Attack The Vault!

This is your vault, an Arduino Uno:

Inside the vault, there is a secret keyphrase stored.

The vault will prompt you to input a password. When correctly entered, a hash of the secret keyphrase is replied, along with the associated salt.

Deliverables

• Hash and salt to prove you managed to enter the vault.
• Write-up of the method(s) you used to enter the vault. There might very well be more than one attack vector.

Write-up minimal content

Your write-up should have at the very least the following elements:

• Hardware necessary to conduct your attack, as well as schematics describing their interfacing.
• Asset description
• Attack tree
• Vulnerability severity assessment
• Attack(s) description and implementation
• Proposed counter-measure(s)

First step

[!IMPORTANT] Start by uploading the firmware to the Arduino. You can use avrdude to do so:

avrdude -v -patmega328p -carduino -P/dev/ttyACM0 -b115200 -Uflash:w:firmware.elf

Planning

This planning is tentative, meaning it should serve as guidelines to assess your progression and evaluate the effort necessary during the autonomous sessions.

• Session 1

  • Attack tree draft
  • Flash the firmware on the target
  • Analyse the target behaviour
  • Decide on a preferred attack vector
  • Decide on a platform for the write-up, initialise it and share it with the teacher

• Session 2

  • Successfully interface the ChipWhisperer-Nano with the target
  • Instrument the behaviour of the target to get information using the CW-Nano
  • Start implementing the attack

• Session 3

  • Finish the attack; retrieve the secret from the target
  • Feedback on the initial write-up draft

• Session 4

  • Evaluate the severity of your attack using CVSS v4
  • With the original source code, devise a counter-measure tailored to your primary attack
  • Demonstration of the counter-measure effectiveness; the exploitation phase is not applicable any more

• Session 5

  • Explore a secondary attack vector on the original firmware
  • Devise an updated primary attack to bypass the counter-measure
  • [ ] Closing self-assessment skill inquiry

Evaluation

50% of the grade is set by the write-up, 50% by a 15 minutes, individual discussion.

Grids

For each grid, there are three levels: acquired, partially acquired and not acquired. They respectively award 100%, 50% or 0% of the associated criterion. Each criterion as an assigned weight within the total grade of the evaluated part (written or oral).

Write-up

	Acquired	Partially acquired	Not acquired	Weight
Form	Well-written, easy to follow, illustrated		Lack of structure	20
Reproducible	We can take it as-is and get to the same result	We need to deduce some commands or information by myself	Cryptic	10
Attack tree is complete	All are present: attacker, attacks, counter-measures and asset	Some branches are missing	Severely lacking: no counter-measures, no difference between exploration and exploitation, ...	10
A vulnerability is correctly identified	We have proofs of its identifications, information leaking prior to the attack that we can exploit	A vulnerability is targetted, but without proper ground	What vulnerability?	10
The Attack is appropriate with regard to the identified vulnerability	Correctly aligned	Adjacent; no entirely linked to the vulnerability	Makes no sense	10
The attack is correctly implemented and manages to retrieve the secret	Works as intended	Does something, but the secret is not retrieved	Does not work	20
The proposed counter-measure would indeed void the exploit	Yes	In some specific context	No	10
Complete vulnerability assessment: score, analysis, recommendations	Complete	Partial	Absent or severely lacking	10

Oral discussion

	Acquired	Partially acquired	Not acquired	Weight
Answers to questions	They are correct and the student can elaborate on the subject	Correct, but that's it	Incorrect	35
Course topics	Can navigate between the subjects, make links between the chapters	Knows about the topics individually, but can't see how they are related	What topics?	25
Perspective	Can take a step back regarding their project, identify flaws, strong points	Can describe the project	Barely understand what they did	40

• Example of discussion topics:
  • If we wanted to cipher the serial communication, what scheme would you recommand?
  • Say the firmware was signed, would you have acted differently?
  • Could you have used a clock glitching attack (which is not available on the CW-Nano)?
  • How would a white-box system have changed your approach?