{ "schemaVersion": 1, "datasetVersion": "2026-11-01.3", "reviewedThrough": "2026-11-01", "title": "LRRK hardware and device attack evidence library", "scope": "Hardware first, with clearly separated device-interface cases and operational context for drones, robotics and representative embedded systems.", "counts": { "cases": 89, "leads": 25, "leadRegistryByStatus": { "reviewed-archival-original-author-reported-result": 1, "reviewed-complete-technical-appendix": 1, "reviewed-context-no-demonstrated-attack-admitted": 3, "reviewed-methodology-only-no-distinct-attack-admitted": 1, "reviewed-original-preprint-scoped-acquisition-results": 1, "reviewed-original-recording-with-scope-qualification": 2, "reviewed-original-source-scoped-results": 10, "reviewed-universal-vendor-claim-excluded": 1, "source-review-gap-retained": 4, "source-reviewed-installation-boundary-gap": 1 }, "leadRegistryByWorkflowStatus": { "pending-or-unresolved": 5, "resolved-to-cases": 15, "reviewed-context-only": 3, "reviewed-excluded": 2 }, "reviewedLeadRegistryRecords": 20, "resolvedToCasesLeads": 15, "reviewedExcludedLeads": 2, "pendingOrUnresolvedLeads": 5, "byStrand": { "community": 14, "drones-robotics": 31, "primary": 44 }, "byScope": { "context": 1, "device-interface": 21, "hardware": 67 }, "byEvidenceGroup": { "advisory": 5, "demonstration": 58, "discussion": 6, "operational-report": 2, "reported-result": 18 }, "byEvidenceStatus": { "archived_original_author_reported_privileged_console_access": 1, "author-reported-controlled-demonstration": 6, "author_demonstration": 4, "author_demonstration_limited_result": 1, "author_demonstration_with_uncertainty": 1, "author_demonstration_with_validation_limits": 1, "author_report_with_redacted_evidence": 1, "author_reported_hardware_result_in_original_recording_transcript": 1, "author_reported_hardware_result_in_recording_transcript": 1, "community_author_reported_result": 1, "controlled-demonstration-partial-outcome": 1, "controlled_vendor_research_demonstration": 1, "design_proposal": 1, "discussion_hypothesis_with_correction": 1, "discussion_maintainer_claim_and_unresolved_reproduction": 1, "discussion_tooling_and_lab": 1, "discussion_tooling_and_unsuccessful_attempts": 1, "discussion_unsuccessful_attempt": 1, "government-advisory-simulator-scope": 1, "government_reported_operational_incident": 1, "institutional-first-party-controlled-demonstration": 1, "malware_analysis_report": 1, "original-author-demonstration-and-advisory": 1, "original-author-presentation-and-analysis-artifact": 1, "original-bug-report-and-upstream-fix": 1, "original-preprint-hardware-acquisition": 1, "original-preprint-hardware-debug-readout": 1, "original-preprint-inconclusive-hardware-acquisition": 1, "original-research-and-advisory": 1, "original-research-controlled-crashes": 1, "original-research-controlled-demonstration": 2, "original-research-controller-authentication-observations": 1, "original-research-disputed-vulnerability": 1, "original-research-embedded-control-authentication": 1, "original-research-manuscript-controlled-demonstration": 1, "original-research-partial-document-read": 1, "original-research-reported-control-and-safety-interface": 1, "original-research-reported-firmware-corruption": 1, "original-research-reported-firmware-trust-weakness": 1, "original-research-static-firmware-trust-analysis": 1, "original-vulnerability-report-with-upstream-correction": 1, "original_author_research_demonstration": 1, "original_conference_author_reported_dma_proof_of_concept": 1, "original_conference_author_reported_result": 1, "peer-reviewed-controlled-demonstration": 2, "preprint_author_demonstration": 1, "published_research_characterization_and_exploitability_analysis": 1, "published_research_demonstration": 23, "published_research_demonstration_white_box": 1, "published_research_demonstration_with_negative_boundary": 1, "published_research_evaluation_with_negative_results": 1, "published_research_physical_proof_of_concept": 1, "reported-operational-incident-mechanism-unresolved": 1, "researcher-case-study-limited-public-detail": 1, "vendor-and-government-confirmed-vulnerability": 1, "vendor-confirmed-vulnerability": 1, "vendor-confirmed-vulnerability-and-controlled-demonstration": 1 }, "uniqueCanonicalUrls": 78, "uniqueSourceUrls": 149, "independentExperiments": null, "countCaveat": "Records describe distinct claims or contexts. Shared papers, reports, forum topics and related artifacts do not establish independent experiments.", "reviewedContextOnlyLeads": 3, "pendingOriginalLeads": 4, "pendingDiscoveryLeads": 1, "addedAssignedRecords": 6, "addedUnmappedRecords": 1 }, "frameworks": { "emb3d": { "repository": "https://github.com/mitre/emb3d", "commit": "0d7c25bb4e2928c516fb5811aaab9ff8bab2896c", "siteRelease": "2.0.2", "modelBundle": "2.0.1", "stixSpec": "2.1", "licenseUrl": "https://emb3d.mitre.org/subtabs/terms-of-use.html", "sha256": { "_data/properties_threat_mappings.json": "fb1c6935d0464831c9c726b97055b335999edfc12099fa33f34fa78fc22d2e9a", "_data/threats.json": "c213246a06abe81c5c1ae37b57cdfbcdcc0fd74a0f1c99a37a29534c1b587ca6", "_data/mitigations_threat_mappings.json": "ceac7561eca3882fab1aa987cd9159ea3dbe04c18d1be17cf109cb61c16a8bd7", "_data/threats_properties_mitigations_mappings.json": "d4e82a258d64d31a05ce77341906951ecff62c105a8caabc12ced9e320905822", "assets/emb3d-stix-2.0.1.json": "3fed4b36a8907cefcfcb2ae051e0dae87bfdb18d23ffa780731e3dda0cebc1d8", "propertyMapper.js": "20c7df6626f3a926cdd1621a1bd0694013201128cd329c1490988081f0bf2be1", "subtabs/terms-of-use.html": "a1e4152c9a383fbde6c6c46959b9ad4b2d759aa502bd3ff8ebba492f97966b5a" }, "counts": { "properties": 59, "threats": 81, "mitigations": 89, "directPropertyThreatRelationships": 90, "threatMitigationRelationships": 213, "immediateParentRelationships": 40 }, "hardwareThreatIds": [ "TID-101", "TID-102", "TID-103", "TID-105", "TID-106", "TID-107", "TID-108", "TID-109", "TID-110", "TID-111", "TID-113", "TID-114", "TID-115", "TID-116", "TID-118", "TID-119" ], "attribution": "©2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation." }, "attack": { "version": "20.0", "releaseDate": "2026-10-13", "url": "https://attack.mitre.org/versions/v20/", "verifiedThrough": "2026-11-01", "crosswalk": "Only source-reviewed direct references or explicitly labeled analyst inferences. No forced EMB3D-to-ATT&CK/ICS crosswalk or MITRE endorsement." } }, "rubric": { "name": "LRRK analyst evidence confidence", "maximum": 100, "components": { "provenance": { "max": 20, "rationale": null }, "technicalEvidence": { "max": 35, "rationale": null }, "configurationSpecificity": { "max": 20, "rationale": null }, "independentCorroboration": { "max": 15, "rationale": null }, "followUpResolution": { "max": 10, "rationale": null } }, "meaning": "Evidence strength for the narrowly stated claim, not probability, severity, present-device applicability, safety or an official MITRE score.", "unreviewedLeads": "Null confidence; not zero risk.", "unavailableComponentRationales": "Null means the source strand provided no separate component reason. Overall rationale is retained; no reasons are invented.", "corroboration": "Multiple citations, reposts, same-team artifacts or shared reports are not independent reproduction." }, "methodology": { "review": "AI-assisted public-source desk research. No LRRK physical reproduction, device actuation or independent human acceptance is asserted.", "readStatus": "Reviewed means the research strand inspected the returned source material. Partial-page reads, targeted passages, omitted forum replies and blocked content remain explicit.", "classification": "evidenceStatus preserves each strand's original label. evidenceGroup is a coarse compiler grouping and never upgrades the stated outcome.", "mechanisms": "Community mechanism labels are preserved. When a strand supplied no separate list, mapped EMB3D threat names are used; an empty list is not proof of no mechanism.", "mappingAttribution": "officialCaseAttribution=false means no verified direct MITRE attribution of this exact case is asserted. Ambiguous official-evidence inventory labels are displayed as analyst inference and their original wording is retained in mapping provenance.", "collectionLimit": "A documented seed corpus with open gaps, not an exhaustive census of the internet. Normal interfaces, search excerpts, HTTP success and code availability do not themselves prove attacks.", "publication": "This snapshot does not establish exploitation on any current LRRK device. Operational reports, advisories, demonstrations, unverified reports and discussions remain distinct." }, "coverage": { "hardwareThreatCount": 16, "mappedHardwareThreatCount": 16, "hardwareThreats": [ { "id": "TID-101", "name": "Power Consumption Analysis Side Channel", "url": "https://emb3d.mitre.org/threats/TID-101.html", "recordCount": 3, "caseIds": [ "primary-dpa-1999", "LRRK-COM-006", "LRRK-20261101-PRI-001" ], "hardwareScopeRecordCount": 3, "byEvidenceGroup": { "demonstration": 2, "discussion": 1 }, "countMeaning": "Mapped records, including discussions and reported results; not independent experiments or confirmed device applicability." }, { "id": "TID-102", "name": "Electromagnetic Analysis Side Channel", "url": "https://emb3d.mitre.org/threats/TID-102.html", "recordCount": 1, "caseIds": [ "primary-dema-fpga-2004" ], "hardwareScopeRecordCount": 1, "byEvidenceGroup": { "demonstration": 1 }, "countMeaning": "Mapped records, including discussions and reported results; not independent experiments or confirmed device applicability." }, { "id": "TID-103", "name": "Microarchitectural Side Channels", "url": "https://emb3d.mitre.org/threats/TID-103.html", "recordCount": 3, "caseIds": [ "primary-spectre-2018", "primary-meltdown-2018", "primary-hertzbleed-2022" ], "hardwareScopeRecordCount": 3, "byEvidenceGroup": { "demonstration": 3 }, "countMeaning": "Mapped records, including discussions and reported results; not independent experiments or confirmed device applicability." }, { "id": "TID-105", "name": "Hardware Fault Injection – Control Flow Modification", "url": "https://emb3d.mitre.org/threats/TID-105.html", "recordCount": 18, "caseIds": [ "primary-emfi-moro-2013", "primary-mu-glitch-2023", "DR-001", "LRRK-COM-001", "LRRK-COM-002", "LRRK-COM-003", "LRRK-COM-004", "LRRK-COM-005", "LRRK-COM-010", "LRRK-COM-011", "LRRK-20261101-DR-001", "LRRK-20261101-HW-CLOCK-001", "LRRK-20261101-COM-003", "LRRK-20261101-FI-004", "LRRK-20261101-FI-001", "LRRK-20261101-COM-001", "LRRK-20261101-DR2-003", "LRRK-20261101-FR-001" ], "hardwareScopeRecordCount": 18, "byEvidenceGroup": { "demonstration": 12, "discussion": 3, "reported-result": 3 }, "countMeaning": "Mapped records, including discussions and reported results; not independent experiments or confirmed device applicability." }, { "id": "TID-106", "name": "Data Bus Interception", "url": "https://emb3d.mitre.org/threats/TID-106.html", "recordCount": 1, "caseIds": [ "primary-membuster-2020" ], "hardwareScopeRecordCount": 1, "byEvidenceGroup": { "demonstration": 1 }, "countMeaning": "Mapped records, including discussions and reported results; not independent experiments or confirmed device applicability." }, { "id": "TID-107", "name": "Unauthorized Direct Memory Access (DMA)", "url": "https://emb3d.mitre.org/threats/TID-107.html", "recordCount": 7, "caseIds": [ "primary-dma-dell-2020", "primary-dma-hp-2020", "primary-thunderspy-2020", "primary-ai-runtime-dma-2026", "LRRK-COM-007", "LRRK-20261101-PRI-004", "LRRK-20261101-PRI2-001" ], "hardwareScopeRecordCount": 7, "byEvidenceGroup": { "demonstration": 5, "discussion": 1, "reported-result": 1 }, "countMeaning": "Mapped records, including discussions and reported results; not independent experiments or confirmed device applicability." }, { "id": "TID-108", "name": "ROM/NVRAM Data Extraction or Modification", "url": "https://emb3d.mitre.org/threats/TID-108.html", "recordCount": 3, "caseIds": [ "primary-siemens-root-of-trust-2023", "DR-018", "LRRK-COM-008" ], "hardwareScopeRecordCount": 3, "byEvidenceGroup": { "demonstration": 2, "reported-result": 1 }, "countMeaning": "Mapped records, including discussions and reported results; not independent experiments or confirmed device applicability." }, { "id": "TID-109", "name": "RAM Chip Contents Readout", "url": "https://emb3d.mitre.org/threats/TID-109.html", "recordCount": 3, "caseIds": [ "primary-cryo-ram-2023", "LRRK-20261101-PRI-002", "LRRK-20261101-PRI-003" ], "hardwareScopeRecordCount": 3, "byEvidenceGroup": { "demonstration": 2, "reported-result": 1 }, "countMeaning": "Mapped records, including discussions and reported results; not independent experiments or confirmed device applicability." }, { "id": "TID-110", "name": "Hardware Fault Injection – Data Manipulation", "url": "https://emb3d.mitre.org/threats/TID-110.html", "recordCount": 9, "caseIds": [ "primary-rowhammer-2014", "primary-plundervolt-2020", "primary-clkscrew-2017", "primary-gpuhammer-2025", "primary-gddrhammer-2026", "primary-geforge-2026", "primary-gputhor-2026", "LRRK-20261101-PRI-005", "LRRK-20261101-PRI-006" ], "hardwareScopeRecordCount": 9, "byEvidenceGroup": { "demonstration": 9 }, "countMeaning": "Mapped records, including discussions and reported results; not independent experiments or confirmed device applicability." }, { "id": "TID-111", "name": "Untrusted External Storage", "url": "https://emb3d.mitre.org/threats/TID-111.html", "recordCount": 2, "caseIds": [ "primary-badusb-2014", "LRRK-COM-009" ], "hardwareScopeRecordCount": 2, "byEvidenceGroup": { "demonstration": 1, "discussion": 1 }, "countMeaning": "Mapped records, including discussions and reported results; not independent experiments or confirmed device applicability." }, { "id": "TID-113", "name": "Unverified Peripheral Firmware Loaded", "url": "https://emb3d.mitre.org/threats/TID-113.html", "recordCount": 3, "caseIds": [ "primary-equation-hdd-2015", "primary-perilous-bcm5719-2020", "primary-perilous-hp-camera-2020" ], "hardwareScopeRecordCount": 3, "byEvidenceGroup": { "demonstration": 2, "reported-result": 1 }, "countMeaning": "Mapped records, including discussions and reported results; not independent experiments or confirmed device applicability." }, { "id": "TID-114", "name": "Peripheral Data Bus Interception", "url": "https://emb3d.mitre.org/threats/TID-114.html", "recordCount": 4, "caseIds": [ "primary-siemens-root-of-trust-2023", "primary-pcie-mitm-2020", "LRRK-20261101-DR2-001", "LRRK-20261101-DR2-002" ], "hardwareScopeRecordCount": 4, "byEvidenceGroup": { "demonstration": 4 }, "countMeaning": "Mapped records, including discussions and reported results; not independent experiments or confirmed device applicability." }, { "id": "TID-115", "name": "Firmware/Data Extraction via Hardware Interface", "url": "https://emb3d.mitre.org/threats/TID-115.html", "recordCount": 10, "caseIds": [ "primary-prado-jtag-2020", "DR-019", "LRRK-COM-001", "LRRK-COM-002", "LRRK-COM-003", "LRRK-COM-011", "LRRK-20261101-FI-004", "LRRK-20261101-FI-001", "LRRK-20261101-COM-001", "LRRK-20261101-FI-003" ], "hardwareScopeRecordCount": 10, "byEvidenceGroup": { "demonstration": 8, "reported-result": 2 }, "countMeaning": "Mapped records, including discussions and reported results; not independent experiments or confirmed device applicability." }, { "id": "TID-116", "name": "Latent Privileged Access Port", "url": "https://emb3d.mitre.org/threats/TID-116.html", "recordCount": 3, "caseIds": [ "primary-bhis-uart-2019", "LRRK-20261101-FI-004", "LRRK-20261101-PRI2-002" ], "hardwareScopeRecordCount": 3, "byEvidenceGroup": { "demonstration": 2, "reported-result": 1 }, "countMeaning": "Mapped records, including discussions and reported results; not independent experiments or confirmed device applicability." }, { "id": "TID-118", "name": "Weak Peripheral Port Electrical Damage Protection", "url": "https://emb3d.mitre.org/threats/TID-118.html", "recordCount": 1, "caseIds": [ "primary-usb-electrical-damage-2019" ], "hardwareScopeRecordCount": 1, "byEvidenceGroup": { "operational-report": 1 }, "countMeaning": "Mapped records, including discussions and reported results; not independent experiments or confirmed device applicability." }, { "id": "TID-119", "name": "Latent Hardware Debug Port Allows Memory/Code Manipulation", "url": "https://emb3d.mitre.org/threats/TID-119.html", "recordCount": 1, "caseIds": [ "primary-riverloop-jtag-2021" ], "hardwareScopeRecordCount": 1, "byEvidenceGroup": { "demonstration": 1 }, "countMeaning": "Mapped records, including discussions and reported results; not independent experiments or confirmed device applicability." } ] }, "sharedSourceGroups": [ { "url": "https://arxiv.org/html/2605.11040v1", "caseIds": [ "DR-018", "DR-019", "DR-020" ], "note": "Shared source; these records are not independent experiments." }, { "url": "https://attack.mitre.org/techniques/T1200/", "caseIds": [ "LRRK-COM-007", "LRRK-COM-009" ], "note": "Shared source; these records are not independent experiments." }, { "url": "https://cyberside.net.ee/docs/fares_coldboot.pdf", "caseIds": [ "LRRK-20261101-PRI-002", "LRRK-20261101-PRI-003" ], "note": "Shared source; these records are not independent experiments." }, { "url": "https://eclypsium.com/blog/direct-memory-access-attacks-a-walk-down-memory-lane/", "caseIds": [ "primary-dma-dell-2020", "primary-dma-hp-2020" ], "note": "Shared source; these records are not independent experiments." }, { "url": "https://eclypsium.com/research/perilous-peripherals-the-hidden-dangers-inside-windows-linux-computers/", "caseIds": [ "primary-perilous-bcm5719-2020", "primary-perilous-hp-camera-2020" ], "note": "Shared source; these records are not independent experiments." }, { "url": "https://forum.newae.com/t/breaking-crp-level-1-stm32f103/1799.json", "caseIds": [ "LRRK-COM-001", "LRRK-COM-002" ], "note": "Shared source; these records are not independent experiments." }, { "url": "https://forum.newae.com/t/stm32g0-rdp-level-1-bypass/6375.json", "caseIds": [ "LRRK-COM-004", "LRRK-COM-011" ], "note": "Shared source; these records are not independent experiments." }, { "url": "https://gddr.fail/", "caseIds": [ "primary-gddrhammer-2026", "primary-geforge-2026" ], "note": "Shared source; these records are not independent experiments." }, { "url": "https://media.ccc.de/v/c4.openchaos.2018.06.glitching-the-switch", "caseIds": [ "LRRK-20261101-FI-004", "LRRK-20261101-FR-001" ], "note": "Shared citation with different roles: this CCC event is primary source for the T210 development-board record and historical context in the Tegra X2 study. The shared link is not independent corroboration or evidence that either study reproduced the other." }, { "url": "https://nvidia.custhelp.com/app/answers/detail/a_id/5671", "caseIds": [ "primary-gpuhammer-2025", "primary-gputhor-2026" ], "note": "Shared source; these records are not independent experiments." }, { "url": "https://www.anvilsecure.com/blog/glitching-stm32-read-out-protection-with-voltage-fault-injection.html", "caseIds": [ "LRRK-COM-004", "LRRK-COM-011" ], "note": "Shared source; these records are not independent experiments." }, { "url": "https://www.ioactive.com/wp-content/uploads/pdfs/Hacking-Robots-Before-Skynet-Technical-Appendix.pdf", "caseIds": [ "DR-021", "DR-022", "DR-023", "DR-024", "DR-025", "DR-026" ], "note": "Shared source; these records are not independent experiments." }, { "url": "https://www.johannes-bauer.com/personal/publications/2016-03-Bauer-DFRWS-EU.pdf", "caseIds": [ "LRRK-20261101-PRI-002", "LRRK-20261101-PRI-003" ], "note": "Shared source; these records are not independent experiments." }, { "url": "https://www.ndss-symposium.org/ndss-paper/drone-security-and-the-mysterious-case-of-djis-droneid/", "caseIds": [ "DR-002", "DR-003" ], "note": "Shared source; these records are not independent experiments." }, { "url": "https://www.ndss-symposium.org/wp-content/uploads/2023/02/ndss2023_f217_paper.pdf", "caseIds": [ "DR-002", "DR-003" ], "note": "Shared source; these records are not independent experiments." }, { "url": "https://www.nozominetworks.com/blog/dji-mavic-3-drone-research-part-2-vulnerability-analysis", "caseIds": [ "DR-004", "DR-005", "DR-006" ], "note": "Shared source; these records are not independent experiments." } ], "licenses": { "emb3d": { "title": "MITRE EMB3D license and disclaimers", "url": "https://emb3d.mitre.org/subtabs/terms-of-use.html", "text": "Terms of Use\n\nLICENSE\n\nThe MITRE Corporation (MITRE) hereby grants you a non-exclusive, royalty-free license to use, copy, and create derivative works of EMB3D™ for internal business purposes or commercial use. Any copy you make for such purposes is authorized provided that you reproduce MITRE’s copyright designation and this license in any such copy and provide MITRE notice of such use at EMB3D@mitre.org.\n\n“©2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.”\n\nFor all other uses of EMB3D™, contact MITRE at techtransfer@mitre.org.\n\nAll rights not expressly granted are hereby reserved. Portions of EMB3D™ were produced for the U.S. Government under various contracts or funded by internal research and development funds and the U.S. Government retains certain rights in EMB3D™. You agree that you shall not include a charge for EMB3D™ in any sales or license of derivative products or services to the U.S. Government.\n\nYour use of MITRE’s website and EMB3D™ will comply with all relevant laws, regulations, Executive Orders, and other obligations.\n\nDISCLAIMERS\n\nMITRE does not claim EMB3D™ enumerates all possibilities for the types of actions and behaviors documented as part of EMB3D™’s adversary model and framework of techniques. Using the information contained within EMB3D™ to address or cover full categories of techniques will not guarantee full defensive coverage as there may be undisclosed techniques or variations on existing techniques not documented by EMB3D™.\n\nEMB3D™ AND ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN ARE PROVIDED ON AN “AS IS” BASIS AND THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS, AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, ANY WARRANTY THAT THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF ACCURACY, NONINFRINGEMENT, MERCHANTABILITY, OR FITNESS FOR A PARTICULAR PURPOSE.\n" }, "attack": { "title": "MITRE ATT&CK license", "url": "https://attack.mitre.org/resources/legal-and-branding/terms-of-use/", "text": "MITRE ATT&CK® Terms of Use\nSource: https://attack.mitre.org/resources/legal-and-branding/terms-of-use/\nRetrieved: 2026-11-01\n\nThe MITRE Corporation (MITRE) hereby grants you a non-exclusive, royalty-free license to use ATT&CK® for research, development, and commercial purposes. Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy.\n\n\"© 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.\"\n\n#### [DISCLAIMERS](https://attack.mitre.org/resources/legal-and-branding/terms-of-use/\\#disclaimers)\n\nMITRE does not claim ATT&CK enumerates all possibilities for the types of actions and behaviors documented as part of its adversary model and framework of techniques. Using the information contained within ATT&CK to address or cover full categories of techniques will not guarantee full defensive coverage as there may be undisclosed techniques or variations on existing techniques not documented by ATT&CK.\n\nALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS, AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.\n\nSee our [FAQ](https://attack.mitre.org/resources/faq) for more information on how to use and represent the ATT&CK name.\n" } }, "cases": [ { "id": "primary-dpa-1999", "title": "Differential Power Analysis against DES implementations", "canonicalUrl": "https://paulkocher.com/doc/DifferentialPowerAnalysis.pdf", "strand": "primary", "scope": "hardware", "publicationDate": "1999", "eventDate": null, "reviewDate": "2026-11-01", "dateNotes": "Publication date precision: year.", "device": { "description": "Smart-card cryptographic implementations; product identities largely undisclosed", "configuration": "Original paper illustrates DES power traces and differential analysis; exact commercial device revisions are not established." }, "access": "Physical power-observation access and repeated cryptographic operations; laboratory instrumentation.", "claim": "Differential Power Analysis against DES implementations", "outcome": "Authors report recovering secret keys from implementation-dependent power leakage; this establishes a mechanism, not compromise of an arbitrary present-day device.", "evidenceStatus": "published_research_demonstration", "evidenceGroup": "demonstration", "hardwareBoundary": "Original paper illustrates DES power traces and differential analysis; exact commercial device revisions are not established.", "mechanisms": [ "Power Consumption Analysis Side Channel" ], "sources": [ { "url": "https://paulkocher.com/doc/DifferentialPowerAnalysis.pdf", "title": "dpa.dvi", "type": "primary_research_paper", "reviewedAt": "2026-11-01", "readStatus": "reviewed", "supports": null, "limitations": [], "provenance": { "key": "dpa-kocher", "url": "https://paulkocher.com/doc/DifferentialPowerAnalysis.pdf", "title": "dpa.dvi", "scrape_id": "01a19769-dfda-737b-a876-e89eb8050dda", "http_status": 200, "parsed_pages": 10, "total_pages": 10, "cache_state": "hit", "cached_at": "2026-10-30T19:08:35.369Z", "reported_credits": 10, "error": null, "body_characters": 22475, "source_type": "primary_research_paper" } } ], "followUp": { "performed": [ "Read the original public evidence and compared its scope to the official threat reference." ], "result": "Source review supports the bounded account; no LrrK physical reproduction was performed.", "next_steps": [ "Confirm exact target hardware, firmware, access and mitigation state before any separate authorized assessment." ] }, "limitations": [ "Supplemental foundational primary evidence; the exact Arduino AES paper cited by EMB3D did not return substantive body content.", "No independent reproduction or present-day product applicability was verified.", "Research-strand review status: AI-assisted desk review; no physical reproduction or independent human acceptance claimed." ], "mappings": { "emb3d": [ { "id": "TID-101", "name": "Power Consumption Analysis Side Channel", "url": "https://emb3d.mitre.org/threats/TID-101.html", "basis": "analyst-inference", "rationale": "Mechanism-level analyst cross-reference; this case is not asserted to be named by EMB3D.", "officialCaseAttribution": false, "provenance": { "id": "TID-101", "relationship": "analyst_inference", "source_url": "https://emb3d.mitre.org/threats/TID-101.html", "basis": "Mechanism-level analyst cross-reference; this case is not asserted to be named by EMB3D." } } ], "attack": [] }, "confidence": { "total": 65, "components": { "provenance": { "score": 20, "max": 20, "rationale": "Original source and provenance inspected." }, "technicalEvidence": { "score": 30, "max": 35, "rationale": "Technical evidence read; methods and outcome limits retained." }, "configurationSpecificity": { "score": 9, "max": 20, "rationale": "Device and configuration details are bounded; missing revisions remain unknown." }, "independentCorroboration": { "score": 3, "max": 15, "rationale": "Independent corroboration is limited; taxonomy citation and same-team artifacts are not independent reproduction." }, "followUpResolution": { "score": 3, "max": 10, "rationale": "Follow-up source checks performed; unresolved items remain explicit." } }, "rationale": null } }, { "id": "primary-dema-fpga-2004", "title": "Electromagnetic side channels of an FPGA AES implementation", "canonicalUrl": "https://eprint.iacr.org/2004/145.pdf", "strand": "primary", "scope": "hardware", "publicationDate": "2004", "eventDate": null, "reviewDate": "2026-11-01", "dateNotes": "Publication date precision: year.", "device": { "description": "Altera Cyclone FPGA running a parallel AES implementation", "configuration": "Custom research implementation, not an identified drone controller or commercial cryptographic product." }, "access": "Close physical electromagnetic measurement access during AES execution.", "claim": "Electromagnetic side channels of an FPGA AES implementation", "outcome": "Researchers demonstrate differential electromagnetic analysis of the tested parallel AES implementation and recovery of information about targeted key bytes.", "evidenceStatus": "published_research_demonstration", "evidenceGroup": "demonstration", "hardwareBoundary": "Custom research implementation, not an identified drone controller or commercial cryptographic product.", "mechanisms": [ "Electromagnetic Analysis Side Channel" ], "sources": [ { "url": "https://eprint.iacr.org/2004/145.pdf", "title": null, "type": "primary_research_paper", "reviewedAt": "2026-11-01", "readStatus": "partial", "supports": null, "limitations": [ "Only 12 of 16 parsed pages were read." ], "provenance": { "key": "emfi-2004", "url": "https://eprint.iacr.org/2004/145.pdf", "title": null, "scrape_id": "01a19767-0ee7-7462-9a88-ec77a74820fe", "http_status": 200, "parsed_pages": 12, "total_pages": 16, "cache_state": "miss", "cached_at": null, "reported_credits": 12, "error": null, "body_characters": 19911, "source_type": "primary_research_paper" } } ], "followUp": { "performed": [ "Read the original public evidence and compared its scope to the official threat reference." ], "result": "Source review supports the bounded account; no LrrK physical reproduction was performed.", "next_steps": [ "Confirm exact target hardware, firmware, access and mitigation state before any separate authorized assessment." ] }, "limitations": [ "Implementation- and probe-location-dependent laboratory result.", "No evidence of operational exploitation or whole-product compromise was established.", "Research-strand review status: AI-assisted desk review; no physical reproduction or independent human acceptance claimed." ], "mappings": { "emb3d": [ { "id": "TID-102", "name": "Electromagnetic Analysis Side Channel", "url": "https://emb3d.mitre.org/threats/TID-102.html", "basis": "analyst-inference", "rationale": "Named case or primary replacement for evidence cited by the official EMB3D hardware entry.", "officialCaseAttribution": false, "provenance": { "id": "TID-102", "relationship": "official_evidence_reference", "source_url": "https://emb3d.mitre.org/threats/TID-102.html", "basis": "Named case or primary replacement for evidence cited by the official EMB3D hardware entry.", "normalizationNote": "Raw wording combines named evidence with possible primary replacements. Displayed as analyst inference; no verified official case attribution is asserted." } } ], "attack": [] }, "confidence": { "total": 71, "components": { "provenance": { "score": 20, "max": 20, "rationale": "Original source and provenance inspected." }, "technicalEvidence": { "score": 30, "max": 35, "rationale": "Technical evidence read; methods and outcome limits retained." }, "configurationSpecificity": { "score": 15, "max": 20, "rationale": "Device and configuration details are bounded; missing revisions remain unknown." }, "independentCorroboration": { "score": 3, "max": 15, "rationale": "Independent corroboration is limited; taxonomy citation and same-team artifacts are not independent reproduction." }, "followUpResolution": { "score": 3, "max": 10, "rationale": "Follow-up source checks performed; unresolved items remain explicit." } }, "rationale": null } }, { "id": "primary-spectre-2018", "title": "Spectre speculative-execution disclosure demonstrations", "canonicalUrl": "https://spectreattack.com/spectre.pdf", "strand": "primary", "scope": "hardware", "publicationDate": "2018", "eventDate": null, "reviewDate": "2026-11-01", "dateNotes": "Publication date precision: year.", "device": { "description": "Tested speculative-execution processors from Intel, AMD and Arm", "configuration": "Specific branch-prediction and software contexts described in the original paper; neither all variants nor modern mitigated systems are interchangeable." }, "access": "Ability to execute attacker-controlled code or invoke a suitable victim gadget, according to the demonstrated variant.", "claim": "Spectre speculative-execution disclosure demonstrations", "outcome": "The paper demonstrates disclosure of victim-process information through speculative execution and observable microarchitectural side effects.", "evidenceStatus": "published_research_demonstration", "evidenceGroup": "demonstration", "hardwareBoundary": "Specific branch-prediction and software contexts described in the original paper; neither all variants nor modern mitigated systems are interchangeable.", "mechanisms": [ "Microarchitectural Side Channels" ], "sources": [ { "url": "https://spectreattack.com/spectre.pdf", "title": null, "type": "primary_research_paper", "reviewedAt": "2026-11-01", "readStatus": "reviewed", "supports": null, "limitations": [], "provenance": { "key": "spectre", "url": "https://spectreattack.com/spectre.pdf", "title": null, "scrape_id": "01a19768-464c-7378-840f-a528bdb46736", "http_status": 200, "parsed_pages": 19, "total_pages": 19, "cache_state": "hit", "cached_at": "2026-10-31T00:24:43.130Z", "reported_credits": 19, "error": null, "body_characters": 105039, "source_type": "primary_research_paper" } } ], "followUp": { "performed": [ "Read the original public evidence and compared its scope to the official threat reference." ], "result": "Source review supports the bounded account; no LrrK physical reproduction was performed.", "next_steps": [ "Confirm exact target hardware, firmware, access and mitigation state before any separate authorized assessment." ] }, "limitations": [ "A code-execution path and suitable processor/software conditions are prerequisites.", "This read does not establish active exploitation in a drone or the effectiveness of any current mitigation set.", "Research-strand review status: AI-assisted desk review; no physical reproduction or independent human acceptance claimed." ], "mappings": { "emb3d": [ { "id": "TID-103", "name": "Microarchitectural Side Channels", "url": "https://emb3d.mitre.org/threats/TID-103.html", "basis": "analyst-inference", "rationale": "Named case or primary replacement for evidence cited by the official EMB3D hardware entry.", "officialCaseAttribution": false, "provenance": { "id": "TID-103", "relationship": "official_evidence_reference", "source_url": "https://emb3d.mitre.org/threats/TID-103.html", "basis": "Named case or primary replacement for evidence cited by the official EMB3D hardware entry.", "normalizationNote": "Raw wording combines named evidence with possible primary replacements. Displayed as analyst inference; no verified official case attribution is asserted." } } ], "attack": [] }, "confidence": { "total": 76, "components": { "provenance": { "score": 20, "max": 20, "rationale": "Original source and provenance inspected." }, "technicalEvidence": { "score": 33, "max": 35, "rationale": "Technical evidence read; methods and outcome limits retained." }, "configurationSpecificity": { "score": 16, "max": 20, "rationale": "Device and configuration details are bounded; missing revisions remain unknown." }, "independentCorroboration": { "score": 4, "max": 15, "rationale": "Independent corroboration is limited; taxonomy citation and same-team artifacts are not independent reproduction." }, "followUpResolution": { "score": 3, "max": 10, "rationale": "Follow-up source checks performed; unresolved items remain explicit." } }, "rationale": null } }, { "id": "primary-meltdown-2018", "title": "Meltdown kernel-memory disclosure demonstrations", "canonicalUrl": "https://meltdownattack.com/meltdown.pdf", "strand": "primary", "scope": "hardware", "publicationDate": "2018", "eventDate": null, "reviewDate": "2026-11-01", "dateNotes": "Publication date precision: year.", "device": { "description": "Affected out-of-order processor configurations evaluated in the original Meltdown paper", "configuration": "Original pre-mitigation test systems; processor families and address-space-isolation defenses matter." }, "access": "Local unprivileged execution on a susceptible configuration.", "claim": "Meltdown kernel-memory disclosure demonstrations", "outcome": "Researchers demonstrate reading protected memory through transient execution; the paper evaluates KAISER page-table separation as a defense.", "evidenceStatus": "published_research_demonstration", "evidenceGroup": "demonstration", "hardwareBoundary": "Original pre-mitigation test systems; processor families and address-space-isolation defenses matter.", "mechanisms": [ "Microarchitectural Side Channels" ], "sources": [ { "url": "https://meltdownattack.com/meltdown.pdf", "title": null, "type": "primary_research_paper", "reviewedAt": "2026-11-01", "readStatus": "reviewed", "supports": null, "limitations": [], "provenance": { "key": "meltdown", "url": "https://meltdownattack.com/meltdown.pdf", "title": null, "scrape_id": "01a19768-4641-77d5-b112-20ef5031c034", "http_status": 200, "parsed_pages": 18, "total_pages": 18, "cache_state": "miss", "cached_at": null, "reported_credits": 18, "error": null, "body_characters": 96592, "source_type": "primary_research_paper" } } ], "followUp": { "performed": [ "Read the original methods and results, including the paper's defense evaluation." ], "result": "The primary evidence includes a mitigation result, which is retained rather than presenting the attack alone.", "next_steps": [ "Confirm exact target hardware, firmware, access and mitigation state before any separate authorized assessment." ] }, "limitations": [ "Distinct mechanism and affected set from Spectre.", "Historical demonstration; no claim that every current processor or patched system remains vulnerable.", "Research-strand review status: AI-assisted desk review; no physical reproduction or independent human acceptance claimed." ], "mappings": { "emb3d": [ { "id": "TID-103", "name": "Microarchitectural Side Channels", "url": "https://emb3d.mitre.org/threats/TID-103.html", "basis": "analyst-inference", "rationale": "Named case or primary replacement for evidence cited by the official EMB3D hardware entry.", "officialCaseAttribution": false, "provenance": { "id": "TID-103", "relationship": "official_evidence_reference", "source_url": "https://emb3d.mitre.org/threats/TID-103.html", "basis": "Named case or primary replacement for evidence cited by the official EMB3D hardware entry.", "normalizationNote": "Raw wording combines named evidence with possible primary replacements. Displayed as analyst inference; no verified official case attribution is asserted." } } ], "attack": [] }, "confidence": { "total": 78, "components": { "provenance": { "score": 20, "max": 20, "rationale": "Original source and provenance inspected." }, "technicalEvidence": { "score": 33, "max": 35, "rationale": "Technical evidence read; methods and outcome limits retained." }, "configurationSpecificity": { "score": 16, "max": 20, "rationale": "Device