Assess

Independent LrrK research · Edition 2026-11-01.3

Hardware Attack Library (HAL)

Hardware-first evidence for drones, robotics and embedded devices: what researchers actually showed, on which device, with what access, and what stayed unresolved. Records are organised by the hardware threat classes in MITRE EMB3D™, with ATT&CK® cross-references only where a source supports them. LrrK endorses this framework as an independent effort of the security research community and is not affiliated with or endorsed by The MITRE Corporation.

89 reviewed evidence records · 5 pending leads · 20 closed lead reviews (15 resolved to records, 3 reviewed as context only, 2 reviewed and excluded) · reviewed through 1 November 2026. Context-only reviews are background, not demonstrated attacks. Several records share a paper or experiment, so these are not 89 independent attacks. Coverage means representation in this documented corpus — not every device, attack or source on the internet.

EMB3D Framework

Counts are records in this documented corpus, including discussions and reported results; they are not independent experiments, exhaustive coverage or confirmed device applicability. Choose a threat to filter the evidence.

Reviewed evidence records

Showing 3 of 89 reviewed records for EMB3D TID-109 RAM Chip Contents Readout. Default order: hardware, then device interface, then context; within each, drones and robotics first, then fault-injection learning.

Full archived edition (JSON) ↓
HardwarePrimary hardware researchDemonstrationprimary-cryo-ram-2023Cryo-mechanical extraction from a Siemens S7-1511 PLC84/100
Bounded outcome
Authors demonstrate volatile-memory extraction and reconstruction from the selected PLC, enabling inspection of runtime content.
Stated claim
Cryo-mechanical extraction from a Siemens S7-1511 PLC
Evidence status
Published research demonstration (published_research_demonstration)
Device, firmware & configuration

Description: Siemens S7-1511-1 PN CPU module 6ES7511-1AK02-0AB0 Configuration: Custom embedded memory layout with LPDDR1 / DDR2 handling in the study; FPGA readout and a dedicated cryo-mechanical apparatus.

Access required

Invasive physical memory-chip handling and specialized laboratory equipment; prior device code execution is not required for the demonstrated approach.

Scope / hardware boundary
Custom embedded memory layout with LPDDR1 / DDR2 handling in the study; FPGA readout and a dedicated cryo-mechanical apparatus.
Dates
Published: 2023 · Reviewed: 1 November 2026 — Publication date precision: year.
Mechanisms
RAM Chip Contents Readout

Sources

Limitations

  • The paper discusses drones as possible external-DRAM environments; it does not demonstrate extraction from every quadcopter.
  • CiscoDDR3 work is described as preliminary; DDR4/DDR5 transfer is a research expectation, not a completed result.
  • Hardware manipulation can be destructive and is not authorized by a library entry.
  • Research-strand review status: AI-assisted desk review; no physical reproduction or independent human acceptance claimed.

Follow-up

Performed

  • Read the complete 12-page paper, target-model section and future-work limitations.
  • Compared the result with the2013 cold-boot abstract's failedDDR3 reproduction.

Result

  • Preserved demonstrated PLC scope and separated preliminary or future memory-generation claims.

Unresolved / next

  • Confirm exact target hardware, firmware, access and mitigation state before any separate authorized assessment.

Evidence confidence · 84/100

Confidence components for primary-cryo-ram-2023
ComponentScoreReason
Provenance20/20Original source and provenance inspected.
Technical evidence33/35Technical evidence read; methods and outcome limits retained.
Configuration specificity19/20Device and configuration details are bounded; missing revisions remain unknown.
Independent corroboration4/15Independent corroboration is limited; taxonomy citation and same-team artifacts are not independent reproduction.
Follow-up resolution8/10Follow-up source checks performed; unresolved items remain explicit.

