Ships are mechanical beasts with many parts working to ensure safe, successful voyages. A digital equivalent would be software. Like software development, shipbuilding involves several steps and precise engineering. Then, when everything is complete, the builders test their creations under different conditions to ensure the vessel is safe and performs as designed. Pretty much all the best software we use today goes through tests to ensure they are secure, too.

One such test is fault injection. Compared to shipbuilding, fault injection would be akin to nautical engineers intentionally putting holes in their ships to see how they handle sinking...

What Is Fault Injection and Why Is it Important?

Fault injection is the practice of intentionally creating defects in a system. The goal of this practice is to analyze how the system performs under stress. Hardware and software engineers typically induce faults in their hardware or software for several reasons.

For one, they want to uncover and address failures that could arise outside the controlled environment of the production lab. This is important because they have no control over the conditions under which customers will use their products. Heat could compromise components or materials holding components together; a server failure could cause an entire region to lose access to their favorite streaming service; attackers could trigger a fault that breaks security features. When such events happen, developers and device manufacturers want to ensure their products still protect the integrity of users’ data and safety or adjust load distribution to minimize service disruption.

Ultimately, fault injection is necessary to make apps and hardware safe, secure, and reliable. Likewise, fault injection helps manufacturers protect intellectual property, reduce the risk of loss, and retain their customer’s confidence. You wouldn’t put your money in a bank if their app crashes all the time and hackers have a field day cracking it, would you?

How Do Fault Injection Attacks Work?

Manufacturers intentionally perform fault injection to uncover flaws that could compromise the security of their products. Nothing stops attackers from doing the same to expose weaknesses in a system and exploit them. After all, the tools used to perform fault injection are public, and the methods are not overly complex.

Furthermore, experienced attackers can get creative with their methods and push the system beyond what’s normal. At this point, you need to know that fault injection can be physical (in hardware) or digital (in software). Likewise, the tools and methods used in fault injection attacks can take either form. Manufacturers and hackers often combine physical and digital tools in their testing and attacks, respectively.

Some tools used for fault injection are FERRARI (Fault and ERRor Automatic Real-time Injector), FTAPE (Fault Tolerance And Performance Evaluator), Xception, Gremlin, Holodeck, and ExhaustiF. Meanwhile, FIA methods often involve bombarding the system with intense electromagnetic pulses, raising the environmental temperature, undervolting GPUs or CPUs, or triggering a short circuit. Using FIA tools and methods, they can corrupt a system long enough to exploit a reset, bypass a protocol, or steal sensitive data.

Preventing Fault Injection Attacks

You don’t have to worry about preventing FIA attacks if you’re a regular consumer. That responsibility is on the device manufacturer or software developer, just like the ship’s safety is the job of the sailing crew. Manufacturers and developers do this by designing more resilient security protocols and making data extraction difficult for hackers.

Nevertheless, there are no perfect systems. Attackers develop novel methods of attack often, and they are not limited in how they apply those methods since they don’t play by the rules. For example, a hacker may combine FIA with a side-channel attack, especially if their access to the device is limited. The team on the other side must acknowledge this fact in designing resilient systems and planning their fault injection tests.

Should You Be Worried About FIA?

Not directly. There are more likely cybersecurity threats that affect you more personally than fault injection attacks. Besides, FIA is seldom covert. An attacker will need physical access to your device to execute a fault injection attack. Also, fault injection methods are generally invasive and result in some level of temporary or permanent damage to the system. So, you’re very likely to notice something is wrong or be left with a device you can’t use.

The catch, of course, is that the attacker may have stolen sensitive data by the time you notice the tampering. It's up to the manufacturer or developer to prevent the attack in the first place and improve their products’ security.