and configuration details are bounded; missing revisions remain unknown." }, "independentCorroboration": { "score": 4, "max": 15, "rationale": "Independent corroboration is limited; taxonomy citation and same-team artifacts are not independent reproduction." }, "followUpResolution": { "score": 5, "max": 10, "rationale": "Follow-up source checks performed; unresolved items remain explicit." } }, "rationale": null } }, { "id": "primary-hertzbleed-2022", "title": "Hertzbleed remote timing leakage and subsequent corrections", "canonicalUrl": "https://www.hertzbleed.com/", "strand": "primary", "scope": "hardware", "publicationDate": "2022-06-14", "eventDate": null, "reviewDate": "2026-11-01", "dateNotes": "Publication date precision: day.", "device": { "description": "Tested Intel Core and AMD Ryzen x86 systems; original SIKE implementation", "configuration": "Authors tested Intel Core generations 8–11 and AMD Zen2/Zen3 families. The original SIKE target is deprecated; later work discusses other cryptography and browser contexts." }, "access": "Remote timing observations against a suitable workload; no physical power probe is required for the reported remote variant.", "claim": "Hertzbleed remote timing leakage and subsequent corrections", "outcome": "Authors demonstrate remote key extraction from the tested constant-time SIKE implementation through data-dependent frequency effects.", "evidenceStatus": "published_research_demonstration", "evidenceGroup": "demonstration", "hardwareBoundary": "Authors tested Intel Core generations 8–11 and AMD Zen2/Zen3 families. The original SIKE target is deprecated; later work discusses other cryptography and browser contexts.", "mechanisms": [ "Microarchitectural Side Channels" ], "sources": [ { "url": "https://www.hertzbleed.com/", "title": "Hertzbleed Attack", "type": "original_researcher_report", "reviewedAt": "2026-11-01", "readStatus": "reviewed", "supports": null, "limitations": [], "provenance": { "key": "hertzbleed", "url": "https://www.hertzbleed.com/", "title": "Hertzbleed Attack", "scrape_id": "01a19766-b9d0-7546-9e8f-810e053a36e7", "http_status": 200, "parsed_pages": null, "total_pages": null, "cache_state": "miss", "cached_at": null, "reported_credits": 1, "error": null, "body_characters": 13995, "source_type": "original_researcher_report" } }, { "url": "https://github.com/FPSG-UIUC/hertzbleed", "title": "GitHub - FPSG-UIUC/hertzbleed · GitHub", "type": "author_artifact_repository", "reviewedAt": "2026-11-01", "readStatus": "reviewed", "supports": null, "limitations": [], "provenance": { "key": "artifact-hertzbleed", "url": "https://github.com/FPSG-UIUC/hertzbleed", "title": "GitHub - FPSG-UIUC/hertzbleed · GitHub", "scrape_id": "01a1976d-577c-7402-a601-3a403fa7334f", "http_status": 200, "parsed_pages": null, "total_pages": null, "cache_state": "miss", "cached_at": null, "reported_credits": 1, "error": null, "body_characters": 10954, "source_type": "author_artifact_repository" } } ], "followUp": { "performed": [ "Read the author site's April 2023 SIKE-deprecation update and May 2023 extension/correction.", "Checked the linked original artifact repository; it was publicly accessible." ], "result": "Retained the historical result while removing any implication that SIKE remains a current recommended target or that the scope ends at SIKE.", "next_steps": [ "Confirm exact target hardware, firmware, access and mitigation state before any separate authorized assessment." ] }, "limitations": [ "Frequency leakage is not equivalent to a universally exploitable library.", "SIKE's later cryptanalytic break is separate from Hertzbleed.", "The same-team follow-up and repository do not count as independent reproduction.", "Research-strand review status: AI-assisted desk review; no physical reproduction or independent human acceptance claimed." ], "mappings": { "emb3d": [ { "id": "TID-103", "name": "Microarchitectural Side Channels", "url": "https://emb3d.mitre.org/threats/TID-103.html", "basis": "analyst-inference", "rationale": "Named case or primary replacement for evidence cited by the official EMB3D hardware entry.", "officialCaseAttribution": false, "provenance": { "id": "TID-103", "relationship": "official_evidence_reference", "source_url": "https://emb3d.mitre.org/threats/TID-103.html", "basis": "Named case or primary replacement for evidence cited by the official EMB3D hardware entry.", "normalizationNote": "Raw wording combines named evidence with possible primary replacements. Displayed as analyst inference; no verified official case attribution is asserted." } } ], "attack": [] }, "confidence": { "total": 78, "components": { "provenance": { "score": 20, "max": 20, "rationale": "Original source and provenance inspected." }, "technicalEvidence": { "score": 29, "max": 35, "rationale": "Technical evidence read; methods and outcome limits retained." }, "configurationSpecificity": { "score": 17, "max": 20, "rationale": "Device and configuration details are bounded; missing revisions remain unknown." }, "independentCorroboration": { "score": 4, "max": 15, "rationale": "Independent corroboration is limited; taxonomy citation and same-team artifacts are not independent reproduction." }, "followUpResolution": { "score": 8, "max": 10, "rationale": "Follow-up source checks performed; unresolved items remain explicit." } }, "rationale": null } }, { "id": "primary-emfi-moro-2013", "title": "Electromagnetic fault-model study of a 32-bit Cortex-M3 microcontroller", "canonicalUrl": "https://arxiv.org/pdf/1402.6421", "strand": "primary", "scope": "hardware", "publicationDate": "2013", "eventDate": null, "reviewDate": "2026-11-01", "dateNotes": "Publication date precision: year.", "device": { "description": "130nm Arm Cortex-M3 microcontroller; exact commercial part not disclosed in the inspected passage", "configuration": "Cacheless 32-bit research target with basic clock/voltage protections; original paper version mirrored as arXiv1402.6421." }, "access": "Close physical electromagnetic injection and observation access in a laboratory.", "claim": "Electromagnetic fault-model study of a 32-bit Cortex-M3 microcontroller", "outcome": "Experiments show changes to instruction behavior and Flash-loaded data, supporting a constrained fault model rather than a universal instruction-skip assumption.", "evidenceStatus": "published_research_demonstration", "evidenceGroup": "demonstration", "hardwareBoundary": "Cacheless 32-bit research target with basic clock/voltage protections; original paper version mirrored as arXiv1402.6421.", "mechanisms": [ "Hardware Fault Injection – Control Flow Modification" ], "sources": [ { "url": "https://arxiv.org/pdf/1402.6421", "title": "Electromagnetic fault injection: towards a fault model on a 32-bit microcontroller", "type": "primary_research_paper", "reviewedAt": "2026-11-01", "readStatus": "reviewed", "supports": null, "limitations": [], "provenance": { "key": "emfi-2013", "url": "https://arxiv.org/pdf/1402.6421", "title": "Electromagnetic fault injection: towards a fault model on a 32-bit microcontroller", "scrape_id": "01a19768-471b-74a5-9027-5acb588570b5", "http_status": 200, "parsed_pages": 12, "total_pages": 12, "cache_state": "miss", "cached_at": null, "reported_credits": 12, "error": null, "body_characters": 56759, "source_type": "primary_research_paper" } } ], "followUp": { "performed": [ "Read the original public evidence and compared its scope to the official threat reference." ], "result": "Source review supports the bounded account; no LrrK physical reproduction was performed.", "next_steps": [ "Confirm exact target hardware, firmware, access and mitigation state before any separate authorized assessment." ] }, "limitations": [ "Physical setup and target architecture determine the induced fault.", "The source does not establish an end-to-end drone compromise.", "The original2013 publication and2014 arXiv deposit are versions of one study.", "Research-strand review status: AI-assisted desk review; no physical reproduction or independent human acceptance claimed." ], "mappings": { "emb3d": [ { "id": "TID-105", "name": "Hardware Fault Injection – Control Flow Modification", "url": "https://emb3d.mitre.org/threats/TID-105.html", "basis": "analyst-inference", "rationale": "Named case or primary replacement for evidence cited by the official EMB3D hardware entry.", "officialCaseAttribution": false, "provenance": { "id": "TID-105", "relationship": "official_evidence_reference", "source_url": "https://emb3d.mitre.org/threats/TID-105.html", "basis": "Named case or primary replacement for evidence cited by the official EMB3D hardware entry.", "normalizationNote": "Raw wording combines named evidence with possible primary replacements. Displayed as analyst inference; no verified official case attribution is asserted." } } ], "attack": [] }, "confidence": { "total": 73, "components": { "provenance": { "score": 20, "max": 20, "rationale": "Original source and provenance inspected." }, "technicalEvidence": { "score": 32, "max": 35, "rationale": "Technical evidence read; methods and outcome limits retained." }, "configurationSpecificity": { "score": 14, "max": 20, "rationale": "Device and configuration details are bounded; missing revisions remain unknown." }, "independentCorroboration": { "score": 3, "max": 15, "rationale": "Independent corroboration is limited; taxonomy citation and same-team artifacts are not independent reproduction." }, "followUpResolution": { "score": 4, "max": 10, "rationale": "Follow-up source checks performed; unresolved items remain explicit." } }, "rationale": null } }, { "id": "primary-mu-glitch-2023", "title": "µ-Glitch multiple-fault demonstrations against TrustZone-M protections", "canonicalUrl": "https://www.usenix.org/system/files/usenixsecurity23-sass.pdf", "strand": "primary", "scope": "hardware", "publicationDate": "2023-08", "eventDate": null, "reviewDate": "2026-11-01", "dateNotes": "Publication date precision: month.", "device": { "description": "NXP LPC55SXX / RT6XX, STM32L5 and Atmel SAML11 families evaluated in the paper", "configuration": "Four tested TrustZone-M chip families with different fault defenses; exact board and firmware revisions require consultation of the paper before transfer." }, "access": "Physical voltage-fault laboratory access plus target instrumentation; no flight-system authorization is implied.", "claim": "µ-Glitch multiple-fault demonstrations against TrustZone-M protections", "outcome": "Authors demonstrate that coordinated multiple faults can undermine the tested protections and expose secure memory from nonsecure execution.", "evidenceStatus": "published_research_demonstration", "evidenceGroup": "demonstration", "hardwareBoundary": "Four tested TrustZone-M chip families with different fault defenses; exact board and firmware revisions require consultation of the paper before transfer.", "mechanisms": [ "Hardware Fault Injection – Control Flow Modification" ], "sources": [ { "url": "https://www.usenix.org/system/files/usenixsecurity23-sass.pdf", "title": null, "type": "primary_research_paper", "reviewedAt": "2026-11-01", "readStatus": "reviewed", "supports": null, "limitations": [], "provenance": { "key": "mu-glitch", "url": "https://www.usenix.org/system/files/usenixsecurity23-sass.pdf", "title": null, "scrape_id": "01a19767-0f0b-7676-8794-e83deaa0bc7a", "http_status": 200, "parsed_pages": 19, "total_pages": 19, "cache_state": "miss", "cached_at": null, "reported_credits": 19, "error": null, "body_characters": 86491, "source_type": "primary_research_paper" } } ], "followUp": { "performed": [ "Read full 19-page primary paper, disclosure account and countermeasure discussion.", "Searched for a public unique artifact; results did not establish one." ], "result": "Demonstration is supported by the paper; reproducibility and current mitigation closure remain explicit gaps.", "next_steps": [ "Locate the exact artifact or request author clarification through a separately authorized communication.", "Review exact silicon/firmware revisions and contemporary vendor guidance before any lab proposal." ] }, "limitations": [ "A targeted multi-fault research result, not a guarantee of compromise across all revisions.", "The paper's NXP acknowledgement is author-reported; a separate current vendor fix was not verified.", "A targeted artifact search did not establish a unique public µ-Glitch release.", "Research-strand review status: AI-assisted desk review; no physical reproduction or independent human acceptance claimed." ], "mappings": { "emb3d": [ { "id": "TID-105", "name": "Hardware Fault Injection – Control Flow Modification", "url": "https://emb3d.mitre.org/threats/TID-105.html", "basis": "analyst-inference", "rationale": "Named case or primary replacement for evidence cited by the official EMB3D hardware entry.", "officialCaseAttribution": false, "provenance": { "id": "TID-105", "relationship": "official_evidence_reference", "source_url": "https://emb3d.mitre.org/threats/TID-105.html", "basis": "Named case or primary replacement for evidence cited by the official EMB3D hardware entry.", "normalizationNote": "Raw wording combines named evidence with possible primary replacements. Displayed as analyst inference; no verified official case attribution is asserted." } } ], "attack": [] }, "confidence": { "total": 77, "components": { "provenance": { "score": 20, "max": 20, "rationale": "Original source and provenance inspected." }, "technicalEvidence": { "score": 33, "max": 35, "rationale": "Technical evidence read; methods and outcome limits retained." }, "configurationSpecificity": { "score": 16, "max": 20, "rationale": "Device and configuration details are bounded; missing revisions remain unknown." }, "independentCorroboration": { "score": 3, "max": 15, "rationale": "Independent corroboration is limited; taxonomy citation and same-team artifacts are not independent reproduction." }, "followUpResolution": { "score": 5, "max": 10, "rationale": "Follow-up source checks performed; unresolved items remain explicit." } }, "rationale": null } }, { "id": "primary-membuster-2020", "title": "MEMBUSTER off-chip memory-bus leakage from SGX applications", "canonicalUrl": "https://www.usenix.org/system/files/sec20summer_lee-dayeol_prepub.pdf", "strand": "primary", "scope": "hardware", "publicationDate": "2020", "eventDate": null, "reviewDate": "2026-11-01", "dateNotes": "Publication date precision: year.", "device": { "description": "Intel SGX test platform including an i5-8400 and external DDR4", "configuration": "Hunspell and Memcached enclaves, exposed address-bus observations; advanced experiments also use a modified SGX driver." }, "access": "Physical memory-bus observation; some enhancement scenarios additionally assume privileged host control.", "claim": "MEMBUSTER off-chip memory-bus leakage from SGX applications", "outcome": "The paper demonstrates recovering sensitive application behavior/data from memory-access patterns visible off chip.", "evidenceStatus": "published_research_demonstration", "evidenceGroup": "demonstration", "hardwareBoundary": "Hunspell and Memcached enclaves, exposed address-bus observations; advanced experiments also use a modified SGX driver.", "mechanisms": [ "Data Bus Interception" ], "sources": [ { "url": "https://www.usenix.org/system/files/sec20summer_lee-dayeol_prepub.pdf", "title": null, "type": "primary_research_paper", "reviewedAt": "2026-11-01", "readStatus": "reviewed", "supports": null, "limitations": [], "provenance": { "key": "membuster", "url": "https://www.usenix.org/system/files/sec20summer_lee-dayeol_prepub.pdf", "title": null, "scrape_id": "01a19767-0eff-721a-a118-b3cd26fecd98", "http_status": 200, "parsed_pages": 18, "total_pages": 18, "cache_state": "miss", "cached_at": null, "reported_credits": 18, "error": null, "body_characters": 96952, "source_type": "primary_research_paper" } } ], "followUp": { "performed": [ "Read the original public evidence and compared its scope to the official threat reference." ], "result": "Source review supports the bounded account; no LrrK physical reproduction was performed.", "next_steps": [ "Confirm exact target hardware, firmware, access and mitigation state before any separate authorized assessment." ] }, "limitations": [ "This is address-pattern leakage, not automatically plaintext recovery from every encrypted bus.", "External-memory topology, application behavior and optional privileged enhancements constrain transfer.", "Research-strand review status: AI-assisted desk review; no physical reproduction or independent human acceptance claimed." ], "mappings": { "emb3d": [ { "id": "TID-106", "name": "Data Bus Interception", "url": "https://emb3d.mitre.org/threats/TID-106.html", "basis": "analyst-inference", "rationale": "Named case or primary replacement for evidence cited by the official EMB3D hardware entry.", "officialCaseAttribution": false, "provenance": { "id": "TID-106", "relationship": "official_evidence_reference", "source_url": "https://emb3d.mitre.org/threats/TID-106.html", "basis": "Named case or primary replacement for evidence cited by the official EMB3D hardware entry.", "normalizationNote": "Raw wording combines named evidence with possible primary replacements. Displayed as analyst inference; no verified official case attribution is asserted." } } ], "attack": [] }, "confidence": { "total": 78, "components": { "provenance": { "score": 20, "max": 20, "rationale": "Original source and provenance inspected." }, "technicalEvidence": { "score": 33, "max": 35, "rationale": "Technical evidence read; methods and outcome limits retained." }, "configurationSpecificity": { "score": 18, "max": 20, "rationale": "Device and configuration details are bounded; missing revisions remain unknown." }, "independentCorroboration": { "score": 3, "max": 15, "rationale": "Independent corroboration is limited; taxonomy citation and same-team artifacts are not independent reproduction." }, "followUpResolution": { "score": 4, "max": 10, "rationale": "Follow-up source checks performed; unresolved items remain explicit." } }, "rationale": null } }, { "id": "primary-dma-dell-2020", "title": "Pre-boot DMA exposure from Dell XPS7390 Thunderbolt configuration", "canonicalUrl": "https://eclypsium.com/blog/direct-memory-access-attacks-a-walk-down-memory-lane/", "strand": "primary", "scope": "hardware", "publicationDate": "2020-01-30", "eventDate": null, "reviewDate": "2026-11-01", "dateNotes": "Publication date precision: day.", "device": { "description": "Dell XPS 13 7390 2-in-1", "configuration": "The tested default enabled Thunderbolt/PCIe pre-boot modules; the report links a Dell advisory and says other platforms had that setting disabled." }, "access": "Physical external Thunderbolt connection during the relevant pre-boot state.", "claim": "Pre-boot DMA exposure from Dell XPS7390 Thunderbolt configuration", "outcome": "Researchers demonstrate a closed-chassis DMA attack in the tested configuration despite other boot-security features.", "evidenceStatus": "published_research_demonstration", "evidenceGroup": "demonstration", "hardwareBoundary": "The tested default enabled Thunderbolt/PCIe pre-boot modules; the report links a Dell advisory and says other platforms had that setting disabled.", "mechanisms": [ "Unauthorized Direct Memory Access (DMA)" ], "sources": [ { "url": "https://eclypsium.com/blog/direct-memory-access-attacks-a-walk-down-memory-lane/", "title": "Memory Lane - Direct Memory Access Attacks | Eclypsium", "type": "original_researcher_report", "reviewedAt": "2026-11-01", "readStatus": "reviewed", "supports": null, "limitations": [], "provenance": { "key": "dma-eclypsium", "url": "https://eclypsium.com/blog/direct-memory-access-attacks-a-walk-down-memory-lane/", "title": "Memory Lane - Direct Memory Access Attacks | Eclypsium", "scrape_id": "01a19766-ba6c-759f-92b2-0e73615c4a50", "http_status": 200, "parsed_pages": null, "total_pages": null, "cache_state": "miss", "cached_at": null, "reported_credits": 1, "error": null, "body_characters": 20182, "source_type": "original_researcher_report" } } ], "followUp": { "performed": [ "Read the original attack and vendor-mitigation sections." ], "result": "The demonstrated configuration is bounded; no claim is made about current defaults or firmware.", "next_steps": [ "Confirm exact target hardware, firmware, access and mitigation state before any separate authorized assessment." ] }, "limitations": [ "The insecure setting is material; presence of Thunderbolt alone is insufficient.", "The linked Dell advisory itself was not separately read in this strand; vendor remediation is reported by the researchers.", "Research-strand review status: AI-assisted desk review; no physical reproduction or independent human acceptance claimed." ], "mappings": { "emb3d": [ { "id": "TID-107", "name": "Unauthorized Direct Memory Access (DMA)", "url": "https://emb3d.mitre.org/threats/TID-107.html", "basis": "analyst-inference", "rationale": "Named case or primary replacement for evidence cited by the official EMB3D hardware entry.", "officialCaseAttribution": false, "provenance": { "id": "TID-107", "relationship": "official_evidence_reference", "source_url": "https://emb3d.mitre.org/threats/TID-107.html", "basis": "Named case or primary replacement for evidence cited by the official EMB3D hardware entry.", "normalizationNote": "Raw wording combines named evidence with possible primary replacements. Displayed as analyst inference; no verified official case attribution is asserted." } } ], "attack": [] }, "confidence": { "total": 76, "components": { "provenance": { "score": 20, "max": 20, "rationale": "Original source and provenance inspected." }, "technicalEvidence": { "score": 28, "max": 35, "rationale": "Technical evidence read; methods and outcome limits retained." }, "configurationSpecificity": { "score": 18, "max": 20, "rationale": "Device and configuration details are bounded; missing revisions remain unknown." }, "independentCorroboration": { "score": 5, "max": 15, "rationale": "Independent corroboration is limited; taxonomy citation and same-team artifacts are not independent reproduction." }, "followUpResolution": { "score": 5, "max": 10, "rationale": "Follow-up source checks performed; unresolved items remain explicit." } }, "rationale": null } }, { "id": "primary-dma-hp-2020", "title": "HP pre-boot DMA demonstration and configuration-dependent retest", "canonicalUrl": "https://eclypsium.com/blog/direct-memory-access-attacks-a-walk-down-memory-lane/", "strand": "primary", "scope": "hardware", "publicationDate": "2020-01-30", "eventDate": null, "reviewDate": "2026-11-01", "dateNotes": "Publication date precision: day.", "device": { "description": "HP ProBook 640 G4; retest on EliteBook 840 G6 with Sure Start Gen 5", "configuration": "Original open-chassis DMA test; retest BIOS 01.04.02 dated 2020-01-20. The pre-boot protection setting changes the result." }, "access": "Physical internal DMA-capable interface access before OS boot.", "claim": "HP pre-boot DMA demonstration and configuration-dependent retest", "outcome": "Original system permitted boot-time memory modification/code execution. The author retest reports protection on the newer BIOS when configured to cover the relevant devices, while a Thunderbolt-only setting left the internal path exposed.", "evidenceStatus": "published_research_demonstration", "evidenceGroup": "demonstration", "hardwareBoundary": "Original open-chassis DMA test; retest BIOS 01.04.02 dated 2020-01-20. The pre-boot protection setting changes the result.", "mechanisms": [ "Unauthorized Direct Memory Access (DMA)" ], "sources": [ { "url": "https://eclypsium.com/blog/direct-memory-access-attacks-a-walk-down-memory-lane/", "title": "Memory Lane - Direct Memory Access Attacks | Eclypsium", "type": "original_researcher_report", "reviewedAt": "2026-11-01", "readStatus": "reviewed", "supports": null, "limitations": [], "provenance": { "key": "dma-eclypsium", "url": "https://eclypsium.com/blog/direct-memory-access-attacks-a-walk-down-memory-lane/", "title": "Memory Lane - Direct Memory Access Attacks | Eclypsium", "scrape_id": "01a19766-ba6c-759f-92b2-0e73615c4a50", "http_status": 200, "parsed_pages": null, "total_pages": null, "cache_state": "miss", "cached_at": null, "reported_credits": 1, "error": null, "body_characters": 20182, "source_type": "original_researcher_report" } } ], "followUp": { "performed": [ "Read the newer EliteBook BIOS retest and its contrast between protection settings." ], "result": "Retest/counterevidence is preserved alongside the initial success.", "next_steps": [ "Confirm exact target hardware, firmware, access and mitigation state before any separate authorized assessment." ] }, "limitations": [ "The attack and retest involve different hardware generations.", "The researcher's successful retest is not independent LrrK validation or a blanket statement about all HP systems.", "Research-strand review status: AI-assisted desk review; no physical reproduction or independent human acceptance claimed." ], "mappings": { "emb3d": [ { "id": "TID-107", "name": "Unauthorized Direct Memory Access (DMA)", "url": "https://emb3d.mitre.org/threats/TID-107.html", "basis": "analyst-inference", "rationale": "Named case or primary replacement for evidence cited by the official EMB3D hardware entry.", "officialCaseAttribution": false, "provenance": { "id": "TID-107", "relationship": "official_evidence_reference", "source_url": "https://emb3d.mitre.org/threats/TID-107.html", "basis": "Named case or primary replacement for evidence cited by the official EMB3D hardware entry.", "normalizationNote": "Raw wording combines named evidence with possible primary replacements. Displayed as analyst inference; no verified official case attribution is asserted." } } ], "attack": [] }, "confidence": { "total": 82, "components": { "provenance": { "score": 20, "max": 20, "rationale": "Original source and provenance inspected." }, "technicalEvidence": { "score": 30, "max": 35, "rationale": "Technical evidence read; methods and outcome limits retained." }, "configurationSpecificity": { "score": 19, "max": 20, "rationale": "Device and configuration details are bounded; missing revisions remain unknown." }, "independentCorroboration": { "score": 5, "max": 15, "rationale": "Independent corroboration is limited; taxonomy citation and same-team artifacts are not independent reproduction." }, "followUpResolution": { "score": 8, "max": 10, "rationale": "Follow-up source checks performed; unresolved items remain explicit." } }, "rationale": null } }, { "id": "primary-thunderspy-2020", "title": "Thunderspy Thunderbolt security research and protection boundary", "canonicalUrl": "https://thunderspy.io/", "strand": "primary", "scope": "hardware", "publicationDate": "2020", "eventDate": null, "reviewDate": "2026-11-01", "dateNotes": "Publication date precision: year.", "device": { "description": "Thunderbolt1/2/3 systems investigated by the original researchers", "configuration": "Attack variants depend on controller firmware and whether Kernel DMA Protection is implemented. Historical2011–2020 product claims are not treated as a2026 inventory." }, "access": "Brief physical access, often opening the enclosure; some variants involve a connected peripheral.", "claim": "Thunderspy Thunderbolt security research and protection boundary", "outcome": "The author reports multiple controller-protection weaknesses enabling unauthorized DMA paths on tested systems and distinguishes partial protection from Kernel DMA Protection.", "evidenceStatus": "published_research_demonstration", "evidenceGroup": "demonstration", "hardwareBoundary": "Attack variants depend on controller firmware and whether Kernel DMA Protection is implemented. Historical2011–2020 product claims are not treated as a2026 inventory.", "mechanisms": [ "Unauthorized Direct Memory Access (DMA)" ], "sources": [ { "url": "https://thunderspy.io/", "title": "Thunderspy - When Lightning Strikes Thrice: Breaking Thunderbolt 3 Security", "type": "original_researcher_report", "reviewedAt": "2026-11-01", "readStatus": "reviewed", "supports": null, "limitations": [], "provenance": { "key": "thunderspy", "url": "https://thunderspy.io/", "title": "Thunderspy - When Lightning Strikes Thrice: Breaking Thunderbolt 3 Security", "scrape_id": "01a19766-ba64-77dc-8714-a7466d247b77", "http_status": 200, "parsed_pages": null, "total_pages": null, "cache_state": "miss", "cached_at": null, "reported_credits": 1, "error": null, "body_characters": 48764, "source_type": "original_researcher_report" } }, { "url": "https://github.com/BjornRuytenberg/spycheck-linux", "title": "GitHub - BjornRuytenberg/spycheck-linux: Verify whether your Thunderbolt-enabled Linux system is vulnerable to the Thunderspy attacks. · GitHub", "type": "author_artifact_repository", "reviewedAt": "2026-11-01", "readStatus": "reviewed", "supports": null, "limitations": [], "provenance": { "key": "artifact-thunderspy", "url": "https://github.com/BjornRuytenberg/spycheck-linux", "title": "GitHub - BjornRuytenberg/spycheck-linux: Verify whether your Thunderbolt-enabled Linux system is vulnerable to the Thunderspy attacks. · GitHub", "scrape_id": "01a1976d-5940-741e-9be4-a404bf9abee1", "http_status": 200, "parsed_pages": null, "total_pages": null, "cache_state": "miss", "cached_at": null, "reported_credits": 1, "error": null, "body_characters": 9285, "source_type": "author_artifact_repository" } } ], "followUp": { "performed": [ "Read the author's updates and Kernel DMA Protection discussion.", "Verified the public Spycheck repository exists; did not run it." ], "result": "Availability of a checker is separated from vulnerable-device or exploitation evidence.", "next_steps": [ "Confirm exact target hardware, firmware, access and mitigation state before any separate authorized assessment." ] }, "limitations": [ "The homepage's broad device statements require per-system validation.", "Spycheck is a discovery/checking artifact, not proof of successful exploitation.", "No current product-wide vulnerability claim is made.", "Research-strand review status: AI-assisted desk review; no physical reproduction or independent human acceptance claimed." ], "mappings": { "emb3d": [ { "id": "TID-107", "name": "Unauthorized Direct Memory Access (DMA)", "url": "https://emb3d.mitre.org/threats/TID-107.html", "basis": "analyst-inference", "rationale": "Named case or primary replacement for evidence cited by the official EMB3D hardware entry.", "officialCaseAttribution": false, "provenance": { "id": "TID-107", "relationship": "official_evidence_reference", "source_url": "https://emb3d.mitre.org/threats/TID-107.html", "basis": "Named case or primary replacement for evidence cited by the official EMB3D hardware entry.", "normalizationNote": "Raw wording combines named evidence with possible primary replacements. Displayed as analyst inference; no verified official case attribution is asserted." } } ], "attack": [] }, "confidence": { "total": 74, "components": { "provenance": { "score": 20, "max": 20, "rationale": "Original source and provenance inspected." }, "technicalEvidence": { "score": 28, "max": 35, "rationale": "Technical evidence read; methods and outcome limits retained." }, "configurationSpecificity": { "score": 15, "max": 20, "rationale": "Device and configuration details are bounded; missing revisions remain unknown." }, "independentCorroboration": { "score": 4, "max": 15, "rationale": "Independent corroboration is limited; taxonomy citation and same-team artifacts are not independent reproduction." }, "followUpResolution": { "score": 7, "max": 10, "rationale": "Follow-up source checks performed; unresolved items remain explicit." } }, "rationale": null } }, { "id": "primary-siemens-root-of-trust-2023", "title": "Siemens S7-1500 immutable-root-of-trust weakness and hardware revisions", "canonicalUrl": "https://redballoonsecurity.com/siemens-discovery/", "strand": "primary", "scope": "hardware", "publicationDate": "2023-01-10", "eventDate": null, "reviewDate": "2026-11-01", "dateNotes": "Publication date precision: day.", "device": { "description": "Affected Siemens SIMATIC/SIPLUS S7-1500 CPU product variants", "configuration": "CVE-2022-38773. Vendor SSA-482757 V1.5, updated 2025-01-14, enumerates product-specific affected versions and replacement hardware." }, "access": "Physical tampering with affected PLC hardware and storage/peripheral trust paths.", "claim": "Siemens S7-1500 immutable-root-of-trust weakness and hardware revisions", "outcome": "Original research describes boot-image replacement and protected-boot bypass; Siemens confirms the hardware root-of-trust issue and identifies newer fixed hardware for selected CPU types.", "evidenceStatus": "published_research_demonstration", "evidenceGroup": "demonstration", "hardwareBoundary": "CVE-2022-38773. Vendor SSA-482757 V1.5, updated 2025-01-14, enumerates product-specific affected versions and replacement hardware.", "mechanisms": [ "ROM/NVRAM Data Extraction or Modification", "Peripheral Data Bus Interception" ], "sources": [ { "url": "https://redballoonsecurity.com/siemens-discovery/", "title": "Siemens SIMATIC S7-1500 Boot Bypass Vulnerabilities", "type": "original_researcher_report", "reviewedAt": "2026-11-01", "readStatus": "reviewed", "supports": null, "limitations": [], "provenance": { "key": "siemens-s7", "url": "https://redballoonsecurity.com/siemens-discovery/", "title": "Siemens SIMATIC S7-1500 Boot Bypass Vulnerabilities", "scrape_id": "01a19766-ba7d-7042-8520-9bffbc82e305", "http_status": 200, "parsed_pages": null, "total_pages": null, "cache_state": "miss", "cached_at": null, "reported_credits": 1, "error": null, "body_characters": 25186, "source_type": "original_researcher_report" } }, { "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-482757.pdf", "title": "SSA-482757_V1.5", "type": "vendor_security_advisory", "reviewedAt": "2026-11-01", "readStatus": "reviewed", "supports": null, "limitations": [], "provenance": { "key": "siemens-advisory", "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-482757.pdf", "title": "SSA-482757_V1.5", "scrape_id": "01a19769-da3e-7435-ba2f-253407cf53ac", "http_status": 200, "parsed_pages": 14, "total_pages": 14, "cache_state": "miss", "cached_at": null, "reported_credits": 14, "error": null, "body_characters": 32300, "source_type": "vendor_security_advisory" } }, { "url": "https://attack.mitre.org/versions/v20/techniques/T1693/001/", "title": "Modify Firmware: System Firmware, Sub-technique T1693.001 - ICS | MITRE ATT&CK®", "type": "official_taxonomy", "reviewedAt": "2026-11-01", "readStatus": "reviewed", "supports": null, "limitations": [], "provenance": { "key": "attck-system-ics", "url": "https://attack.mitre.org/versions/v20/techniques/T1693/001/", "title": "Modify Firmware: System Firmware, Sub-technique T1693.001 - ICS | MITRE ATT&CK®", "scrape_id": "01a19769-da42-7147-9100-0001041399b7", "http_status": 200, "parsed_pages": null, "total_pages": null, "cache_state": "miss", "cached_at": null, "reported_credits": 1, "error": null, "body_characters": 17083, "source_type": "official_taxonomy" } } ], "followUp": { "performed": [ "Read both original disclosure and current retrieved Siemens advisory V1.5.", "Checked the current versioned ICS technique definition before the analyst cross-reference." ], "result": "Vendor confirmation, fixed-hardware distinctions and taxonomy-version changes are retained.", "next_steps": [ "Confirm exact target hardware, firmware, access and mitigation state before any separate authorized assessment." ] }, "limitations": [ "Affected product lists are not interchangeable with the entire S7-1500 family.", "Hardware replacement/fix availability is product-specific; a firmware-only repair should not be assumed.", "No evidence of field exploitation is established by this research.", "Research-strand review status: AI-assisted desk review; no physical reproduction or independent human acceptance claimed." ], "mappings": { "emb3d": [ { "id": "TID-108", "name": "ROM/NVRAM Data Extraction or Modification", "url": "https://emb3d.mitre.org/threats/TID-108.html", "basis": "analyst-inference", "rationale": "Named case or primary replacement for evidence cited by the official EMB3D hardware entry.", "officialCaseAttribution": false, "provenance": { "id": "TID-108", "relationship": "official_evidence_reference", "source_url": "https://emb3d.mitre.org/threats/TID-108.html", "basis": "Named case or primary replacement for evidence cited by the official EMB3D hardware entry.", "normalizationNote": "Raw wording combines named evidence with possible primary replacements. Displayed as analyst inference; no verified official case attribution is asserted." } }, { "id": "TID-114", "name": "Peripheral Data Bus Interception", "url": "https://emb3d.mitre.org/threats/TID-114.html", "basis": "analyst-inference", "rationale": "Named case or primary replacement for evidence cited by the official EMB3D hardware entry.", "officialCaseAttribution": false, "provenance": { "id": "TID-114", "relationship": "official_evidence_reference", "source_url": "https://emb3d.mitre.org/threats/TID-114.html", "basis": "Named case or primary replacement for evidence cited by the official EMB3D hardware entry.", "normalizationNote": "Raw wording combines named evidence with possible primary replacements. Displayed as analyst inference; no verified official case attribution is asserted." } } ], "attack": [ { "id": "T1693.001", "name": "Modify Firmware: System Firmware", "url": "https://attack.mitre.org/versions/v20/techniques/T1693/001/", "basis": "analyst-inference", "rationale": "The documented PLC boot-image modification is consistent with the technique definition; MITRE is not asserted to name this specific laboratory case.", "officialCaseAttribution": false, "domain": "ics", "provenance": { "id": "T1693.001", "name": "Modify Firmware: System Firmware", "domain": "ics", "version": "20.0", "relationship": "analyst_inference", "source_url": "https://attack.mitre.org/versions/v20/techniques/T1693/001/", "basis": "The documented PLC boot-image modification is consistent with the technique definition; MITRE is not asserted to name this specific laboratory case." } } ] }, "confidence": { "total": 91, "components": { "provenance": { "score": 20, "max": 20, "rationale": "Original source and provenance inspected." }, "technicalEvidence": { "score": 32, "max": 35, "rationale": "Technical evidence read; methods and outcome limits retained." }, "configurationSpecificity": { "score": 19, "max": 20, "rationale": "Device and configuration details are bounded; missing revisions remain unknown." }, "independentCorroboration": { "score": 11, "max": 15, "rationale": "Independent corroboration is limited; taxonomy citation and same-team artifacts are not independent reproduction." }, "followUpResolution": { "score": 9, "max": 10, "rationale": "Follow-up source checks