Framework mappings

Original record: https://wootconference.org/papers/woot23-paper3.pdf (opens original source in a new tab) · Share: link to this record

HardwarePrimary hardware researchDemonstrationLRRK-20261101-PRI-0032016 recovery of cooled, scrambled DDR3 memory on specified Intel systems77/100
Bounded outcome
The authors report restoring placed memory images after cooled cold boots using descrambling and, where required, channel deinterleaving. At operating temperature their captured data had completely decayed and no usable image was obtained. Recovery was near the original image with occasional errors, rather than evidence of arbitrary secret recovery.
Stated claim
Intel memory scrambling does not by itself rule out cold-boot recovery on the tested DDR3 configurations.
Evidence status
Published research demonstration with negative boundary (published_research_demonstration_with_negative_boundary)
Device, firmware & configuration

Description: Predominantly Intel Core i3-3225/MSI B75MA-P45; additional reported CPU/mainboard combinations Configuration: The paper also lists i5-760/MSI H55M-P33, i5-2520M/Dell 03PH4G and i5-2400/Esprimo P900 E90+. It distinguishes constant from randomized Intel memory scrambling and single/dual-channel layouts. DDR3 DIMMs are described as produced in 2013, 666/833 MHz types, without exact module part numbers in the inspected results. Reported usable trials used cooling to about −30 °C; operating-temperature trials at about +30 °C produced no usable image.

Access required

Physical RAM access and controlled cold-boot acquisition; usable recovery in this study depended on substantial cooling, retained data, address/layout information and known-plaintext/related-data assumptions.

Scope / hardware boundary
Specified older Intel DDR3 systems and the documented cooled acquisition conditions; neither DDR4 support nor uncooled DDR3 recovery was established.
Dates
Published: 2016 · Reviewed: 1 November 2026 — Author-hosted 2016 DFRWS Europe paper; no separate experiment date established.
Mechanisms
RAM Chip Contents Readout

Sources

Shared source; these records are not independent experiments. Shared with LRRK-20261101-PRI-002.

Shared source; these records are not independent experiments. Shared with LRRK-20261101-PRI-002.

Limitations

  • No current Intel platform, different memory encryption design, DDR4/DDR5 system, robot or drone is demonstrated by this paper.
  • The reported software/tool link is anonymized in this author PDF; no runnable descrambling artifact was verified or executed.
  • Near-complete placed-image recovery is distinct from independently extracting a live production cryptographic secret.
  • Later paper and earlier evaluation share an author, so they earn no independent-reproduction points here.

Follow-up

Performed

  • Compared the measured cooled success and operating-temperature failure.
  • Retained hardware, controller scrambling, channel and acquisition assumptions.
  • Compared with the 2013 study without claiming identical DIMMs or that all DDR3 behavior was disproved.

Result

  • A scoped positive DDR3 counterexample is supported; the earlier negative study remains valid for its own tested conditions.

Unresolved / next

  • Exact controller, firmware, DIMM identity, thermal condition and recovery error bounds remain prerequisites for any new applicability claim.

Evidence confidence · 77/100

Confidence components for LRRK-20261101-PRI-003
ComponentScoreReason
Provenance20/20Original author-hosted paper and ten-page extraction inspected.
Technical evidence31/35Measured recovery and negative uncooled boundary were read; no physical reproduction by LrrK.
Configuration specificity17/20CPU/mainboard and scrambling/channel conditions are given; exact DIMM and firmware revisions remain incomplete.
Independent corroboration0/15No independent reproduction was reviewed; shared-author prior work is not counted as such.
Follow-up resolution9/10The apparent generation-wide contradiction was resolved into differing configurations and conditions.

Overall rationale LrrK analyst confidence in this bounded public evidence account; not probability, severity, device applicability, an official MITRE score, or LrrK bench verification.

Framework mappings

Original record: https://www.johannes-bauer.com/personal/publications/2016-03-Bauer-DFRWS-EU.pdf (opens original source in a new tab) · Share: link to this record

HardwarePrimary hardware researchReported resultLRRK-20261101-PRI-0022013 cold-boot evaluation: DDR1/DDR2 recovery and a bounded five-configuration DDR3 negative result76/100
Bounded outcome
DDR1/DDR2 measurements broadly reproduced earlier recovery behavior. The five DDR3 configurations retained usable contents through warm reset but yielded noise rather than placed data after the tested cold reboots, including cooled trials. This is a negative result for those methods/configurations, not proof that DDR3 cannot retain data.
Stated claim
The study tested whether previously reported cold-boot memory recovery transferred across its specified systems and memory generations.
Evidence status
Published research evaluation with negative results (published_research_evaluation_with_negative_results)
Device, firmware & configuration

Description: Seventeen non-ECC SDRAM system/configuration combinations, including five DDR3 combinations M–Q Configuration: DDR3 configurations: ASRock H77M-ITX/CMX8GX3M2A1600C9 (8192 MiB); Fujitsu ESPRIMO P900 E90+/M378B5773CHO-CK0 (2048 MiB); ASRock Z77 Pro4/HMT351U6BFR8C-H9 (4096 MiB); Asus PBP67LE/M378B5773DHO-CH9 (2048 MiB); ASRock Z77 Pro3/KHX2133C8D3T1K2/4G (4096 MiB), as transcribed by the PDF extraction. BIOS/CPU revisions for these rows are not supplied in the inspected table. The reported unsuccessful cooled DDR3 trials included cooling to about −10 °C; this temperature does not establish a universal retention threshold.

