Hardware Analysis Series – Part 3: Fault injection – introduction and practical applications

By Kike Gandia · Hardware & OT · 13 min read

In 2025, with digital devices woven into every aspect of our lives, there is an unsettling technique few people know about: the deliberate injection of faults into computer systems. This is a methodology that was originally born as a defensive tool for testing the resilience of critical components, but has evolved into a double-edged sword in the arsenal of modern cybersecurity. Fault injection allows researchers and attackers to manipulate hardware and software and trigger unexpected behavior, from causing a vehicle's braking system to malfunction to extracting cryptographic keys from supposedly tamper-proof smart cards. This report explores the unsettling world where errors are not accidents, but precision tools for breaking the defenses of the systems that underpin our digital infrastructure.

The anatomy of controlled chaos

Fault injection is the antithesis of how computer systems are supposed to work. While engineers work tirelessly to eliminate bugs, this discipline does exactly the opposite: it introduces defects in a systematic, controlled way. But what exactly is it?

Definition and origins of a disruptive method

Fault injection involves modifying the state of data in a controlled way while a computer system is running, in order to determine whether it behaves according to its specification in the presence of a predefined set of faults1. The technique emerged from the field of fault tolerance, a critical discipline aimed at making systems resilient to potential failures. Fault injection was originally used by hardware engineers to test the durability and reliability of circuits and electronic components, but as technology evolved its scope widened to include software and entire systems2. The ever-growing complexity of modern computing environments and the sophistication of cyber threats demanded more rigorous testing methods, which drove the development of fault injection as a fundamental technique in cybersecurity practice. The history of this methodology reflects the constant battle between building robust systems and finding their weak spots, a technological dance that has shaped the development of modern computing.

Classifying faults: not all errors are created equal

The faults that can be injected into a system are as diverse as the systems themselves. By duration, they can be classified as permanent faults (manufacturing defects or misuse) and transient faults (such as voltage variations or electromagnetic interference). Similarly, in software we find easily identifiable design faults, intermittent internal faults whose triggering condition rarely occurs, and faults caused by software aging, typically through exhaustion of operating system resources. This classification is crucial for understanding which types of fault we need to simulate during testing. The most challenging faults are those that rarely occur under normal conditions but can have catastrophic consequences when they do, such as those that could affect critical systems in aviation, medicine or nuclear infrastructure. Injecting these faults in a controlled way lets engineers prepare for scenarios that would otherwise be extremely difficult to reproduce and analyze under laboratory conditions.

Hardware · duration Permanent faults: Manufacturing defects or misuse: once they appear, they stay.
Hardware · duration Transient faults: Voltage variations or electromagnetic interference that come and go.
Software Design faults: Easy to identify, because they show up in a reproducible way.
Software Intermittent internal faults: Their triggering condition rarely occurs, which makes them the hardest to track down.
Software Aging: Typically caused by exhaustion of operating system resources.

The most challenging faults are the ones that rarely occur under normal conditions but have catastrophic consequences: aviation, medicine, nuclear infrastructure.

The technical arsenal: how faults are introduced

The range of fault injection techniques is as broad as it is creative, spanning purely physical methods to virtual approaches that emulate faulty behavior. Each approach offers unique advantages depending on the goal of the test.

Hardware fault injection techniques: playing with physics

Hardware fault injection techniques involve directly manipulating a system's physical components. Among the most popular are power glitch injection (tampering with the current/voltage supply), clock glitch injection (tampering with the clock signal) and electromagnetic fault injection (using magnetic fields to induce changes)18. Clock glitching, for example, exploits embedded systems' reliance on dependable clocks: by shortening a clock cycle, certain instructions can be skipped entirely, bypassing critical security checks17. Voltage fault injection attacks are particularly powerful because they exploit brief, hard-to-detect power fluctuations to cause errors or bypass security mechanisms6. These physical techniques have the advantage of working even against systems that have been exhaustively verified at the software level, exposing vulnerabilities that no code audit could ever detect.