performed; unresolved items remain explicit." } }, "rationale": null } }, { "id": "primary-cryo-ram-2023", "title": "Cryo-mechanical extraction from a Siemens S7-1511 PLC", "canonicalUrl": "https://wootconference.org/papers/woot23-paper3.pdf", "strand": "primary", "scope": "hardware", "publicationDate": "2023", "eventDate": null, "reviewDate": "2026-11-01", "dateNotes": "Publication date precision: year.", "device": { "description": "Siemens S7-1511-1 PN CPU module 6ES7511-1AK02-0AB0", "configuration": "Custom embedded memory layout with LPDDR1 / DDR2 handling in the study; FPGA readout and a dedicated cryo-mechanical apparatus." }, "access": "Invasive physical memory-chip handling and specialized laboratory equipment; prior device code execution is not required for the demonstrated approach.", "claim": "Cryo-mechanical extraction from a Siemens S7-1511 PLC", "outcome": "Authors demonstrate volatile-memory extraction and reconstruction from the selected PLC, enabling inspection of runtime content.", "evidenceStatus": "published_research_demonstration", "evidenceGroup": "demonstration", "hardwareBoundary": "Custom embedded memory layout with LPDDR1 / DDR2 handling in the study; FPGA readout and a dedicated cryo-mechanical apparatus.", "mechanisms": [ "RAM Chip Contents Readout" ], "sources": [ { "url": "https://wootconference.org/papers/woot23-paper3.pdf", "title": null, "type": "primary_research_paper", "reviewedAt": "2026-11-01", "readStatus": "reviewed", "supports": null, "limitations": [], "provenance": { "key": "cryo", "url": "https://wootconference.org/papers/woot23-paper3.pdf", "title": null, "scrape_id": "01a19767-0ef9-73dc-a407-a32ce7a319f6", "http_status": 200, "parsed_pages": 12, "total_pages": 12, "cache_state": "miss", "cached_at": null, "reported_credits": 12, "error": null, "body_characters": 63618, "source_type": "primary_research_paper" } } ], "followUp": { "performed": [ "Read the complete 12-page paper, target-model section and future-work limitations.", "Compared the result with the2013 cold-boot abstract's failedDDR3 reproduction." ], "result": "Preserved demonstrated PLC scope and separated preliminary or future memory-generation claims.", "next_steps": [ "Confirm exact target hardware, firmware, access and mitigation state before any separate authorized assessment." ] }, "limitations": [ "The paper discusses drones as possible external-DRAM environments; it does not demonstrate extraction from every quadcopter.", "CiscoDDR3 work is described as preliminary; DDR4/DDR5 transfer is a research expectation, not a completed result.", "Hardware manipulation can be destructive and is not authorized by a library entry.", "Research-strand review status: AI-assisted desk review; no physical reproduction or independent human acceptance claimed." ], "mappings": { "emb3d": [ { "id": "TID-109", "name": "RAM Chip Contents Readout", "url": "https://emb3d.mitre.org/threats/TID-109.html", "basis": "analyst-inference", "rationale": "Named case or primary replacement for evidence cited by the official EMB3D hardware entry.", "officialCaseAttribution": false, "provenance": { "id": "TID-109", "relationship": "official_evidence_reference", "source_url": "https://emb3d.mitre.org/threats/TID-109.html", "basis": "Named case or primary replacement for evidence cited by the official EMB3D hardware entry.", "normalizationNote": "Raw wording combines named evidence with possible primary replacements. Displayed as analyst inference; no verified official case attribution is asserted." } } ], "attack": [] }, "confidence": { "total": 84, "components": { "provenance": { "score": 20, "max": 20, "rationale": "Original source and provenance inspected." }, "technicalEvidence": { "score": 33, "max": 35, "rationale": "Technical evidence read; methods and outcome limits retained." }, "configurationSpecificity": { "score": 19, "max": 20, "rationale": "Device and configuration details are bounded; missing revisions remain unknown." }, "independentCorroboration": { "score": 4, "max": 15, "rationale": "Independent corroboration is limited; taxonomy citation and same-team artifacts are not independent reproduction." }, "followUpResolution": { "score": 8, "max": 10, "rationale": "Follow-up source checks performed; unresolved items remain explicit." } }, "rationale": null } }, { "id": "primary-rowhammer-2014", "title": "Original experimental DRAM disturbance study", "canonicalUrl": "https://users.ece.cmu.edu/~yoonguk/papers/kim-isca14.pdf", "strand": "primary", "scope": "hardware", "publicationDate": "2014", "eventDate": null, "reviewDate": "2026-11-01", "dateNotes": "Publication date precision: year.", "device": { "description": "129 tested DDR3 modules from three manufacturers and Intel/AMD test systems", "configuration": "The study reports disturbance errors in110 of 129 modules; those historical sample results do not describe every current memory generation." }, "access": "Suitable local memory-access execution; characterization also uses laboratory FPGA equipment.", "claim": "Original experimental DRAM disturbance study", "outcome": "Repeated accesses cause corruption in other DRAM rows on susceptible modules; the paper establishes the physical disturbance phenomenon.", "evidenceStatus": "published_research_demonstration", "evidenceGroup": "demonstration", "hardwareBoundary": "The study reports disturbance errors in110 of 129 modules; those historical sample results do not describe every current memory generation.", "mechanisms": [ "Hardware Fault Injection – Data Manipulation" ], "sources": [ { "url": "https://users.ece.cmu.edu/~yoonguk/papers/kim-isca14.pdf", "title": null, "type": "primary_research_paper", "reviewedAt": "2026-11-01", "readStatus": "reviewed", "supports": null, "limitations": [], "provenance": { "key": "rowhammer2014", "url": "https://users.ece.cmu.edu/~yoonguk/papers/kim-isca14.pdf", "title": null, "scrape_id": "01a19769-d958-76f6-9dfd-61d6779fc2f2", "http_status": 200, "parsed_pages": 12, "total_pages": 12, "cache_state": "miss", "cached_at": null, "reported_credits": 12, "error": null, "body_characters": 97047, "source_type": "primary_research_paper" } } ], "followUp": { "performed": [ "Read original characterization results.", "Compared the historical phenomenon with later GPU-specific primary studies." ], "result": "Kept the foundational result separate from later exploit and device configurations.", "next_steps": [ "Confirm exact target hardware, firmware, access and mitigation state before any separate authorized assessment." ] }, "limitations": [ "The original disturbance demonstration should not be relabeled as proof of every later privilege-escalation exploit.", "Refresh, memory-controller, cell and configuration differences matter.", "Research-strand review status: AI-assisted desk review; no physical reproduction or independent human acceptance claimed." ], "mappings": { "emb3d": [ { "id": "TID-110", "name": "Hardware Fault Injection – Data Manipulation", "url": "https://emb3d.mitre.org/threats/TID-110.html", "basis": "analyst-inference", "rationale": "Named case or primary replacement for evidence cited by the official EMB3D hardware entry.", "officialCaseAttribution": false, "provenance": { "id": "TID-110", "relationship": "official_evidence_reference", "source_url": "https://emb3d.mitre.org/threats/TID-110.html", "basis": "Named case or primary replacement for evidence cited by the official EMB3D hardware entry.", "normalizationNote": "Raw wording combines named evidence with possible primary replacements. Displayed as analyst inference; no verified official case attribution is asserted." } } ], "attack": [] }, "confidence": { "total": 88, "components": { "provenance": { "score": 20, "max": 20, "rationale": "Original source and provenance inspected." }, "technicalEvidence": { "score": 34, "max": 35, "rationale": "Technical evidence read; methods and outcome limits retained." }, "configurationSpecificity": { "score": 19, "max": 20, "rationale": "Device and configuration details are bounded; missing revisions remain unknown." }, "independentCorroboration": { "score": 9, "max": 15, "rationale": "Independent corroboration is limited; taxonomy citation and same-team artifacts are not independent reproduction." }, "followUpResolution": { "score": 6, "max": 10, "rationale": "Follow-up source checks performed; unresolved items remain explicit." } }, "rationale": null } }, { "id": "primary-plundervolt-2020", "title": "Plundervolt privileged-software fault injection against SGX", "canonicalUrl": "https://plundervolt.com/doc/plundervolt.pdf", "strand": "primary", "scope": "hardware", "publicationDate": "2020", "eventDate": null, "reviewDate": "2026-11-01", "dateNotes": "Publication date precision: year.", "device": { "description": "Tested Intel SGX-capable Core processors from Skylake onward", "configuration": "Original table includes i7-6700K, i7-7700HQ, i3-7100U and related tested systems, with microcode-specific conditions." }, "access": "Privileged software access to a voltage-management interface; physical access is not required for this threat model.", "claim": "Plundervolt privileged-software fault injection against SGX", "outcome": "Authors demonstrate corruption of SGX computations, including cryptographic and memory-safety consequences under the tested conditions.", "evidenceStatus": "published_research_demonstration", "evidenceGroup": "demonstration", "hardwareBoundary": "Original table includes i7-6700K, i7-7700HQ, i3-7100U and related tested systems, with microcode-specific conditions.", "mechanisms": [ "Hardware Fault Injection – Data Manipulation" ], "sources": [ { "url": "https://plundervolt.com/doc/plundervolt.pdf", "title": null, "type": "primary_research_paper", "reviewedAt": "2026-11-01", "readStatus": "reviewed", "supports": null, "limitations": [], "provenance": { "key": "plundervolt", "url": "https://plundervolt.com/doc/plundervolt.pdf", "title": null, "scrape_id": "01a19767-0ed0-756c-be6b-4e82809741cd", "http_status": 200, "parsed_pages": 17, "total_pages": 17, "cache_state": "miss", "cached_at": null, "reported_credits": 17, "error": null, "body_characters": 102700, "source_type": "primary_research_paper" } }, { "url": "https://plundervolt.com/", "title": "Plundervolt", "type": "original_researcher_report", "reviewedAt": "2026-11-01", "readStatus": "reviewed", "supports": null, "limitations": [], "provenance": { "key": "plundervolt-site", "url": "https://plundervolt.com/", "title": "Plundervolt", "scrape_id": "01a1976b-2e47-70c2-9132-2f5a58f1bd59", "http_status": 200, "parsed_pages": null, "total_pages": null, "cache_state": "miss", "cached_at": null, "reported_credits": 1, "error": null, "body_characters": 9721, "source_type": "original_researcher_report" } }, { "url": "https://github.com/KitMurdock/plundervolt", "title": "GitHub - KitMurdock/plundervolt · GitHub", "type": "author_artifact_repository", "reviewedAt": "2026-11-01", "readStatus": "reviewed", "supports": null, "limitations": [], "provenance": { "key": "artifact-plundervolt", "url": "https://github.com/KitMurdock/plundervolt", "title": "GitHub - KitMurdock/plundervolt · GitHub", "scrape_id": "01a1976d-57b8-7355-8516-32d1d9289708", "http_status": 200, "parsed_pages": null, "total_pages": null, "cache_state": "miss", "cached_at": null, "reported_credits": 1, "error": null, "body_characters": 6673, "source_type": "author_artifact_repository" } } ], "followUp": { "performed": [ "Read full primary paper and its exact CPU/microcode table.", "Read disclosure/mitigation context and verified that the author artifact repository is accessible." ], "result": "Access and microcode boundaries remain explicit; artifact presence is not execution proof.", "next_steps": [ "Confirm exact target hardware, firmware, access and mitigation state before any separate authorized assessment." ] }, "limitations": [ "An existing privileged foothold is required; this is not unprivileged remote entry.", "Current microcode and locked voltage-control configurations can change applicability.", "Author disclosure/advisory links were read on the author site, but a separate current Intel advisory was not inspected.", "Research-strand review status: AI-assisted desk review; no physical reproduction or independent human acceptance claimed." ], "mappings": { "emb3d": [ { "id": "TID-110", "name": "Hardware Fault Injection – Data Manipulation", "url": "https://emb3d.mitre.org/threats/TID-110.html", "basis": "analyst-inference", "rationale": "Named case or primary replacement for evidence cited by the official EMB3D hardware entry.", "officialCaseAttribution": false, "provenance": { "id": "TID-110", "relationship": "official_evidence_reference", "source_url": "https://emb3d.mitre.org/threats/TID-110.html", "basis": "Named case or primary replacement for evidence cited by the official EMB3D hardware entry.", "normalizationNote": "Raw wording combines named evidence with possible primary replacements. Displayed as analyst inference; no verified official case attribution is asserted." } } ], "attack": [] }, "confidence": { "total": 86, "components": { "provenance": { "score": 20, "max": 20, "rationale": "Original source and provenance inspected." }, "technicalEvidence": { "score": 34, "max": 35, "rationale": "Technical evidence read; methods and outcome limits retained." }, "configurationSpecificity": { "score": 19, "max": 20, "rationale": "Device and configuration details are bounded; missing revisions remain unknown." }, "independentCorroboration": { "score": 5, "max": 15, "rationale": "Independent corroboration is limited; taxonomy citation and same-team artifacts are not independent reproduction." }, "followUpResolution": { "score": 8, "max": 10, "rationale": "Follow-up source checks performed; unresolved items remain explicit." } }, "rationale": null } }, { "id": "primary-clkscrew-2017", "title": "CLKSCREW software-controlled energy-management faults", "canonicalUrl": "https://www.usenix.org/system/files/conference/usenixsecurity17/sec17-tang.pdf", "strand": "primary", "scope": "hardware", "publicationDate": "2017-08", "eventDate": null, "reviewDate": "2026-11-01", "dateNotes": "Publication date precision: month.", "device": { "description": "Commodity Nexus 6 Armv7 / Android platform", "configuration": "The demonstrated SoC and TrustZone implementation with controllable energy-management behavior." }, "access": "A malicious kernel driver; neither ordinary application access nor physical injection is assumed.", "claim": "CLKSCREW software-controlled energy-management faults", "outcome": "Researchers demonstrate extracting protected AES material and loading self-signed code into TrustZone in the evaluated scenarios.", "evidenceStatus": "published_research_demonstration", "evidenceGroup": "demonstration", "hardwareBoundary": "The demonstrated SoC and TrustZone implementation with controllable energy-management behavior.", "mechanisms": [ "Hardware Fault Injection – Data Manipulation" ], "sources": [ { "url": "https://www.usenix.org/system/files/conference/usenixsecurity17/sec17-tang.pdf", "title": null, "type": "primary_research_paper", "reviewedAt": "2026-11-01", "readStatus": "reviewed", "supports": null, "limitations": [], "provenance": { "key": "clkscrew", "url": "https://www.usenix.org/system/files/conference/usenixsecurity17/sec17-tang.pdf", "title": null, "scrape_id": "01a19767-0ee8-72d4-8158-a64af2e6ae92", "http_status": 200, "parsed_pages": 19, "total_pages": 19, "cache_state": "miss", "cached_at": null, "reported_credits": 19, "error": null, "body_characters": 106862, "source_type": "primary_research_paper" } } ], "followUp": { "performed": [ "Read the original public evidence and compared its scope to the official threat reference." ], "result": "Source review supports the bounded account; no LrrK physical reproduction was performed.", "next_steps": [ "Confirm exact target hardware, firmware, access and mitigation state before any separate authorized assessment." ] }, "limitations": [ "Privilege in the normal-world kernel is a prerequisite, not an outcome established from an unprivileged app.", "The paper's Nexus 6 result does not prove a current autonomous controller is affected.", "Research-strand review status: AI-assisted desk review; no physical reproduction or independent human acceptance claimed." ], "mappings": { "emb3d": [ { "id": "TID-110", "name": "Hardware Fault Injection – Data Manipulation", "url": "https://emb3d.mitre.org/threats/TID-110.html", "basis": "analyst-inference", "rationale": "Named case or primary replacement for evidence cited by the official EMB3D hardware entry.", "officialCaseAttribution": false, "provenance": { "id": "TID-110", "relationship": "official_evidence_reference", "source_url": "https://emb3d.mitre.org/threats/TID-110.html", "basis": "Named case or primary replacement for evidence cited by the official EMB3D hardware entry.", "normalizationNote": "Raw wording combines named evidence with possible primary replacements. Displayed as analyst inference; no verified official case attribution is asserted." } } ], "attack": [] }, "confidence": { "total": 80, "components": { "provenance": { "score": 20, "max": 20, "rationale": "Original source and provenance inspected." }, "technicalEvidence": { "score": 34, "max": 35, "rationale": "Technical evidence read; methods and outcome limits retained." }, "configurationSpecificity": { "score": 18, "max": 20, "rationale": "Device and configuration details are bounded; missing revisions remain unknown." }, "independentCorroboration": { "score": 4, "max": 15, "rationale": "Independent corroboration is limited; taxonomy citation and same-team artifacts are not independent reproduction." }, "followUpResolution": { "score": 4, "max": 10, "rationale": "Follow-up source checks performed; unresolved items remain explicit." } }, "rationale": null } }, { "id": "primary-badusb-2014", "title": "BadUSB device-class emulation research", "canonicalUrl": "https://srlabs.de/blog/usb-peripherals-turn", "strand": "primary", "scope": "hardware", "publicationDate": "2014-07-31", "eventDate": null, "reviewDate": "2026-11-01", "dateNotes": "Publication date precision: day.", "device": { "description": "Reprogrammable USB-controller peripherals studied by SRLabs", "configuration": "The original research concerns controller firmware and role changes; particular controller/revision support is not universal." }, "access": "Connection of a reprogrammed peripheral or prior control over an existing peripheral's firmware.", "claim": "BadUSB device-class emulation research", "outcome": "SRLabs describes tested malicious device-role emulation, including keyboard and network-interface behaviors; storage-file scanning does not inspect controller firmware.", "evidenceStatus": "published_research_demonstration", "evidenceGroup": "demonstration", "hardwareBoundary": "The original research concerns controller firmware and role changes; particular controller/revision support is not universal.", "mechanisms": [ "Untrusted External Storage" ], "sources": [ { "url": "https://srlabs.de/blog/usb-peripherals-turn", "title": "USB peripherals can turn against their users - SRLabs Research", "type": "original_researcher_report", "reviewedAt": "2026-11-01", "readStatus": "reviewed", "supports": null, "limitations": [], "provenance": { "key": "badusb", "url": "https://srlabs.de/blog/usb-peripherals-turn", "title": "USB peripherals can turn against their users - SRLabs Research", "scrape_id": "01a19766-bb46-74a0-8d75-614e4839d576", "http_status": 200, "parsed_pages": null, "total_pages": null, "cache_state": "miss", "cached_at": null, "reported_credits": 1, "error": null, "body_characters": 3910, "source_type": "original_researcher_report" } } ], "followUp": { "performed": [ "Followed EMB3D's secondary citation to the original SRLabs report and its conference/artifact links." ], "result": "Primary provenance is established, while historical defense statements and unreviewed artifacts remain bounded.", "next_steps": [ "Confirm exact target hardware, firmware, access and mitigation state before any separate authorized assessment." ] }, "limitations": [ "A historical author report, not evidence that every USB device can be reprogrammed.", "The2014 claim that no effective defenses are known is not promoted to a current absolute.", "The event video and archived Android proof of concept were linked but not executed or reviewed as separate artifacts.", "Research-strand review status: AI-assisted desk review; no physical reproduction or independent human acceptance claimed." ], "mappings": { "emb3d": [ { "id": "TID-111", "name": "Untrusted External Storage", "url": "https://emb3d.mitre.org/threats/TID-111.html", "basis": "analyst-inference", "rationale": "Named case or primary replacement for evidence cited by the official EMB3D hardware entry.", "officialCaseAttribution": false, "provenance": { "id": "TID-111", "relationship": "official_evidence_reference", "source_url": "https://emb3d.mitre.org/threats/TID-111.html", "basis": "Named case or primary replacement for evidence cited by the official EMB3D hardware entry.", "normalizationNote": "Raw wording combines named evidence with possible primary replacements. Displayed as analyst inference; no verified official case attribution is asserted." } } ], "attack": [] }, "confidence": { "total": 67, "components": { "provenance": { "score": 20, "max": 20, "rationale": "Original source and provenance inspected." }, "technicalEvidence": { "score": 25, "max": 35, "rationale": "Technical evidence read; methods and outcome limits retained." }, "configurationSpecificity": { "score": 13, "max": 20, "rationale": "Device and configuration details are bounded; missing revisions remain unknown." }, "independentCorroboration": { "score": 4, "max": 15, "rationale": "Independent corroboration is limited; taxonomy citation and same-team artifacts are not independent reproduction." }, "followUpResolution": { "score": 5, "max": 10, "rationale": "Follow-up source checks performed; unresolved items remain explicit." } }, "rationale": null } }, { "id": "primary-equation-hdd-2015", "title": "Equation hard-drive firmware-reprogramming modules", "canonicalUrl": "https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/08064459/Equation_group_questions_and_answers.pdf", "strand": "primary", "scope": "hardware", "publicationDate": "2015-02", "eventDate": null, "reviewDate": "2026-11-01", "dateNotes": "Publication date precision: month.", "device": { "description": "HDD firmware targeted by recovered EquationDrug/GrayFish modules; supported manufacturers vary", "configuration": "Kaspersky report V1.5 identifies firmware-reprogramming modules 3.0.1 and 4.2.0; PE compilation dates are explicitly uncertain." }, "access": "A prior software compromise with device-specific firmware reprogramming capability; exact initial access is not established by this artifact account.", "claim": "Equation hard-drive firmware-reprogramming modules", "outcome": "Kaspersky reports recovered modules capable of replacing drive firmware and accessing hidden storage; this supports a reported adversarial capability, not a claim that every listed drive was observed infected.", "evidenceStatus": "malware_analysis_report", "evidenceGroup": "reported-result", "hardwareBoundary": "Kaspersky report V1.5 identifies firmware-reprogramming modules 3.0.1 and 4.2.0; PE compilation dates are explicitly uncertain.", "mechanisms": [ "Unverified Peripheral Firmware Loaded" ], "sources": [ { "url": "https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/08064459/Equation_group_questions_and_answers.pdf", "title": null, "type": "primary_research_paper", "reviewedAt": "2026-11-01", "readStatus": "partial", "supports": null, "limitations": [ "Only 30 of 44 parsed pages were read." ], "provenance": { "key": "equation", "url": "https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/08064459/Equation_group_questions_and_answers.pdf", "title": null, "scrape_id": "01a19768-4720-726f-9136-5ec04f8f0b2d", "http_status": 200, "parsed_pages": 30, "total_pages": 44, "cache_state": "miss", "cached_at": null, "reported_credits": 30, "error": null, "body_characters": 52214, "source_type": "primary_research_paper" } }, { "url": "https://attack.mitre.org/versions/v20/techniques/T1542/002/", "title": "Pre-OS Boot: Component Firmware, Sub-technique T1542.002 - Enterprise | MITRE ATT&CK®", "type": "official_taxonomy", "reviewedAt": "2026-11-01", "readStatus": "reviewed", "supports": null, "limitations": [], "provenance": { "key": "attck-component", "url": "https://attack.mitre.org/versions/v20/techniques/T1542/002/", "title": "Pre-OS Boot: Component Firmware, Sub-technique T1542.002 - Enterprise | MITRE ATT&CK®", "scrape_id": "01a19769-d94d-748a-91a5-7f836ff6e17f", "http_status": 200, "parsed_pages": null, "total_pages": null, "cache_state": "miss", "cached_at": null, "reported_credits": 1, "error": null, "body_characters": 5746, "source_type": "official_taxonomy" } } ], "followUp": { "performed": [ "Read original analysis, firmware-module section and qualification of compilation dates.", "Read ATT&CK v20's direct Equation procedure reference." ], "result": "Kept observed/reported malware artifacts separate from universal drive-infection claims.", "next_steps": [ "Confirm exact target hardware, firmware, access and mitigation state before any separate authorized assessment." ] }, "limitations": [ "Recovered-code capability and proven deployment on a specific drive are different claims.", "The single vendor investigation and MITRE citation are not independent physical reproduction.", "Module PE timestamps are not treated as confirmed event dates.", "Research-strand review status: AI-assisted desk review; no physical reproduction or independent human acceptance claimed." ], "mappings": { "emb3d": [ { "id": "TID-113", "name": "Unverified Peripheral Firmware Loaded", "url": "https://emb3d.mitre.org/threats/TID-113.html", "basis": "analyst-inference", "rationale": "Named case or primary replacement for evidence cited by the official EMB3D hardware entry.", "officialCaseAttribution": false, "provenance": { "id": "TID-113", "relationship": "official_evidence_reference", "source_url": "https://emb3d.mitre.org/threats/TID-113.html", "basis": "Named case or primary replacement for evidence cited by the official EMB3D hardware entry.", "normalizationNote": "Raw wording combines named evidence with possible primary replacements. Displayed as analyst inference; no verified official case attribution is asserted." } } ], "attack": [ { "id": "T1542.002", "name": "Pre-OS Boot: Component Firmware", "url": "https://attack.mitre.org/versions/v20/techniques/T1542/002/", "basis": "official-case-reference", "rationale": "The current MITRE technique page directly lists Equation's hard-drive firmware capability and cites this Kaspersky report.", "officialCaseAttribution": true, "domain": "enterprise", "provenance": { "id": "T1542.002", "name": "Pre-OS Boot: Component Firmware", "domain": "enterprise", "version": "20.0", "relationship": "official_case_reference", "source_url": "https://attack.mitre.org/versions/v20/techniques/T1542/002/", "basis": "The current MITRE technique page directly lists Equation's hard-drive firmware capability and cites this Kaspersky report." } } ] }, "confidence": { "total": 78, "components": { "provenance": { "score": 20, "max": 20, "rationale": "Original source and provenance inspected." }, "technicalEvidence": { "score": 29, "max": 35, "rationale": "Technical evidence read; methods and outcome limits retained." }, "configurationSpecificity": { "score": 13, "max": 20, "rationale": "Device and configuration details are bounded; missing revisions remain unknown." }, "independentCorroboration": { "score": 8, "max": 15, "rationale": "Independent corroboration is limited; taxonomy citation and same-team artifacts are not independent reproduction." }, "followUpResolution": { "score": 8, "max": 10, "rationale": "Follow-up source checks performed; unresolved items remain explicit." } }, "rationale": null } }, { "id": "primary-perilous-bcm5719-2020", "title": "Unsigned Broadcom BCM5719 NIC firmware demonstration", "canonicalUrl": "https://eclypsium.com/research/perilous-peripherals-the-hidden-dangers-inside-windows-linux-computers/", "strand": "primary", "scope": "hardware", "publicationDate": "2020-02-18", "eventDate": null, "reviewDate": "2026-11-01", "dateNotes": "Publication date precision: day.", "device": { "description": "Broadcom BCM5719 NIC in the researcher's server configuration", "configuration": "Unsigned host-loaded NIC firmware; BMC configured to share the NIC with the host." }, "access": "Ability to modify firmware loaded to the NIC; initial compromise/firmware-write authority is a prerequisite.", "claim": "Unsigned Broadcom BCM5719 NIC firmware demonstration", "outcome": "The original research demonstrates using modified NIC firmware to inspect or alter management traffic otherwise outside the host's normal view.", "evidenceStatus": "published_research_demonstration", "evidenceGroup": "demonstration", "hardwareBoundary": "Unsigned host-loaded NIC firmware; BMC configured to share the NIC with the host.", "mechanisms": [ "Unverified Peripheral Firmware Loaded" ], "sources": [ { "url": "https://eclypsium.com/research/perilous-peripherals-the-hidden-dangers-inside-windows-linux-computers/", "title": "Perilous Peripherals: The Hidden Dangers Inside Windows & Linux Computers", "type": "original_researcher_report", "reviewedAt": "2026-11-01", "readStatus": "reviewed", "supports": null, "limitations": [], "provenance": { "key": "perilous", "url": "https://eclypsium.com/research/perilous-peripherals-the-hidden-dangers-inside-windows-linux-computers/", "title": "Perilous Peripherals: The Hidden Dangers Inside Windows & Linux Computers", "scrape_id": "01a19766-ba90-71aa-8e08-6b44168449cb", "http_status": 200, "parsed_pages": null, "total_pages": null, "cache_state": "miss", "cached_at": null, "reported_credits": 1, "error": null, "body_characters": 21427, "source_type": "original_researcher_report" } } ], "followUp": { "performed": [ "Read the specific BCM5719 demonstration, separating it from the article's broader attack possibilities." ], "result": "Recorded a concrete configuration rather than importing all vendor marketing consequences as established.", "next_steps": [ "Confirm exact target hardware, firmware, access and mitigation state before any separate authorized assessment." ] }, "limitations": [ "The report lists many potential consequences; only its demonstrated NIC behavior is presented as an observed outcome.", "Shared-NIC BMC topology and firmware acceptance are material prerequisites.", "Do not treat every server using a related component as confirmed affected today.", "Research-strand review status: AI-assisted desk review; no physical reproduction or independent human acceptance claimed." ], "mappings": { "emb3d": [ { "id": "TID-113", "name": "Unverified Peripheral Firmware Loaded", "url": "https://emb3d.mitre.org/threats/TID-113.html", "basis": "analyst-inference", "rationale": "Named case or primary replacement for evidence cited by the official EMB3D hardware entry.", "officialCaseAttribution": false, "provenance": { "id": "TID-113", "relationship": "official_evidence_reference", "source_url": "https://emb3d.mitre.org/threats/TID-113.html", "basis": "Named case or primary replacement for evidence cited by the official EMB3D hardware entry.", "normalizationNote": "Raw wording combines named evidence with possible primary replacements. Displayed as analyst inference; no verified official case attribution is asserted." } } ], "attack": [] }, "confidence": { "total": 73, "components": { "provenance": { "score": 20, "max": 20, "rationale": "Original source and provenance inspected." }, "technicalEvidence": { "score": 28, "max": 35, "rationale": "Technical evidence read; methods and outcome limits retained." }, "configurationSpecificity": { "score": 17, "max": 20, "rationale": "Device and configuration details are bounded; missing revisions remain unknown." }, "independentCorroboration": { "score": 3, "max": 15, "rationale": "Independent corroboration is limited; taxonomy citation and same-team artifacts are not independent reproduction." }, "followUpResolution": { "score": 5, "max": 10, "rationale": "Follow-up source checks performed; unresolved items remain explicit." } }, "rationale": null } }, { "id": "primary-perilous-hp-camera-2020", "title": "Unsigned HP/SunplusIT camera-firmware descriptor modification", "canonicalUrl": "https://eclypsium.com/research/perilous-peripherals-the-hidden-dangers-inside-windows-linux-computers/", "strand": "primary", "scope": "hardware", "publicationDate": "2020-02-18", "eventDate": null, "reviewDate": "2026-11-01", "dateNotes": "Publication date precision: day.", "device": { "description": "HP Spectre x360 Convertible 13-ap0xxx with HP Wide Vision FHD/SunplusIT USB camera", "configuration": "Researcher's sp93170.exe update package and camera firmware image; update acceptance lacked authenticity checks." }, "access": "Local software access; the author reports that the update tool worked as a normal user.", "claim": "Unsigned HP/SunplusIT camera-firmware descriptor modification", "outcome": "Researchers verified modified USB descriptors being accepted by the device update tool. More extensive malicious HID behavior was described as a potential follow-on, not demonstrated in this specific result.", "evidenceStatus": "published_research_demonstration", "evidenceGroup": "demonstration", "hardwareBoundary": "Researcher's sp93170.exe update package and camera firmware image; update acceptance lacked authenticity checks.", "mechanisms": [ "Unverified Peripheral Firmware Loaded" ], "sources": [ { "url": "https://eclypsium.com/research/perilous-peripherals-the-hidden-dangers-inside-windows-linux-computers/", "title": "Perilous Peripherals: The Hidden Dangers Inside Windows & Linux Computers", "type": "original_researcher_report", "reviewedAt": "2026-11-01", "readStatus": "reviewed", "supports": null, "limitations": [], "provenance": { "key": "perilous", "url": "https://eclypsium.com/research/perilous-peripherals-the-hidden-dangers-inside-windows-linux-computers/", "title": "Perilous Peripherals: The Hidden Dangers Inside Windows & Linux Computers", "scrape_id": "01a19766-ba90-71aa-8e08-6b44168449cb", "http_status": 200, "parsed_pages": null, "total_pages": null, "cache_state": "miss", "cached_at": null, "reported_credits": 1, "error": null, "body_characters": 21427, "source_type": "original_researcher_report" } } ], "followUp": { "performed": [ "Read the camera-specific verified outcome and distinguished it from proposed behavior." ], "result": "Retained the narrow demonstrated result and normal-user prerequisite.", "next_steps": [ "Confirm exact target hardware, firmware, access and mitigation state before any separate authorized assessment." ] }, "limitations": [ "USB-descriptor modification is not proof of the full proposed malware behavior.", "HP mitigation work is reported by the author; current camera firmware state was not verified.", "Research-strand review status: AI-assisted desk review; no physical reproduction or independent human acceptance claimed." ], "mappings": { "emb3d": [ { "id": "TID-113", "name": "Unverified Peripheral Firmware Loaded", "url": "https://emb3d.mitre.org/threats/TID-113.html", "basis": "analyst-inference", "rationale": "Named case or primary replacement for evidence cited by the official EMB3D hardware entry.", "officialCaseAttribution": false, "provenance": { "id": "TID-113", "relationship": "official_evidence_reference", "source_url": "https://emb3d.mitre.org/threats/TID-113.html", "basis": "Named case or primary replacement for evidence cited by the official EMB3D hardware entry.", "normalizationNote": "Raw wording combines named evidence with possible primary replacements. Displayed as analyst inference; no verified official case attribution is asserted." } } ], "attack": [] }, "confidence": { "total": 74, "components": { "provenance": { "score": 20, "max": 20, "rationale": "Original source and provenance inspected." }, "technicalEvidence": { "score": 28, "max": 35, "rationale": "Technical evidence read; methods and outcome limits retained." }, "configurationSpecificity": { "score": 18, "max": 20, "rationale": "Device and configuration details are bounded; missing revisions remain unknown." }, "independentCorroboration": { "score": 3, "max": 15, "rationale": "Independent corroboration is limited; taxonomy citation and same-team artifacts are not independent reproduction." }, "followUpResolution": { "score": 5, "max": 10, "rationale": "Follow-up source checks performed; unresolved items remain explicit." } }, "rationale": null } }, { "id": "primary-pcie-mitm-2020", "title": "FPGA PCIe man-in-the-middle emulator demonstration", "canonicalUrl": "https://hal.science/hal-03228978v1/file/S0141933120303653.pdf", "strand": "primary", "scope": "hardware", "publicationDate": "2020", "eventDate": null, "reviewDate": "2026-11-01", "dateNotes": "Publication date precision: year.", "device": { "description": "Research host with PCIe3.0 and Stratix5 FPGA endpoint", "configuration": "Proof-of-concept emulator with protocol/timing constraints, rather than a demonstrated compromise of every smartphone interconnect." }, "access": "Physical insertion/control of a specialized PCIe interposer/emulation platform.", "claim": "FPGA PCIe man-in-the-middle emulator demonstration", "outcome": "The paper demonstrates a hardware platform for observing and replaying PCIe transactions in the tested setup.", "evidenceStatus": "published_research_demonstration", "evidenceGroup": "demonstration", "hardwareBoundary": "Proof-of-concept emulator with protocol/timing constraints, rather than a demonstrated compromise of every smartphone interconnect.", "mechanisms": [ "Peripheral Data Bus Interception" ], "sources": [ { "url": "https://hal.science/hal-03228978v1/file/S0141933120303653.pdf", "title": "Toward a hardware man-in-the-middle attack on PCIe bus", "type": "primary_research_paper", "reviewedAt": "2026-11-01", "readStatus": "reviewed", "supports": null, "limitations": [], "provenance": { "key": "pcie-paper", "url": "https://hal.science/hal-03228978v1/file/S0141933120303653.pdf", "title": "Toward a hardware man-in-the-middle attack on PCIe bus", "scrape_id": "01a19769-d955-7069-9aac-1f7d7d30c8f4", "http_status": 200, "parsed_pages": 13, "total_pages": 13, "cache_state": "miss", "cached_at": null, "reported_credits": 13, "error": null, "body_characters": 61766, "source_type": "primary_research_paper" } }, { "url": "https://hal.science/hal-03228978", "title": " Toward a hardware man-in-the-middle attack on PCIe bus - Archive ouverte HAL", "type": "original_researcher_report", "reviewedAt": "2026-11-01", "readStatus": "reviewed", "supports": null, "limitations": [], "provenance": { "key": "pcie-mitm", "url": "https://hal.science/hal-03228978", "title": " Toward