Access required

Physical access to the running system or its RAM; the paper evaluates reset, power-cycle and RAM-transplantation conditions. Cooling and boot behavior materially affect outcomes.

Scope / hardware boundary
Distinguish warm reset (successful on the five tested DDR3 configurations) from the tested power-cycle cold-reboot path (unsuccessful). Seventeen configurations do not mean seventeen distinct computer models.
Dates
Published: 2013 · Reviewed: 1 November 2026 — Conference 2–6 September 2013; IEEE indexing date 7 November 2013 is not the experiment date.
Mechanisms
RAM Chip Contents Readout

Sources

  • coldboot-2013-paper (opens original source in a new tab) · Primary research paper mirrored · Reviewed 1 November 2026
    • Public mirror, with identity matched to the previously reviewed IEEE bibliographic record. Model strings above retain extraction uncertainty.

    Supports: Eight-page authored study; table I configuration set, reset/cold-reboot results and cautious conclusion inspected.

  • Lest We Forget: Cold-Boot Attacks on Scrambled DDR3 Memory (opens original source in a new tab) · Primary author followup · Reviewed 1 November 2026
    • This later paper shares author Michael Gruhn with the 2013 study and uses different configurations/conditions. It is not an independent reproduction of the same five failures.

    Supports: Later authors demonstrate that Intel DDR3 scrambling and remanence require a more specific explanation; it limits any universal reading of the 2013 negative result.

Shared source; these records are not independent experiments. Shared with LRRK-20261101-PRI-003.

Shared source; these records are not independent experiments. Shared with LRRK-20261101-PRI-003.

Limitations

  • The original explanation of DDR3 noise was uncertain; later work demonstrates usable cold-boot recovery on particular scrambled DDR3 systems.
  • No secret-key extraction or modern embedded/drone applicability follows from these placed-data measurements alone.
  • The mirror's extracted hardware spelling is not an independent board-identity verification.
  • A failed cold-reboot test and a successful warm-reset read are separate observations.

Follow-up

Performed

  • Read the original setup and separated twelve DDR1/DDR2 configurations from five DDR3 configurations.
  • Retained the warm-reset success omitted by a broad 'DDR3 failed' summary.
  • Read the later DDR3 descrambling experiment rather than treating the early inference as a final memory-generation rule.

Result

  • The original negative result is admitted with its exact boundary and later contrary examples; LRRK-20261101-PRI-003 records the later positive study separately.

Unresolved / next

  • Do not infer current device behavior from memory generation alone; preserve power, firmware, controller/scrambling and acquisition conditions in any future evidence.

Evidence confidence · 76/100

Confidence components for LRRK-20261101-PRI-002
ComponentScoreReason
Provenance18/20Authored complete eight-page paper from a public mirror matched to the publisher record, not a publisher-hosted PDF.
Technical evidence31/35Measured positive and negative results, warm-reset distinction and author uncertainty were inspected.
Configuration specificity18/20Seventeen configurations and five DDR3 board/module pairs are explicit; some platform revisions and OCR spelling remain uncertain.
Independent corroboration0/15No distinct team repeated these exact negative configurations in the reviewed evidence; the 2016 follow-up shares an author.
Follow-up resolution9/10Later contrary evidence was read and prevents an unsupported DDR3-immunity conclusion.

Overall rationale LrrK analyst confidence in this bounded public evidence account; not probability, severity, device applicability, an official MITRE score, or LrrK bench verification.

Framework mappings

Original record: https://doi.org/10.1109/ARES.2013.52 (opens original source in a new tab) · Share: link to this record

Lead registry

Leads are sources not yet admitted as reviewed records. They carry no confidence score — null, not zero risk. 5 are pending or unresolved; 20 lead reviews are closed and listed separately.

