Ludovic Tyack

HW & SW pentester during the day; HW & SW security researcher at night

[Ludovic Tyack @LudovicTyack]

@0xor0ne @Kevin2600 @Neodyme Hum… you are reading a 1.8v flash with a 3.3V IC (esp32) - a quite weak wiring and no decoupling capacitor… what could possibly go wrong
I bet the bit errors are due to the overvoltage and/or glitch during memory access
Well done to still having been able to recover the data

[Airbus Security Lab @AirbusSecLab]

Passionate about hacking & cybersecurity? Airbus is looking for a Vulnerability Research & Exploitation Specialist in France!
💻 Reverse engineering, Red Teaming
✈️Join a global aerospace & defense leader
Apply now! 🚀
https://t.co/wheJECIvtJ

[Ludovic Tyack @LudovicTyack]

@LennertWo @jcldf I have butterfly diode from Innolume and IIVI - and high power (but quite slow) diodes from civillaser.
In this setup (that was not aimed for FI but for probing) it’s a low power diode from an OTDR that has been repurposed. The coupler and sensor was already assembled.

[Ludovic Tyack @LudovicTyack]

This week I have taken out some stuff to build an affordable laser probing system.
It is also capable of imaging (but very slow), and I will work on laser voltage probing. Laser fault injection should (will) also be possible.

[Ludovic Tyack @LudovicTyack]

@LennertWo @jcldf To lower the cost and ease accessibility, I choose to build myself the driver and have several DFB IR diodes from different manufacturers. The diode itself can be expensive, there is a trade of (peak power, speed, stability, availability, price).

[Ludovic Tyack @LudovicTyack]

@jcldf Required laser power depends on losses in your setup, the lithography of the target. Also : pulses could be measured in Joules instead of Watts… and ~30nJ is sufficient to inject faults.
I use lasers capable to pulse few Watts during few nanoseconds.

[Ludovic Tyack @LudovicTyack]

@jcldf That’s the plan : I’ll release all the details when it will be finished - tested and characterized.
The idea is to have (at the end) setups that only use/reuse COTS available in the public domain.
It’s a personal project - so everything you see was bought as a hobbyist.

[Ludovic Tyack @LudovicTyack]

@jcldf It’s a quite simple setup : An IR fiber-coupled laser into collimator and lens through a directional fiber coupler to monitor reflection (using a fiber coupled sensor).
A controlled xy table for automatic lens displacements - and a manual xyz table for sample positioning.

[Ludovic Tyack @LudovicTyack]

@gamozolabs @travisgoodspeed If you have patterns on which you can correlate with the previous pattern in order to find offsets and rotations - it might be easier to compensate the position by software instead of trying to mechanically realign the sample at nanoscale…

[Ludovic Tyack @LudovicTyack]

@gamozolabs @travisgoodspeed This is a newport LTA-HL + UMR8.25 based stage - which is capable of 50nm displacement step - with a 300nm typical repeatable bi-directional accuracy.
It’s not cheap but I got them from ebay at a low fraction of the price.
Imaging using the same spot ease the realignment.

[Ludovic Tyack @LudovicTyack]

This is a (partial) image of the BCM2711 SoC (raspberry pi 4), taken backside.

We can identify the 4xCortex A72 at the bottom right.

Resolution is low (5um) to speed up the scanning - but using this setup, I still have coherent image at 50nm resolution.

[Adam McCombs @[email protected] @nanographs]

Introducing the first open source SEM digital image capture solution, the Open Beam Interface!

GitHub: https://t.co/POTXKRPos9

Bring your analog SEM into the digital world, all over one USB type-C connection.

Taking orders now for our first batch of 6 boards, DM for details.

[Airbus Security Lab @AirbusSecLab]

Our team is looking for an offensive security engineer:
https://t.co/aN2zsFbfzg
Want to know more about our activities? Check out https://t.co/WCnGQ5GAfl.
Interested in becoming an @AirbusSeclab team member? Feel free to reach out!

[The Register @TheRegister]

Robot can rip the data out of RAM chips with chilling technology https://t.co/JmiHk5Lj1N

[Ludovic Tyack @LudovicTyack]

@gudnotevl You need to add some conductive lip seals and ensure it touch everywhere… I use some RF shielding fabric to ensure good join.

[Hans Baier @[email protected] @hansfbaier]

RT @[email protected]
I guarantee that this is the wildest paper you’ll read all year. Drewes et al., “Pentimento: Data Remanence in Cloud FPGAs,” https://t.co/gJNqtzOE9y

We find that a remote attacker can recover…
https://t.co/Z6UaFqAtQL

[Pedro Umbelino @kripthor]

I really really need to try out this wizardry!!!

https://t.co/4CcxeV2szy

[Ludovic Tyack @LudovicTyack]

Custom FC fiber to T2 mount (M42x0.75)

[0xor0ne @0xor0ne]

Very interesting blog post by @eshard on side channel attacks targeting ARM SOCs

https://t.co/z9orRTTipO

#infosec #cybersecurity #arm

[Ludovic Tyack @LudovicTyack]

@marunmagesh Q switched laser generates high power pulses that could vaporize metal - increasing the risk to destroy the target…