a hardware man-in-the-middle attack on PCIe bus - Archive ouverte HAL", "scrape_id": "01a19768-469e-74ec-960f-45f3be2cfcb1", "http_status": 200, "parsed_pages": null, "total_pages": null, "cache_state": "miss", "cached_at": null, "reported_credits": 1, "error": null, "body_characters": 7811, "source_type": "original_researcher_report" } } ], "followUp": { "performed": [ "Followed the publisher citation to the author-deposited full paper and inspected the stated evaluation platform." ], "result": "Resolved the original source and correct publication/deposit distinction.", "next_steps": [ "Confirm exact target hardware, firmware, access and mitigation state before any separate authorized assessment." ] }, "limitations": [ "Generic architectural reach and a concrete deployed-device exploit are different claims.", "HAL deposit date2022 is not the2020 publication date.", "No independent reproduction was found in the bounded source follow-up.", "Research-strand review status: AI-assisted desk review; no physical reproduction or independent human acceptance claimed." ], "mappings": { "emb3d": [ { "id": "TID-114", "name": "Peripheral Data Bus Interception", "url": "https://emb3d.mitre.org/threats/TID-114.html", "basis": "analyst-inference", "rationale": "Named case or primary replacement for evidence cited by the official EMB3D hardware entry.", "officialCaseAttribution": false, "provenance": { "id": "TID-114", "relationship": "official_evidence_reference", "source_url": "https://emb3d.mitre.org/threats/TID-114.html", "basis": "Named case or primary replacement for evidence cited by the official EMB3D hardware entry.", "normalizationNote": "Raw wording combines named evidence with possible primary replacements. Displayed as analyst inference; no verified official case attribution is asserted." } } ], "attack": [] }, "confidence": { "total": 78, "components": { "provenance": { "score": 20, "max": 20, "rationale": "Original source and provenance inspected." }, "technicalEvidence": { "score": 31, "max": 35, "rationale": "Technical evidence read; methods and outcome limits retained." }, "configurationSpecificity": { "score": 18, "max": 20, "rationale": "Device and configuration details are bounded; missing revisions remain unknown." }, "independentCorroboration": { "score": 3, "max": 15, "rationale": "Independent corroboration is limited; taxonomy citation and same-team artifacts are not independent reproduction." }, "followUpResolution": { "score": 6, "max": 10, "rationale": "Follow-up source checks performed; unresolved items remain explicit." } }, "rationale": null } }, { "id": "primary-prado-jtag-2020", "title": "JTAG firmware extraction from a Linksys WRT54G", "canonicalUrl": "https://sergioprado.blog/2020-02-20-extracting-firmware-from-devices-using-jtag/", "strand": "primary", "scope": "hardware", "publicationDate": "2020-02-20", "eventDate": null, "reviewDate": "2026-11-01", "dateNotes": "Publication date precision: day.", "device": { "description": "Linksys WRT54G research target", "configuration": "MIPS/EJTAG-accessible target with demonstrated firmware readout; exact hardware/firmware revision is not established here." }, "access": "Physical board/debug-interface access.", "claim": "JTAG firmware extraction from a Linksys WRT54G", "outcome": "The original researcher demonstrates reading a firmware image and inspecting its structure.", "evidenceStatus": "author_demonstration", "evidenceGroup": "demonstration", "hardwareBoundary": "MIPS/EJTAG-accessible target with demonstrated firmware readout; exact hardware/firmware revision is not established here.", "mechanisms": [ "Firmware/Data Extraction via Hardware Interface" ], "sources": [ { "url": "https://sergioprado.blog/2020-02-20-extracting-firmware-from-devices-using-jtag/", "title": "Extracting firmware from devices using JTAG - sergioprado.blog", "type": "original_researcher_report", "reviewedAt": "2026-11-01", "readStatus": "reviewed", "supports": null, "limitations": [], "provenance": { "key": "jtag-prado", "url": "https://sergioprado.blog/2020-02-20-extracting-firmware-from-devices-using-jtag/", "title": "Extracting firmware from devices using JTAG - sergioprado.blog", "scrape_id": "01a19767-d259-714e-8fe6-3fa04245648c", "http_status": 200, "parsed_pages": null, "total_pages": null, "cache_state": "miss", "cached_at": null, "reported_credits": 1, "error": null, "body_characters": 27636, "source_type": "original_researcher_report" } } ], "followUp": { "performed": [ "Read the original public evidence and compared its scope to the official threat reference." ], "result": "Source review supports the bounded account; no LrrK physical reproduction was performed.", "next_steps": [ "Confirm exact target hardware, firmware, access and mitigation state before any separate authorized assessment." ] }, "limitations": [ "A worked tutorial on a selected router, not a report that every production JTAG interface is unprotected.", "No independent dump or file-integrity comparison was performed by LrrK.", "Research-strand review status: AI-assisted desk review; no physical reproduction or independent human acceptance claimed." ], "mappings": { "emb3d": [ { "id": "TID-115", "name": "Firmware/Data Extraction via Hardware Interface", "url": "https://emb3d.mitre.org/threats/TID-115.html", "basis": "analyst-inference", "rationale": "Named case or primary replacement for evidence cited by the official EMB3D hardware entry.", "officialCaseAttribution": false, "provenance": { "id": "TID-115", "relationship": "official_evidence_reference", "source_url": "https://emb3d.mitre.org/threats/TID-115.html", "basis": "Named case or primary replacement for evidence cited by the official EMB3D hardware entry.", "normalizationNote": "Raw wording combines named evidence with possible primary replacements. Displayed as analyst inference; no verified official case attribution is asserted." } } ], "attack": [] }, "confidence": { "total": 67, "components": { "provenance": { "score": 20, "max": 20, "rationale": "Original source and provenance inspected." }, "technicalEvidence": { "score": 26, "max": 35, "rationale": "Technical evidence read; methods and outcome limits retained." }, "configurationSpecificity": { "score": 14, "max": 20, "rationale": "Device and configuration details are bounded; missing revisions remain unknown." }, "independentCorroboration": { "score": 3, "max": 15, "rationale": "Independent corroboration is limited; taxonomy citation and same-team artifacts are not independent reproduction." }, "followUpResolution": { "score": 4, "max": 10, "rationale": "Follow-up source checks performed; unresolved items remain explicit." } }, "rationale": null } }, { "id": "primary-bhis-uart-2019", "title": "Linksys E2500 v3 UART root-shell account with retained uncertainty", "canonicalUrl": "https://www.blackhillsinfosec.com/how-to-hack-hardware-using-uart/", "strand": "primary", "scope": "hardware", "publicationDate": "2019", "eventDate": null, "reviewDate": "2026-11-01", "dateNotes": "Publication date precision: year.", "device": { "description": "Linksys E2500 v3; earlier unsuccessful/erratic JTAG work on a used BEFSR41 is separate", "configuration": "Specific serial access points and BusyBox shell behavior reported by the original author; firmware version is unspecified." }, "access": "Physical access to the internal UART interface.", "claim": "Linksys E2500 v3 UART root-shell account with retained uncertainty", "outcome": "The author reports reaching a root shell on the E2500v3, while acknowledging uncertainty about credential entry. Earlier JTAG data were erratic and not a validated firmware extraction.", "evidenceStatus": "author_demonstration_with_uncertainty", "evidenceGroup": "demonstration", "hardwareBoundary": "Specific serial access points and BusyBox shell behavior reported by the original author; firmware version is unspecified.", "mechanisms": [ "Latent Privileged Access Port" ], "sources": [ { "url": "https://www.blackhillsinfosec.com/how-to-hack-hardware-using-uart/", "title": "How to Hack Hardware using UART - Black Hills Information Security, Inc.", "type": "original_researcher_report", "reviewedAt": "2026-11-01", "readStatus": "reviewed", "supports": null, "limitations": [], "provenance": { "key": "uart-bhis", "url": "https://www.blackhillsinfosec.com/how-to-hack-hardware-using-uart/", "title": "How to Hack Hardware using UART - Black Hills Information Security, Inc.", "scrape_id": "01a19767-d231-779c-9ad3-da6985413fd5", "http_status": 200, "parsed_pages": null, "total_pages": null, "cache_state": "miss", "cached_at": null, "reported_credits": 1, "error": null, "body_characters": 16588, "source_type": "original_researcher_report" } } ], "followUp": { "performed": [ "Read the author's explicit caveats about the used board, erratic dump and possible credential-entry error." ], "result": "Preserved the successful shell observation separately from uncertain causal explanation and failed extraction.", "next_steps": [ "Confirm exact target hardware, firmware, access and mitigation state before any separate authorized assessment." ] }, "limitations": [ "The authentication-bypass explanation is not conclusively established by the account.", "A root prompt report is not independent proof of complete firmware extraction.", "The failed/erratic work on another board must not be counted as a successful JTAG result.", "Research-strand review status: AI-assisted desk review; no physical reproduction or independent human acceptance claimed." ], "mappings": { "emb3d": [ { "id": "TID-116", "name": "Latent Privileged Access Port", "url": "https://emb3d.mitre.org/threats/TID-116.html", "basis": "analyst-inference", "rationale": "Named case or primary replacement for evidence cited by the official EMB3D hardware entry.", "officialCaseAttribution": false, "provenance": { "id": "TID-116", "relationship": "official_evidence_reference", "source_url": "https://emb3d.mitre.org/threats/TID-116.html", "basis": "Named case or primary replacement for evidence cited by the official EMB3D hardware entry.", "normalizationNote": "Raw wording combines named evidence with possible primary replacements. Displayed as analyst inference; no verified official case attribution is asserted." } } ], "attack": [] }, "confidence": { "total": 63, "components": { "provenance": { "score": 20, "max": 20, "rationale": "Original source and provenance inspected." }, "technicalEvidence": { "score": 21, "max": 35, "rationale": "Technical evidence read; methods and outcome limits retained." }, "configurationSpecificity": { "score": 13, "max": 20, "rationale": "Device and configuration details are bounded; missing revisions remain unknown." }, "independentCorroboration": { "score": 2, "max": 15, "rationale": "Independent corroboration is limited; taxonomy citation and same-team artifacts are not independent reproduction." }, "followUpResolution": { "score": 7, "max": 10, "rationale": "Follow-up source checks performed; unresolved items remain explicit." } }, "rationale": null } }, { "id": "primary-riverloop-jtag-2021", "title": "Archer C7 exposed JTAG memory and firmware demonstration", "canonicalUrl": "https://riverloopsecurity.com/blog/2021/07/hw-101-jtag-part3/", "strand": "primary", "scope": "hardware", "publicationDate": "2021-07-08", "eventDate": null, "reviewDate": "2026-11-01", "dateNotes": "Publication date precision: day.", "device": { "description": "TP-Link Archer C7 / AC1750 with Qualcomm QCA9558-AT4A", "configuration": "MIPS EJTAG test platform documented across the three-part RiverLoop series; exact retail firmware revision remains unspecified." }, "access": "Physical internal JTAG connection with a compatible debug probe.", "claim": "Archer C7 exposed JTAG memory and firmware demonstration", "outcome": "The final article demonstrates memory access and firmware dumping, followed by inspection of the recovered image.", "evidenceStatus": "author_demonstration", "evidenceGroup": "demonstration", "hardwareBoundary": "MIPS EJTAG test platform documented across the three-part RiverLoop series; exact retail firmware revision remains unspecified.", "mechanisms": [ "Latent Hardware Debug Port Allows Memory/Code Manipulation" ], "sources": [ { "url": "https://riverloopsecurity.com/blog/2021/07/hw-101-jtag-part3/", "title": "Hardware Hacking 101: Communicating with JTAG via OpenOCD", "type": "original_researcher_report", "reviewedAt": "2026-11-01", "readStatus": "reviewed", "supports": null, "limitations": [], "provenance": { "key": "jtag-river3", "url": "https://riverloopsecurity.com/blog/2021/07/hw-101-jtag-part3/", "title": "Hardware Hacking 101: Communicating with JTAG via OpenOCD", "scrape_id": "01a19767-d38c-73df-b678-3e021f40f2e7", "http_status": 200, "parsed_pages": null, "total_pages": null, "cache_state": "miss", "cached_at": null, "reported_credits": 1, "error": null, "body_characters": 15836, "source_type": "original_researcher_report" } }, { "url": "https://riverloopsecurity.com/blog/2021/05/hw-101-jtag-part2/", "title": "Hardware Hacking 101: Identifying and Verifying JTAG on a Device", "type": "original_researcher_report", "reviewedAt": "2026-11-01", "readStatus": "reviewed", "supports": null, "limitations": [], "provenance": { "key": "jtag-river2", "url": "https://riverloopsecurity.com/blog/2021/05/hw-101-jtag-part2/", "title": "Hardware Hacking 101: Identifying and Verifying JTAG on a Device", "scrape_id": "01a19767-d255-77ea-b449-499349447000", "http_status": 200, "parsed_pages": null, "total_pages": null, "cache_state": "miss", "cached_at": null, "reported_credits": 1, "error": null, "body_characters": 13988, "source_type": "original_researcher_report" } }, { "url": "https://riverloopsecurity.com/blog/2021/05/hw-101-jtag/", "title": "Hardware Hacking 101: Introduction to JTAG", "type": "original_researcher_report", "reviewedAt": "2026-11-01", "readStatus": "reviewed", "supports": null, "limitations": [], "provenance": { "key": "jtag-river1", "url": "https://riverloopsecurity.com/blog/2021/05/hw-101-jtag/", "title": "Hardware Hacking 101: Introduction to JTAG", "scrape_id": "01a19767-d246-71df-ac06-1ab685193678", "http_status": 200, "parsed_pages": null, "total_pages": null, "cache_state": "miss", "cached_at": null, "reported_credits": 1, "error": null, "body_characters": 14990, "source_type": "original_researcher_report" } } ], "followUp": { "performed": [ "Read all three articles to distinguish background, interface identification and the final demonstrated operation." ], "result": "Credited the final memory/firmware behavior, without promoting discovery-only stages into exploitation proof.", "next_steps": [ "Confirm exact target hardware, firmware, access and mitigation state before any separate authorized assessment." ] }, "limitations": [ "Identification of pins alone is not counted as memory/code manipulation.", "Board-revision and debug-lock differences constrain transfer to another unit.", "No instructions or command sequences are included in this library record.", "Research-strand review status: AI-assisted desk review; no physical reproduction or independent human acceptance claimed." ], "mappings": { "emb3d": [ { "id": "TID-119", "name": "Latent Hardware Debug Port Allows Memory/Code Manipulation", "url": "https://emb3d.mitre.org/threats/TID-119.html", "basis": "analyst-inference", "rationale": "Named case or primary replacement for evidence cited by the official EMB3D hardware entry.", "officialCaseAttribution": false, "provenance": { "id": "TID-119", "relationship": "official_evidence_reference", "source_url": "https://emb3d.mitre.org/threats/TID-119.html", "basis": "Named case or primary replacement for evidence cited by the official EMB3D hardware entry.", "normalizationNote": "Raw wording combines named evidence with possible primary replacements. Displayed as analyst inference; no verified official case attribution is asserted." } } ], "attack": [] }, "confidence": { "total": 74, "components": { "provenance": { "score": 20, "max": 20, "rationale": "Original source and provenance inspected." }, "technicalEvidence": { "score": 28, "max": 35, "rationale": "Technical evidence read; methods and outcome limits retained." }, "configurationSpecificity": { "score": 17, "max": 20, "rationale": "Device and configuration details are bounded; missing revisions remain unknown." }, "independentCorroboration": { "score": 3, "max": 15, "rationale": "Independent corroboration is limited; taxonomy citation and same-team artifacts are not independent reproduction." }, "followUpResolution": { "score": 6, "max": 10, "rationale": "Follow-up source checks performed; unresolved items remain explicit." } }, "rationale": null } }, { "id": "primary-usb-electrical-damage-2019", "title": "DOJ-documented USB Killer damage incident at a college", "canonicalUrl": "https://www.justice.gov/usao-ndny/pr/former-student-sentenced-destroying-computers-college-st-rose", "strand": "primary", "scope": "hardware", "publicationDate": "2019-08-13", "eventDate": "2019-02-14", "reviewDate": "2026-11-01", "dateNotes": "Publication date precision: day.", "device": { "description": "66 college computers plus monitors and computer-enhanced podiums; exact models undisclosed", "configuration": "Actual equipment identities, port protections and failure analysis are not supplied by the public sentencing release." }, "access": "Physical access to device USB ports.", "claim": "DOJ-documented USB Killer damage incident at a college", "outcome": "The DOJ sentencing release reports an admitted act that damaged college equipment using a USB Killer device.", "evidenceStatus": "government_reported_operational_incident", "evidenceGroup": "operational-report", "hardwareBoundary": "Actual equipment identities, port protections and failure analysis are not supplied by the public sentencing release.", "mechanisms": [ "Weak Peripheral Port Electrical Damage Protection" ], "sources": [ { "url": "https://www.justice.gov/usao-ndny/pr/former-student-sentenced-destroying-computers-college-st-rose", "title": " Northern District of New York | Former Student Sentenced For Destroying Computers at The College of St. Rose | United States Department of Justice", "type": "government_incident_report", "reviewedAt": "2026-11-01", "readStatus": "reviewed", "supports": null, "limitations": [], "provenance": { "key": "usbkill-doj", "url": "https://www.justice.gov/usao-ndny/pr/former-student-sentenced-destroying-computers-college-st-rose", "title": " Northern District of New York | Former Student Sentenced For Destroying Computers at The College of St. Rose | United States Department of Justice", "scrape_id": "01a1976b-2dff-77fb-a279-659e1b4c8222", "http_status": 200, "parsed_pages": null, "total_pages": null, "cache_state": "miss", "cached_at": null, "reported_credits": 1, "error": null, "body_characters": 4345, "source_type": "government_incident_report" } } ], "followUp": { "performed": [ "Replaced vendor marketing as the principal incident evidence with the DOJ sentencing account." ], "result": "Obtained independent operational evidence while retaining its limited hardware detail.", "next_steps": [ "Confirm exact target hardware, firmware, access and mitigation state before any separate authorized assessment." ] }, "limitations": [ "The official account establishes the reported incident and admission, not electrical waveforms or model-by-model susceptibility.", "No universal USB-C/Lightning bypass claim is imported from product advertising.", "Research-strand review status: AI-assisted desk review; no physical reproduction or independent human acceptance claimed." ], "mappings": { "emb3d": [ { "id": "TID-118", "name": "Weak Peripheral Port Electrical Damage Protection", "url": "https://emb3d.mitre.org/threats/TID-118.html", "basis": "analyst-inference", "rationale": "Mechanism-level analyst cross-reference; this case is not asserted to be named by EMB3D.", "officialCaseAttribution": false, "provenance": { "id": "TID-118", "relationship": "analyst_inference", "source_url": "https://emb3d.mitre.org/threats/TID-118.html", "basis": "Mechanism-level analyst cross-reference; this case is not asserted to be named by EMB3D." } } ], "attack": [] }, "confidence": { "total": 66, "components": { "provenance": { "score": 20, "max": 20, "rationale": "Original source and provenance inspected." }, "technicalEvidence": { "score": 22, "max": 35, "rationale": "Technical evidence read; methods and outcome limits retained." }, "configurationSpecificity": { "score": 7, "max": 20, "rationale": "Device and configuration details are bounded; missing revisions remain unknown." }, "independentCorroboration": { "score": 10, "max": 15, "rationale": "Independent corroboration is limited; taxonomy citation and same-team artifacts are not independent reproduction." }, "followUpResolution": { "score": 7, "max": 10, "rationale": "Follow-up source checks performed; unresolved items remain explicit." } }, "rationale": null } }, { "id": "primary-gpuhammer-2025", "title": "GPUHammer GDDR6 model-degradation demonstration", "canonicalUrl": "https://gururaj-s.github.io/assets/pdf/SEC25_GPUHammer.pdf", "strand": "primary", "scope": "hardware", "publicationDate": "2025", "eventDate": null, "reviewDate": "2026-11-01", "dateNotes": "Publication date precision: year.", "device": { "description": "NVIDIA RTX A6000 with48 GB GDDR6; separate A100/RTX3080 tests reported no flips", "configuration": "User-level CUDA, ECC disabled and a suitable shared/time-sliced memory placement. The paper reports8 unique flips across4 tested banks." }, "access": "Ability to run CUDA workloads on the susceptible GPU and satisfy memory co-location assumptions.", "claim": "GPUHammer GDDR6 model-degradation demonstration", "outcome": "Researchers demonstrate GPU-memory bit flips and model-accuracy degradation under their proof-of-concept conditions.", "evidenceStatus": "published_research_demonstration", "evidenceGroup": "demonstration", "hardwareBoundary": "User-level CUDA, ECC disabled and a suitable shared/time-sliced memory placement. The paper reports8 unique flips across4 tested banks.", "mechanisms": [ "Hardware Fault Injection – Data Manipulation" ], "sources": [ { "url": "https://gururaj-s.github.io/assets/pdf/SEC25_GPUHammer.pdf", "title": null, "type": "primary_research_paper", "reviewedAt": "2026-11-01", "readStatus": "reviewed", "supports": null, "limitations": [], "provenance": { "key": "gpuhammer-paper", "url": "https://gururaj-s.github.io/assets/pdf/SEC25_GPUHammer.pdf", "title": null, "scrape_id": "01a1976c-0b80-72a8-9f5e-85e5711e0817", "http_status": 200, "parsed_pages": 20, "total_pages": 20, "cache_state": "miss", "cached_at": null, "reported_credits": 20, "error": null, "body_characters": 104391, "source_type": "primary_research_paper" } }, { "url": "https://www.gpuhammer.com/", "title": "GPUHammer", "type": "original_researcher_report", "reviewedAt": "2026-11-01", "readStatus": "reviewed", "supports": null, "limitations": [], "provenance": { "key": "gpuhammer", "url": "https://www.gpuhammer.com/", "title": "GPUHammer", "scrape_id": "01a1976b-2e11-707e-9e51-0e7e5b297674", "http_status": 200, "parsed_pages": null, "total_pages": null, "cache_state": "miss", "cached_at": null, "reported_credits": 1, "error": null, "body_characters": 15562, "source_type": "original_researcher_report" } }, { "url": "https://nvidia.custhelp.com/app/answers/detail/a_id/5671", "title": "Security Notice: Rowhammer - July 2025 | NVIDIA", "type": "vendor_security_advisory", "reviewedAt": "2026-11-01", "readStatus": "reviewed", "supports": null, "limitations": [], "provenance": { "key": "nvidia-rowhammer", "url": "https://nvidia.custhelp.com/app/answers/detail/a_id/5671", "title": "Security Notice: Rowhammer - July 2025 | NVIDIA", "scrape_id": "01a1976c-0b8f-715e-8b13-6d14a4b9fb47", "http_status": 200, "parsed_pages": null, "total_pages": null, "cache_state": "miss", "cached_at": null, "reported_credits": 1, "error": null, "body_characters": 11304, "source_type": "vendor_security_advisory" } }, { "url": "https://github.com/sith-lab/gpuhammer", "title": "GitHub - sith-lab/gpuhammer · GitHub", "type": "author_artifact_repository", "reviewedAt": "2026-11-01", "readStatus": "reviewed", "supports": null, "limitations": [], "provenance": { "key": "artifact-gpuhammer", "url": "https://github.com/sith-lab/gpuhammer", "title": "GitHub - sith-lab/gpuhammer · GitHub", "scrape_id": "01a1976d-5774-7660-9fa7-caebe100eb88", "http_status": 200, "parsed_pages": null, "total_pages": null, "cache_state": "miss", "cached_at": null, "reported_credits": 1, "error": null, "body_characters": 28226, "source_type": "author_artifact_repository" } } ], "followUp": { "performed": [ "Read complete 20-page paper, author site and NVIDIA's July2025 notice.", "Checked current artifact availability and later GPUThor limitations." ], "result": "Bounded the claim to tested GDDR6/ECC conditions and preserved later counterevidence to universal mitigation claims.", "next_steps": [ "Confirm exact target hardware, firmware, access and mitigation state before any separate authorized assessment." ] }, "limitations": [ "The paper's negative results on other tested GPUs are retained.", "The2025 NVIDIA notice supports enabling system ECC for that threat; the2026 GPUThor preprint prevents treating ECC as a universal guarantee.", "Artifact presence was checked but the code was not executed.", "Research-strand review status: AI-assisted desk review; no physical reproduction or independent human acceptance claimed." ], "mappings": { "emb3d": [ { "id": "TID-110", "name": "Hardware Fault Injection – Data Manipulation", "url": "https://emb3d.mitre.org/threats/TID-110.html", "basis": "analyst-inference", "rationale": "Mechanism-level analyst cross-reference; this case is not asserted to be named by EMB3D.", "officialCaseAttribution": false, "provenance": { "id": "TID-110", "relationship": "analyst_inference", "source_url": "https://emb3d.mitre.org/threats/TID-110.html", "basis": "Mechanism-level analyst cross-reference; this case is not asserted to be named by EMB3D." } } ], "attack": [] }, "confidence": { "total": 92, "components": { "provenance": { "score": 20, "max": 20, "rationale": "Original source and provenance inspected." }, "technicalEvidence": { "score": 34, "max": 35, "rationale": "Technical evidence read; methods and outcome limits retained." }, "configurationSpecificity": { "score": 20, "max": 20, "rationale": "Device and configuration details are bounded; missing revisions remain unknown." }, "independentCorroboration": { "score": 9, "max": 15, "rationale": "Independent corroboration is limited; taxonomy citation and same-team artifacts are not independent reproduction." }, "followUpResolution": { "score": 9, "max": 10, "rationale": "Follow-up source checks performed; unresolved items remain explicit." } }, "rationale": null } }, { "id": "primary-gddrhammer-2026", "title": "GDDRHammer GPU-to-host memory compromise research", "canonicalUrl": "https://gddr.fail/files/gddrhammer.pdf", "strand": "primary", "scope": "hardware", "publicationDate": "2026-05", "eventDate": null, "reviewDate": "2026-11-01", "dateNotes": "Publication date precision: month.", "device": { "description": "GDDR6NVIDIA GPUs in the author's25-plus-device characterization; tested RTXA6000 exploitation", "configuration": "The threat model uses unprivileged CPU/CUDA execution, default 2 MB GPU pages and ECC disabled; driver and memory topology matter." }, "access": "Local user-mode workload execution, including CUDA; no physical access is assumed.", "claim": "GDDRHammer GPU-to-host memory compromise research", "outcome": "Authors demonstrate GPU page-table corruption and GPU-to-CPU memory read/write in their end-to-end experiment.", "evidenceStatus": "published_research_demonstration", "evidenceGroup": "demonstration", "hardwareBoundary": "The threat model uses unprivileged CPU/CUDA execution, default 2 MB GPU pages and ECC disabled; driver and memory topology matter.", "mechanisms": [ "Hardware Fault Injection – Data Manipulation" ], "sources": [ { "url": "https://gddr.fail/files/gddrhammer.pdf", "title": null, "type": "primary_research_paper", "reviewedAt": "2026-11-01", "readStatus": "reviewed", "supports": null, "limitations": [], "provenance": { "key": "gddrhammer-paper", "url": "https://gddr.fail/files/gddrhammer.pdf", "title": null, "scrape_id": "01a1976c-0c11-762e-9fd9-8a71c4b29a91", "http_status": 200, "parsed_pages": 19, "total_pages": 19, "cache_state": "miss", "cached_at": null, "reported_credits": 19, "error": null, "body_characters": 107669, "source_type": "primary_research_paper" } }, { "url": "https://gddr.fail/", "title": "GPU Memory Exploits", "type": "original_researcher_report", "reviewedAt": "2026-11-01", "readStatus": "reviewed", "supports": null, "limitations": [], "provenance": { "key": "gddr", "url": "https://gddr.fail/", "title": "GPU Memory Exploits", "scrape_id": "01a1976b-2e59-71f5-92dd-4c9d073a2f5f", "http_status": 200, "parsed_pages": null, "total_pages": null, "cache_state": "miss", "cached_at": null, "reported_credits": 1, "error": null, "body_characters": 8124, "source_type": "original_researcher_report" } }, { "url": "https://github.com/heelsec/GDDRHammer", "title": "GitHub - heelsec/GDDRHammer: GDDRHammer: Greatly Disturbing DRAM Rows — Cross-Component Rowhammer Attacks from Modern GPUs · GitHub", "type": "author_artifact_repository", "reviewedAt": "2026-11-01", "readStatus": "reviewed", "supports": null, "limitations": [], "provenance": { "key": "artifact-gddrhammer", "url": "https://github.com/heelsec/GDDRHammer", "title": "GitHub - heelsec/GDDRHammer: GDDRHammer: Greatly Disturbing DRAM Rows — Cross-Component Rowhammer Attacks from Modern GPUs · GitHub", "scrape_id": "01a1976d-57ac-760b-8971-168f6c951089", "http_status": 200, "parsed_pages": null, "total_pages": null, "cache_state": "miss", "cached_at": null, "reported_credits": 1, "error": null, "body_characters": 5606, "source_type": "author_artifact_repository" } } ], "followUp": { "performed": [ "Read full 19-page paper and threat model, then inspected linked public artifact repository.", "Compared the outcome and prerequisites against GeForge and GPUHammer." ], "result": "Separated broad bit-flip characterization from the tested end-to-end exploit.", "next_steps": [ "Confirm exact target hardware, firmware, access and mitigation state before any separate authorized assessment." ] }, "limitations": [ "Characterization of many GPUs does not establish full host takeover on every characterized GPU.", "Do not infer an unexamined IOMMU state or extend the outcome to all isolated cloud configurations.", "The separate GeForge study is related independent research, not a byte-for-byte reproduction of this setup.", "Research-strand review status: AI-assisted desk review; no physical reproduction or independent human acceptance claimed." ], "mappings": { "emb3d": [ { "id": "TID-110", "name": "Hardware Fault Injection – Data Manipulation", "url": "https://emb3d.mitre.org/threats/TID-110.html", "basis": "analyst-inference", "rationale": "Mechanism-level analyst cross-reference; this case is not asserted to be named by EMB3D.", "officialCaseAttribution": false, "provenance": { "id": "TID-110", "relationship": "analyst_inference", "source_url": "https://emb3d.mitre.org/threats/TID-110.html", "basis": "Mechanism-level analyst cross-reference; this case is not asserted to be named by EMB3D." } } ], "attack": [] }, "confidence": { "total": 87, "components": { "provenance": { "score": 20, "max": 20, "rationale": "Original source and provenance inspected." }, "technicalEvidence": { "score": 34, "max": 35, "rationale": "Technical evidence read; methods and outcome limits retained." }, "configurationSpecificity": { "score": 18, "max": 20, "rationale": "Device and configuration details are bounded; missing revisions remain unknown." }, "independentCorroboration": { "score": 7, "max": 15, "rationale": "Independent corroboration is limited; taxonomy citation and same-team artifacts are not independent reproduction." }, "followUpResolution": { "score": 8, "max": 10, "rationale": "Follow-up source checks performed; unresolved items remain explicit." } }, "rationale": null } }, { "id": "primary-geforge-2026", "title": "GeForge GPU page-table and configuration-dependent host compromise", "canonicalUrl": "https://gddr.fail/files/GeForge.pdf", "strand": "primary", "scope": "hardware", "publicationDate": "2026-05", "eventDate": null, "reviewDate": "2026-11-01", "dateNotes": "Publication date precision: month.", "device": { "description": "NVIDIA RTX 3060 and RTXA6000 test GPUs", "configuration": "Stock driver, ordinary CUDA APIs and ECC disabled. Host-memory escalation requires IOMMU disabled or not enforcing GPU/host isolation." }, "access": "A nonprivileged local account with CUDA execution and sufficient GPU memory allocation opportunity.", "claim": "GeForge GPU page-table and configuration-dependent host compromise", "outcome": "The paper demonstrates GPU-context confidentiality/integrity compromise and host-root escalation under the stated isolation conditions.", "evidenceStatus": "published_research_demonstration", "evidenceGroup": "demonstration", "hardwareBoundary": "Stock driver, ordinary CUDA APIs and ECC disabled. Host-memory escalation requires IOMMU disabled or not enforcing GPU/host isolation.", "mechanisms": [ "Hardware Fault Injection – Data Manipulation" ], "sources": [ { "url": "https://gddr.fail/files/GeForge.pdf", "title": null, "type": "primary_research_paper", "reviewedAt": "2026-11-01", "readStatus": "reviewed", "supports": null, "limitations": [], "provenance": { "key": "geforge-paper", "url": "https://gddr.fail/files/GeForge.pdf", "title": null, "scrape_id": "01a1976c-0c08-76cc-8670-b1063c3b578d", "http_status": 200, "parsed_pages": 19, "total_pages": 19, "cache_state": "miss", "cached_at": null, "reported_credits": 19, "error": null, "body_characters": 105915, "source_type": "primary_research_paper" } }, { "url": "https://gddr.fail/", "title": "GPU Memory Exploits", "type": "original_researcher_report", "reviewedAt": "2026-11-01", "readStatus": "reviewed", "supports": null, "limitations": [], "provenance": { "key": "gddr", "url": "https://gddr.fail/", "title": "GPU Memory Exploits", "scrape_id": "01a1976b-2e59-71f5-92dd-4c9d073a2f5f", "http_status": 200, "parsed_pages": null, "total_pages": null, "cache_state": "miss", "cached_at": null, "reported_credits": 1, "error": null, "body_characters": 8124, "source_type": "original_researcher_report" } }, { "url": "https://github.com/stefan1wan/GeForge", "title": "GitHub - stefan1wan/GeForge · GitHub", "type": "author_artifact_repository", "reviewedAt": "2026-11-01", "readStatus": "reviewed", "supports": null, "limitations": [], "provenance": { "key": "artifact-geforge", "url": "https://github.com/stefan1wan/GeForge", "title": "GitHub - stefan1wan/GeForge · GitHub", "scrape_id": "01a1976d-5759-71c7-ad3d-aa3d6902d60e", "http_status": 200, "parsed_pages": null, "total_pages": null, "cache_state": "miss", "cached_at": null, "reported_credits": 1, "error": null, "body_characters": 9737, "source_type": "author_artifact_repository" } } ], "followUp": { "performed": [ "Read full 19-page paper, especially its threat-model distinction.", "Verified the current public repository returned substantive content." ], "result": "Retained the host-isolation prerequisite and current artifact evidence.", "next_steps": [ "Confirm exact target hardware, firmware, access and mitigation state before any separate authorized assessment." ] }, "limitations": [ "GPU-local and host-directed outcomes have different boundaries.", "An enabled/enforcing IOMMU changes the demonstrated host path.", "The repository is currently accessible; a historical404 report would not prove current unavailability.", "Research-strand review status: AI-assisted desk review; no physical reproduction or independent human acceptance claimed." ], "mappings": { "emb3d": [ { "id": "TID-110", "name": "Hardware Fault Injection – Data Manipulation", "url": "https://emb3d.mitre.org/threats/TID-110.html", "basis": "analyst-inference", "rationale": "Mechanism-level analyst cross-reference; this case is not asserted to be named by EMB3D.", "officialCaseAttribution": false, "provenance": { "id": "TID-110", "relationship": "analyst_inference", "source_url": "https://emb3d.mitre.org/threats/TID-110.html", "basis": "Mechanism-level analyst cross-reference; this case is not asserted to be named by EMB3D." } } ], "attack": [] }, "confidence": { "total": 89, "components": { "provenance": { "score": 20, "max": 20, "rationale": "Original source and provenance inspected." }, "technicalEvidence": { "score": 34, "max": 35, "rationale": "Technical evidence read; methods and outcome limits retained." }, "configurationSpecificity": { "score": 20, "max": 20, "rationale": "Device and configuration details are bounded; missing revisions remain unknown." }, "independentCorroboration": { "score": 7, "max": 15, "rationale": "Independent corroboration is limited; taxonomy citation and same-team artifacts are not independent reproduction." }, "followUpResolution": { "score": 8, "max": 10, "rationale": "Follow-up source checks performed; unresolved items remain explicit." } }, "rationale": null } }, { "id": "primary-gputhor-2026", "title": "GPUThor preprint: ECC-enabled GPU Rowhammer qualifications", "canonicalUrl": "https://arxiv.org/abs/2609.16546", "strand": "primary", "scope": "hardware", "publicationDate": "2026-09-15", "eventDate": null, "reviewDate": "2026-11-01", "dateNotes": "Publication date precision: day.", "device": { "description": "Tested GA10x GDDR6 GPUs A4000/A4500/A5000/A6000; ECC-enabled experiments on A6000", "configuration": "arXiv2609.16546 updated2026-09-16. Other cloud GPU ECC-on outcomes include estimates, which are not counted as measured ECC-on experiments." }, "access": "Unprivileged CUDA execution; GPU-local and host-directed scenarios have different isolation requirements.", "claim": "GPUThor preprint: ECC-enabled GPU Rowhammer qualifications", "outcome": "Authors report ECC-enabled A6000 denial of service and privilege-escalation demonstrations. Host escalation additionally requires disabled/nonenforcing IOMMU; the paper's broader threat model includes enabled-IOMMU GPU-local scenarios.", "evidenceStatus": "preprint_author_demonstration", "evidenceGroup": "demonstration", "hardwareBoundary": "arXiv2609.16546 updated2026-09-16. Other cloud GPU ECC-on outcomes include estimates, which are not counted as measured ECC-on experiments.", "mechanisms": [ "Hardware Fault Injection – Data Manipulation" ], "sources": [ { "url": "https://arxiv.org/abs/2609.16546", "title": "GPUThor: Amplifying Rowhammer Attacks via Non-Uniform Patterns to Exploit ECC-Protected