Closed lead reviews

Pending or unresolved leads (5)
  • primary-lead-iommu-2010 Exploiting an I/OMMU vulnerability (opens original source in a new tab)

    Source review gap retained · Confidence: not scored

    Companion original-source evidence materially narrows the mechanism, but neither the SSTIC paper nor the existing 2018 Dell paper silently resolves the unread IEEE 5665798 original.

    Next check: Compare a normally accessible original IEEE manuscript with the SSTIC account if one becomes available. Retain publication/experiment lineage and avoid counting both venues as independent proof without distinct outcomes.

  • DR-L06 2011 Predator/Reaper support-computer malware: conflicting public accounts (opens original source in a new tab)

    Source review gap retained · Confidence: not scored

    Read additional contemporary Dark Reading coverage quoting the Air Force account: malware was described as a nuisance on a standalone mission-support network, with aircraft control reportedly unaffected. Repeated quotations are one statement chain, not independent forensic evidence. The original AF Space Command press record remains unlocated.

    Next check: Locate a normal public original AF Space Command record or authenticated official archival copy before resolving the competing accounts; retain as context, not a hardware-attack demonstration.

  • LRRK-COM-LEAD-001 STM32F103 voltage-glitch Reddit discussion (opens original source in a new tab)

    Source review gap retained · Confidence: not scored

    Three new targeted public origin-discovery queries, in addition to the three retained follow-up01 queries, did not establish a public original-author artifact attributable to the supplied Reddit post. The known unsupported Reddit URL was not resubmitted and no mirror was used. Search snippets and unrelated STM32-family studies remain discovery only.

    Next check: A normally accessible original-author artifact with a defensible identity connection to this post is required before claim review. Do not retry or mirror the restricted source.

  • LRRK-COM-LEAD-002 EEVblog STM32F4 level-2 protection discussion (opens original source in a new tab)

    Source review gap retained · Confidence: not scored

    New captures of the first three forum pages were reviewed with the reused last-page capture. Earlier success assertions do not establish F4 RDP2: one contributor explicitly says F4 was untested and cannot identify the F3 model involved. The later RDP2 assertion still lacks an exact tested F4 part/revision, protection-state evidence and a retained validated result. Searches returned only the known assertion and the already published FEV RDP1 article.

    Next check: Require an original F4/RDP2 configuration and validated result, or a normally accessible original correction. Reconcile the uncertain ST operation before any decision to retry it; no bypass or unrequested paid repeat.

  • LRRK-LEAD-HOBOT-2026 HOBOT S7 Pro: author-reported OTA data writes need an installation-boundary follow-up (opens original source in a new tab)

    Source reviewed installation boundary gap · Confidence: not scored

    The original paper reports unauthenticated OTA data writes using non-destructive payloads. A data-transfer characteristic accepting writes does not by itself prove firmware-image installation, activation or bypass of a later signature check. Official TID-211 requires an installation/authentication boundary, so no admitted TID-211 case is proposed.

    Next check: Review a normally accessible original artifact or follow-up documenting the on-device verification/installation state, or a vendor security response; do not operate a robot or attempt firmware writes.

How to read evidence confidence

LRRK analyst evidence confidence, 0–100. Evidence strength for the narrowly stated claim, not probability, severity, present-device applicability, safety or an official MITRE score. It is an analyst rubric, not a MITRE rating.

  • Provenance · up to 20
  • Technical evidence · up to 35
  • Configuration specificity · up to 20
  • Independent corroboration · up to 15
  • Follow-up resolution · up to 10

Null means the source strand provided no separate component reason. Overall rationale is retained; no reasons are invented.

Multiple citations, reposts, same-team artifacts or shared reports are not independent reproduction.