Power glitch Tamper with the supply: Brief, hard-to-detect power fluctuations that cause errors or bypass security mechanisms.
Clock glitch Tamper with the clock signal: Exploits embedded systems' reliance on dependable clocks: shorten a cycle and certain instructions are skipped entirely, bypassing critical checks.
EMFI Electromagnetic fields: Induce changes in the circuit without direct physical contact.

The three families of hardware fault injection. Their advantage: they work even against systems exhaustively verified at the software level.

The laser revolution: microscopic precision for patient attackers

Laser fault injection is currently the pinnacle of precision in physical attacks. Able to focus on an impact area as small as 1 μm or less, laser injection far surpasses the precision of electromagnetic methods, which typically affect areas of at least 50 μm5. This extraordinary precision enables bit-level modifications in specific registers, such as flipping, setting or resetting a bit value, something that electromagnetic injection cannot achieve. Laser systems can even alter signal propagation to inhibit the execution of individual instructions or, remarkably, change the very nature of an instruction, turning an addition into a subtraction, for example5. From a security standpoint, defending against laser-based attacks poses unique challenges: because the impact area is significantly smaller than that of EM-based systems, it is harder for detection systems to identify or protect against such intrusions.

Electromagnetic injection impact area ≥ 50 μm

Affects a wide area of the circuit.
Does not allow bit-level modifications in a specific register.
Easier to detect and to shield against.

Laser injection impact area ≤ 1 μm

Bit-level modifications: flip, set or reset a value.
Can inhibit the execution of individual instructions.
Can change the nature of an instruction: turn an addition into a subtraction.
The smaller area makes it harder for detection systems to spot.

A fiftyfold difference in precision is what separates disturbing a circuit from writing a specific bit.

Software-Implemented Fault Injection (SWIFI): the art of digital deception

Software fault injection techniques are a less invasive but equally effective approach. Tools such as Exhaustif perform time-triggered memory and register corruption and feature optimized function interception mechanisms that can corrupt a function's input arguments and/or return value with minimal execution overhead3. This approach has the advantage of requiring no specialized hardware and can be applied to production systems with minimal changes. Exhaustif, for example, consists of two main parts: the Exhaustif Executive Manager (EEM), a graphical interface for defining fault injection test suites, and the Fault Injector Kernel (FIK), the injector module that carries out the injections as instructed by the EEM3. SWIFI methods are especially useful during the integration and validation phases of complex systems, enabling “gray-box” testing that is invaluable for verifying the robustness of critical systems.

Simulation and hybrid methods: the best of both worlds

Simulation techniques make it possible to study how a system behaves under faults without manipulating real hardware, while hybrid techniques combine hardware and software elements to obtain more accurate results1. Systems such as FT-UNSHADES can simulate ionizing radiation environments during the design of a synthesizable integrated circuit on a Virtex 5 SRAM FPGA. This offers significant design potential, since testing can begin from the very first synthesizable IC prototype by injecting faults into critical registers or memories9. Bringing fault testing in this early makes it possible to identify the most critical processes or weakest parts from the first stages of design, enabling redesign-and-test cycles that would be prohibitively expensive with physical prototypes. Simulation also offers advantages in terms of reproducibility and experimental control, allowing exactly the same fault conditions to be recreated many times over to analyze different mitigation strategies.

Practical applications: from the lab to the real world

Far from being an academic exercise, fault injection has profound practical implications across a range of industrial and security sectors. Its applications range from verifying critical systems to refining sophisticated attacks.

Verifying critical systems: when failure is not an option

A fundamental application of fault injection is testing embedded systems used in critical infrastructure. In the automotive industry, for example, the technique is used to test the electronic control units (ECUs) that manage vital vehicle functions such as braking, steering and engine performance. By injecting faults into these systems, engineers can assess how the vehicle responds to unexpected conditions, ensuring that safety mechanisms are robust and reliable. This kind of testing is crucial to prevent catastrophic failures that could lead to accidents or serious injuries. Fault injection makes it possible to answer critical questions such as "Can I trust the car's braking system?" or "Could the elevator control system ever hurt someone?", making it an indispensable tool for validating systems where human lives are at stake.