GPUs", "type": "preprint_targeted_body_passages", "reviewedAt": "2026-11-01", "readStatus": "partial", "supports": null, "limitations": [ "Firecrawl canonical paper metadata plus six targeted in-body passages" ], "provenance": { "key": "gputhor-read", "url": "https://arxiv.org/abs/2609.16546", "title": "GPUThor: Amplifying Rowhammer Attacks via Non-Uniform Patterns to Exploit ECC-Protected GPUs", "read_method": "Firecrawl canonical paper metadata plus six targeted in-body passages", "publication_status": "arXiv preprint", "publication_date": "2026-09-15", "version_updated": "2026-09-16", "reported_credits": null, "source_type": "preprint_targeted_body_passages" } }, { "url": "https://nvidia.custhelp.com/app/answers/detail/a_id/5671", "title": "Security Notice: Rowhammer - July 2025 | NVIDIA", "type": "vendor_security_advisory", "reviewedAt": "2026-11-01", "readStatus": "reviewed", "supports": null, "limitations": [], "provenance": { "key": "nvidia-rowhammer", "url": "https://nvidia.custhelp.com/app/answers/detail/a_id/5671", "title": "Security Notice: Rowhammer - July 2025 | NVIDIA", "scrape_id": "01a1976c-0b8f-715e-8b13-6d14a4b9fb47", "http_status": 200, "parsed_pages": null, "total_pages": null, "cache_state": "miss", "cached_at": null, "reported_credits": 1, "error": null, "body_characters": 11304, "source_type": "vendor_security_advisory" } } ], "followUp": { "performed": [ "Read canonical metadata and six targeted body passages covering methods, results, threat model and limitations.", "Compared those claims with NVIDIA's2025 notice and the originalGPUHammer configuration." ], "result": "Identified material newer evidence that narrows a blanketECC-mitigation statement, while preserving preprint and configuration limits.", "next_steps": [ "Read the complete versioned preprint and any later vendor response or independent reproduction before strengthening confidence." ] }, "limitations": [ "Targeted in-body passages and canonical metadata were read; this strand did not review every appendix or independently reproduce the preprint.", "The authors report no flips on tested HBM / GDDR6X/newer-generationGDDR6; those negatives are retained.", "A5000 ECC-on estimates are not promoted into observed experiments.", "Prior2025 vendor advice is not proof that ECC universally prevents later attacks.", "Research-strand review status: AI-assisted desk review; no physical reproduction or independent human acceptance claimed." ], "mappings": { "emb3d": [ { "id": "TID-110", "name": "Hardware Fault Injection – Data Manipulation", "url": "https://emb3d.mitre.org/threats/TID-110.html", "basis": "analyst-inference", "rationale": "Mechanism-level analyst cross-reference; this case is not asserted to be named by EMB3D.", "officialCaseAttribution": false, "provenance": { "id": "TID-110", "relationship": "analyst_inference", "source_url": "https://emb3d.mitre.org/threats/TID-110.html", "basis": "Mechanism-level analyst cross-reference; this case is not asserted to be named by EMB3D." } } ], "attack": [] }, "confidence": { "total": 78, "components": { "provenance": { "score": 19, "max": 20, "rationale": "Original source and provenance inspected." }, "technicalEvidence": { "score": 29, "max": 35, "rationale": "Technical evidence read; methods and outcome limits retained." }, "configurationSpecificity": { "score": 19, "max": 20, "rationale": "Device and configuration details are bounded; missing revisions remain unknown." }, "independentCorroboration": { "score": 3, "max": 15, "rationale": "Independent corroboration is limited; taxonomy citation and same-team artifacts are not independent reproduction." }, "followUpResolution": { "score": 8, "max": 10, "rationale": "Follow-up source checks performed; unresolved items remain explicit." } }, "rationale": null } }, { "id": "primary-ai-runtime-dma-2026", "title": "Controlled GH200/BlueField runtime-model modification", "canonicalUrl": "https://eclypsium.com/wp-content/uploads/Trusted-AI-Requires-Trusted-Infrastructure.pdf", "strand": "primary", "scope": "hardware", "publicationDate": "2026-10-29", "eventDate": null, "reviewDate": "2026-11-01", "dateNotes": "Publication date precision: day.", "device": { "description": "Controlled NVIDIA GH200 system with BlueFieldDPU", "configuration": "Privileged DMA-capable infrastructure component; memory reachability depends on IOMMU,PCIe topology and platform controls." }, "access": "Existing access/control over an infrastructure component with sufficient mapped-memory privileges; no unauthenticated remote entry is established.", "claim": "Controlled GH200/BlueField runtime-model modification", "outcome": "Eclypsium demonstrates changing runtime model behavior while stored-model integrity checks and previously completed artifact/boot checks remain valid.", "evidenceStatus": "controlled_vendor_research_demonstration", "evidenceGroup": "demonstration", "hardwareBoundary": "Privileged DMA-capable infrastructure component; memory reachability depends on IOMMU,PCIe topology and platform controls.", "mechanisms": [ "Unauthorized Direct Memory Access (DMA)" ], "sources": [ { "url": "https://eclypsium.com/wp-content/uploads/Trusted-AI-Requires-Trusted-Infrastructure.pdf", "title": null, "type": "primary_research_paper", "reviewedAt": "2026-11-01", "readStatus": "reviewed", "supports": null, "limitations": [], "provenance": { "key": "ai-runtime-paper", "url": "https://eclypsium.com/wp-content/uploads/Trusted-AI-Requires-Trusted-Infrastructure.pdf", "title": null, "scrape_id": "01a1976c-0c18-73af-9e24-3b278888bf3e", "http_status": 200, "parsed_pages": 15, "total_pages": 15, "cache_state": "miss", "cached_at": null, "reported_credits": 15, "error": null, "body_characters": 104172, "source_type": "primary_research_paper" } }, { "url": "https://eclypsium.com/press-release/eclypsium-and-nvidia-collaborate-to-address-emerging-ai-infrastructure-attack-surface-and-strengthen-ai-trust/", "title": "Eclypsium and NVIDIA Collaborate to Address Emerging AI Infrastructure Attack Surface and Strengthen AI Trust", "type": "original_researcher_report", "reviewedAt": "2026-11-01", "readStatus": "reviewed", "supports": null, "limitations": [], "provenance": { "key": "ai-runtime", "url": "https://eclypsium.com/press-release/eclypsium-and-nvidia-collaborate-to-address-emerging-ai-infrastructure-attack-surface-and-strengthen-ai-trust/", "title": "Eclypsium and NVIDIA Collaborate to Address Emerging AI Infrastructure Attack Surface and Strengthen AI Trust", "scrape_id": "01a1976b-2e48-75af-bc11-a0dcbed8180b", "http_status": 200, "parsed_pages": null, "total_pages": null, "cache_state": "miss", "cached_at": null, "reported_credits": 1, "error": null, "body_characters": 9376, "source_type": "original_researcher_report" } } ], "followUp": { "performed": [ "Read complete 15-page primary report and dated announcement.", "Checked the test-platform, privileged-access and runtime-versus-stored-artifact distinctions." ], "result": "Bounded the account to the demonstrated GH200/DPU configuration and avoided a generic model-file or remote-attack claim.", "next_steps": [ "Confirm exact target hardware, firmware, access and mitigation state before any separate authorized assessment." ] }, "limitations": [ "This is a controlled demonstration, not evidence of widespread exploitation.", "The case establishes one configuration-specific integrity gap, not that all BlueField or GPU deployments are unsafe.", "The release and report are the same research organization, not independent corroboration.", "Research-strand review status: AI-assisted desk review; no physical reproduction or independent human acceptance claimed." ], "mappings": { "emb3d": [ { "id": "TID-107", "name": "Unauthorized Direct Memory Access (DMA)", "url": "https://emb3d.mitre.org/threats/TID-107.html", "basis": "analyst-inference", "rationale": "Mechanism-level analyst cross-reference; this case is not asserted to be named by EMB3D.", "officialCaseAttribution": false, "provenance": { "id": "TID-107", "relationship": "analyst_inference", "source_url": "https://emb3d.mitre.org/threats/TID-107.html", "basis": "Mechanism-level analyst cross-reference; this case is not asserted to be named by EMB3D." } } ], "attack": [] }, "confidence": { "total": 81, "components": { "provenance": { "score": 20, "max": 20, "rationale": "Original source and provenance inspected." }, "technicalEvidence": { "score": 32, "max": 35, "rationale": "Technical evidence read; methods and outcome limits retained." }, "configurationSpecificity": { "score": 19, "max": 20, "rationale": "Device and configuration details are bounded; missing revisions remain unknown." }, "independentCorroboration": { "score": 3, "max": 15, "rationale": "Independent corroboration is limited; taxonomy citation and same-team artifacts are not independent reproduction." }, "followUpResolution": { "score": 7, "max": 10, "rationale": "Follow-up source checks performed; unresolved items remain explicit." } }, "rationale": null } }, { "id": "DR-001", "title": "DJI Mavic Pro: EM fault injection produced controlled memory corruption during firmware update", "canonicalUrl": "https://www.ioactive.com/applying-fault-injection-to-the-firmware-update-process-of-a-drone/", "strand": "drones-robotics", "scope": "hardware", "publicationDate": "2023-06-13", "eventDate": null, "reviewDate": "2026-11-01", "dateNotes": "Source update metadata: 2025-05-15; this is not an event date.", "device": { "vendor": "DJI", "models": [ "Mavic Pro" ], "firmwareVersions": null, "configuration": "Physically accessed board and firmware-update processing; exact tested firmware revision not disclosed in the inspected blog." }, "access": { "class": "physical-hardware", "requirements": "Physical possession, board access and specialized EM fault-injection instrumentation; laboratory iteration." }, "claim": "DJI Mavic Pro: EM fault injection produced controlled memory corruption during firmware update", "outcome": "IOActive reports a process crash with attacker-controlled values in registers after EM fault injection. Its separate EM side-channel key-recovery attempt was impractical; a reliable code-execution payload was described as future work.", "evidenceStatus": "controlled-demonstration-partial-outcome", "evidenceGroup": "demonstration", "hardwareBoundary": "Direct physical perturbation of the processor during update handling.", "mechanisms": [ "Hardware Fault Injection – Control Flow Modification" ], "sources": [ { "url": "https://www.ioactive.com/applying-fault-injection-to-the-firmware-update-process-of-a-drone/", "title": "Applying Fault Injection to the Firmware Update Process of a Drone - IOActive", "type": "original-research", "reviewedAt": "2026-11-01T14:01:08Z", "readStatus": "reviewed", "supports": "Observed memory corruption, attempted but impractical key recovery, and the explicit remaining code-execution step.", "limitations": [], "provenance": { "sourceId": "DR-S00", "url": "https://www.ioactive.com/applying-fault-injection-to-the-firmware-update-process-of-a-drone/", "title": "Applying Fault Injection to the Firmware Update Process of a Drone - IOActive", "kind": "original-research", "published": "2023-06-13T18:34:00+00:00", "modified": "2025-05-15T18:38:45+00:00", "verifiedAt": "2026-11-01T14:01:08Z", "httpStatus": 200, "scrapeId": "01a19766-fef7-7689-8a3b-0dd08a1a2bb5", "claimSupport": "Observed memory corruption, attempted but impractical key recovery, and the explicit remaining code-execution step.", "partialRead": null } } ], "followUp": [ { "question": "Did the researchers demonstrate full code execution?", "status": "resolved", "result": "No: the article makes payload design the next step after observed corruption.", "sourceURLs": [ "https://www.ioactive.com/applying-fault-injection-to-the-firmware-update-process-of-a-drone/" ] }, { "question": "Can a current owner device be declared vulnerable?", "status": "open", "result": "No exact tested firmware pin or independent replication; owner-specific validation remains unperformed.", "sourceURLs": [] } ], "limitations": [ "No independently reproduced code execution, full drone control, extracted encryption key, or operational exploitation established.", "Exact firmware version absent; modified blog metadata is not a new experiment date.", "Do not map this EMFI result to software-induced Rowhammer TID-110 merely because both alter data." ], "mappings": { "emb3d": [ { "id": "TID-105", "name": "Hardware Fault Injection – Control Flow Modification", "url": "https://emb3d.mitre.org/threats/TID-105.html", "basis": "analyst-inference", "rationale": "Physical EM glitching is the researched mechanism. Fit does not extend the observed result beyond a crash and controlled register corruption.", "officialCaseAttribution": false, "scope": "mechanism-only; control-flow exploitation remains unproven", "provenance": { "id": "TID-105", "name": "Hardware Fault Injection – Control Flow Modification", "url": "https://emb3d.mitre.org/threats/TID-105.html", "basis": "analyst_mapping", "fit": "mechanism-only; control-flow exploitation remains unproven", "rationale": "Physical EM glitching is the researched mechanism. Fit does not extend the observed result beyond a crash and controlled register corruption.", "modelVersion": "2.0.1", "sourcePin": "MITRE/emb3d@0d7c25bb4e2928c516fb5811aaab9ff8bab2896c", "officialCaseAttribution": false } } ], "attack": [] }, "confidence": { "total": 68, "components": { "provenance": { "score": 20, "max": 20, "rationale": null }, "technicalEvidence": { "score": 28, "max": 35, "rationale": null }, "configurationSpecificity": { "score": 10, "max": 20, "rationale": null }, "independentCorroboration": { "score": 0, "max": 15, "rationale": null }, "followUpResolution": { "score": 10, "max": 10, "rationale": null } }, "rationale": "Original instrumented research with explicit negative and partial outcomes; no independent reproduction or precise firmware revision." } }, { "id": "DR-002", "title": "NDSS 2023 DJI drones and controllers: DUML firmware vulnerabilities under a connected-device threat model", "canonicalUrl": "https://www.ndss-symposium.org/ndss-paper/drone-security-and-the-mysterious-case-of-djis-droneid/", "strand": "drones-robotics", "scope": "device-interface", "publicationDate": "2023", "eventDate": null, "reviewDate": "2026-11-01", "dateNotes": null, "device": { "vendor": "DJI", "models": [ "Mavic Air 2", "DJI Mini 2", "Mavic 2 Pro", "RC231" ], "firmwareVersions": [ "Mavic Air 2 01.01.0610", "DJI Mini 2 01.03.0000", "Mavic 2 Pro 01.00.0770", "RC231 with Mavic Air 2 01.01.0610" ], "configuration": "These are the paper's fuzzer setup versions, not a claim each of its sixteen vulnerabilities affects every listed device. The paper also uses later versions in a separate DroneID comparison table." }, "access": { "class": "embedded-firmware/connected-controller", "requirements": "Active attacker controls or can access a device connected to the drone/remote-control chain, including the operator smartphone; this is not arbitrary unauthenticated Internet reachability." }, "claim": "NDSS 2023 DJI drones and controllers: DUML firmware vulnerabilities under a connected-device threat model", "outcome": "Researchers report sixteen vulnerabilities spanning denial of service and arbitrary code/command execution, with root access on affected drone/controller targets and a mid-flight crash vector. The paper reports coordinated remediation by DJI.", "evidenceStatus": "peer-reviewed-controlled-demonstration", "evidenceGroup": "demonstration", "hardwareBoundary": "Embedded firmware and DUML control interfaces cross into navigation/flight behavior; UART analysis was part of discovery but exposed boot output alone is not a usable debug-privilege claim.", "mechanisms": [ "Out of Bounds Memory Access", "Remotely Triggerable Deadlock/DoS" ], "sources": [ { "url": "https://www.ndss-symposium.org/ndss-paper/drone-security-and-the-mysterious-case-of-djis-droneid/", "title": "Drone Security and the Mysterious Case of DJI's DroneID - NDSS Symposium", "type": "conference-primary-summary", "reviewedAt": "2026-11-01T14:01:08Z", "readStatus": "reviewed", "supports": "Study outcomes and threat model.", "limitations": [], "provenance": { "sourceId": "DR-S01", "url": "https://www.ndss-symposium.org/ndss-paper/drone-security-and-the-mysterious-case-of-djis-droneid/", "title": "Drone Security and the Mysterious Case of DJI's DroneID - NDSS Symposium", "kind": "conference-primary-summary", "published": null, "modified": "2024-10-08T11:50:36+00:00", "verifiedAt": "2026-11-01T14:01:08Z", "httpStatus": 200, "scrapeId": "01a19766-fee5-75fe-8902-0acc3cbd369c", "claimSupport": "Study outcomes and threat model.", "partialRead": null } }, { "url": "https://www.ndss-symposium.org/wp-content/uploads/2023/02/ndss2023_f217_paper.pdf", "title": null, "type": "peer-reviewed-paper-partial", "reviewedAt": "2026-11-01T14:01:08Z", "readStatus": "partial", "supports": "Experimental setup, access chain, outcomes and stated fixes; first sixteen of seventeen PDF pages read.", "limitations": [ { "pagesRead": 16, "pagesTotal": 17 } ], "provenance": { "sourceId": "DR-S14", "url": "https://www.ndss-symposium.org/wp-content/uploads/2023/02/ndss2023_f217_paper.pdf", "title": null, "kind": "peer-reviewed-paper-partial", "published": null, "modified": null, "verifiedAt": "2026-11-01T14:01:08Z", "httpStatus": 200, "scrapeId": "01a19768-7c4b-72fa-a1ee-cc0628b161ee", "claimSupport": "Experimental setup, access chain, outcomes and stated fixes; first sixteen of seventeen PDF pages read.", "partialRead": { "pagesRead": 16, "pagesTotal": 17 } } } ], "followUp": [ { "question": "What device/version and access conditions were actually inspected?", "status": "resolved", "result": "Fuzzer setup versions and connected smartphone/controller preconditions read from the paper.", "sourceURLs": [ "https://www.ndss-symposium.org/wp-content/uploads/2023/02/ndss2023_f217_paper.pdf" ] }, { "question": "Were bugs fixed according to the authors?", "status": "resolved", "result": "Paper says DJI fixed the reported bugs; this is author remediation reporting, not LrrK retesting.", "sourceURLs": [ "https://www.ndss-symposium.org/wp-content/uploads/2023/02/ndss2023_f217_paper.pdf" ] } ], "limitations": [ "The paper was read through page 16/17; no claim of complete appendix/reference coverage.", "Different vulnerability/device matrices must not be collapsed into a blanket affected-products statement.", "No operational malicious use or present-day DJI-fleet vulnerability established." ], "mappings": { "emb3d": [ { "id": "TID-327", "name": "Out of Bounds Memory Access", "url": "https://emb3d.mitre.org/threats/TID-327.html", "basis": "analyst-inference", "rationale": "The firmware study reports exploitable memory errors; this cross-reference applies to memory-corruption members of the reported set, not all sixteen findings.", "officialCaseAttribution": false, "scope": "mechanism", "provenance": { "id": "TID-327", "name": "Out of Bounds Memory Access", "url": "https://emb3d.mitre.org/threats/TID-327.html", "basis": "analyst_mapping", "fit": "mechanism", "rationale": "The firmware study reports exploitable memory errors; this cross-reference applies to memory-corruption members of the reported set, not all sixteen findings.", "modelVersion": "2.0.1", "sourcePin": "MITRE/emb3d@0d7c25bb4e2928c516fb5811aaab9ff8bab2896c", "officialCaseAttribution": false } }, { "id": "TID-404", "name": "Remotely Triggerable Deadlock/DoS", "url": "https://emb3d.mitre.org/threats/TID-404.html", "basis": "analyst-inference", "rationale": "Reported remote firmware crashes and inconsistent states support a DoS mechanism reference within the connected-device threat model.", "officialCaseAttribution": false, "scope": "mechanism", "provenance": { "id": "TID-404", "name": "Remotely Triggerable Deadlock/DoS", "url": "https://emb3d.mitre.org/threats/TID-404.html", "basis": "analyst_mapping", "fit": "mechanism", "rationale": "Reported remote firmware crashes and inconsistent states support a DoS mechanism reference within the connected-device threat model.", "modelVersion": "2.0.1", "sourcePin": "MITRE/emb3d@0d7c25bb4e2928c516fb5811aaab9ff8bab2896c", "officialCaseAttribution": false } } ], "attack": [] }, "confidence": { "total": 80, "components": { "provenance": { "score": 20, "max": 20, "rationale": null }, "technicalEvidence": { "score": 33, "max": 35, "rationale": null }, "configurationSpecificity": { "score": 18, "max": 20, "rationale": null }, "independentCorroboration": { "score": 0, "max": 15, "rationale": null }, "followUpResolution": { "score": 9, "max": 10, "rationale": null } }, "rationale": "Peer-reviewed original paper and specified setup; same-author conference page is not independent corroboration, and fixes were not retested." } }, { "id": "DR-003", "title": "NDSS 2023 DJI DroneID: passive recovery of drone and operator positions", "canonicalUrl": "https://www.ndss-symposium.org/ndss-paper/drone-security-and-the-mysterious-case-of-djis-droneid/", "strand": "drones-robotics", "scope": "device-interface", "publicationDate": "2023", "eventDate": null, "reviewDate": "2026-11-01", "dateNotes": null, "device": { "vendor": "DJI", "models": [ "DJI devices using the tested OcuSync/DroneID implementations" ], "firmwareVersions": null, "configuration": "DroneID radio tracking protocol studied in the paper; distinct from the firmware exploitation experiment." }, "access": { "class": "radio-observation", "requirements": "Ability to receive the target's radio transmission with suitable receiving equipment; not physical possession or controller authentication." }, "claim": "NDSS 2023 DJI DroneID: passive recovery of drone and operator positions", "outcome": "The researchers decoded unencrypted DroneID position information, including drone and operator/home-position information. This establishes privacy exposure in the tested protocol, not flight takeover.", "evidenceStatus": "peer-reviewed-controlled-demonstration", "evidenceGroup": "demonstration", "hardwareBoundary": "Radio-emitted operational information from an embedded device; networking category rather than physical tampering.", "mechanisms": [ "Unencrypted Sensitive Data Communication" ], "sources": [ { "url": "https://www.ndss-symposium.org/ndss-paper/drone-security-and-the-mysterious-case-of-djis-droneid/", "title": "Drone Security and the Mysterious Case of DJI's DroneID - NDSS Symposium", "type": "conference-primary-summary", "reviewedAt": "2026-11-01T14:01:08Z", "readStatus": "reviewed", "supports": "Unencrypted tracking data and passive decoder.", "limitations": [], "provenance": { "sourceId": "DR-S01", "url": "https://www.ndss-symposium.org/ndss-paper/drone-security-and-the-mysterious-case-of-djis-droneid/", "title": "Drone Security and the Mysterious Case of DJI's DroneID - NDSS Symposium", "kind": "conference-primary-summary", "published": null, "modified": "2024-10-08T11:50:36+00:00", "verifiedAt": "2026-11-01T14:01:08Z", "httpStatus": 200, "scrapeId": "01a19766-fee5-75fe-8902-0acc3cbd369c", "claimSupport": "Unencrypted tracking data and passive decoder.", "partialRead": null } }, { "url": "https://www.ndss-symposium.org/wp-content/uploads/2023/02/ndss2023_f217_paper.pdf", "title": null, "type": "peer-reviewed-paper-partial", "reviewedAt": "2026-11-01T14:01:08Z", "readStatus": "partial", "supports": "Threat model and separation from active firmware exploitation.", "limitations": [ { "pagesRead": 16, "pagesTotal": 17 } ], "provenance": { "sourceId": "DR-S14", "url": "https://www.ndss-symposium.org/wp-content/uploads/2023/02/ndss2023_f217_paper.pdf", "title": null, "kind": "peer-reviewed-paper-partial", "published": null, "modified": null, "verifiedAt": "2026-11-01T14:01:08Z", "httpStatus": 200, "scrapeId": "01a19768-7c4b-72fa-a1ee-cc0628b161ee", "claimSupport": "Threat model and separation from active firmware exploitation.", "partialRead": { "pagesRead": 16, "pagesTotal": 17 } } } ], "followUp": [ { "question": "Is the privacy result the same attack as root exploitation?", "status": "resolved", "result": "No: the paper defines passive radio observation and active connected/physical-device threat models separately.", "sourceURLs": [ "https://www.ndss-symposium.org/wp-content/uploads/2023/02/ndss2023_f217_paper.pdf" ] } ], "limitations": [ "Do not equate DJI DroneID with every standardized Remote ID implementation.", "No evidence this passive observation grants control of a drone.", "No exact universal firmware affected range assigned." ], "mappings": { "emb3d": [ { "id": "TID-408", "name": "Unencrypted Sensitive Data Communication", "url": "https://emb3d.mitre.org/threats/TID-408.html", "basis": "analyst-inference", "rationale": "Passive recovery of operational/location data fits unencrypted sensitive communication; this is an analyst interpretation, not an official case mapping.", "officialCaseAttribution": false, "scope": "mechanism", "provenance": { "id": "TID-408", "name": "Unencrypted Sensitive Data Communication", "url": "https://emb3d.mitre.org/threats/TID-408.html", "basis": "analyst_mapping", "fit": "mechanism", "rationale": "Passive recovery of operational/location data fits unencrypted sensitive communication; this is an analyst interpretation, not an official case mapping.", "modelVersion": "2.0.1", "sourcePin": "MITRE/emb3d@0d7c25bb4e2928c516fb5811aaab9ff8bab2896c", "officialCaseAttribution": false } } ], "attack": [] }, "confidence": { "total": 72, "components": { "provenance": { "score": 20, "max": 20, "rationale": null }, "technicalEvidence": { "score": 31, "max": 35, "rationale": null }, "configurationSpecificity": { "score": 12, "max": 20, "rationale": null }, "independentCorroboration": { "score": 0, "max": 15, "rationale": null }, "followUpResolution": { "score": 9, "max": 10, "rationale": null } }, "rationale": "Original peer-reviewed receiver implementation and direct result; no independent replication or current protocol coverage established." } }, { "id": "DR-004", "title": "DJI QuickTransfer: weak Wi-Fi credential generation, CVE-2023-6951", "canonicalUrl": "https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2023-6951", "strand": "drones-robotics", "scope": "device-interface", "publicationDate": "2024-03-29", "eventDate": null, "reviewDate": "2026-11-01", "dateNotes": null, "device": { "description": { "vendor": "DJI", "models": [ "Mavic 3 family", "Matrice 300", "Matrice M30", "Mini 3 Pro" ], "firmwareVersions": [ "Mavic 3 Pro before 01.01.0300", "Mavic 3 before 01.00.1200", "Mavic 3 Classic before 01.00.0500", "Mavic 3 Enterprise before 07.01.10.03", "Matrice 300 before 57.00.01.00", "Matrice M30 before 07.01.0022", "Mini 3 Pro before 01.00.0620" ], "configuration": "QuickTransfer user-enabled Wi-Fi media transfer while the drone is not flying." }, "reportedCves": [ "CVE-2023-6951" ] }, "access": { "class": "adjacent-radio", "requirements": "Within reach of the exposed QuickTransfer Wi-Fi access point after the operator enables the mode." }, "claim": "DJI QuickTransfer: weak Wi-Fi credential generation, CVE-2023-6951", "outcome": "Nozomi demonstrated that low-entropy generated Wi-Fi credentials could be recovered, allowing unauthorized association with the drone access point. Association is a precondition for further services, not demonstrated flight control.", "evidenceStatus": "original-research-and-advisory", "evidenceGroup": "demonstration", "hardwareBoundary": "Embedded radio/service boundary; firmware-generated credentials rather than physical chip compromise.", "mechanisms": [ "Predictable Cryptographic Key" ], "sources": [ { "url": "https://www.nozominetworks.com/blog/dji-mavic-3-drone-research-part-2-vulnerability-analysis", "title": "DJI Mavic 3 Drone Research: Vulnerability Analysis", "type": "original-research", "reviewedAt": "2026-11-01T14:01:08Z", "readStatus": "reviewed", "supports": "Attack mode, user interaction, tested credential weakness and remediation discussion.", "limitations": [], "provenance": { "sourceId": "DR-S02", "url": "https://www.nozominetworks.com/blog/dji-mavic-3-drone-research-part-2-vulnerability-analysis", "title": "DJI Mavic 3 Drone Research: Vulnerability Analysis", "kind": "original-research", "published": null, "modified": null, "verifiedAt": "2026-11-01T14:01:08Z", "httpStatus": 200, "scrapeId": "01a19766-ff98-7348-8f82-286fb660eca2", "claimSupport": "Attack mode, user interaction, tested credential weakness and remediation discussion.", "partialRead": null } }, { "url": "https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2023-6951", "title": "CVE-2023-6951 | Nozomi Networks Labs", "type": "researcher-advisory", "reviewedAt": "2026-11-01T14:01:08Z", "readStatus": "reviewed", "supports": "CVE identity, affected firmware boundaries and upgrade advice.", "limitations": [], "provenance": { "sourceId": "DR-S03", "url": "https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2023-6951", "title": "CVE-2023-6951 | Nozomi Networks Labs", "kind": "researcher-advisory", "published": null, "modified": null, "verifiedAt": "2026-11-01T14:01:08Z", "httpStatus": 200, "scrapeId": "01a19766-ff12-7798-8180-fe4d4ba216b4", "claimSupport": "CVE identity, affected firmware boundaries and upgrade advice.", "partialRead": null } } ], "followUp": [ { "question": "Was this simply an Internet remote attack?", "status": "resolved", "result": "No: adjacent Wi-Fi and operator QuickTransfer activation are required in the report.", "sourceURLs": [ "https://www.nozominetworks.com/blog/dji-mavic-3-drone-research-part-2-vulnerability-analysis" ] }, { "question": "Was a fix reported?", "status": "resolved", "result": "Nozomi lists fixed versions for seven drone product groups.", "sourceURLs": [ "https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2023-6951" ] } ], "limitations": [ "QuickTransfer's nonflying state and user activation are material.", "The credential experiment is not proof of arbitrary code execution or airborne takeover.", "Only the advisory's listed versions are reproduced; no live device validation." ], "mappings": { "emb3d": [ { "id": "TID-317", "name": "Predictable Cryptographic Key", "url": "https://emb3d.mitre.org/threats/TID-317.html", "basis": "analyst-inference", "rationale": "Insufficient entropy in access credentials permits unauthorized access; the advisory demonstrates this specific key-generation weakness.", "officialCaseAttribution": false, "scope": "mechanism", "provenance": { "id": "TID-317", "name": "Predictable Cryptographic Key", "url": "https://emb3d.mitre.org/threats/TID-317.html", "basis": "analyst_mapping", "fit": "mechanism", "rationale": "Insufficient entropy in access credentials permits unauthorized access; the advisory demonstrates this specific key-generation weakness.", "modelVersion": "2.0.1", "sourcePin": "MITRE/emb3d@0d7c25bb4e2928c516fb5811aaab9ff8bab2896c", "officialCaseAttribution": false } } ], "attack": [] }, "confidence": { "total": 81, "components": { "provenance": { "score": 20, "max": 20, "rationale": null }, "technicalEvidence": { "score": 31, "max": 35, "rationale": null }, "configurationSpecificity": { "score": 20, "max": 20, "rationale": null }, "independentCorroboration": { "score": 0, "max": 15, "rationale": null }, "followUpResolution": { "score": 10, "max": 10, "rationale": null } }, "rationale": "Original experiment plus exact researcher advisory and correction versions; these are not independent sources." } }, { "id": "DR-005", "title": "DJI QuickTransfer: unauthenticated media API with disputed CVE-2023-6949", "canonicalUrl": "https://www.nozominetworks.com/blog/dji-mavic-3-drone-research-part-2-vulnerability-analysis", "strand": "drones-robotics", "scope": "device-interface", "publicationDate": "2024-04-02", "eventDate": null, "reviewDate": "2026-11-01", "dateNotes": null, "device": { "description": { "vendor": "DJI", "models": [ "DJI Mavic 3 research platform; impacted-model review discussed by the researcher" ], "firmwareVersions": null, "configuration": "HTTP media service reachable from the QuickTransfer Wi-Fi connection." }, "reportedCves": [ "CVE-2023-6949" ] }, "access": { "class": "adjacent-network/connected-mobile", "requirements": "Access to the QuickTransfer network or a malicious/compromised mobile endpoint already using it; user enables QuickTransfer." }, "claim": "DJI QuickTransfer: unauthenticated media API with disputed CVE-2023-6949", "outcome": "Researchers found a media API lacking application-layer authentication, permitting retrieval of pictures and videos by a network-connected party. DJI disputed the CVE, arguing that fixing Wi-Fi credential generation addressed the remote entry path.", "evidenceStatus": "original-research-disputed-vulnerability", "evidenceGroup": "reported-result", "hardwareBoundary": "Embedded media-service boundary, not physical hardware tampering.", "mechanisms": [ "Remotely Accessible Unauthenticated Services" ], "sources": [ { "url": "https://www.nozominetworks.com/blog/dji-mavic-3-drone-research-part-2-vulnerability-analysis", "title": "DJI Mavic 3 Drone Research: Vulnerability Analysis", "type": "original-research", "reviewedAt": "2026-11-01T14:01:08Z", "readStatus": "reviewed", "supports": "Unauthenticated API behavior and vendor dispute rationale.", "limitations": [], "provenance": { "sourceId": "DR-S02", "url": "https://www.nozominetworks.com/blog/dji-mavic-3-drone-research-part-2-vulnerability-analysis", "title": "DJI Mavic 3 Drone Research: Vulnerability Analysis", "kind": "original-research", "published": null, "modified": null, "verifiedAt": "2026-11-01T14:01:08Z", "httpStatus": 200, "scrapeId": "01a19766-ff98-7348-8f82-286fb660eca2", "claimSupport": "Unauthenticated API behavior and vendor dispute rationale.", "partialRead": null } } ], "followUp": [ { "question": "Was vendor disagreement checked?", "status": "resolved", "result": "Yes: report identifies this CVE as disputed and explains the alternative trust-boundary interpretation.", "sourceURLs": [ "https://www.nozominetworks.com/blog/dji-mavic-3-drone-research-part-2-vulnerability-analysis" ] } ], "limitations": [ "Vendor dispute is retained, not treated as proof the mechanism does not exist or as an independently resolved vulnerability.", "No arbitrary airborne takeover or covert worldwide access demonstrated.", "Exact per-CVE firmware matrix not assigned from the broader report." ], "mappings": { "emb3d": [ { "id": "TID-310", "name": "Remotely Accessible Unauthenticated Services", "url": "https://emb3d.mitre.org/threats/TID-310.html", "basis": "analyst-inference", "rationale": "The reachable HTTP service lacks application-layer authentication; fit is conditional on the documented network boundary.", "officialCaseAttribution": false, "scope": "mechanism", "provenance": { "id": "TID-310", "name": "Remotely Accessible Unauthenticated Services", "url": "https://emb3d.mitre.org/threats/TID-310.html", "basis": "analyst_mapping", "fit": "mechanism", "rationale": "The reachable HTTP service lacks application-layer authentication; fit is conditional on the documented network boundary.", "modelVersion": "2.0.1", "sourcePin": "MITRE/emb3d@0d7c25bb4e2928c516fb5811aaab9ff8bab2896c", "officialCaseAttribution": false } } ], "attack": [] }, "confidence": { "total": 69, "components": { "provenance": { "score": 20, "max": 20, "rationale": null }, "technicalEvidence": { "score": 27, "max": 35, "rationale": null }, "configurationSpecificity": { "score": 12, "max": 20, "rationale": null }, "independentCorroboration": { "score": 0, "max": 15, "rationale": null }, "followUpResolution": { "score": 10, "max": 10, "rationale": null } }, "rationale": "Original technical account with an explicit unresolved vendor interpretation; no independent adjudication." } }, { "id": "DR-006", "title": "DJI QuickTransfer: diagnostic and SDK service crashes, with potential memory exploitation kept separate", "canonicalUrl": "https://www.nozominetworks.com/blog/dji-mavic-3-drone-research-part-2-vulnerability-analysis", "strand": "drones-robotics", "scope": "device-interface", "publicationDate": "2024-04-02", "eventDate": null, "reviewDate": "2026-11-01", "dateNotes": null, "device": { "description": { "vendor": "DJI", "models": [ "DJI Mavic 3 research platform" ], "firmwareVersions": null, "configuration": "Firmware services analyzed using an Android emulator and adjacent QuickTransfer connectivity." }, "reportedCves": [ "CVE-2023-6950", "CVE-2023-6948", "CVE-2023-51452", "CVE-2023-51453", "CVE-2023-51454", "CVE-2023-51455", "CVE-2023-51456" ] }, "access": { "class": "embedded-service/adjacent-network", "requirements": "QuickTransfer activation plus access to its Wi-Fi network or the connected mobile endpoint; some reported CVSS vectors require prior network authorization." }, "claim": "DJI QuickTransfer: diagnostic and SDK service crashes, with potential memory exploitation kept separate", "outcome": "Report describes persistent diagnostic FTP denial of service, three SDK-service DoS crashes and three out-of-bounds corruption primitives. The latter were described as potentially exploitable, not as demonstrated complete drone compromise.", "evidenceStatus": "original-research-controlled-crashes", "evidenceGroup": "demonstration", "hardwareBoundary": "Embedded firmware/service robustness; not direct physical hardware attack.", "mechanisms": [ "Out of Bounds Memory Access", "Remotely Triggerable Deadlock/DoS" ], "sources": [ { "url": "https://www.nozominetworks.com/blog/dji-mavic-3-drone-research-part-2-vulnerability-analysis", "title": "DJI Mavic 3 Drone Research: Vulnerability Analysis", "type": "original-research", "reviewedAt": "2026-11-01T14:01:08Z", "readStatus": "reviewed", "supports": "Distinguishes diagnostic DoS, FORTIFY-stopped crashes and potential exploit primitives.", "limitations": [], "provenance": { "sourceId": "DR-S02", "url": "https://www.nozominetworks.com/blog/dji-mavic-3-drone-research-part-2-vulnerability-analysis", "title": "DJI Mavic 3 Drone Research: Vulnerability Analysis", "kind": "original-research", "published": null, "modified": null, "verifiedAt": "2026-11-01T14:01:08Z", "httpStatus": 200, "scrapeId": "01a19766-ff98-7348-8f82-286fb660eca2", "claimSupport": "Distinguishes diagnostic DoS, FORTIFY-stopped crashes and potential exploit primitives.", "partialRead": null } } ], "followUp": [ { "question": "Does every crash establish RCE?", "status": "resolved", "result": "No: three were reported DoS-only, while three corruption primitives were framed as potential exploitation.", "sourceURLs": [ "https://www.nozominetworks.com/blog/dji-mavic-3-drone-research-part-2-vulnerability-analysis" ] }, { "question": "Was all nine-issue research patched?", "status": "resolved", "result": "No: researcher reports seven fixed issues and two disputed ones, including diagnostic DoS and media authentication.", "sourceURLs": [ "https://www.nozominetworks.com/blog/dji-mavic-3-drone-research-part-2-vulnerability-analysis" ] } ], "limitations": [ "CVE-2023-6950 diagnostic-service DoS