Implementations of cryptographic algorithms continue to proliferate in consumer products due to the increasing demand for secure transmission of confidential information. Although the current standard cryptographic algorithms proved to withstand exhaustive attacks, their hardware and software implementations have exhibited vulnerabilities to side channel attacks, e.g., power analysis and fault injection attacks. This paper focuses on fault injection attacks that have been shown to require inexpensive equipment and a short amount of time. The paper provides a comprehensive description of these attacks on cryptographic devices and the countermeasures that have been developed against them. After a brief review of the widely used cryptographic algorithms, we classify the currently known fault injection attacks into low-cost ones (which a single attacker with a modest budget can mount) and high-cost ones (requiring highly skilled attackers with a large budget). We then list the attacks that have been developed for the important and commonly used ciphers and indicate which ones have been successfully used in practice. The known countermeasures against the previously described fault injection attacks are then presented, including intrusion detection and fault detection. We conclude the survey with a discussion on the interaction between fault injection attacks (and the corresponding countermeasures) and power analysis attacks.

Preventive and reactive security measures can only partially mitigate the damage caused by modern ransomware attacks. Indeed, the remarkable amount of illicit profit and the cyber-criminals' increasing interest in ransomware schemes suggest that a fair number of users are actually paying the ransoms. Unfortunately, pure-detection approaches (e.g., based on analysis sandboxes or pipelines) are not sufficient nowadays, because often we do not have the luxury of being able to isolate a sample to analyze, and when this happens it is already too late for several users! We believe that a forward-looking solution is to equip modern operating systems with practical self-healing capabilities against this serious threat. Towards such a vision, we propose ShieldFS, an add-on driver that makes the Windows native filesystem immune to ransomware attacks. For each running process, ShieldFS dynamically toggles a protection layer that acts as a copy-on-write mechanism, according to the outcome of its detection component. Internally, ShieldFS monitors the low-level filesystem activity to update a set of adaptive models that profile the system activity over time. Whenever one or more processes violate these models, their operations are deemed malicious and the side effects on the filesystem are transparently rolled back. We designed ShieldFS after an analysis of billions of low-level, I/O filesystem requests generated by thousands of benign applications, which we collected from clean machines in use by real users for about one month. This is the first measurement on the filesystem activity of a large set of benign applications in real working conditions. We evaluated ShieldFS in real-world working conditions on real, personal machines, against samples from state of the art ransomware families. ShieldFS was able to detect the malicious activity at runtime and transparently recover all the original files. Although the models can be tuned to fit various filesystem usage profiles, our results show that our initial tuning yields high accuracy even on unseen samples and variants.

In this paper we present software countermeasures specifically designed to counteract fault injection attacks during\ud the execution of a software implementation of a cryptographic\ud algorithm and analyze the efficiency of these countermeasures.\ud We propose two approaches based on the insertion\ud of redundant computations and checks, which in their\ud general form are suitable for any cryptographic algorithm.\ud In particular, we focus on selective instruction duplication\ud to detect single errors, instruction triplication to support error\ud correction, and parity checking to detect corruption of\ud a stored value. We developed a framework to automatically\ud add the desired countermeasure, and we support the possibility to apply the selected redundancy to either all the\ud instructions of the cryptographic routine or restrict it to the\ud most sensitive ones, such as table lookups and key fetching.\ud Considering an ARM processor as a target platform\ud and AES as a target algorithm, we evaluate the overhead of\ud the proposed countermeasures while keeping the robustness\ud of the implementation high enough to thwart most or all of\ud the known fault attacks. Experimental results show that in\ud the considered architecture, the solution with the smallest\ud overhead is per-instruction selective doubling and checking,\ud and that the instruction triplication scheme is a viable alternative if very high levels of injected fault resistance are\ud required

In recent years, the ability to induce bit-flips in DRAM cells via software-only driven charge depletion has been successfully exploited to gain unauthorized privileged access to the functional resources on fixed and mobile computational platforms. The first crucial step in executing these attacks, collectively known as rowhammer attacks, concerns gaining the knowledge of how virtual memory addresses are mapped onto the geometric addresses of the physical DRAM module(s). We propose a methodology to reverse engineer such maps without direct physical probing of the DRAM bus of the target platform. We validate the correctness of the inferred maps against some publicly available data about modern Intel CPUs maps and show that they depend on the number of installed memory modules.

Fault injection attacks are a powerful tool to exploit implementative weaknesses of robust cryptographic algorithms. The faults induced during the computation of the cryptographic primitives allow to extract pieces of information about the secret parameters stored into the device using the erroneous results. Various fault induction techniques have been researched, both to make practical several theoretical fault models proposed in open literature and to outline new kinds of vulnerabilities. In this paper we describe a non-invasive fault model based on the effects of underfeeding the power supply of an ARM general purpose CPU. We describe the methodology followed to characterize the fault model on an ARM9 microprocessor and propose and mount attacks on implementations of the RSA primitives.