correct password — provided a crucial behavioral "tell" to identify the success or failure of the password check. The analogy used was a "login prompt" where the machine processes the password and then explicitly signals "yes" or "no."

Further analysis of the captured waveforms allowed the researchers to pinpoint the critical section of the authentication process. They noted that the TRST (Test Reset) line, which is active low, only transitioned to a high state halfway through the authentication sequence. This observation was key: all JTAG activities occurring before TRST went high were deemed irrelevant to the actual authentication, as the JTAG interface was essentially held in a reset state until that point. This effectively filtered out noise and helped narrow down the relevant instruction and data sequences.

By reverse-engineering the protocol, observing the state machine transitions, and identifying the critical timing of the TRST line, the team was able to understand the sequence of instructions and data exchanges that constituted the password verification. This understanding allowed them to identify the specific moment where the MCU performed the password comparison, setting the stage for the fault injection attack.

The replication of these waveforms using an FT4232HL dongle was a pivotal step, enabling the researchers to precisely control the JTAG signals and inject their own sequences, bypassing the need for the official UDE debugger for the attack phase. This custom setup allowed for the fine-grained timing control necessary for a successful fault injection attack.

Demo / Proof of Concept

▶ Watch: Motivation behind SPC5 JTAG research (7:50)

The practical demonstration of this research centered on gaining unauthorized debug access to the STMicroelectronics SPC58 EC80E development kit. This kit, equipped with the target SPC58 automotive MCU, served as the platform for the proof of concept. The researchers utilized the official UDE debugger, which includes both hardware and software components, to initially configure the MCU.

The first step in the demonstration involved setting a known 256-bit password within the SPC58 MCU's One-Time Programmable (OTP) memory. This ensured a controlled environment where the authentication mechanism was active and the expected password was known. The UDE debugger, when attempting to connect to the locked MCU, would transmit this password, which the MCU would then compare against its internally stored value.

To move beyond the official debugger and execute their attack, the team created a custom setup. They replicated the complex JTAG waveforms observed during the authentication process using an FT4232HL dongle. This versatile USB-to-multi-protocol synchronous serial engine allowed them to generate and control the precise JTAG signals (TDO, TMS, TCK, TRST) required to interact with the SPC58 MCU. This custom hardware setup was crucial for independent control and fine-tuning of the attack parameters.

The proof of concept involved two main stages of bypass:

1. Protocol-Level Authentication Bypass: By analyzing the communication protocol, the researchers identified that the official debugger performed two distinct rounds of authentication. Their custom software, leveraging the FT4232HL dongle, was able to bypass one of these rounds immediately, demonstrating a vulnerability in the multi-stage design. This significantly reduced the complexity of the remaining challenge.
2. Voltage Fault Injection Bypass: The ultimate goal was to bypass the final 256-bit password verification. This was achieved using voltage fault injection. During the critical window when the SPC58 MCU was comparing the supplied password with the one stored in its OTP memory, the researchers transiently disrupted the MCU's supply rail voltage. This precisely timed voltage glitch caused a momentary malfunction in the comparison logic. Despite supplying an incorrect password, the fault injection induced an error that led the MCU to register a "successfully connected" status code. This effectively tricked the chip into believing the correct password had been provided, granting full debug access without authorization.

The demonstration highlighted the practical effectiveness of combining detailed protocol analysis with targeted physical attacks. The ability to replicate the debug interface's behavior and then introduce a fault at a precise moment showcased a potent method for defeating hardware security mechanisms that rely solely on software-based password checks.

Defensive Implications

▶ Watch: Beginning of the SPC58 automotive MCU project (8:50)

The research presented on unlocking automotive-grade ICs via JTAG fault injection carries significant implications for chip manufacturers, automotive OEMs, and suppliers. The findings underscore that relying solely on software-based password authentication for critical debug interfaces is insufficient against determined attackers employing physical attack techniques.

Here are key defensive implications and recommended actions:

• Embrace Secure-by-Design Principles: Security must be integrated from the earliest stages of chip and system design, not as an afterthought. This includes a holistic threat model that explicitly considers physical attacks like fault injection and side-channel analysis.
• Implement Robust Hardware-Based Protections: While password authentication offers a layer of defense, it should be complemented, or ideally replaced, by more resilient hardware-rooted security mechanisms. This could include:
• True Random Number Generators (TRNGs) for cryptographic operations.
• Hardware Root of Trust (HRoT) for secure boot and code integrity.
• Physical Unclonable Functions (PUFs) for device unique identification.
• Dedicated Hardware Security Modules (HSMs) for cryptographic key management and secure operations.
• Consider Asymmetric Cryptography for Debug Access: The talk noted that challenge-response schemes with asymmetric cryptography are costly but theoretically more secure. As the cost of vulnerabilities in automotive systems continues to rise, the industry should re-evaluate the cost-benefit analysis of implementing such robust cryptographic authentication for debug interfaces, especially for critical production units.
• Comprehensive Security Testing and Validation: OEMs and suppliers must conduct thorough security testing throughout the development lifecycle, extending beyond software vulnerabilities to include extensive physical penetration testing. This means:
• Fault Injection Testing: Actively testing chips for susceptibility to voltage glitches, clock glitches, electromagnetic pulses, and other fault injection methods during critical operations like password verification, secure boot, and cryptographic key usage.
• Side-Channel Analysis: Assessing the chip's susceptibility to power analysis, electromagnetic analysis, and timing attacks to ensure sensitive data (like encryption keys or authentication secrets) is not leaked.
• JTAG Security Audits: Rigorously auditing JTAG implementations for protocol-level weaknesses, unintended debug modes, and vulnerabilities in authentication sequences.
• Strengthen Physical Security Measures: While physical concealment of JTAG traces is a first step, it's not enough. Consider:
• Tamper Detection and Response: Implementing hardware mechanisms that detect physical tampering (e.g., decapsulation attempts, probing) and respond by erasing sensitive data or permanently disabling debug access.
• Secure Packaging: Utilizing tamper-resistant packaging for critical ICs.
• Improve Agility of Security Response: The research highlighted slow and inefficient security responses in some vendors. Automotive companies must develop agile processes for vulnerability identification, patching, and over-the-air (OTA) updates to mitigate risks promptly. This includes establishing clear communication channels with security researchers and proactive engagement with the security community.
• Educate and Train Developers: Developers need to be aware of advanced hardware attack vectors and how their code and design choices can impact the overall physical security of the device. Promoting a security-first mindset across engineering teams is paramount.

By addressing these defensive implications, the automotive industry can move towards building more resilient and trustworthy embedded systems that can withstand sophisticated physical attacks, thereby enhancing vehicle safety and security in the long term.

Key Takeaways

• JTAG password protection is vulnerable to physical attacks: Relying solely on a 256-bit password stored in OTP memory for JTAG access is insufficient against determined attackers employing fault injection.
• Protocol analysis is crucial for physical attacks: Reverse engineering the proprietary JTAG communication protocol, including identifying unknown instructions and analyzing signal timing (like the TRST line), was essential for pinpointing vulnerabilities.
• Fault injection bypasses authentication: Voltage fault injection, when precisely timed during the password comparison phase, can disrupt the MCU's operation and force a successful authentication status despite an incorrect password.
• Custom hardware enables sophisticated attacks: Tools like the FT4232HL dongle allow researchers to precisely replicate and manipulate JTAG waveforms, enabling controlled and repeatable fault injection experiments.
• Automotive security needs secure-by-design: The research underscores the critical need for automotive OEMs and chip manufacturers to adopt secure-by-design principles, incorporating robust hardware security measures and comprehensive physical attack testing from the outset.
• Physical attacks are a real threat: Examples like the Tesla IVI and Starlink hacks demonstrate that fault injection is a proven and effective method for bypassing secure boot and unlocking features in real-world systems.

About the Speaker(s)

The presentation was delivered by a team of researchers from a company identified as "Google," which describes itself as a "hacker-driven company" founded in 2020. This organization operates with the philosophy that one cannot defend effectively without understanding how to attack. The team comprises experienced researchers and white-hat hackers from "top-not security companies," bringing expertise in both blue team (defense) and red team (offense) operations.

Their team members have a strong track record of sharing research at prominent security conferences such as Defcon, Hacking the Box, and Black Hat. They have also published books covering specialized areas like automotive security, hardware security, and wireless security. "Google" actively engages with security communities like ASRG (Automotive Security Research Group), "Google Hack," and Defcon groups, emphasizing the importance of contributions from the hacker community.

The company's mission is to address key challenges in automotive cybersecurity by providing solutions across the product lifecycle. These include:

• Secure by Design: Offering defense solutions to help the industry prevent vulnerabilities stemming from design flaws.
• Comprehensive Security Testing: Providing the "Google bar suite" for security testing and validation to counter insecure implementations during development.
• Efficient Security Response: Developing an automatic threat intelligence platform to identify threats promptly and improve the agility of security responses, which they note can be slow and inefficient in the industry.
• All-in-One Cyber Security Platform: Offering a comprehensive platform for automotive threat tracing to orchestrate security efforts both internally and externally.