is disputed by DJI; report says it was not fixed.", "Potential RCE from corruption primitives is not established code execution.", "Emulator results and observed target outcomes should remain distinct in any later per-CVE expansion." ], "mappings": { "emb3d": [ { "id": "TID-327", "name": "Out of Bounds Memory Access", "url": "https://emb3d.mitre.org/threats/TID-327.html", "basis": "analyst-inference", "rationale": "Applies to the SDK corruption primitives, without upgrading potential exploitability to proven RCE.", "officialCaseAttribution": false, "scope": "mechanism", "provenance": { "id": "TID-327", "name": "Out of Bounds Memory Access", "url": "https://emb3d.mitre.org/threats/TID-327.html", "basis": "analyst_mapping", "fit": "mechanism", "rationale": "Applies to the SDK corruption primitives, without upgrading potential exploitability to proven RCE.", "modelVersion": "2.0.1", "sourcePin": "MITRE/emb3d@0d7c25bb4e2928c516fb5811aaab9ff8bab2896c", "officialCaseAttribution": false } }, { "id": "TID-404", "name": "Remotely Triggerable Deadlock/DoS", "url": "https://emb3d.mitre.org/threats/TID-404.html", "basis": "analyst-inference", "rationale": "Applies to reported service crashes requiring restart/recovery.", "officialCaseAttribution": false, "scope": "mechanism", "provenance": { "id": "TID-404", "name": "Remotely Triggerable Deadlock/DoS", "url": "https://emb3d.mitre.org/threats/TID-404.html", "basis": "analyst_mapping", "fit": "mechanism", "rationale": "Applies to reported service crashes requiring restart/recovery.", "modelVersion": "2.0.1", "sourcePin": "MITRE/emb3d@0d7c25bb4e2928c516fb5811aaab9ff8bab2896c", "officialCaseAttribution": false } } ], "attack": [] }, "confidence": { "total": 71, "components": { "provenance": { "score": 20, "max": 20, "rationale": null }, "technicalEvidence": { "score": 30, "max": 35, "rationale": null }, "configurationSpecificity": { "score": 11, "max": 20, "rationale": null }, "independentCorroboration": { "score": 0, "max": 15, "rationale": null }, "followUpResolution": { "score": 10, "max": 10, "rationale": null } }, "rationale": "Technical differentiated report with outcomes and disagreement retained; per-CVE target revisions remain incomplete." } }, { "id": "DR-007", "title": "Universal Robots 2017: network exploit chain altered cobot safety configuration", "canonicalUrl": "https://www.ioactive.com/exploiting-industrial-collaborative-robots/", "strand": "drones-robotics", "scope": "device-interface", "publicationDate": "2017-08-22", "eventDate": null, "reviewDate": "2026-11-01", "dateNotes": null, "device": { "vendor": "Universal Robots", "models": [ "UR3", "UR5", "UR10" ], "firmwareVersions": [ "3.4.2.65, May 2017, cited as latest affected release in the historical report" ], "configuration": "Collaborative robot control software and network-accessible control services; demonstrated robot variant not separately pinned in the inspected report." }, "access": { "class": "embedded-controller/network", "requirements": "Network reachability to robot controller services; physical possession is not the demonstrated entry condition." }, "claim": "Universal Robots 2017: network exploit chain altered cobot safety configuration", "outcome": "IOActive reported a six-vulnerability chain that modified safety limits and disabled selected safety controls; the report links a controlled demonstration of unsafe motion. No malicious real-world injury is established.", "evidenceStatus": "original-research-controlled-demonstration", "evidenceGroup": "demonstration", "hardwareBoundary": "Embedded control and safety configuration governing mechanical movement. This is not proof of chip tampering or a physical injection attack.", "mechanisms": [ "Out of Bounds Memory Access", "Remotely Accessible Unauthenticated Services" ], "sources": [ { "url": "https://www.ioactive.com/exploiting-industrial-collaborative-robots/", "title": "Exploiting Industrial Collaborative Robots - IOActive", "type": "original-research", "reviewedAt": "2026-11-01T14:01:08Z", "readStatus": "reviewed", "supports": "Historical tested version, safety-configuration result and laboratory demonstration.", "limitations": [], "provenance": { "sourceId": "DR-S08", "url": "https://www.ioactive.com/exploiting-industrial-collaborative-robots/", "title": "Exploiting Industrial Collaborative Robots - IOActive", "kind": "original-research", "published": "2017-08-22T11:45:00+00:00", "modified": "2025-05-19T14:25:18+00:00", "verifiedAt": "2026-11-01T14:01:08Z", "httpStatus": 200, "scrapeId": "01a19768-2e86-734a-9153-18d0ad56cb28", "claimSupport": "Historical tested version, safety-configuration result and laboratory demonstration.", "partialRead": null } } ], "followUp": [ { "question": "Is the case about physically damaging a chip?", "status": "resolved", "result": "No: network-accessible embedded control and safety settings are the relevant boundary.", "sourceURLs": [ "https://www.ioactive.com/exploiting-industrial-collaborative-robots/" ] }, { "question": "Current remediation across affected legacy versions?", "status": "open", "result": "No current vendor retest or complete historical fix matrix performed.", "sourceURLs": [] } ], "limitations": [ "2017 patch-status wording is historical and must not be presented as current UR availability.", "Potential harm described in the report is not an observed injury.", "No exact modern device/configuration inference." ], "mappings": { "emb3d": [ { "id": "TID-327", "name": "Out of Bounds Memory Access", "url": "https://emb3d.mitre.org/threats/TID-327.html", "basis": "analyst-inference", "rationale": "The reported exploit chain includes memory corruption; applies only to that part of the chain.", "officialCaseAttribution": false, "provenance": { "id": "TID-327", "name": "Out of Bounds Memory Access", "url": "https://emb3d.mitre.org/threats/TID-327.html", "basis": "analyst_mapping", "rationale": "The reported exploit chain includes memory corruption; applies only to that part of the chain.", "modelVersion": "2.0.1", "sourcePin": "MITRE/emb3d@0d7c25bb4e2928c516fb5811aaab9ff8bab2896c", "officialCaseAttribution": false } }, { "id": "TID-310", "name": "Remotely Accessible Unauthenticated Services", "url": "https://emb3d.mitre.org/threats/TID-310.html", "basis": "analyst-inference", "rationale": "Unauthenticated control functions are part of the reported controller attack surface.", "officialCaseAttribution": false, "provenance": { "id": "TID-310", "name": "Remotely Accessible Unauthenticated Services", "url": "https://emb3d.mitre.org/threats/TID-310.html", "basis": "analyst_mapping", "rationale": "Unauthenticated control functions are part of the reported controller attack surface.", "modelVersion": "2.0.1", "sourcePin": "MITRE/emb3d@0d7c25bb4e2928c516fb5811aaab9ff8bab2896c", "officialCaseAttribution": false } } ], "attack": [ { "id": "T0836", "name": "Modify Parameter", "url": "https://attack.mitre.org/versions/v20/techniques/T0836/", "basis": "analyst-inference", "rationale": "Analyst cross-reference to changing safety limits governing motion, not MITRE attribution of this laboratory case.", "officialCaseAttribution": false, "domain": "ics", "provenance": { "id": "T0836", "name": "Modify Parameter", "domain": "ICS", "url": "https://attack.mitre.org/versions/v20/techniques/T0836/", "basis": "analyst_cross_reference", "rationale": "Analyst cross-reference to changing safety limits governing motion, not MITRE attribution of this laboratory case.", "attackVersion": "20.0", "officialCaseAttribution": false } } ] }, "confidence": { "total": 72, "components": { "provenance": { "score": 20, "max": 20, "rationale": null }, "technicalEvidence": { "score": 31, "max": 35, "rationale": null }, "configurationSpecificity": { "score": 14, "max": 20, "rationale": null }, "independentCorroboration": { "score": 0, "max": 15, "rationale": null }, "followUpResolution": { "score": 7, "max": 10, "rationale": null } }, "rationale": "Original chain and demonstration with historical version; independent replication and current fix matrix absent." } }, { "id": "DR-008", "title": "Universal Robots PolyScope 5 Dashboard Server command injection, CVE-2026-8153", "canonicalUrl": "https://www.universal-robots.com/articles/ur/cybersecurity/cve-2026-8153-command-injection-in-the-polyscope-5-dashboard-server/", "strand": "drones-robotics", "scope": "device-interface", "publicationDate": "2026-05-11", "eventDate": null, "reviewDate": "2026-11-01", "dateNotes": null, "device": { "description": { "vendor": "Universal Robots", "models": [ "Robots using affected PolyScope 5" ], "firmwareVersions": [ "PolyScope 5 before 5.25.1" ], "configuration": "Dashboard Server enabled in UI and network port reachable." }, "reportedCves": [ "CVE-2026-8153" ] }, "access": { "class": "embedded-controller/network", "requirements": "Unauthenticated attacker can reach an enabled Dashboard Server; vendor stresses LAN reachability and says robots are not designed for direct Internet access." }, "claim": "Universal Robots PolyScope 5 Dashboard Server command injection, CVE-2026-8153", "outcome": "Vendor confirms OS command injection that can execute commands on the controller; corrected in 5.25.1. Vendor states CISA had received no known public exploitation report at advisory publication.", "evidenceStatus": "vendor-confirmed-vulnerability", "evidenceGroup": "advisory", "hardwareBoundary": "Robot operating/controller software reachable through an enabled management interface, not direct physical tampering.", "mechanisms": [], "sources": [ { "url": "https://www.universal-robots.com/articles/ur/cybersecurity/cve-2026-8153-command-injection-in-the-polyscope-5-dashboard-server/", "title": "CVE-2026-8153: Command Injection in the PolyScope 5 Dashboard Server", "type": "vendor-advisory", "reviewedAt": "2026-11-01T14:01:08Z", "readStatus": "reviewed", "supports": "Affected version, enabled-service requirement, fix and no-known-public-exploitation qualification.", "limitations": [], "provenance": { "sourceId": "DR-S04", "url": "https://www.universal-robots.com/articles/ur/cybersecurity/cve-2026-8153-command-injection-in-the-polyscope-5-dashboard-server/", "title": "CVE-2026-8153: Command Injection in the PolyScope 5 Dashboard Server", "kind": "vendor-advisory", "published": null, "modified": null, "verifiedAt": "2026-11-01T14:01:08Z", "httpStatus": 200, "scrapeId": "01a19766-feca-73d8-993e-72460c675638", "claimSupport": "Affected version, enabled-service requirement, fix and no-known-public-exploitation qualification.", "partialRead": null } } ], "followUp": [ { "question": "Was the precise attack boundary checked?", "status": "resolved", "result": "Requires enabled Dashboard Server and reachable port; do not silently claim Internet exposure.", "sourceURLs": [ "https://www.universal-robots.com/articles/ur/cybersecurity/cve-2026-8153-command-injection-in-the-polyscope-5-dashboard-server/" ] }, { "question": "Was a fixed version identified?", "status": "resolved", "result": "Vendor specifies PolyScope 5.25.1 or newer.", "sourceURLs": [ "https://www.universal-robots.com/articles/ur/cybersecurity/cve-2026-8153-command-injection-in-the-polyscope-5-dashboard-server/" ] } ], "limitations": [ "This is a confirmed vulnerability, not an observed malicious incident.", "Controller compromise potential does not independently establish a demonstrated unsafe-motion outcome for this CVE.", "Publication-time exploitation statement is not continuous monitoring through verification date." ], "mappings": { "emb3d": [], "attack": [ { "id": "T0866", "name": "Exploitation of Remote Services", "url": "https://attack.mitre.org/versions/v20/techniques/T0866/", "basis": "analyst-inference", "rationale": "Service exploitation on an embedded industrial controller fits the verified ICS description; no public-facing exposure or malicious campaign is assumed.", "officialCaseAttribution": false, "domain": "ics", "provenance": { "id": "T0866", "name": "Exploitation of Remote Services", "domain": "ICS", "url": "https://attack.mitre.org/versions/v20/techniques/T0866/", "basis": "analyst_cross_reference", "rationale": "Service exploitation on an embedded industrial controller fits the verified ICS description; no public-facing exposure or malicious campaign is assumed.", "attackVersion": "20.0", "officialCaseAttribution": false } } ] }, "confidence": { "total": 73, "components": { "provenance": { "score": 20, "max": 20, "rationale": null }, "technicalEvidence": { "score": 23, "max": 35, "rationale": null }, "configurationSpecificity": { "score": 20, "max": 20, "rationale": null }, "independentCorroboration": { "score": 0, "max": 15, "rationale": null }, "followUpResolution": { "score": 10, "max": 10, "rationale": null } }, "rationale": "Authoritative vendor confirmation and exact configuration/fix; original exploit artifact and independent reproduction were not inspected." } }, { "id": "DR-009", "title": "ECOVACS Deebot BLE remote-code-execution research and vendor fixes", "canonicalUrl": "https://www.ecovacs.com/global/userhelp/dsa20241119", "strand": "drones-robotics", "scope": "device-interface", "publicationDate": "2024-11-19", "eventDate": "2024 controlled test reported", "reviewDate": "2026-11-01", "dateNotes": "Source update metadata: 2024-11-19; this is not an event date.", "device": { "vendor": "ECOVACS", "models": [ "X2 OMNI", "X2 COMBO", "X2S", "X5 PRO", "X5 PRO PLUS", "X5 PRO ULTRA", "T30 OMNI", "T30S" ], "firmwareVersions": [ "Vendor patched versions: X2 OMNI 1.76.6", "X2 COMBO 1.81.10", "X2S 1.49.0", "X5 PRO 1.70.0", "X5 PRO PLUS 1.38.0", "X5 PRO ULTRA 1.17.0", "T30 OMNI 1.93.0", "T30S 1.95.0" ], "configuration": "BLE vulnerability and specific product/version fixes; ABC also documented an owner-authorized X2 controlled experiment." }, "access": { "class": "adjacent-radio/embedded-firmware", "requirements": "Bluetooth reachability under the product-specific technical conditions; no universal distance guarantee inferred." }, "claim": "ECOVACS Deebot BLE remote-code-execution research and vendor fixes", "outcome": "Vendor acknowledges BLE RCE and distributes fixes. ABC's first-hand controlled test reports remote access to an owner's X2 camera/audio/robot computer, with explicit owner permission.", "evidenceStatus": "vendor-confirmed-vulnerability-and-controlled-demonstration", "evidenceGroup": "demonstration", "hardwareBoundary": "BLE provisioning/interface to onboard robot software; not physical chip manipulation.", "mechanisms": [], "sources": [ { "url": "https://www.ecovacs.com/global/userhelp/dsa20241119", "title": "Security Advisory - ECOVACS GLOBAL", "type": "vendor-advisory", "reviewedAt": "2026-11-01T14:01:08Z", "readStatus": "reviewed", "supports": "Affected products and patched revisions.", "limitations": [], "provenance": { "sourceId": "DR-S05", "url": "https://www.ecovacs.com/global/userhelp/dsa20241119", "title": "Security Advisory - ECOVACS GLOBAL", "kind": "vendor-advisory", "published": null, "modified": null, "verifiedAt": "2026-11-01T14:01:08Z", "httpStatus": 200, "scrapeId": "01a19766-feea-71fc-aaaa-490a3d9f2908", "claimSupport": "Affected products and patched revisions.", "partialRead": null } }, { "url": "https://www.abc.net.au/news/2024-10-04/robot-vacuum-hacked-photos-camera-audio/104414020", "title": "We hacked a robot vacuum — and could watch live through its camera - ABC News", "type": "first-hand-controlled-journalism", "reviewedAt": "2026-11-01T14:01:08Z", "readStatus": "reviewed", "supports": "Owner-authorized observation of robot access; not a malicious incident or independent reverse-engineering replication.", "limitations": [], "provenance": { "sourceId": "DR-S28", "url": "https://www.abc.net.au/news/2024-10-04/robot-vacuum-hacked-photos-camera-audio/104414020", "title": "We hacked a robot vacuum — and could watch live through its camera - ABC News", "kind": "first-hand-controlled-journalism", "published": "2024-10-03T18:47:58+00:00", "modified": "2024-10-03T23:44:11+00:00", "verifiedAt": "2026-11-01T14:01:08Z", "httpStatus": 200, "scrapeId": "01a19769-9b75-7214-900f-7c5206cb3acb", "claimSupport": "Owner-authorized observation of robot access; not a malicious incident or independent reverse-engineering replication.", "partialRead": null } } ], "followUp": [ { "question": "Did vendor acknowledge the BLE issue and identify fixes?", "status": "resolved", "result": "Yes, eight product/revision entries are listed in the November 19 advisory.", "sourceURLs": [ "https://www.ecovacs.com/global/userhelp/dsa20241119" ] }, { "question": "Do October 2024 malicious account incidents establish BLE exploitation?", "status": "resolved", "result": "No; those accounts have a different and unresolved entry mechanism.", "sourceURLs": [ "https://www.abc.net.au/news/2024-10-11/robot-vacuum-yells-racial-slurs-at-family-after-being-hacked/104445408" ] } ], "limitations": [ "Vendor lists technical conditions without a complete primitive-level explanation, so no specific EMB3D memory-error mapping is inferred.", "The first-hand demonstration and later vendor fix support the scoped claim, not every ECOVACS model.", "Do not conflate this BLE route with the separate reported account attacks." ], "mappings": { "emb3d": [], "attack": [] }, "confidence": { "total": 83, "components": { "provenance": { "score": 20, "max": 20, "rationale": null }, "technicalEvidence": { "score": 25, "max": 35, "rationale": null }, "configurationSpecificity": { "score": 19, "max": 20, "rationale": null }, "independentCorroboration": { "score": 9, "max": 15, "rationale": null }, "followUpResolution": { "score": 10, "max": 10, "rationale": null } }, "rationale": "Vendor confirmation plus first-hand authorized test gives limited independent corroboration; primitive-level details not resolved here." } }, { "id": "DR-010", "title": "ECOVACS robot/base-station link permits malicious firmware updates", "canonicalUrl": "https://www.cisa.gov/news-events/ics-advisories/icsa-25-135-19", "strand": "drones-robotics", "scope": "hardware", "publicationDate": "2025-05-15", "eventDate": null, "reviewDate": "2026-11-01", "dateNotes": "Source update metadata: 2025-07-10; this is not an event date.", "device": { "description": { "vendor": "ECOVACS", "models": [ "X1S PRO", "X1 PRO OMNI", "X1 OMNI", "X1 TURBO", "T10 Series", "T20 Series", "T30 Series" ], "firmwareVersions": [ "X1S PRO/X1 PRO OMNI before 2.5.38", "X1 OMNI/X1 TURBO before 2.4.45", "T10 before 1.11.0", "T20 before 1.25.0", "T30 before 1.100.0" ], "configuration": "Vacuum/base-station local Wi-Fi link and firmware update verification." }, "reportedCves": [ "CVE-2025-30198", "CVE-2025-30199", "CVE-2025-30200" ] }, "access": { "class": "adjacent-radio/firmware-update", "requirements": "Ability to access or forge the insecure vacuum/base link under reported credential and firmware-update prerequisites; CVE-2025-30199 also has a high-privilege CVSS prerequisite." }, "claim": "ECOVACS robot/base-station link permits malicious firmware updates", "outcome": "CISA reports deterministic communication keys and lack of base-station firmware validation, permitting malicious updates/code execution. Vendor lists fixed versions; CISA Update A says mitigation is available for all listed devices.", "evidenceStatus": "vendor-and-government-confirmed-vulnerability", "evidenceGroup": "advisory", "hardwareBoundary": "Direct firmware trust boundary on an embedded robot peripheral/base station; not evidence of malicious operational exploitation.", "mechanisms": [ "Device Allows Unauthenticated Firmware Installation", "Predictable Cryptographic Key" ], "sources": [ { "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-25-135-19", "title": "ECOVACS DEEBOT Vacuum and Base Station (Update A) | CISA", "type": "government-advisory", "reviewedAt": "2026-11-01T14:01:08Z", "readStatus": "reviewed", "supports": "Mechanisms, CVEs, affected versions, update history.", "limitations": [], "provenance": { "sourceId": "DR-S06", "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-25-135-19", "title": "ECOVACS DEEBOT Vacuum and Base Station (Update A) | CISA", "kind": "government-advisory", "published": null, "modified": null, "verifiedAt": "2026-11-01T14:01:08Z", "httpStatus": 200, "scrapeId": "01a19766-ffc5-738e-835f-9e9338b90357", "claimSupport": "Mechanisms, CVEs, affected versions, update history.", "partialRead": null } }, { "url": "https://www.ecovacs.com/global/userhelp/dsa20250509001", "title": "Security Advisory - Base station communication security issues of DEEBOT series products - ECOVACS GLOBAL", "type": "vendor-advisory", "reviewedAt": "2026-11-01T14:01:08Z", "readStatus": "reviewed", "supports": "Product-specific fixed firmware list and update dates.", "limitations": [], "provenance": { "sourceId": "DR-S13", "url": "https://www.ecovacs.com/global/userhelp/dsa20250509001", "title": "Security Advisory - Base station communication security issues of DEEBOT series products - ECOVACS GLOBAL", "kind": "vendor-advisory", "published": null, "modified": null, "verifiedAt": "2026-11-01T14:01:08Z", "httpStatus": 200, "scrapeId": "01a19768-2e94-7479-aa59-2c543788c781", "claimSupport": "Product-specific fixed firmware list and update dates.", "partialRead": null } } ], "followUp": [ { "question": "Does the base station validate its updates?", "status": "resolved", "result": "CISA explicitly identifies download without integrity checking in CVE-2025-30199.", "sourceURLs": [ "https://www.cisa.gov/news-events/ics-advisories/icsa-25-135-19" ] }, { "question": "Was remediation later available?", "status": "resolved", "result": "Vendor updated July 1 and CISA Update A July 10 supplies fixes for all listed products.", "sourceURLs": [ "https://www.ecovacs.com/global/userhelp/dsa20250509001", "https://www.cisa.gov/news-events/ics-advisories/icsa-25-135-19" ] } ], "limitations": [ "The advisory groups related weaknesses; do not flatten every CVE into an unauthenticated Internet RCE.", "CISA and vendor coordinated disclosure are corroboration of acknowledgement, not independent experimental replication.", "No owner-device test or incident attribution performed." ], "mappings": { "emb3d": [ { "id": "TID-211", "name": "Device Allows Unauthenticated Firmware Installation", "url": "https://emb3d.mitre.org/threats/TID-211.html", "basis": "analyst-inference", "rationale": "Base-station update packages are not validated on-device, matching the official unauthenticated-installation trust boundary.", "officialCaseAttribution": false, "provenance": { "id": "TID-211", "name": "Device Allows Unauthenticated Firmware Installation", "url": "https://emb3d.mitre.org/threats/TID-211.html", "basis": "analyst_mapping", "rationale": "Base-station update packages are not validated on-device, matching the official unauthenticated-installation trust boundary.", "modelVersion": "2.0.1", "sourcePin": "MITRE/emb3d@0d7c25bb4e2928c516fb5811aaab9ff8bab2896c", "officialCaseAttribution": false } }, { "id": "TID-317", "name": "Predictable Cryptographic Key", "url": "https://emb3d.mitre.org/threats/TID-317.html", "basis": "analyst-inference", "rationale": "Communication keys are derived predictably from the serial number.", "officialCaseAttribution": false, "provenance": { "id": "TID-317", "name": "Predictable Cryptographic Key", "url": "https://emb3d.mitre.org/threats/TID-317.html", "basis": "analyst_mapping", "rationale": "Communication keys are derived predictably from the serial number.", "modelVersion": "2.0.1", "sourcePin": "MITRE/emb3d@0d7c25bb4e2928c516fb5811aaab9ff8bab2896c", "officialCaseAttribution": false } } ], "attack": [ { "id": "T1693.001", "name": "Modify Firmware: System Firmware", "url": "https://attack.mitre.org/versions/v20/techniques/T1693/001/", "basis": "analyst-inference", "rationale": "Analyst cross-reference to unauthorized firmware installation on the embedded base device; not a MITRE-observed campaign.", "officialCaseAttribution": false, "domain": "ics", "provenance": { "id": "T1693.001", "name": "Modify Firmware: System Firmware", "domain": "ICS", "url": "https://attack.mitre.org/versions/v20/techniques/T1693/001/", "basis": "analyst_cross_reference", "rationale": "Analyst cross-reference to unauthorized firmware installation on the embedded base device; not a MITRE-observed campaign.", "attackVersion": "20.0", "officialCaseAttribution": false } } ] }, "confidence": { "total": 81, "components": { "provenance": { "score": 20, "max": 20, "rationale": null }, "technicalEvidence": { "score": 26, "max": 35, "rationale": null }, "configurationSpecificity": { "score": 20, "max": 20, "rationale": null }, "independentCorroboration": { "score": 5, "max": 15, "rationale": null }, "followUpResolution": { "score": 10, "max": 10, "rationale": null } }, "rationale": "Government/vendor agreement, clear mechanism, versions and later fix; no independent reproduction." } }, { "id": "DR-011", "title": "Unitree UniPwn: BLE Wi-Fi provisioning leads to root command execution", "canonicalUrl": "https://github.com/Bin4ry/UniPwn", "strand": "drones-robotics", "scope": "device-interface", "publicationDate": "2025-09-20", "eventDate": null, "reviewDate": "2026-11-01", "dateNotes": "Source update metadata: 2025-10-21 repository clarification; this is not an event date.", "device": { "description": { "vendor": "Unitree", "models": [ "Go2", "G1", "H1", "B2" ], "firmwareVersions": [ "NVD CPE: Go2/B2 through 1.1.8", "NVD CPE: G1/H1 through 1.4.4" ], "configuration": "BLE Wi-Fi configuration service and common derived onboard firmware; researchers explicitly exclude Go1/pre-Go2 lineage from this particular finding." }, "reportedCves": [ "CVE-2025-35027" ] }, "access": { "class": "adjacent-radio/embedded-provisioning", "requirements": "BLE proximity and access to the affected provisioning path; related hardcoded key/authentication weaknesses are described by the researchers." }, "claim": "Unitree UniPwn: BLE Wi-Fi provisioning leads to root command execution", "outcome": "Original researchers report and publish a working PoC for root command execution through Wi-Fi configuration handling; NVD describes the same injection mechanism. Wormability is researcher-reported potential, not evidence a self-propagating incident occurred.", "evidenceStatus": "original-research-controlled-demonstration", "evidenceGroup": "demonstration", "hardwareBoundary": "Embedded robot provisioning/firmware boundary; not a physical fault or demonstrated bypass of every motor safety control.", "mechanisms": [ "Hardcoded Credentials" ], "sources": [ { "url": "https://github.com/Bin4ry/UniPwn", "title": "GitHub - Bin4ry/UniPwn · GitHub", "type": "original-research-repository", "reviewedAt": "2026-11-01T14:01:08Z", "readStatus": "reviewed", "supports": "Original scope, PoC claim, lineage clarification and disclosure history; exploit code not copied or executed.", "limitations": [], "provenance": { "sourceId": "DR-S07", "url": "https://github.com/Bin4ry/UniPwn", "title": "GitHub - Bin4ry/UniPwn · GitHub", "kind": "original-research-repository", "published": null, "modified": null, "verifiedAt": "2026-11-01T14:01:08Z", "httpStatus": 200, "scrapeId": "01a19766-ffc8-73eb-9efd-6e9e55330f3c", "claimSupport": "Original scope, PoC claim, lineage clarification and disclosure history; exploit code not copied or executed.", "partialRead": null } }, { "url": "https://nvd.nist.gov/vuln/detail/cve-2025-35027", "title": "NVD-CVE-2025-35027", "type": "government-vulnerability-record", "reviewedAt": "2026-11-01T14:01:08Z", "readStatus": "reviewed", "supports": "Command-execution mechanism and affected-version CPEs.", "limitations": [], "provenance": { "sourceId": "DR-S25", "url": "https://nvd.nist.gov/vuln/detail/cve-2025-35027", "title": "NVD-CVE-2025-35027", "kind": "government-vulnerability-record", "published": null, "modified": null, "verifiedAt": "2026-11-01T14:01:08Z", "httpStatus": 200, "scrapeId": "01a19769-9b08-7659-9f28-3daf5aaf7826", "claimSupport": "Command-execution mechanism and affected-version CPEs.", "partialRead": null } } ], "followUp": [ { "question": "Does this specific report apply to Go1?", "status": "resolved", "result": "Original repository clarification says Go1/pre-Go2 lineage is not vulnerable to this finding.", "sourceURLs": [ "https://github.com/Bin4ry/UniPwn" ] }, { "question": "What current fix is confirmed by the vendor?", "status": "open", "result": "Targeted vendor search found no authoritative fix record; do not repeat September 2025 no-fix language as current truth.", "sourceURLs": [] } ], "limitations": [ "Research repository's broad product-line claim exceeds exactly tested models; NVD ranges are preserved with attribution.", "No current vendor patch advisory was found by a targeted search; absence in search does not prove no fix exists.", "No malicious deployment, worm outbreak or verified injury established." ], "mappings": { "emb3d": [ { "id": "TID-328", "name": "Hardcoded Credentials", "url": "https://emb3d.mitre.org/threats/TID-328.html", "basis": "analyst-inference", "rationale": "Analyst reference to shared hardcoded provisioning authentication material described by the original research; not a mapping of the command-injection sink itself.", "officialCaseAttribution": false, "provenance": { "id": "TID-328", "name": "Hardcoded Credentials", "url": "https://emb3d.mitre.org/threats/TID-328.html", "basis": "analyst_mapping", "rationale": "Analyst reference to shared hardcoded provisioning authentication material described by the original research; not a mapping of the command-injection sink itself.", "modelVersion": "2.0.1", "sourcePin": "MITRE/emb3d@0d7c25bb4e2928c516fb5811aaab9ff8bab2896c", "officialCaseAttribution": false } } ], "attack": [ { "id": "T1694.002", "name": "Insecure Credentials: Hardcoded Credentials", "url": "https://attack.mitre.org/versions/v20/techniques/T1694/002/", "basis": "analyst-inference", "rationale": "Semantic cross-reference to reuse of embedded authentication material only. This does not assert an ICS campaign or map every BLE detail to ATT&CK.", "officialCaseAttribution": false, "domain": "ics", "provenance": { "id": "T1694.002", "name": "Insecure Credentials: Hardcoded Credentials", "domain": "ICS", "url": "https://attack.mitre.org/versions/v20/techniques/T1694/002/", "basis": "analyst_cross_reference", "rationale": "Semantic cross-reference to reuse of embedded authentication material only. This does not assert an ICS campaign or map every BLE detail to ATT&CK.", "attackVersion": "20.0", "officialCaseAttribution": false } } ] }, "confidence": { "total": 76, "components": { "provenance": { "score": 20, "max": 20, "rationale": null }, "technicalEvidence": { "score": 32, "max": 35, "rationale": null }, "configurationSpecificity": { "score": 18, "max": 20, "rationale": null }, "independentCorroboration": { "score": 0, "max": 15, "rationale": null }, "followUpResolution": { "score": 6, "max": 10, "rationale": null } }, "rationale": "Working original PoC and government record; exact cross-product scope and current vendor remediation remain incomplete." } }, { "id": "DR-012", "title": "PX4 MAVLink: unauthenticated shell interface in the specifically listed SITL configuration", "canonicalUrl": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-090-02", "strand": "drones-robotics", "scope": "device-interface", "publicationDate": "2026-03-31", "eventDate": null, "reviewDate": "2026-11-01", "dateNotes": null, "device": { "description": { "vendor": "PX4", "models": [ "PX4 Autopilot software" ], "firmwareVersions": [ "v1.16.0_SITL_latest_stable as listed by CISA" ], "configuration": "Software-in-the-loop configuration and reachable MAVLink interface without cryptographic message authentication." }, "reportedCves": [ "CVE-2026-1579" ] }, "access": { "class": "embedded-controller-protocol/simulation", "requirements": "Access to MAVLink transport when signing/link security is absent. Simulator advisory is not a tested physical-aircraft result." }, "claim": "PX4 MAVLink: unauthenticated shell interface in the specifically listed SITL configuration", "outcome": "CISA reports arbitrary shell-command access through an unauthenticated MAVLink interface. Upstream documentation explains the signing/link-security boundary and its remaining message exceptions.", "evidenceStatus": "government-advisory-simulator-scope", "evidenceGroup": "advisory", "hardwareBoundary": "Autopilot management/control protocol relevant to embedded deployment, but the affected-version string is explicitly SITL; no physical flight exploit established.", "mechanisms": [ "Remotely Accessible Unauthenticated Services" ], "sources": [ { "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-090-02", "title": "PX4 Autopilot | CISA", "type": "government-advisory", "reviewedAt": "2026-11-01T14:01:08Z", "readStatus": "reviewed", "supports": "Exact SITL version, interface requirement and recommendation.", "limitations": [], "provenance": { "sourceId": "DR-S20", "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-090-02", "title": "PX4 Autopilot | CISA", "kind": "government-advisory", "published": null, "modified": null, "verifiedAt": "2026-11-01T14:01:08Z", "httpStatus": 200, "scrapeId": "01a19769-2f24-70b9-b9e2-325e422b0b8b", "claimSupport": "Exact SITL version, interface requirement and recommendation.", "partialRead": null } }, { "url": "https://docs.px4.io/main/en/mavlink/security_hardening", "title": "MAVLink Security Hardening for Production Deployments | PX4 Guide (main)", "type": "upstream-security-documentation", "reviewedAt": "2026-11-01T14:01:08Z", "readStatus": "reviewed", "supports": "Current transport-hardening model, physical-key-storage boundary and signing limitations.", "limitations": [], "provenance": { "sourceId": "DR-S26", "url": "https://docs.px4.io/main/en/mavlink/security_hardening", "title": "MAVLink Security Hardening for Production Deployments | PX4 Guide (main)", "kind": "upstream-security-documentation", "published": null, "modified": null, "verifiedAt": "2026-11-01T14:01:08Z", "httpStatus": 200, "scrapeId": "01a19769-9ae4-7251-91fa-072ceb36b098", "claimSupport": "Current transport-hardening model, physical-key-storage boundary and signing limitations.", "partialRead": null } }, { "url": "https://docs.px4.io/main/en/mavlink/message_signing", "title": "MAVLink Message Signing | PX4 Guide (main)", "type": "upstream-documentation", "reviewedAt": "2026-11-01T14:01:08Z", "readStatus": "reviewed", "supports": "Signing behavior, USB coverage and allowlisted-message exceptions.", "limitations": [], "provenance": { "sourceId": "DR-S27", "url": "https://docs.px4.io/main/en/mavlink/message_signing", "title": "MAVLink Message Signing | PX4 Guide (main)", "kind": "upstream-documentation", "published": null, "modified": null, "verifiedAt": "2026-11-01T14:01:08Z", "httpStatus": 200, "scrapeId": "01a19769-9a99-72e9-ab6c-b255bacbb17f", "claimSupport": "Signing behavior, USB coverage and allowlisted-message exceptions.", "partialRead": null } } ], "followUp": [ { "question": "Does the advisory establish physical drone takeover?", "status": "resolved", "result": "No: listed product version is SITL. Physical applicability remains untested.", "sourceURLs": [ "https://www.cisa.gov/news-events/ics-advisories/icsa-26-090-02" ] }, { "question": "Does signing reject absolutely every unsigned message?", "status": "resolved", "result": "No: current upstream docs retain a limited safety-critical-message allowlist; signing also applies to USB when active.", "sourceURLs": [ "https://docs.px4.io/main/en/mavlink/message_signing" ] }, { "question": "Were physical protection assumptions checked?", "status": "resolved", "result": "Upstream guide identifies SD-card key custody and exposed debug interfaces as separate boundaries, not solved by signing.", "sourceURLs": [ "https://docs.px4.io/main/en/mavlink/security_hardening" ] } ], "limitations": [ "Do not claim all PX4 vehicles or all builds are remotely exploitable from the Internet.", "Upstream current documentation may describe implementation changes after the advisory; version-specific implementation must be checked before deployment advice.", "Signing authenticates messages but does not encrypt telemetry; some safety-related messages remain allowlisted.", "No commands were sent and no motor/mission behavior was exercised." ], "mappings": { "emb3d": [ { "id": "TID-310", "name": "Remotely Accessible Unauthenticated Services", "url": "https://emb3d.mitre.org/threats/TID-310.html", "basis": "analyst-inference", "rationale": "Unauthenticated interactive shell/control access on reachable MAVLink transport matches the service-authentication boundary. TID-406 is not assumed because the protocol does have a signing capability.", "officialCaseAttribution": false, "provenance": { "id": "TID-310", "name": "Remotely Accessible Unauthenticated Services", "url": "https://emb3d.mitre.org/threats/TID-310.html", "basis": "analyst_mapping", "rationale": "Unauthenticated interactive shell/control access on reachable MAVLink transport matches the service-authentication boundary. TID-406 is not assumed because the protocol does have a signing capability.", "modelVersion": "2.0.1", "sourcePin": "MITRE/emb3d@0d7c25bb4e2928c516fb5811aaab9ff8bab2896c", "officialCaseAttribution": false } } ], "attack": [] }, "confidence": { "total": 80, "components": { "provenance": { "score": 20, "max": 20, "rationale": null }, "technicalEvidence": { "score": 25, "max": 35, "rationale": null }, "configurationSpecificity": { "score": 20, "max": 20, "rationale": null }, "independentCorroboration": { "score": 5, "max": 15, "rationale": null }, "followUpResolution": { "score": 10, "max": 10, "rationale": null } }, "rationale": "Government advisory and exact simulation scope, plus current upstream constraints; no independent physical demonstration." } }, { "id": "DR-013", "title": "ArduPilot SERIAL_CONTROL: SITL overread report with merged upstream correction", "canonicalUrl": "https://github.com/ArduPilot/ardupilot/issues/32524", "strand": "drones-robotics", "scope": "device-interface", "publicationDate": "2026-03-23", "eventDate": null, "reviewDate": "2026-11-01", "dateNotes": "Source update metadata: 2026-03-29 fix merged; this is not an event date.", "device": { "description": { "vendor": "ArduPilot", "models": [ "ArduPlane SITL" ], "firmwareVersions": [ "Original report: current upstream checkout on March 23, 2026", "NVD summary: through Plane-4.6.3" ], "configuration": "Reporter rebuilt ArduPlane SITL and observed uninitialized-byte forwarding through a live MAVLink SERIAL_CONTROL path." }, "reportedCves": [ "CVE-2026-38971" ] }, "access": { "class": "controller-protocol/simulation", "requirements": "Reachable MAVLink serial-forwarding path in the reported simulation; applicable authorization/signing configuration not independently resolved." }, "claim": "ArduPilot SERIAL_CONTROL: SITL overread report with merged upstream correction", "outcome": "Original issue reports runtime diagnostics for forwarding