Method, attribution and licenses

Edition
2026-11-01.3 · schema 1 · reviewed through 1 November 2026
Review
AI-assisted public-source desk research. No LRRK physical reproduction, device actuation or independent human acceptance is asserted.
Read status
Reviewed means the research strand inspected the returned source material. Partial-page reads, targeted passages, omitted forum replies and blocked content remain explicit.
Classification
evidenceStatus preserves each strand's original label. evidenceGroup is a coarse compiler grouping and never upgrades the stated outcome.
Mechanisms
Community mechanism labels are preserved. When a strand supplied no separate list, mapped EMB3D threat names are used; an empty list is not proof of no mechanism.
Mapping attribution
officialCaseAttribution=false means no verified direct MITRE attribution of this exact case is asserted. Ambiguous official-evidence inventory labels are displayed as analyst inference and their original wording is retained in mapping provenance. Only source-reviewed direct references or explicitly labeled analyst inferences. No forced EMB3D-to-ATT&CK/ICS crosswalk or MITRE endorsement.
Coverage and gaps
A documented seed corpus with open gaps, not an exhaustive census of the internet. Normal interfaces, search excerpts, HTTP success and code availability do not themselves prove attacks.
Shared sources
Records describe distinct claims or contexts. Shared papers, reports, forum topics and related artifacts do not establish independent experiments. 16 shared-source groups are flagged on their records.
What this does not establish
This snapshot does not establish exploitation on any current LRRK device. Operational reports, advisories, demonstrations, unverified reports and discussions remain distinct.
Updates
Research is reviewed weekly (Mondays, 9 AM Pacific) into private drafts. Only meaningful changes are prepared, and nothing is published automatically; this page changes only when a new reviewed edition is released. It is not a live feed.
Pinned versions
MITRE EMB3D™ site 2.0.2, model 2.0.1, commit 0d7c25bb4e2928c516fb5811aaab9ff8bab2896c (repository (opens original source in a new tab)). MITRE ATT&CK® v20.0 (13 October 2026), verified through 1 November 2026 (ATT&CK (opens original source in a new tab)).
Independence
An independent LrrK implementation. Not produced, reviewed or endorsed by The MITRE Corporation. Original sources retain their own rights; this library links to them and summarises bounded findings.
MITRE EMB3D license and disclaimers

©2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. Terms of Use LICENSE The MITRE Corporation (MITRE) hereby grants you a non-exclusive, royalty-free license to use, copy, and create derivative works of EMB3D™ for internal business purposes or commercial use. Any copy you make for such purposes is authorized provided that you reproduce MITRE’s copyright designation and this license in any such copy and provide MITRE notice of such use at EMB3D@mitre.org. “©2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.” For all other uses of EMB3D™, contact MITRE at techtransfer@mitre.org. All rights not expressly granted are hereby reserved. Portions of EMB3D™ were produced for the U.S. Government under various contracts or funded by internal research and development funds and the U.S. Government retains certain rights in EMB3D™. You agree that you shall not include a charge for EMB3D™ in any sales or license of derivative products or services to the U.S. Government. Your use of MITRE’s website and EMB3D™ will comply with all relevant laws, regulations, Executive Orders, and other obligations. DISCLAIMERS MITRE does not claim EMB3D™ enumerates all possibilities for the types of actions and behaviors documented as part of EMB3D™’s adversary model and framework of techniques. Using the information contained within EMB3D™ to address or cover full categories of techniques will not guarantee full defensive coverage as there may be undisclosed techniques or variations on existing techniques not documented by EMB3D™. EMB3D™ AND ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN ARE PROVIDED ON AN “AS IS” BASIS AND THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS, AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, ANY WARRANTY THAT THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF ACCURACY, NONINFRINGEMENT, MERCHANTABILITY, OR FITNESS FOR A PARTICULAR PURPOSE.

https://emb3d.mitre.org/subtabs/terms-of-use.html (opens original source in a new tab)
MITRE ATT&CK license

MITRE ATT&CK® Terms of Use Source: https://attack.mitre.org/resources/legal-and-branding/terms-of-use/ Retrieved: 2026-11-01 The MITRE Corporation (MITRE) hereby grants you a non-exclusive, royalty-free license to use ATT&CK® for research, development, and commercial purposes. Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. "© 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation." #### [DISCLAIMERS](https://attack.mitre.org/resources/legal-and-branding/terms-of-use/\#disclaimers) MITRE does not claim ATT&CK enumerates all possibilities for the types of actions and behaviors documented as part of its adversary model and framework of techniques. Using the information contained within ATT&CK to address or cover full categories of techniques will not guarantee full defensive coverage as there may be undisclosed techniques or variations on existing techniques not documented by ATT&CK. ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN ARE PROVIDED ON AN "AS IS" BASIS AND THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS, AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. See our [FAQ](https://attack.mitre.org/resources/faq) for more information on how to use and represent the ATT&CK name.

https://attack.mitre.org/resources/legal-and-branding/terms-of-use/ (opens original source in a new tab)