Practical cryptanalysis: extracting secrets from silicon

In the context of cybersecurity, fault injection has proven extraordinarily effective at identifying vulnerabilities in cryptographic implementations. Security researchers use these techniques to induce errors in encryption systems that, when properly analyzed, can reveal critical information about the secret keys. A striking example is how a well-executed theoretical fault can break the AES algorithm (Advanced Encryption Standard, used worldwide to protect confidential information) with just 3 plaintext-ciphertext pairs. These techniques have revolutionized the field of cryptographic security, showing that even mathematically perfect algorithms can be vulnerable when implemented in real hardware exposed to adverse physical conditions. The growing sophistication of these attacks has forced security system designers to build in specific countermeasures against fault injection, continually raising the stakes in the battle between attackers and defenders.

Robustness analysis in FPGAs: flexibility under attack

Fault injection and coverage analysis are essential techniques for testing the reliability and robustness of FPGA designs, simulating the effects of errors or failures in the hardware or its environment, such as radiation, power supply fluctuations or manufacturing defects. Because they are reconfigurable, FPGAs pose unique challenges in terms of security and fault robustness. Specialized tools make it possible to run random fault injection campaigns on these devices, providing invaluable data on how they behave under adverse conditions. The subsequent coverage analysis measures how well the test cases cover possible failure scenarios and design functionality, allowing engineers to refine their implementations. This methodology is particularly relevant in space applications, where FPGAs are exposed to high levels of radiation that can induce faults in their memory elements.

The digital arms race: attack versus defense

As in every area of security, offensive and defensive techniques evolve and counter-evolve constantly. Fault injection is no exception to this dynamic.

Cutting-edge attack technologies: accessible hardware, real potential for damage

Today's fault injection landscape is defined by the democratization of tools that were once the preserve of state laboratories or large corporations. Platforms such as ChipWhisperer have put side-channel analysis and fault injection attacks within reach of researchers, students and potential attackers on relatively modest budgets. Even more surprisingly, some hobbyists have documented how to build devices capable of electromagnetic fault injection for under €5, illustrating how accessible these techniques have become. This democratization has profound implications for embedded systems security, because it dramatically widens the pool of actors able to carry out sophisticated attacks. Device manufacturers must now assume that their products will be subjected to fault injection attempts, not only by government agencies with unlimited resources, but also by independent researchers, hacktivists or even criminals with moderate means.

1 μm: minimum impact area of laser injection (versus 50 μm for electromagnetic injection)
under €5: is what it costs to build a homemade EMFI device (documented by hobbyists)
ChipWhisperer: the platform that opened up the field (side-channel analysis on a modest budget)

The practical consequence: manufacturers can no longer assume that only a state agency will try to inject faults into their products.

Smart defense: when AI strikes back

As attacks grow more sophisticated, defenses evolve too. One promising trend is the use of machine learning techniques to detect fault injection attempts. Recent research has produced AI-based detectors that analyze clock signals directly to identify anomalies indicative of tampering. These systems make it possible to build models that distinguish between safe executions, glitches that keep the device running but could introduce faults, and glitches that cause the target to reset. The adaptability of machine learning is especially valuable for creating fault detection models tuned specifically to the hardware they run on, offering a tailored layer of protection for each system. This approach represents a paradigm shift in fault injection defenses, moving from static, generic countermeasures to adaptive systems that can learn and evolve in response to new attack techniques.

Countermeasures and mitigations: designing for adversity

To protect against fault injection attacks, manufacturers implement a range of defensive strategies. Chief among them are rigorous code reviews and exhaustive testing to identify and fix potential weak points in the software. At the hardware level, tamper-resistant components or secure elements help mitigate the impact of induced faults. Invasive attacks can be mitigated with sensor meshes, while electromagnetic attacks are countered with technologies such as Tempest (Transient ElectroMagnetic Pulse Emanation Surveillance Technology), based on Faraday cages and electromagnetic shielding curtains. Some cryptographic implementations include specific algorithmic countermeasures against side-channel analysis. Effective defense requires a holistic approach that combines hardware, software and operational protections, recognizing that absolute security is impossible and focusing instead on early detection and impact mitigation.