bytes beyond initialized message content. Maintainers merged a bounded-count correction in commit ee7c410b14e1af4e451912172200a35806272293.", "evidenceStatus": "original-bug-report-and-upstream-fix", "evidenceGroup": "advisory", "hardwareBoundary": "Autopilot serial forwarding to peripherals; evidence is a simulation/implementation defect, not demonstrated flight manipulation or arbitrary code execution.", "mechanisms": [], "sources": [ { "url": "https://github.com/ArduPilot/ardupilot/issues/32524", "title": "[BUG] Uninitialized Byte Propagation in ArduPilot's Live MAVLink SERIAL_CONTROL Forwarding Path · Issue #32524 · ArduPilot/ardupilot", "type": "original-research-issue", "reviewedAt": "2026-11-01T14:01:08Z", "readStatus": "reviewed", "supports": "Actual SITL procedure result and expected data-flow defect, paraphrased without reproduction instructions.", "limitations": [], "provenance": { "sourceId": "DR-S29", "url": "https://github.com/ArduPilot/ardupilot/issues/32524", "title": "[BUG] Uninitialized Byte Propagation in ArduPilot's Live MAVLink SERIAL_CONTROL Forwarding Path · Issue #32524 · ArduPilot/ardupilot", "kind": "original-research-issue", "published": null, "modified": null, "verifiedAt": "2026-11-01T14:01:08Z", "httpStatus": 200, "scrapeId": "01a1976a-17b6-70a9-881d-ff6d0caa9118", "claimSupport": "Actual SITL procedure result and expected data-flow defect, paraphrased without reproduction instructions.", "partialRead": null } }, { "url": "https://github.com/ArduPilot/ardupilot/pull/32587", "title": "GCS_MAVLink: fix buffer overread on invalid SERIAL_CONTROL write by tpwrules · Pull Request #32587 · ArduPilot/ardupilot", "type": "upstream-fix", "reviewedAt": "2026-11-01T14:01:08Z", "readStatus": "reviewed", "supports": "Merged correction and commit identity.", "limitations": [], "provenance": { "sourceId": "DR-S30", "url": "https://github.com/ArduPilot/ardupilot/pull/32587", "title": "GCS_MAVLink: fix buffer overread on invalid SERIAL_CONTROL write by tpwrules · Pull Request #32587 · ArduPilot/ardupilot", "kind": "upstream-fix", "published": null, "modified": null, "verifiedAt": "2026-11-01T14:01:08Z", "httpStatus": 200, "scrapeId": "01a1976a-1751-7178-9c59-de60c5d4d05a", "claimSupport": "Merged correction and commit identity.", "partialRead": null } }, { "url": "https://nvd.nist.gov/vuln/detail/cve-2026-38971", "title": "NVD-CVE-2026-38971", "type": "government-vulnerability-record", "reviewedAt": "2026-11-01T14:01:08Z", "readStatus": "reviewed", "supports": "CVE and broad affected-version description.", "limitations": [], "provenance": { "sourceId": "DR-S22", "url": "https://nvd.nist.gov/vuln/detail/cve-2026-38971", "title": "NVD-CVE-2026-38971", "kind": "government-vulnerability-record", "published": null, "modified": null, "verifiedAt": "2026-11-01T14:01:08Z", "httpStatus": 200, "scrapeId": "01a19769-2f38-749b-896c-79019a69d4cc", "claimSupport": "CVE and broad affected-version description.", "partialRead": null } } ], "followUp": [ { "question": "Was a fix actually merged rather than only proposed?", "status": "resolved", "result": "PR #32587 is merged into master on March 29, 2026, commit ee7c410b14e1af4e451912172200a35806272293.", "sourceURLs": [ "https://github.com/ArduPilot/ardupilot/pull/32587" ] }, { "question": "Which deployed release contains the fix?", "status": "open", "result": "Merge was observed; complete downstream release inclusion and physical build applicability were not verified.", "sourceURLs": [] } ], "limitations": [ "CVE severity is not LrrK confidence or proof of flight impact.", "No physical serial peripheral or aircraft reproduced here.", "No EMB3D TID-327 mapping is forced: its inspected description emphasizes out-of-bounds writes, while this narrow claim is an overread/uninitialized-byte path." ], "mappings": { "emb3d": [], "attack": [] }, "confidence": { "total": 75, "components": { "provenance": { "score": 20, "max": 20, "rationale": null }, "technicalEvidence": { "score": 29, "max": 35, "rationale": null }, "configurationSpecificity": { "score": 17, "max": 20, "rationale": null }, "independentCorroboration": { "score": 0, "max": 15, "rationale": null }, "followUpResolution": { "score": 9, "max": 10, "rationale": null } }, "rationale": "Original dynamic bug report plus accepted upstream fix; CVE retelling is not independent replication, and deployment scope remains open." } }, { "id": "DR-014", "title": "University of Texas 2012: controlled UAV navigation manipulation by GPS spoofing", "canonicalUrl": "https://ae.utexas.edu/news/todd-humphreys-research-team-demonstrates-first-successful-gps-spoofing-of-uav/", "strand": "drones-robotics", "scope": "device-interface", "publicationDate": "2012-06-28", "eventDate": "2012-06 White Sands demonstration", "reviewDate": "2026-11-01", "dateNotes": null, "device": { "vendor": null, "models": [ "Small GPS-guided research UAV; exact airframe absent in inspected source" ], "firmwareVersions": null, "configuration": "Controlled hovering-UAV demonstration relying on civilian GPS navigation." }, "access": { "class": "radio/sensor-input", "requirements": "Ability to introduce a suitable counterfeit navigation signal into the tested receiver environment; not controller credential theft." }, "claim": "University of Texas 2012: controlled UAV navigation manipulation by GPS spoofing", "outcome": "University reports repeated navigation-signal capture in a DHS-invited controlled demonstration. It supports feasibility for the tested GPS-dependent UAV, not arbitrary control of every drone.", "evidenceStatus": "institutional-first-party-controlled-demonstration", "evidenceGroup": "demonstration", "hardwareBoundary": "External RF input to an embedded navigation sensor; distinct from firmware compromise or physical chip modification.", "mechanisms": [], "sources": [ { "url": "https://ae.utexas.edu/news/todd-humphreys-research-team-demonstrates-first-successful-gps-spoofing-of-uav/", "title": "Todd Humphreys' Research Team Demonstrates First Successful GPS Spoofing of UAV - Department of Aerospace Engineering and Engineering Mechanics", "type": "research-institution-report", "reviewedAt": "2026-11-01T14:01:08Z", "readStatus": "reviewed", "supports": "Date, location, hovering vehicle and successful navigation-signal manipulation.", "limitations": [], "provenance": { "sourceId": "DR-S10", "url": "https://ae.utexas.edu/news/todd-humphreys-research-team-demonstrates-first-successful-gps-spoofing-of-uav/", "title": "Todd Humphreys' Research Team Demonstrates First Successful GPS Spoofing of UAV - Department of Aerospace Engineering and Engineering Mechanics", "kind": "research-institution-report", "published": null, "modified": "2026-06-30T21:17:19+00:00", "verifiedAt": "2026-11-01T14:01:08Z", "httpStatus": 200, "scrapeId": "01a19768-2e64-71f0-bcb8-53be3261d274", "claimSupport": "Date, location, hovering vehicle and successful navigation-signal manipulation.", "partialRead": null } } ], "followUp": [ { "question": "Is this an operational hostile capture?", "status": "resolved", "result": "No: source describes a controlled research demonstration.", "sourceURLs": [ "https://ae.utexas.edu/news/todd-humphreys-research-team-demonstrates-first-successful-gps-spoofing-of-uav/" ] }, { "question": "Can exact receiver/autopilot applicability be assessed?", "status": "open", "result": "Inspect the linked original paper and test configuration before narrowing device applicability.", "sourceURLs": [ "https://radionavlab.ae.utexas.edu/images/stories/files/papers/unmannedCapture.pdf" ] } ], "limitations": [ "No paper-level method/results review completed for this case; linked paper remains a follow-up lead.", "Exact model, firmware, sensor fusion and failsafe configuration unknown.", "Do not infer evidence for disputed military-drone capture stories or modern authenticated navigation." ], "mappings": { "emb3d": [], "attack": [] }, "confidence": { "total": 54, "components": { "provenance": { "score": 20, "max": 20, "rationale": null }, "technicalEvidence": { "score": 21, "max": 35, "rationale": null }, "configurationSpecificity": { "score": 8, "max": 20, "rationale": null }, "independentCorroboration": { "score": 0, "max": 15, "rationale": null }, "followUpResolution": { "score": 5, "max": 10, "rationale": null } }, "rationale": "First-party university outcome report; exact platform and paper-level technical verification remain incomplete." } }, { "id": "DR-015", "title": "Alias Robotics DJI Mavic Pro: publicly reported firmware-verification and debug-access weaknesses", "canonicalUrl": "https://aliasrobotics.com/case-studies/case-study-pentesting-dji.php", "strand": "drones-robotics", "scope": "hardware", "publicationDate": null, "eventDate": null, "reviewDate": "2026-11-01", "dateNotes": null, "device": { "vendor": "DJI", "models": [ "Mavic Pro" ], "firmwareVersions": null, "configuration": "Public commercial case study discloses six findings from a broader claimed private assessment; exact tested firmware absent." }, "access": { "class": "reported-embedded-firmware", "requirements": "Varies by finding. Public case discusses firmware installation/downgrade and a service path affecting a debug flag; precise full-chain prerequisites not established here." }, "claim": "Alias Robotics DJI Mavic Pro: publicly reported firmware-verification and debug-access weaknesses", "outcome": "The company publicly describes lack of proper firmware-signature verification, low-entropy Wi-Fi authentication and a BusyBox-related path affecting a debug flag. This row records those attributed public findings without endorsing the claimed total of more than 130 flaws.", "evidenceStatus": "researcher-case-study-limited-public-detail", "evidenceGroup": "reported-result", "hardwareBoundary": "Embedded update/debug privilege boundaries, not proof a publicly accessible boot port already gives root.", "mechanisms": [ "Faulty FW/SW Update Integrity Verification" ], "sources": [ { "url": "https://aliasrobotics.com/case-studies/case-study-pentesting-dji.php", "title": "Case Study - DJI", "type": "original-commercial-research-summary", "reviewedAt": "2026-11-01T14:01:08Z", "readStatus": "reviewed", "supports": "Six public finding descriptions; no private vulnerability archive retrieved.", "limitations": [], "provenance": { "sourceId": "DR-S21", "url": "https://aliasrobotics.com/case-studies/case-study-pentesting-dji.php", "title": "Case Study - DJI", "kind": "original-commercial-research-summary", "published": null, "modified": null, "verifiedAt": "2026-11-01T14:01:08Z", "httpStatus": 200, "scrapeId": "01a19769-2f56-700a-b3e3-da094c5f0611", "claimSupport": "Six public finding descriptions; no private vulnerability archive retrieved.", "partialRead": null } } ], "followUp": [ { "question": "Are all claimed private findings inspectable?", "status": "resolved", "result": "No: only the six public descriptions were used; private archive was neither accessed nor requested.", "sourceURLs": [ "https://aliasrobotics.com/case-studies/case-study-pentesting-dji.php" ] }, { "question": "Which exact version and corrected release apply?", "status": "open", "result": "Unresolved; obtain an authoritative public advisory or version-pinned original record.", "sourceURLs": [] } ], "limitations": [ "No source date or exact affected revision verified.", "No independent reproduction or vendor acknowledgement inspected.", "Do not treat the company's claimed aggregate vulnerability count as individually verified cases.", "Publicly described signature-check weakness does not establish a current unsigned-image installation result on every Mavic Pro." ], "mappings": { "emb3d": [ { "id": "TID-213", "name": "Faulty FW/SW Update Integrity Verification", "url": "https://emb3d.mitre.org/threats/TID-213.html", "basis": "analyst-inference", "rationale": "Analyst semantic reference to the publicly alleged firmware-signature verification weakness; this is not independent confirmation it was exploitable on a pinned build.", "officialCaseAttribution": false, "provenance": { "id": "TID-213", "name": "Faulty FW/SW Update Integrity Verification", "url": "https://emb3d.mitre.org/threats/TID-213.html", "basis": "analyst_mapping", "rationale": "Analyst semantic reference to the publicly alleged firmware-signature verification weakness; this is not independent confirmation it was exploitable on a pinned build.", "modelVersion": "2.0.1", "sourcePin": "MITRE/emb3d@0d7c25bb4e2928c516fb5811aaab9ff8bab2896c", "officialCaseAttribution": false } } ], "attack": [] }, "confidence": { "total": 46, "components": { "provenance": { "score": 18, "max": 20, "rationale": null }, "technicalEvidence": { "score": 18, "max": 35, "rationale": null }, "configurationSpecificity": { "score": 7, "max": 20, "rationale": null }, "independentCorroboration": { "score": 0, "max": 15, "rationale": null }, "followUpResolution": { "score": 3, "max": 10, "rationale": null } }, "rationale": "Original public summary with plausible mechanisms, but dates, exact firmware and full validation artifacts missing." } }, { "id": "DR-016", "title": "Trend Micro and Politecnico 2017: controlled industrial-robot precision manipulation", "canonicalUrl": "https://www.trendmicro.com/en_us/research/17/e/compromising-industrial-robots.html", "strand": "drones-robotics", "scope": "device-interface", "publicationDate": "2017-05-03", "eventDate": null, "reviewDate": "2026-11-01", "dateNotes": null, "device": { "vendor": null, "models": [ "Laboratory industrial robot; exact controller/model not verified within the read PDF portion" ], "firmwareVersions": null, "configuration": "Laboratory industrial robot and remotely reachable controller architecture; network entry into the factory is outside the original work's stated scope." }, "access": { "class": "embedded-industrial-controller", "requirements": "Remote access to the controller in the lab threat model; original report excludes breaking the controller enclosure's physical security." }, "claim": "Trend Micro and Politecnico 2017: controlled industrial-robot precision manipulation", "outcome": "Researchers report altering robot accuracy without changing task program code, demonstrating that low-level controller state can affect manufactured output. The inspected first sixteen report pages support scope and broad result, not full reproduction.", "evidenceStatus": "original-research-partial-document-read", "evidenceGroup": "reported-result", "hardwareBoundary": "Controller/sensor-to-motor trust boundary and precision parameters. This is a controlled cyber-physical demonstration, not an observed factory sabotage incident.", "mechanisms": [], "sources": [ { "url": "https://www.trendmicro.com/en_us/research/17/e/compromising-industrial-robots.html", "title": "Industrial Router Risks in the Industry 4.0 Ecosystem | Trend Micro (US)", "type": "original-research-blog", "reviewedAt": "2026-11-01T14:01:08Z", "readStatus": "reviewed", "supports": "Directly states demonstrated precision modification.", "limitations": [], "provenance": { "sourceId": "DR-S09", "url": "https://www.trendmicro.com/en_us/research/17/e/compromising-industrial-robots.html", "title": "Industrial Router Risks in the Industry 4.0 Ecosystem | Trend Micro (US)", "kind": "original-research-blog", "published": "2017-05-03", "modified": null, "verifiedAt": "2026-11-01T14:01:08Z", "httpStatus": 200, "scrapeId": "01a19768-2ecb-7178-bc07-5a37cd8d6690", "claimSupport": "Directly states demonstrated precision modification.", "partialRead": null } }, { "url": "https://blackhat.com/docs/us-17/thursday/us-17-Quarta-Breaking-The-Laws-Of-Robotics-Attacking-Industrial-Robots-wp.pdf", "title": "Rogue Robots: Testing the Limits of an Industrial Robot’s Security", "type": "original-technical-report-partial", "reviewedAt": "2026-11-01T14:01:08Z", "readStatus": "partial", "supports": "Lab and network/physical threat-model boundaries; only sixteen of forty-eight PDF pages read.", "limitations": [ { "pagesRead": 16, "pagesTotal": 48 } ], "provenance": { "sourceId": "DR-S15", "url": "https://blackhat.com/docs/us-17/thursday/us-17-Quarta-Breaking-The-Laws-Of-Robotics-Attacking-Industrial-Robots-wp.pdf", "title": "Rogue Robots: Testing the Limits of an Industrial Robot’s Security", "kind": "original-technical-report-partial", "published": null, "modified": null, "verifiedAt": "2026-11-01T14:01:08Z", "httpStatus": 200, "scrapeId": "01a19768-828f-7219-b5cf-01689b449637", "claimSupport": "Lab and network/physical threat-model boundaries; only sixteen of forty-eight PDF pages read.", "partialRead": { "pagesRead": 16, "pagesTotal": 48 } } } ], "followUp": [ { "question": "Was changing accuracy a demonstrated laboratory result?", "status": "resolved", "result": "Original research blog states it was demonstrated.", "sourceURLs": [ "https://www.trendmicro.com/en_us/research/17/e/compromising-industrial-robots.html" ] }, { "question": "Was exact device/configuration confirmed?", "status": "open", "result": "No: remaining report sections or version-pinned peer-reviewed paper must be reviewed.", "sourceURLs": [ "https://blackhat.com/docs/us-17/thursday/us-17-Quarta-Breaking-The-Laws-Of-Robotics-Attacking-Industrial-Robots-wp.pdf" ] } ], "limitations": [ "Only 16/48 report pages inspected; exact model, firmware and detailed experiment sections remain open.", "Exposure counts based on 2017 service banners are not confirmed compromised robots.", "No current fleet vulnerability or harm to people established." ], "mappings": { "emb3d": [], "attack": [] }, "confidence": { "total": 53, "components": { "provenance": { "score": 20, "max": 20, "rationale": null }, "technicalEvidence": { "score": 23, "max": 35, "rationale": null }, "configurationSpecificity": { "score": 6, "max": 20, "rationale": null }, "independentCorroboration": { "score": 0, "max": 15, "rationale": null }, "followUpResolution": { "score": 4, "max": 10, "rationale": null } }, "rationale": "Original research result and partial report, with major configuration/detail gaps openly retained." } }, { "id": "DR-017", "title": "ECOVACS X2 2024 reported malicious remote control: operational account with unresolved entry mechanism", "canonicalUrl": "https://www.abc.net.au/news/2024-10-11/robot-vacuum-yells-racial-slurs-at-family-after-being-hacked/104445408", "strand": "drones-robotics", "scope": "context", "publicationDate": "2024-10-10", "eventDate": "2024-10 reported incidents", "reviewDate": "2026-11-01", "dateNotes": "Source update metadata: 2024-10-10; this is not an event date.", "device": { "vendor": "ECOVACS", "models": [ "Deebot X2" ], "firmwareVersions": null, "configuration": "Consumer accounts controlling deployed home robots; exact firmware and authentication state not independently available." }, "access": { "class": "contextual-account/robot-output", "requirements": "Unresolved. Reporting includes vendor attribution to compromised credentials/possible credential stuffing, alongside separate known BLE research; no causal link to BLE established." }, "claim": "ECOVACS X2 2024 reported malicious remote control: operational account with unresolved entry mechanism", "outcome": "ABC reported first-hand owner accounts of unauthorized speaker use and robot movement. ECOVACS acknowledged unauthorized account access in quoted correspondence and suggested credential stuffing; forensic entry path remains unresolved.", "evidenceStatus": "reported-operational-incident-mechanism-unresolved", "evidenceGroup": "operational-report", "hardwareBoundary": "Observed/reporting-level robot output is relevant context, but no hardware-layer exploit, firmware modification or chip tampering has been established.", "mechanisms": [], "sources": [ { "url": "https://www.abc.net.au/news/2024-10-11/robot-vacuum-yells-racial-slurs-at-family-after-being-hacked/104445408", "title": "Hackers take control of robot vacuums in multiple cities, yell racial slurs - ABC News", "type": "first-hand-investigative-report", "reviewedAt": "2026-11-01T14:01:08Z", "readStatus": "reviewed", "supports": "Owner experiences and vendor response; source is reporting evidence, not original incident telemetry.", "limitations": [], "provenance": { "sourceId": "DR-S12", "url": "https://www.abc.net.au/news/2024-10-11/robot-vacuum-yells-racial-slurs-at-family-after-being-hacked/104445408", "title": "Hackers take control of robot vacuums in multiple cities, yell racial slurs - ABC News", "kind": "first-hand-investigative-report", "published": "2024-10-10T19:11:48+00:00", "modified": "2024-10-10T20:48:29+00:00", "verifiedAt": "2026-11-01T14:01:08Z", "httpStatus": 200, "scrapeId": "01a19768-2ea1-731e-b2e2-02049d5d9ff8", "claimSupport": "Owner experiences and vendor response; source is reporting evidence, not original incident telemetry.", "partialRead": null } } ], "followUp": [ { "question": "Do the operational incidents establish BLE exploitation?", "status": "resolved", "result": "No: source includes a possible credential-stuffing explanation and lacks a forensic path connecting the incidents to BLE.", "sourceURLs": [ "https://www.abc.net.au/news/2024-10-11/robot-vacuum-yells-racial-slurs-at-family-after-being-hacked/104445408" ] }, { "question": "Is the physical/hardware attack mechanism confirmed?", "status": "open", "result": "No; authoritative technical incident disclosure would be needed.", "sourceURLs": [] } ], "limitations": [ "No packet capture, firmware image, access log or independently inspected vendor correspondence is in this collection.", "A known vulnerability in the same model does not prove its use in these incidents.", "Keep this contextual incident separate from the controlled BLE demonstration and base-station firmware advisory." ], "mappings": { "emb3d": [], "attack": [] }, "confidence": { "total": 45, "components": { "provenance": { "score": 16, "max": 20, "rationale": null }, "technicalEvidence": { "score": 12, "max": 35, "rationale": null }, "configurationSpecificity": { "score": 9, "max": 20, "rationale": null }, "independentCorroboration": { "score": 0, "max": 15, "rationale": null }, "followUpResolution": { "score": 8, "max": 10, "rationale": null } }, "rationale": "Confidence concerns the reported unauthorized robot behavior and quoted vendor response only; entry mechanism remains unknown." } }, { "id": "DR-018", "title": "Holy Stone HS175D and HS720: validated external-flash acquisition under physical access", "canonicalUrl": "https://arxiv.org/html/2605.11040v1", "strand": "drones-robotics", "scope": "hardware", "publicationDate": "2026-05-11", "eventDate": null, "reviewDate": "2026-11-01", "dateNotes": null, "device": { "vendor": "Holy Stone", "models": [ "HS175D", "HS720" ], "firmwareVersions": null, "configuration": "HS175D external XT25F128F-W flash, 16 MiB; HS720 XM25QH64C flash, 8 MiB. Paper reports extracted software structures, but not a vendor firmware release or board revision." }, "access": { "class": "physical-hardware/acquisition", "requirements": "Physical board access to external nonvolatile storage and suitable readout equipment; this is a laboratory acquisition experiment." }, "claim": "Holy Stone HS175D and HS720: validated external-flash acquisition under physical access", "outcome": "The preprint reports repeated, matching full-size external-flash reads for HS175D and HS720 and successful structural analysis of their contents. This establishes reported firmware readability on the tested units, not execution of a malicious image or flight control.", "evidenceStatus": "original-preprint-hardware-acquisition", "evidenceGroup": "demonstration", "hardwareBoundary": "Direct in-circuit reading of nonvolatile storage, crossing a physical firmware-confidentiality boundary.", "mechanisms": [ "ROM/NVRAM Data Extraction or Modification" ], "sources": [ { "url": "https://arxiv.org/html/2605.11040v1", "title": "A Multi-Interface Firmware Acquisition and Validation Methodology for Low-Cost Consumer Drones: A Case Study on Three Holy Stone Platforms", "type": "original-preprint", "reviewedAt": "2026-11-01T14:11:49Z", "readStatus": "reviewed", "supports": "Tables I–VI identify chips, extraction sizes, repeatability and structural checks; limitations separate dump consistency from vendor-authenticated ground truth.", "limitations": [], "provenance": { "sourceId": "DR-S31", "url": "https://arxiv.org/html/2605.11040v1", "title": "A Multi-Interface Firmware Acquisition and Validation Methodology for Low-Cost Consumer Drones: A Case Study on Three Holy Stone Platforms", "kind": "original-preprint", "published": "2026-05-11", "modified": null, "verifiedAt": "2026-11-01T14:11:49Z", "httpStatus": 200, "scrapeId": "01a19772-7374-75ca-84cd-f9158001257b", "claimSupport": "Tables I–VI identify chips, extraction sizes, repeatability and structural checks; limitations separate dump consistency from vendor-authenticated ground truth.", "partialRead": null } } ], "followUp": [ { "question": "Were readable firmware contents distinguished from tool success?", "status": "resolved", "result": "Yes: HS175D and HS720 reads had matching hashes and recognized boot/filesystem structures; HS360S was separately rejected as incomplete.", "sourceURLs": [ "https://arxiv.org/html/2605.11040v1" ] }, { "question": "Did the study demonstrate secure-boot bypass or flight manipulation?", "status": "resolved", "result": "No. Runtime integrity, anti-rollback and other subsystems were out of scope.", "sourceURLs": [ "https://arxiv.org/html/2605.11040v1" ] }, { "question": "Are vendor-authenticated reference images available for comparison?", "status": "open", "result": "The paper says none were available; physical readback was not independently repeated by LrrK.", "sourceURLs": [] } ], "limitations": [ "Preprint prepared for submission; peer review and independent reproduction are not established.", "Exact vendor firmware version and board revision absent.", "Consistency, entropy and recognizable structures are not cryptographic authenticity or proof the entire boot chain lacks enforcement.", "Static package/CVE identification is not a demonstrated exploitable vulnerability." ], "mappings": { "emb3d": [ { "id": "TID-108", "name": "ROM/NVRAM Data Extraction or Modification", "url": "https://emb3d.mitre.org/threats/TID-108.html", "basis": "analyst-inference", "rationale": "The observed report is physical readout of external nonvolatile memory. Only the extraction portion is supported; modification is not demonstrated.", "officialCaseAttribution": false, "provenance": { "id": "TID-108", "name": "ROM/NVRAM Data Extraction or Modification", "url": "https://emb3d.mitre.org/threats/TID-108.html", "basis": "analyst_mapping", "rationale": "The observed report is physical readout of external nonvolatile memory. Only the extraction portion is supported; modification is not demonstrated.", "modelVersion": "2.0.1", "sourcePin": "MITRE/emb3d@0d7c25bb4e2928c516fb5811aaab9ff8bab2896c", "officialCaseAttribution": false } } ], "attack": [] }, "confidence": { "total": 72, "components": { "provenance": { "score": 18, "max": 20, "rationale": null }, "technicalEvidence": { "score": 29, "max": 35, "rationale": null }, "configurationSpecificity": { "score": 17, "max": 20, "rationale": null }, "independentCorroboration": { "score": 0, "max": 15, "rationale": null }, "followUpResolution": { "score": 8, "max": 10, "rationale": null } }, "rationale": "Original preprint supplies chips, sizes, hash consistency and validation tables; no independent replication or vendor reference image." } }, { "id": "DR-019", "title": "Holy Stone HS175D: unprotected SWD permits internal MCU flash and SRAM reads", "canonicalUrl": "https://arxiv.org/html/2605.11040v1", "strand": "drones-robotics", "scope": "hardware", "publicationDate": "2026-05-11", "eventDate": null, "reviewDate": "2026-11-01", "dateNotes": null, "device": { "vendor": "Holy Stone", "models": [ "HS175D" ], "firmwareVersions": null, "configuration": "MindMotion MM32F103 MCU; paper reports accessible SWD and no active readout protection on its tested unit." }, "access": { "class": "physical-debug-interface", "requirements": "Physical access to the MCU debug interface and a compatible hardware debug probe." }, "claim": "Holy Stone HS175D: unprotected SWD permits internal MCU flash and SRAM reads", "outcome": "Researchers report successful readout of MCU internal flash and SRAM through SWD. They do not report malicious code installation, modified motor outputs or a runtime safety bypass.", "evidenceStatus": "original-preprint-hardware-debug-readout", "evidenceGroup": "demonstration", "hardwareBoundary": "Actual privileged hardware debug readout, beyond mere boot-console discovery.", "mechanisms": [ "Firmware/Data Extraction via Hardware Interface" ], "sources": [ { "url": "https://arxiv.org/html/2605.11040v1", "title": "A Multi-Interface Firmware Acquisition and Validation Methodology for Low-Cost Consumer Drones: A Case Study on Three Holy Stone Platforms", "type": "original-preprint", "reviewedAt": "2026-11-01T14:11:49Z", "readStatus": "reviewed", "supports": "Section IV-E and Table VI state SWD access, no readout protection and flash/SRAM readability.", "limitations": [], "provenance": { "sourceId": "DR-S31", "url": "https://arxiv.org/html/2605.11040v1", "title": "A Multi-Interface Firmware Acquisition and Validation Methodology for Low-Cost Consumer Drones: A Case Study on Three Holy Stone Platforms", "kind": "original-preprint", "published": "2026-05-11", "modified": null, "verifiedAt": "2026-11-01T14:11:49Z", "httpStatus": 200, "scrapeId": "01a19772-7374-75ca-84cd-f9158001257b", "claimSupport": "Section IV-E and Table VI state SWD access, no readout protection and flash/SRAM readability.", "partialRead": null } } ], "followUp": [ { "question": "Was SWD success actually reported rather than inferred from pads?", "status": "resolved", "result": "Yes: the paper explicitly reports a successful connection with internal flash/SRAM reads.", "sourceURLs": [ "https://arxiv.org/html/2605.11040v1" ] }, { "question": "Does UART visibility establish the same capability on other units?", "status": "resolved", "result": "No: HS720 is reported only as boot-log output; other-model debug access was not evaluated.", "sourceURLs": [ "https://arxiv.org/html/2605.11040v1" ] } ], "limitations": [ "Firmware revision, board revision, exact readout size/hash and an independently accessible debug-session transcript are not supplied in the inspected account.", "Do not transfer the HS175D SWD result to HS720 or HS360S; those debug interfaces were not tested.", "A memory-read result is not code execution or physical actuation." ], "mappings": { "emb3d": [ { "id": "TID-115", "name": "Firmware/Data Extraction via Hardware Interface", "url": "https://emb3d.mitre.org/threats/TID-115.html", "basis": "analyst-inference", "rationale": "Unprotected SWD readout directly matches firmware/data extraction through a hardware debug interface. No code-write outcome is implied.", "officialCaseAttribution": false, "provenance": { "id": "TID-115", "name": "Firmware/Data Extraction via Hardware Interface", "url": "https://emb3d.mitre.org/threats/TID-115.html", "basis": "analyst_mapping", "rationale": "Unprotected SWD readout directly matches firmware/data extraction through a hardware debug interface. No code-write outcome is implied.", "modelVersion": "2.0.1", "sourcePin": "MITRE/emb3d@0d7c25bb4e2928c516fb5811aaab9ff8bab2896c", "officialCaseAttribution": false } } ], "attack": [] }, "confidence": { "total": 66, "components": { "provenance": { "score": 18, "max": 20, "rationale": null }, "technicalEvidence": { "score": 24, "max": 35, "rationale": null }, "configurationSpecificity": { "score": 16, "max": 20, "rationale": null }, "independentCorroboration": { "score": 0, "max": 15, "rationale": null }, "followUpResolution": { "score": 8, "max": 10, "rationale": null } }, "rationale": "Direct preprint statement and model-specific table; detailed session artifacts and exact firmware pin are missing." } }, { "id": "DR-020", "title": "Holy Stone HS360S: full-size SPI reads failed firmware-content validation", "canonicalUrl": "https://arxiv.org/html/2605.11040v1", "strand": "drones-robotics", "scope": "hardware", "publicationDate": "2026-05-11", "eventDate": null, "reviewDate": "2026-11-01", "dateNotes": null, "device": { "vendor": "Holy Stone", "models": [ "HS360S" ], "firmwareVersions": null, "configuration": "Macronix MX25L6433F external flash, nominal 8 MiB; unstable in-circuit reads under the paper's fixture conditions." }, "access": { "class": "physical-hardware/acquisition-negative-result", "requirements": "Physical flash access and the tested acquisition fixture; no successful functional image assumed." }, "claim": "Holy Stone HS360S: full-size SPI reads failed firmware-content validation", "outcome": "Tool-level reads returned nominally full-size data, but repeat hashes diverged and the retained dump lacked meaningful firmware structures. The paper classifies the HS360S extraction as incomplete despite successful size/tool checks.", "evidenceStatus": "original-preprint-inconclusive-hardware-acquisition", "evidenceGroup": "reported-result", "hardwareBoundary": "Negative physical acquisition/validation result that prevents promoting connection or byte count into valid firmware evidence.", "mechanisms": [], "sources": [ { "url": "https://arxiv.org/html/2605.11040v1", "title": "A Multi-Interface Firmware Acquisition and Validation Methodology for Low-Cost Consumer Drones: A Case Study on Three Holy Stone Platforms", "type": "original-preprint", "reviewedAt": "2026-11-01T14:11:49Z", "readStatus": "reviewed", "supports": "Tables II–VI and failure analysis separate full byte count from repeatable meaningful content.", "limitations": [], "provenance": { "sourceId": "DR-S31", "url": "https://arxiv.org/html/2605.11040v1", "title": "A Multi-Interface Firmware Acquisition and Validation Methodology for Low-Cost Consumer Drones: A Case Study on Three Holy Stone Platforms", "kind": "original-preprint", "published": "2026-05-11", "modified": null, "verifiedAt": "2026-11-01T14:11:49Z", "httpStatus": 200, "scrapeId": "01a19772-7374-75ca-84cd-f9158001257b", "claimSupport": "Tables II–VI and failure analysis separate full byte count from repeatable meaningful content.", "partialRead": null } } ], "followUp": [ { "question": "Does the extraction tool's success flag prove a valid firmware image?", "status": "resolved", "result": "No: hash and structural checks rejected the apparent HS360S success.", "sourceURLs": [ "https://arxiv.org/html/2605.11040v1" ] }, { "question": "Was the cause resolved?", "status": "open", "result": "No. Stable independently validated readout or a vendor reference would be needed.", "sourceURLs": [] } ], "limitations": [ "This is not a successful exploit, a demonstrated protection mechanism or evidence the device cannot be read by another method.", "Paper notes contact/signal instability and ambiguity; causes are not independently resolved.", "Only approximate operator-recorded attempt counts were reported; no reliability percentage is generalized." ], "mappings": { "emb3d": [], "attack": [] }, "confidence": { "total": 68, "components": { "provenance": { "score": 18, "max": 20, "rationale": null }, "technicalEvidence": { "score": 26, "max": 35, "rationale": null }, "configurationSpecificity": { "score": 17, "max": 20, "rationale": null }, "independentCorroboration": { "score": 0, "max": 15, "rationale": null }, "followUpResolution": { "score": 7, "max": 10, "rationale": null } }, "rationale": "Clearly scoped reported negative outcome, with actual chip and validation evidence; mechanism of failure unresolved." } }, { "id": "DR-021", "title": "NAO and Pepper: historical firmware-update verification can be skipped", "canonicalUrl": "https://www.ioactive.com/wp-content/uploads/pdfs/Hacking-Robots-Before-Skynet-Technical-Appendix.pdf", "strand": "drones-robotics", "scope": "device-interface", "publicationDate": null, "eventDate": "Historical report containing 2017 references; exact appendix release date not verified", "reviewDate": "2026-11-01", "dateNotes": null, "device": { "vendor": "Aldebaran / SoftBank Robotics", "models": [ "NAO", "Pepper" ], "firmwareVersions": [ "NAOqi 2.1.4.13 on NAO", "NAOqi 2.4.3.28 on Pepper", "NAOqi 2.5.5.5 on Pepper" ], "configuration": "ALSystem update/reset interfaces and component-image integrity handling described in the technical appendix." }, "access": { "class": "embedded-firmware/update-interface", "requirements": "Ability to invoke the relevant robot update interface; not a blanket assertion of unauthenticated Internet access." }, "claim": "NAO and Pepper: historical firmware-update verification can be skipped", "outcome": "IOActive reports that update operations can accept unsigned/unverified system components when integrity verification is skipped, and shows implementation/API-level evidence. No malicious replacement image, persistence experiment or operational compromise was reproduced here.", "evidenceStatus": "original-research-reported-firmware-trust-weakness", "evidenceGroup": "reported-result", "hardwareBoundary": "Robot firmware authenticity boundary, distinct from a mobile APK update.", "mechanisms": [ "Device Allows Unauthenticated Firmware Installation" ], "sources": [ { "url": "https://www.ioactive.com/wp-content/uploads/pdfs/Hacking-Robots-Before-Skynet-Technical-Appendix.pdf", "title": "Microsoft Word - Hacking Robots Before Skynet - Technical Appendix.docx", "type": "original-technical-appendix-complete", "reviewedAt": "2026-11-01T14:11:49Z", "readStatus": "reviewed", "supports": "Complete 46-page appendix read; Update Mechanisms names the robot/NAOqi versions and optional verification behavior.", "limitations": [], "provenance": { "sourceId": "DR-S32", "url": "https://www.ioactive.com/wp-content/uploads/pdfs/Hacking-Robots-Before-Skynet-Technical-Appendix.pdf", "title": "Microsoft Word - Hacking Robots Before Skynet - Technical Appendix.docx", "kind": "original-technical-appendix-complete", "published": null, "modified": null, "verifiedAt": "2026-11-01T14:11:49Z", "httpStatus": 200, "scrapeId": "01a19772-7256-719a-a1e1-0609b2a4817d", "claimSupport": "Complete 46-page appendix read; Update Mechanisms names the robot/NAOqi versions and optional verification behavior.", "partialRead": null } } ], "followUp": [ { "question": "Is the report specifically about robot firmware?", "status": "resolved", "result": "Yes: the versioned NAO/Pepper section describes system components and robot update operations, separate from later mobile-application examples.", "sourceURLs": [ "https://www.ioactive.com/wp-content/uploads/pdfs/Hacking-Robots-Before-Skynet-Technical-Appendix.pdf" ] }, { "question": "Was current remediation verified?", "status": "open", "result": "No current vendor advisory or modern-firmware check was in this bounded follow-up.", "sourceURLs": [] } ], "limitations": [ "No independently inspected vendor acknowledgement or current