CAPEC Definitions / CAPEC-625
CAPEC-625: Mobile Device Fault Injection
Fault injection attacks against mobile devices use disruptive signals or events (e.g. electromagnetic pulses, laser pulses, clock glitches, etc.) to cause faulty behavior. When performed in a controlled manner on devices performing cryptographic operations, this faulty behavior can be exploited to derive secret key information. Although this attack usually requires physical control of the mobile device, it is non-destructive, and the device can be used after the attack without any indication that secret keys were compromised.
Extended Description
No Extended Description.
Mitigations
Strong physical security of all devices that contain secret key information. (even when devices are not in use)
Frequent changes to secret keys and certificates.
Relationships with other CAPECs
CAPEC-624: Hardware Fault Injection
Prerequisites
No prerequisites found.
Related Weaknesses
CWE-1247: Improper Protection Against Voltage and Clock Glitches
CWE-1248: Semiconductor Defects in Hardware Logic with Security-Sensitive Implications
CWE-1256: Improper Restriction of Software Interfaces to Hardware Features
CWE-1319: Improper Protection against Electromagnetic Fault Injection (EM-FI)
CWE-1332: Improper Handling of Faults that Lead to Instruction Skips
CWE-1334: Unauthorized Error Injection Can Degrade Hardware Redundancy
CWE-1338: Improper Protections Against Hardware Overheating
CWE-1351: Improper Handling of Hardware Behavior in Exceptionally Cold Environments