Software Code review and exhaustive testing: Identify and fix weak points before they reach production.
Hardware Tamper-resistant components: Secure elements that mitigate the impact of induced faults.
Invasive Sensor meshes: Detect opening of, or physical tampering with, the package.
Electromagnetic Tempest: Faraday cages and electromagnetic shielding curtains.
Cryptography Algorithmic countermeasures: Built specifically against side-channel analysis, within the implementation itself.

Effective defense is holistic: hardware, software and procedures. Absolute security is impossible, so the goal is to detect early and limit the impact.

The technology horizon: emerging trends and the near future

Fault injection is a constantly evolving field, driven both by technological advances and by the need for security in a world that depends more and more on digital systems.

Machine learning: the new frontier

Machine learning is transforming both offensive and defensive techniques in fault injection. On the one hand, ML techniques can be applied to fault injection attacks to facilitate, improve and speed up results7. On the other, as mentioned earlier, they also make it possible to build more sophisticated and adaptable detection systems. Research presented by Asier Gambra and colleagues describes an AI-driven voltage fault injection detector that analyzes clock signals directly, providing a detailed characterization of faults in specific microcontrollers. This AI-based approach is a promising direction for countering fault injection attacks across a variety of platforms, because it can be adapted to the unique characteristics of each hardware implementation. The future will likely bring an algorithmic arms race, in which ML-based offensive systems try to evade defenses that are also powered by ML, in a cycle of continuous improvement that will raise the sophistication of both sides of the equation.

The algorithmic arms race. Machine learning speeds up attacks and at the same time enables more adaptable detectors, such as the AI-driven voltage injection detector from Asier Gambra and colleagues, which analyzes clock signals directly. The foreseeable future is a cycle in which ML-based offensive systems try to evade defenses that are also ML-based.

Open platforms and democratization: a double-edged sword

The shift toward open-source fault injection tools and platforms has profound implications. Projects such as the synthesizable openMSP430 microcontroller make it possible to implement automated fault injection workflows, making them easier to study and analyze. At the same time, tools such as ChipWhisperer-Jupyter provide accessible educational environments where researchers and students can experiment with practical fault injection attacks against cryptographic implementations. This democratization of knowledge and tools cuts both ways: on the one hand, it lets more organizations verify the security of their products; on the other, it makes it easier for malicious actors to develop offensive capabilities. Transparency and shared knowledge appear to be winning the battle against “security through obscurity”, on the premise that truly secure systems must withstand attacks even when their implementation details are known. This philosophy, while risky in the short term, promises to build more robust digital ecosystems in the long run.

Conclusion: an expanding field with profound implications

Fault injection has evolved from a specialized hardware verification technique into a critical component of the modern cybersecurity arsenal. Its ability to reveal hidden vulnerabilities in seemingly secure systems makes it an indispensable methodology for attackers and defenders alike in today's digital ecosystem. The growing accessibility of specialized tools, combined with advanced techniques such as machine learning and laser injection, suggests that we are only just beginning to see the full potential of these techniques. As our societies rely more and more on digital systems for critical infrastructure, financial transactions and secure communications, the importance of understanding and mitigating the vulnerabilities exposed by fault injection can only grow. The future will likely see these techniques integrated more deeply into product development cycles, with continuous verification of resilience against fault injection becoming an industry standard. For security professionals, keeping up with these developments is not optional but imperative, in a digital landscape where the next critical vulnerability could be waiting to be discovered through a fault induced at precisely the right time and place.

Topics

#Clock-Glitching #Electromagnetic-Fault-Injection-EMFI #Fault-Injection #Hardware-Hacking #Physical-Reverse-Engineering #Fault-Injection-Attacks

Keep reading

Talk about OT security