COMMON ATTACK PATTERN ENUMERATION AND CLASSIFICATIONLive MITRE record

CAPEC-625

Mobile Device Fault Injection

Fault injection attacks against mobile devices use disruptive signals or events (e.g. electromagnetic pulses, laser pulses, clock glitches, etc.) to cause faulty behavior. When performed in a controlled manner on devices performing cryptographic operations, this faulty behavior can be exploited to derive secret key information. Although this attack usually requires physical control of the mobile device, it is non-destructive, and the device can be used after the attack without any indication that secret keys were compromised.

Abstraction

Standard

Typical severity

High

Likelihood of attack

Medium

Understand the attack

What is this attack pattern?

Fault injection attacks against mobile devices use disruptive signals or events (e.g. electromagnetic pulses, laser pulses, clock glitches, etc.) to cause faulty behavior. When performed in a controlled manner on devices performing cryptographic operations, this faulty behavior can be exploited to derive secret key information. Although this attack usually requires physical control of the mobile device, it is non-destructive, and the device can be used after the attack without any indication that secret keys were compromised.

Requirements

What does the attack require?

Prerequisites

  • Target application or infrastructure exposes an exploitable vulnerability surface.

Skills required

  • High: Adversaries require non-trivial technical skills to create and implement fault injection attacks on mobile devices. Although this style of attack has become easier (commercial equipment and training classes are available to perform these attacks), they usual require significant setup and experimentation time during which physical access to the device is required. This prerequisite makes the attack challenging to perform (assuming that physical security countermeasures and monitoring are in place).

Resources required

Not stated in the MITRE record.

Impact

What does a successful attack lead to?

Read Data

Affected scopes: Confidentiality, Access Control

Defence

How is it prevented and mitigated?

1
Strong physical security of all devices that contain secret key information. (even when devices are not in use)
2
Frequent changes to secret keys and certificates.