Valentin Huber and Marc Schink, Fraunhofer AISEC, Technical University of Munich (TUM)
Body bias injection (BBI) has received attention as a technique to induce transient faults in digital logic, yet its impact on non-volatile memory (NVM) remains largely unexplored. In this work, we present the first in-depth security analysis of BBI targeting embedded flash memory, the predominant NVM technology used in microcontrollers. We introduce a novel method to program flash cells in powered-off state using BBI, in contrast to existing techniques, such as laser or UV radiation, which are limited to erasing cells. Furthermore, we propose a new BBI technique that uses DC biases to manipulate flash memory read operations. We provide a detailed electrical model that explains the physical mechanisms underlying the induced faults and demonstrate the feasibility of the attacks by reactivating the debug interfaces of two microcontrollers. Based on these findings, we conclude by discussing potential countermeasures.
