Researchers Bypass Secure Boot Using Electromagnetic Signal Analysis

Researchers from the Kharter Teams Laboratory, a security lab under China Telecom’s server security technology division, presented a method to bypass secure boot mechanisms in embedded systems by leveraging cross-domain signal analysis. Their approach correlates electromagnetic (EM) radiation from the CPU with eMMC bus activity to precisely identify the signature verification window during boot, reducing the fault injection attack window from seconds to milliseconds. The team modified a development board with an ARM-based CPU, removing the CPU cover and soldering an eMMC adapter to capture signals, while using a near-field EM probe (10 MHz–3 GHz) and oscilloscope for data acquisition. Traditional fault injection methods suffered from low success rates (below 1%), hardware damage risks, and blind timing, but their technique achieved a 6% success rate by aligning glitches with cryptographic computation patterns. Experiments involved benchmark and abnormal boot environments, with cross-correlation algorithms pinpointing the verification stage by comparing normal and tampered boot signals. Tools included a ChipWhisperer for glitch injection (costing $300) and a high-end oscilloscope ($10,000), with execution times ranging from 30 to 90 minutes. The method operates in zero-free environments, disabling debug ports to simulate real-world devices, and future work aims to refine signal recognition using LSTM/CNN models and explore hardware-based defenses.