|
|
|
|
CAPEC-625: Mobile Device Fault Injection |
 Description Fault injection attacks against mobile devices use disruptive signals or events (e.g. electromagnetic pulses, laser pulses, clock glitches, etc.) to cause faulty behavior. When performed in a controlled manner on devices performing cryptographic operations, this faulty behavior can be exploited to derive secret key information. Although this attack usually requires physical control of the mobile device, it is non-destructive, and the device can be used after the attack without any indication that secret keys were compromised. Skills Required
[Level: High] Adversaries require non-trivial technical skills to create and implement fault injection attacks on mobile devices. Although this style of attack has become easier (commercial equipment and training classes are available to perform these attacks), they usual require significant setup and experimentation time during which physical access to the device is required. This prerequisite makes the attack challenging to perform (assuming that physical security countermeasures and monitoring are in place). |
Consequences  This table specifies different individual consequences associated with the attack pattern. The Scope identifies the security property that is violated, while the Impact describes the negative technical impact that arises if an adversary succeeds in their attack. The Likelihood provides information about how likely the specific consequence is expected to be seen relative to the other consequences in the list. For example, there may be high likelihood that a pattern will be used to achieve a certain impact, but a low likelihood that it will be exploited to achieve a different impact.| Scope | Impact | Likelihood |
|---|
Confidentiality Access Control | Read Data | |
Mitigations
| Strong physical security of all devices that contain secret key information. (even when devices are not in use) |
| Frequent changes to secret keys and certificates. |
 Content History | Submissions |
|---|
| Submission Date | Submitter | Organization |
|---|
| 2015-11-09 (Version 2.7) | CAPEC Content Team | The MITRE Corporation | | | Modifications |
|---|
| Modification Date | Modifier | Organization |
|---|
| 2018-07-31 (Version 2.12) | CAPEC Content Team | The MITRE Corporation | | Updated Attack_Motivation-Consequences | | 2019-09-30 (Version 3.2) | CAPEC Content Team | The MITRE Corporation | | Updated @Abstraction | | 2023-01-24 (Version 3.9) | CAPEC Content Team | The MITRE Corporation | | Updated Related_Weaknesses |
More information is available — Please select a different filter.
|