fixed-version matrix.", "Unsigned firmware acceptance is attributed to the original report; this collection does not execute or independently validate it.", "An unkeyed checksum is error checking, not proof of firmware-origin authentication; do not infer cryptographic signature strength merely from MD5 weakness." ], "mappings": { "emb3d": [ { "id": "TID-211", "name": "Device Allows Unauthenticated Firmware Installation", "url": "https://emb3d.mitre.org/threats/TID-211.html", "basis": "analyst-inference", "rationale": "Reported optional/missing enforcement of firmware-origin verification fits the model's update-authentication boundary. Actor access to the update API remains separately required.", "officialCaseAttribution": false, "provenance": { "id": "TID-211", "name": "Device Allows Unauthenticated Firmware Installation", "url": "https://emb3d.mitre.org/threats/TID-211.html", "basis": "analyst_mapping", "rationale": "Reported optional/missing enforcement of firmware-origin verification fits the model's update-authentication boundary. Actor access to the update API remains separately required.", "modelVersion": "2.0.1", "sourcePin": "MITRE/emb3d@0d7c25bb4e2928c516fb5811aaab9ff8bab2896c", "officialCaseAttribution": false } } ], "attack": [ { "id": "T1693.001", "name": "Modify Firmware: System Firmware", "url": "https://attack.mitre.org/versions/v20/techniques/T1693/001/", "basis": "analyst-inference", "rationale": "Semantic reference to unauthorized system-firmware installation potential; no malicious campaign or successful LrrK installation is claimed.", "officialCaseAttribution": false, "domain": "ics", "provenance": { "id": "T1693.001", "name": "Modify Firmware: System Firmware", "domain": "ICS", "url": "https://attack.mitre.org/versions/v20/techniques/T1693/001/", "basis": "analyst_cross_reference", "rationale": "Semantic reference to unauthorized system-firmware installation potential; no malicious campaign or successful LrrK installation is claimed.", "attackVersion": "20.0", "officialCaseAttribution": false } } ] }, "confidence": { "total": 67, "components": { "provenance": { "score": 19, "max": 20, "rationale": null }, "technicalEvidence": { "score": 25, "max": 35, "rationale": null }, "configurationSpecificity": { "score": 18, "max": 20, "rationale": null }, "independentCorroboration": { "score": 0, "max": 15, "rationale": null }, "followUpResolution": { "score": 5, "max": 10, "rationale": null } }, "rationale": "Original complete technical appendix with explicit historical versions; no independent installation or remediation verification." } }, { "id": "DR-022", "title": "ROBOTIS OP2: updater implementation lacks firmware-authenticity enforcement", "canonicalUrl": "https://www.ioactive.com/wp-content/uploads/pdfs/Hacking-Robots-Before-Skynet-Technical-Appendix.pdf", "strand": "drones-robotics", "scope": "device-interface", "publicationDate": null, "eventDate": "Historical report containing 2017 references; exact appendix release date not verified", "reviewDate": "2026-11-01", "dateNotes": null, "device": { "vendor": "ROBOTIS", "models": [ "ROBOTIS OP2" ], "firmwareVersions": null, "configuration": "ROBOTIS-OP2 firmware-installer source path shown in the appendix. Its separate network-service section identifies Recovery_20150326, but that version is not silently assigned to this updater finding." }, "access": { "class": "embedded-firmware/update-path", "requirements": "Ability to reach or execute the affected update path; detailed actor privilege requirements not resolved by the public section." }, "claim": "ROBOTIS OP2: updater implementation lacks firmware-authenticity enforcement", "outcome": "IOActive shows firmware-installer logic and reports direct acceptance of image content without sufficient authenticity checking. The supported claim is a reported implementation trust weakness; an installed malicious image and physical behavior are not demonstrated in this review.", "evidenceStatus": "original-research-static-firmware-trust-analysis", "evidenceGroup": "reported-result", "hardwareBoundary": "Firmware acceptance by an embedded humanoid platform, distinct from a companion application's update process.", "mechanisms": [ "Device Allows Unauthenticated Firmware Installation" ], "sources": [ { "url": "https://www.ioactive.com/wp-content/uploads/pdfs/Hacking-Robots-Before-Skynet-Technical-Appendix.pdf", "title": "Microsoft Word - Hacking Robots Before Skynet - Technical Appendix.docx", "type": "original-technical-appendix-complete", "reviewedAt": "2026-11-01T14:11:49Z", "readStatus": "reviewed", "supports": "Unsigned Firmware Images in ROBOTIS-OP2 section and its code-analysis conclusion.", "limitations": [], "provenance": { "sourceId": "DR-S32", "url": "https://www.ioactive.com/wp-content/uploads/pdfs/Hacking-Robots-Before-Skynet-Technical-Appendix.pdf", "title": "Microsoft Word - Hacking Robots Before Skynet - Technical Appendix.docx", "kind": "original-technical-appendix-complete", "published": null, "modified": null, "verifiedAt": "2026-11-01T14:11:49Z", "httpStatus": 200, "scrapeId": "01a19772-7256-719a-a1e1-0609b2a4817d", "claimSupport": "Unsigned Firmware Images in ROBOTIS-OP2 section and its code-analysis conclusion.", "partialRead": null } } ], "followUp": [ { "question": "Was an actual malicious image installation documented in the inspected section?", "status": "open", "result": "No dynamic installation receipt was identified; the presented support is code analysis and researcher assertion.", "sourceURLs": [ "https://www.ioactive.com/wp-content/uploads/pdfs/Hacking-Robots-Before-Skynet-Technical-Appendix.pdf" ] }, { "question": "Is the relevant boundary firmware or Android app installation?", "status": "resolved", "result": "Firmware-installer code on the ROBOTIS platform.", "sourceURLs": [ "https://www.ioactive.com/wp-content/uploads/pdfs/Hacking-Robots-Before-Skynet-Technical-Appendix.pdf" ] } ], "limitations": [ "No exact updater revision, vendor fix or independent dynamic validation.", "Do not inherit the network-service recovery-image version as an exact updater-tested version without corroboration.", "Possible backdoors are a consequence hypothesis, not an observed implanted image." ], "mappings": { "emb3d": [ { "id": "TID-211", "name": "Device Allows Unauthenticated Firmware Installation", "url": "https://emb3d.mitre.org/threats/TID-211.html", "basis": "analyst-inference", "rationale": "Reported on-device failure to authenticate image content matches the update trust boundary; dynamic exploitability remains unverified.", "officialCaseAttribution": false, "provenance": { "id": "TID-211", "name": "Device Allows Unauthenticated Firmware Installation", "url": "https://emb3d.mitre.org/threats/TID-211.html", "basis": "analyst_mapping", "rationale": "Reported on-device failure to authenticate image content matches the update trust boundary; dynamic exploitability remains unverified.", "modelVersion": "2.0.1", "sourcePin": "MITRE/emb3d@0d7c25bb4e2928c516fb5811aaab9ff8bab2896c", "officialCaseAttribution": false } } ], "attack": [] }, "confidence": { "total": 56, "components": { "provenance": { "score": 19, "max": 20, "rationale": null }, "technicalEvidence": { "score": 23, "max": 35, "rationale": null }, "configurationSpecificity": { "score": 10, "max": 20, "rationale": null }, "independentCorroboration": { "score": 0, "max": 15, "rationale": null }, "followUpResolution": { "score": 4, "max": 10, "rationale": null } }, "rationale": "Original source excerpt and explicit interpretation, but exact revision, execution preconditions and dynamic outcome remain incomplete." } }, { "id": "DR-023", "title": "UBTech Alpha 1S: Bluetooth update path accepts tampered robot firmware", "canonicalUrl": "https://www.ioactive.com/wp-content/uploads/pdfs/Hacking-Robots-Before-Skynet-Technical-Appendix.pdf", "strand": "drones-robotics", "scope": "device-interface", "publicationDate": null, "eventDate": "Historical report containing 2017 references; exact appendix release date not verified", "reviewDate": "2026-11-01", "dateNotes": null, "device": { "vendor": "UBTech", "models": [ "Alpha 1S" ], "firmwareVersions": null, "configuration": "The appendix analyzes companion release Alpha1_v2.6.1.7 and separately notes code removal in Android app v2.7.2.1; these are app versions, not robot firmware release identifiers." }, "access": { "class": "adjacent-radio/firmware-update", "requirements": "Bluetooth reachability to the robot's reported update function; the same report describes lack of authenticated pairing on the affected control path." }, "claim": "UBTech Alpha 1S: Bluetooth update path accepts tampered robot firmware", "outcome": "IOActive reports an unsigned robot-firmware update path and states that a tampered image bricks the robot. Removing update code from a later companion application was reported not to remove the robot-side weakness.", "evidenceStatus": "original-research-reported-firmware-corruption", "evidenceGroup": "reported-result", "hardwareBoundary": "Adjacent-radio entry to robot firmware installation and availability; not merely malicious mobile APK distribution.", "mechanisms": [ "Device Allows Unauthenticated Firmware Installation" ], "sources": [ { "url": "https://www.ioactive.com/wp-content/uploads/pdfs/Hacking-Robots-Before-Skynet-Technical-Appendix.pdf", "title": "Microsoft Word - Hacking Robots Before Skynet - Technical Appendix.docx", "type": "original-technical-appendix-complete", "reviewedAt": "2026-11-01T14:11:49Z", "readStatus": "reviewed", "supports": "Missing Bluetooth authentication, Remote Robot Kill and Remote Firmware Upgrade sections distinguish robot firmware from companion updates.", "limitations": [], "provenance": { "sourceId": "DR-S32", "url": "https://www.ioactive.com/wp-content/uploads/pdfs/Hacking-Robots-Before-Skynet-Technical-Appendix.pdf", "title": "Microsoft Word - Hacking Robots Before Skynet - Technical Appendix.docx", "kind": "original-technical-appendix-complete", "published": null, "modified": null, "verifiedAt": "2026-11-01T14:11:49Z", "httpStatus": 200, "scrapeId": "01a19772-7256-719a-a1e1-0609b2a4817d", "claimSupport": "Missing Bluetooth authentication, Remote Robot Kill and Remote Firmware Upgrade sections distinguish robot firmware from companion updates.", "partialRead": null } } ], "followUp": [ { "question": "Was the firmware result distinct from the mobile APK example?", "status": "resolved", "result": "Yes: the appendix has separate robot-firmware and Android application update sections.", "sourceURLs": [ "https://www.ioactive.com/wp-content/uploads/pdfs/Hacking-Robots-Before-Skynet-Technical-Appendix.pdf" ] }, { "question": "Does later app-code removal prove the robot is corrected?", "status": "resolved", "result": "No: original researchers explicitly distinguish app-code removal from robot-side firmware vulnerability.", "sourceURLs": [ "https://www.ioactive.com/wp-content/uploads/pdfs/Hacking-Robots-Before-Skynet-Technical-Appendix.pdf" ] }, { "question": "Is a current fixed robot firmware identified?", "status": "open", "result": "No current vendor fix was verified in this original-source follow-up.", "sourceURLs": [] } ], "limitations": [ "The reported bricking result was not independently reproduced; no recovery or permanent-damage proof is supplied here.", "Exact robot firmware version, Bluetooth state prerequisites and current vendor remediation remain unknown.", "Companion app version changes are not proof of a robot firmware fix.", "No payload bytes, update commands, exploit code or binaries are copied into this collection." ], "mappings": { "emb3d": [ { "id": "TID-211", "name": "Device Allows Unauthenticated Firmware Installation", "url": "https://emb3d.mitre.org/threats/TID-211.html", "basis": "analyst-inference", "rationale": "Reported robot-side acceptance of unsigned/tampered update content fits missing firmware-origin authentication.", "officialCaseAttribution": false, "provenance": { "id": "TID-211", "name": "Device Allows Unauthenticated Firmware Installation", "url": "https://emb3d.mitre.org/threats/TID-211.html", "basis": "analyst_mapping", "rationale": "Reported robot-side acceptance of unsigned/tampered update content fits missing firmware-origin authentication.", "modelVersion": "2.0.1", "sourcePin": "MITRE/emb3d@0d7c25bb4e2928c516fb5811aaab9ff8bab2896c", "officialCaseAttribution": false } } ], "attack": [] }, "confidence": { "total": 65, "components": { "provenance": { "score": 19, "max": 20, "rationale": null }, "technicalEvidence": { "score": 27, "max": 35, "rationale": null }, "configurationSpecificity": { "score": 13, "max": 20, "rationale": null }, "independentCorroboration": { "score": 0, "max": 15, "rationale": null }, "followUpResolution": { "score": 6, "max": 10, "rationale": null } }, "rationale": "Complete original technical account includes update implementation and reported corruption outcome; device firmware revision and independent repetition absent." } }, { "id": "DR-024", "title": "Asratec V-Sido: weak peripheral pairing and unauthenticated GR-001 control", "canonicalUrl": "https://www.ioactive.com/wp-content/uploads/pdfs/Hacking-Robots-Before-Skynet-Technical-Appendix.pdf", "strand": "drones-robotics", "scope": "device-interface", "publicationDate": null, "eventDate": "Historical report containing 2017 references; exact appendix release date not verified", "reviewDate": "2026-11-01", "dateNotes": null, "device": { "vendor": "Asratec / HPI Japan", "models": [ "V-Sido CONNECT RC with extra Bluetooth dongle", "GR-001 running V-Sido OS" ], "firmwareVersions": null, "configuration": "Two distinct configurations in the appendix: a controller dongle using a fixed default pairing PIN, and V-Sido Lite control of a GR-001 without authentication." }, "access": { "class": "controller/peripheral-interface", "requirements": "Proximity to the reported Bluetooth peripheral or reachability to the relevant V-Sido controller interface; the two observations are not asserted to be a single exploit chain." }, "claim": "Asratec V-Sido: weak peripheral pairing and unauthenticated GR-001 control", "outcome": "IOActive describes a known/default Bluetooth pairing secret on the CONNECT RC dongle and explicitly reports confirming unauthenticated V-Sido Lite control on GR-001. This does not establish arbitrary code execution or a firmware replacement.", "evidenceStatus": "original-research-controller-authentication-observations", "evidenceGroup": "reported-result", "hardwareBoundary": "External controller peripheral and embedded robot-control interface governing servos.", "mechanisms": [ "Default Credentials", "Remotely Accessible Unauthenticated Services" ], "sources": [ { "url": "https://www.ioactive.com/wp-content/uploads/pdfs/Hacking-Robots-Before-Skynet-Technical-Appendix.pdf", "title": "Microsoft Word - Hacking Robots Before Skynet - Technical Appendix.docx", "type": "original-technical-appendix-complete", "reviewedAt": "2026-11-01T14:11:49Z", "readStatus": "reviewed", "supports": "Separate Asratec CONNECT RC and V-Sido OS/GR-001 examples name the devices and authentication weakness.", "limitations": [], "provenance": { "sourceId": "DR-S32", "url": "https://www.ioactive.com/wp-content/uploads/pdfs/Hacking-Robots-Before-Skynet-Technical-Appendix.pdf", "title": "Microsoft Word - Hacking Robots Before Skynet - Technical Appendix.docx", "kind": "original-technical-appendix-complete", "published": null, "modified": null, "verifiedAt": "2026-11-01T14:11:49Z", "httpStatus": 200, "scrapeId": "01a19772-7256-719a-a1e1-0609b2a4817d", "claimSupport": "Separate Asratec CONNECT RC and V-Sido OS/GR-001 examples name the devices and authentication weakness.", "partialRead": null } } ], "followUp": [ { "question": "Was the GR-001 claim only a generic protocol example?", "status": "resolved", "result": "No: the appendix explicitly says it was confirmed on GR-001.", "sourceURLs": [ "https://www.ioactive.com/wp-content/uploads/pdfs/Hacking-Robots-Before-Skynet-Technical-Appendix.pdf" ] }, { "question": "Are default peripheral pairing and control-service access one verified chain?", "status": "resolved", "result": "No: the source reports them as separate device/configuration examples.", "sourceURLs": [ "https://www.ioactive.com/wp-content/uploads/pdfs/Hacking-Robots-Before-Skynet-Technical-Appendix.pdf" ] } ], "limitations": [ "Exact dongle, controller and V-Sido release versions are not pinned.", "A weak pairing default and absent application authentication are different observations, not interchangeable mechanisms.", "Current vendor settings, configuration changes and corrected versions were not verified." ], "mappings": { "emb3d": [ { "id": "TID-311", "name": "Default Credentials", "url": "https://emb3d.mitre.org/threats/TID-311.html", "basis": "analyst-inference", "rationale": "Applies only to the reported controller-dongle default pairing credential.", "officialCaseAttribution": false, "provenance": { "id": "TID-311", "name": "Default Credentials", "url": "https://emb3d.mitre.org/threats/TID-311.html", "basis": "analyst_mapping", "rationale": "Applies only to the reported controller-dongle default pairing credential.", "modelVersion": "2.0.1", "sourcePin": "MITRE/emb3d@0d7c25bb4e2928c516fb5811aaab9ff8bab2896c", "officialCaseAttribution": false } }, { "id": "TID-310", "name": "Remotely Accessible Unauthenticated Services", "url": "https://emb3d.mitre.org/threats/TID-310.html", "basis": "analyst-inference", "rationale": "Applies only to the separately reported GR-001 control-interface authentication omission.", "officialCaseAttribution": false, "provenance": { "id": "TID-310", "name": "Remotely Accessible Unauthenticated Services", "url": "https://emb3d.mitre.org/threats/TID-310.html", "basis": "analyst_mapping", "rationale": "Applies only to the separately reported GR-001 control-interface authentication omission.", "modelVersion": "2.0.1", "sourcePin": "MITRE/emb3d@0d7c25bb4e2928c516fb5811aaab9ff8bab2896c", "officialCaseAttribution": false } } ], "attack": [] }, "confidence": { "total": 61, "components": { "provenance": { "score": 19, "max": 20, "rationale": null }, "technicalEvidence": { "score": 24, "max": 35, "rationale": null }, "configurationSpecificity": { "score": 12, "max": 20, "rationale": null }, "independentCorroboration": { "score": 0, "max": 15, "rationale": null }, "followUpResolution": { "score": 6, "max": 10, "rationale": null } }, "rationale": "Original device-specific confirmation and interface evidence; firmware pins and independent corroboration absent." } }, { "id": "DR-025", "title": "ROBOTIS OP2 RoboPlus: unauthenticated motion-control service in a named recovery image", "canonicalUrl": "https://www.ioactive.com/wp-content/uploads/pdfs/Hacking-Robots-Before-Skynet-Technical-Appendix.pdf", "strand": "drones-robotics", "scope": "device-interface", "publicationDate": null, "eventDate": "Historical report containing 2017 references; exact appendix release date not verified", "reviewDate": "2026-11-01", "dateNotes": null, "device": { "vendor": "ROBOTIS", "models": [ "ROBOTIS OP2" ], "firmwareVersions": [ "ROBOTIS-OP2_Recovery_20150326 as named in the network-service section" ], "configuration": "Embedded RoboPlus Motion server distributed with the named robot image; remote network control/editing path." }, "access": { "class": "embedded-controller/network", "requirements": "Network reachability to the motion server. Wireless exposure is conditional on adding a wireless interface, not assumed universally." }, "claim": "ROBOTIS OP2 RoboPlus: unauthenticated motion-control service in a named recovery image", "outcome": "IOActive reports that the motion server accepts clients without authentication and supports editing actuator/motion data. The appendix supplies implementation-level evidence; no malicious operational incident or independently observed injury is established.", "evidenceStatus": "original-research-embedded-control-authentication", "evidenceGroup": "reported-result", "hardwareBoundary": "Unauthenticated onboard motion/actuator management boundary; distinct from the same platform's firmware updater.", "mechanisms": [ "Remotely Accessible Unauthenticated Services" ], "sources": [ { "url": "https://www.ioactive.com/wp-content/uploads/pdfs/Hacking-Robots-Before-Skynet-Technical-Appendix.pdf", "title": "Microsoft Word - Hacking Robots Before Skynet - Technical Appendix.docx", "type": "original-technical-appendix-complete", "reviewedAt": "2026-11-01T14:11:49Z", "readStatus": "reviewed", "supports": "RoboPlus section identifies the recovery image, server's missing authentication and motion-management functionality.", "limitations": [], "provenance": { "sourceId": "DR-S32", "url": "https://www.ioactive.com/wp-content/uploads/pdfs/Hacking-Robots-Before-Skynet-Technical-Appendix.pdf", "title": "Microsoft Word - Hacking Robots Before Skynet - Technical Appendix.docx", "kind": "original-technical-appendix-complete", "published": null, "modified": null, "verifiedAt": "2026-11-01T14:11:49Z", "httpStatus": 200, "scrapeId": "01a19772-7256-719a-a1e1-0609b2a4817d", "claimSupport": "RoboPlus section identifies the recovery image, server's missing authentication and motion-management functionality.", "partialRead": null } } ], "followUp": [ { "question": "Was a concrete firmware image identified?", "status": "resolved", "result": "Yes: Recovery_20150326 is explicitly named for the RoboPlus server.", "sourceURLs": [ "https://www.ioactive.com/wp-content/uploads/pdfs/Hacking-Robots-Before-Skynet-Technical-Appendix.pdf" ] }, { "question": "Does every robot have wireless reachability?", "status": "resolved", "result": "No: the report makes that conditional on a separate wireless interface.", "sourceURLs": [ "https://www.ioactive.com/wp-content/uploads/pdfs/Hacking-Robots-Before-Skynet-Technical-Appendix.pdf" ] } ], "limitations": [ "The historical recovery-image identifier is not a blanket affected-range statement for all ROBOTIS products.", "An exposed management capability is not arbitrary remote code execution or evidence of Internet exposure.", "No current vendor fix or independent robot test." ], "mappings": { "emb3d": [ { "id": "TID-310", "name": "Remotely Accessible Unauthenticated Services", "url": "https://emb3d.mitre.org/threats/TID-310.html", "basis": "analyst-inference", "rationale": "Unauthenticated access to onboard actuator/motion-management functions matches this service trust boundary.", "officialCaseAttribution": false, "provenance": { "id": "TID-310", "name": "Remotely Accessible Unauthenticated Services", "url": "https://emb3d.mitre.org/threats/TID-310.html", "basis": "analyst_mapping", "rationale": "Unauthenticated access to onboard actuator/motion-management functions matches this service trust boundary.", "modelVersion": "2.0.1", "sourcePin": "MITRE/emb3d@0d7c25bb4e2928c516fb5811aaab9ff8bab2896c", "officialCaseAttribution": false } } ], "attack": [] }, "confidence": { "total": 68, "components": { "provenance": { "score": 19, "max": 20, "rationale": null }, "technicalEvidence": { "score": 26, "max": 35, "rationale": null }, "configurationSpecificity": { "score": 17, "max": 20, "rationale": null }, "independentCorroboration": { "score": 0, "max": 15, "rationale": null }, "followUpResolution": { "score": 6, "max": 10, "rationale": null } }, "rationale": "Original server implementation and concrete image identifier; no modern fix or independent dynamic reproduction." } }, { "id": "DR-026", "title": "Baxter and Sawyer: unauthenticated ROS management can reach motion and safety functions", "canonicalUrl": "https://www.ioactive.com/wp-content/uploads/pdfs/Hacking-Robots-Before-Skynet-Technical-Appendix.pdf", "strand": "drones-robotics", "scope": "device-interface", "publicationDate": null, "eventDate": "Historical report containing 2017 references; exact appendix release date not verified", "reviewDate": "2026-11-01", "dateNotes": null, "device": { "vendor": "Rethink Robotics", "models": [ "Baxter Research Robot", "Sawyer", "Baxter Manufacturing Robot", "Sawyer Manufacturing Robot" ], "firmwareVersions": [ "Baxter Research Robot SDK 1.2.0", "Sawyer SDK 5.0.4", "Baxter/Sawyer Manufacturing Robot v3.3.2 Intera SDK as listed in the section" ], "configuration": "ROS Master/RSDK shell network configuration and actuator/safety-control APIs; listed SDK/Intera versions are preserved as such." }, "access": { "class": "embedded-controller/network", "requirements": "Reachability to the robot's ROS Master under the reported network setup; physical access to exposed LAN ports is a possible connection route, not itself proof of unauthenticated privilege." }, "claim": "Baxter and Sawyer: unauthenticated ROS management can reach motion and safety functions", "outcome": "IOActive reports that a network peer can use ROS management APIs without authentication to control robot functions, with collision-safety suppression available through the exposed interface. It explicitly says firmware upgrade/downgrade still requires SSH and is not enabled by this particular weakness.", "evidenceStatus": "original-research-reported-control-and-safety-interface", "evidenceGroup": "reported-result", "hardwareBoundary": "Robot-controller software boundary to actuators and safety behavior, not a physical chip or debug-port exploit.", "mechanisms": [ "Remotely Accessible Unauthenticated Services" ], "sources": [ { "url": "https://www.ioactive.com/wp-content/uploads/pdfs/Hacking-Robots-Before-Skynet-Technical-Appendix.pdf", "title": "Microsoft Word - Hacking Robots Before Skynet - Technical Appendix.docx", "type": "original-technical-appendix-complete", "reviewedAt": "2026-11-01T14:11:49Z", "readStatus": "reviewed", "supports": "Versioned Baxter/Sawyer RSDK section and safety discussion; firmware-update exclusion retained.", "limitations": [], "provenance": { "sourceId": "DR-S32", "url": "https://www.ioactive.com/wp-content/uploads/pdfs/Hacking-Robots-Before-Skynet-Technical-Appendix.pdf", "title": "Microsoft Word - Hacking Robots Before Skynet - Technical Appendix.docx", "kind": "original-technical-appendix-complete", "published": null, "modified": null, "verifiedAt": "2026-11-01T14:11:49Z", "httpStatus": 200, "scrapeId": "01a19772-7256-719a-a1e1-0609b2a4817d", "claimSupport": "Versioned Baxter/Sawyer RSDK section and safety discussion; firmware-update exclusion retained.", "partialRead": null } } ], "followUp": [ { "question": "Does this unauthenticated ROS path also grant firmware update privileges?", "status": "resolved", "result": "No: original section explicitly requires SSH for upgrade/downgrade and excludes those actions from this flaw.", "sourceURLs": [ "https://www.ioactive.com/wp-content/uploads/pdfs/Hacking-Robots-Before-Skynet-Technical-Appendix.pdf" ] }, { "question": "Can listed SDK versions be treated as universal firmware ranges?", "status": "resolved", "result": "No: SDK/Intera identifiers are reproduced without converting them into a broader firmware applicability claim.", "sourceURLs": [ "https://www.ioactive.com/wp-content/uploads/pdfs/Hacking-Robots-Before-Skynet-Technical-Appendix.pdf" ] }, { "question": "Current correction/version applicability?", "status": "open", "result": "Unresolved in this bounded original-source review.", "sourceURLs": [] } ], "limitations": [ "The appendix and related IOActive report discuss historical patching, but a complete per-version remediation matrix was not verified here.", "Availability of safety-control APIs does not independently establish malicious deployment, physical injury or permanent safety-system defeat.", "A physical LAN port alone is not proof every attached system is vulnerable." ], "mappings": { "emb3d": [ { "id": "TID-310", "name": "Remotely Accessible Unauthenticated Services", "url": "https://emb3d.mitre.org/threats/TID-310.html", "basis": "analyst-inference", "rationale": "The reported onboard ROS management APIs permit sensitive robot actions without authenticating the remote peer.", "officialCaseAttribution": false, "provenance": { "id": "TID-310", "name": "Remotely Accessible Unauthenticated Services", "url": "https://emb3d.mitre.org/threats/TID-310.html", "basis": "analyst_mapping", "rationale": "The reported onboard ROS management APIs permit sensitive robot actions without authenticating the remote peer.", "modelVersion": "2.0.1", "sourcePin": "MITRE/emb3d@0d7c25bb4e2928c516fb5811aaab9ff8bab2896c", "officialCaseAttribution": false } } ], "attack": [] }, "confidence": { "total": 70, "components": { "provenance": { "score": 19, "max": 20, "rationale": null }, "technicalEvidence": { "score": 27, "max": 35, "rationale": null }, "configurationSpecificity": { "score": 17, "max": 20, "rationale": null }, "independentCorroboration": { "score": 0, "max": 15, "rationale": null }, "followUpResolution": { "score": 7, "max": 10, "rationale": null } }, "rationale": "Original version-scoped interface analysis with an explicit negative firmware-permission boundary; no independent present-day reproduction." } }, { "id": "LRRK-COM-001", "title": "STM32F1 protected-flash readout: original author demonstration", "canonicalUrl": "https://habr.com/ru/companies/ntc-vulkan/articles/483732/", "strand": "community", "scope": "hardware", "publicationDate": "2020-01-16", "eventDate": null, "reviewDate": "2026-11-01", "dateNotes": "Article displays 16 January 2020; experiments occurred before publication, exact event dates not provided.", "device": { "primary": "STM32F103RBT6 development board", "additional_author_test": "ST-LINK-V2.1 using STM32F103CBT6", "negative_transfer_test": "STM32F303RCT7 returned data inconsistent with the expected firmware", "firmware_revision": null, "scope": "Modified laboratory hardware, not a drone or a robot assessment." }, "access": "Direct physical access to a laboratory board and its power/programming connections; invasive preparation is described by the author but not reproduced here.", "claim": "The article reports reading protected flash from specific STM32F1 parts using voltage faults during the bootloader protection decision.", "outcome": "Authors report a protected-firmware readout demonstration and a replacement ST-LINK controller operating with the recovered firmware. They separately report that their STM32F303 test did not yield the expected content.", "evidenceStatus": "author_demonstration", "evidenceGroup": "demonstration", "hardwareBoundary": "Modified laboratory hardware, not a drone or a robot assessment.", "mechanisms": [ "voltage fault injection", "protected firmware readout" ], "sources": [ { "url": "https://habr.com/ru/companies/ntc-vulkan/articles/483732/", "title": "Считывание защищенной прошивки из флеш-памяти STM32F1xx с использованием ChipWhisperer / Хабр", "type": "original technical article", "reviewedAt": "2026-11-01T14:07:57Z", "readStatus": "reviewed", "supports": "Specific parts, readout outcome, linked demonstration and unsuccessful STM32F303 transfer test.", "limitations": [ "Public source reviewed for the scoped claim and/or linked-artifact context." ], "provenance": { "source_key": "habr_f1", "url": "https://habr.com/ru/companies/ntc-vulkan/articles/483732/", "title": "Считывание защищенной прошивки из флеш-памяти STM32F1xx с использованием ChipWhisperer / Хабр", "source_type": "original technical article", "supports": "Specific parts, readout outcome, linked demonstration and unsuccessful STM32F303 transfer test.", "reviewed_at": "2026-11-01T14:07:57Z", "scrape_id": "01a19769-e21f-74a8-9f53-c7b125021965", "http_status": 200, "captureRegistry": { "source_key": "habr_f1", "requested_url": "https://habr.com/ru/companies/ntc-vulkan/articles/483732/", "source_url": "https://habr.com/ru/companies/ntc-vulkan/articles/483732/", "title": "Считывание защищенной прошивки из флеш-памяти STM32F1xx с использованием ChipWhisperer / Хабр", "http_status": 200, "scrape_id": "01a19769-e21f-74a8-9f53-c7b125021965", "published_time": null, "modified_time": null, "credits_used": 1, "error": null, "full_text_retained_in_deliverable": false } } }, { "url": "https://forum.newae.com/t/breaking-crp-level-1-stm32f103/1799.json", "title": null, "type": "public forum original discussion", "reviewedAt": "2026-11-01T14:07:57Z", "readStatus": "partial", "supports": "A forum participant points to this article as their successful STM32F103 work; this is not independent reproduction.", "limitations": [ "First 20 of 24 public topic-stream posts; four remaining IDs retrieved separately." ], "provenance": { "source_key": "f103_json", "url": "https://forum.newae.com/t/breaking-crp-level-1-stm32f103/1799.json", "title": null, "source_type": "public forum original discussion", "supports": "A forum participant points to this article as their successful STM32F103 work; this is not independent reproduction.", "reviewed_at": "2026-11-01T14:07:57Z", "scrape_id": "01a19769-2c8e-709b-beaa-c878d7b907cd", "http_status": 200, "captureRegistry": { "source_key": "f103_json", "requested_url": "https://forum.newae.com/t/breaking-crp-level-1-stm32f103/1799.json", "source_url": "https://forum.newae.com/t/breaking-crp-level-1-stm32f103/1799.json", "title": null, "http_status": 200, "scrape_id": "01a19769-2c8e-709b-beaa-c878d7b907cd", "published_time": null, "modified_time": null, "credits_used": 1, "error": null, "full_text_retained_in_deliverable": false } } } ], "followUp": { "actions": [ "Read the source linked by the NewAE success claim instead of relying on the forum summary.", "Checked the article's results and explicit unsuccessful experiment on another STM32 family." ], "results": [ "Article supplies concrete part numbers, bootloader analysis and an author-reported replacement-controller validation." ], "contradictions": [ "The article's success does not transfer to its tested STM32F303 configuration." ], "limitations": [ "Linked video and images were discovered in the article; no physical reproduction was performed.", "No independent reproduction of the exact parts/configuration was verified.", "Do not reuse the article's broad family or protection-level statements without vendor-specific checking." ] }, "limitations": [ "Linked video and images were discovered in the article; no physical reproduction was performed.", "No independent reproduction of the exact parts/configuration was verified.", "Do not reuse the article's broad family or protection-level statements without vendor-specific checking." ], "mappings": { "emb3d": [ { "id": "TID-105", "name": "Hardware Fault Injection – Control Flow Modification", "url": "https://emb3d.mitre.org/threats/TID-105.html", "basis": "analyst-inference", "rationale": "The reported voltage fault bypasses a protection decision in processor control flow.", "officialCaseAttribution": false, "scope": "reported mechanism", "provenance": { "id": "TID-105", "title": "Hardware Fault Injection – Control Flow Modification", "url": "https://emb3d.mitre.org/threats/TID-105.html", "mapping_basis": "analyst_inference", "scope": "reported mechanism", "rationale": "The reported voltage fault bypasses a protection decision in processor control flow.", "verified_against": "MITRE official EMB3D repository commit 0d7c25bb4e2928c516fb5811aaab9ff8bab2896c, threat description read 2026-11-01", "official_case_mapping": false } }, { "id": "TID-115", "name": "Firmware/Data Extraction via Hardware Interface", "url": "https://emb3d.mitre.org/threats/TID-115.html", "basis": "analyst-inference", "rationale": "The reported consequence is firmware extraction through a device programming/bootloader interface.", "officialCaseAttribution": false, "scope": "reported mechanism", "provenance": { "id": "TID-115", "title": "Firmware/Data Extraction via Hardware Interface", "url": "https://emb3d.mitre.org/threats/TID-115.html", "mapping_basis": "analyst_inference", "scope": "reported mechanism", "rationale": "The reported consequence is firmware extraction through a device programming/bootloader interface.", "verified_against": "MITRE official EMB3D repository commit 0d7c25bb4e2928c516fb5811aaab9ff8bab2896c, threat description read 2026-11-01", "official_case_mapping": false } } ], "attack": [] }, "confidence": { "total": 74, "components": { "provenance": { "score": 18, "max": 20, "rationale": null }, "technicalEvidence": { "score": 28, "max": 35, "rationale": null }, "configurationSpecificity": { "score": 20, "max": 20, "rationale": null }, "independentCorroboration": { "score": 0, "max": 15, "rationale": null }, "followUpResolution": { "score": 8, "max": 10, "rationale": null } }, "rationale": "Strong first-party technical report with exact parts and a reported functional check, but no independently verified reproduction; forum cross-post is the same claim." } }, { "id": "LRRK-COM-002", "title": "STM32F2/F4 readout reports with unintended flash erasure", "canonicalUrl": "https://forum.newae.com/t/breaking-crp-level-1-stm32f103/1799/20", "strand": "community", "scope": "hardware", "publicationDate": "2021-11-04", "eventDate": null, "reviewDate": "2026-11-01", "dateNotes": "Thread began 2020-02-07; selected first-person F2/F4 result is post 20 dated 2021-11-04. Later replies were checked through 2024-08-03.", "device": { "reported_families": [ "STM32F2", "STM32F4" ], "exact_parts": null, "die_revisions": null, "firmware_revisions": null, "scope": "Community laboratory reports; no drone/robot model identified." }, "access": "Physical access to target boards and laboratory fault-injection equipment.", "claim": "A participant reports reading protected flash in blocks from STM32F2/F4 targets while also triggering unintended erasure. A different participant later reports obtaining needed firmware material through a combined hardware/software investigation.", "outcome": "Reported partial readouts are accompanied by destructive side effects, unstable behavior and configuration-dependent results. No exact-part repeatability or complete verified firmware image was independently established.", "evidenceStatus": "community_author_reported_result", "evidenceGroup": "reported-result", "hardwareBoundary": "Community laboratory reports; no drone/robot model identified.", "mechanisms": [ "voltage fault injection", "protected firmware readout" ], "sources": [ { "url": "https://forum.newae.com/t/breaking-crp-level-1-stm32f103/1799.json", "title": null, "type": "public forum original discussion", "reviewedAt": "2026-11-01T14:07:57Z", "readStatus": "partial", "supports": "Posts 7, 13, 19 and 20 describe partial readout, instability and erasure.", "limitations": [ "First 20 of 24 public topic-stream posts; four remaining IDs retrieved separately." ], "provenance": { "source_key": "f103_json", "url": "https://forum.newae.com/t/breaking-crp-level-1-stm32f103/1799.json", "title": null, "source_type": "public forum original discussion", "supports": "Posts 7, 13, 19 and 20 describe partial readout, instability and erasure.", "reviewed_at": "2026-11-01T14:07:57Z", "scrape_id": "01a19769-2c8e-709b-beaa-c878d7b907cd", "http_status": 200, "captureRegistry": { "source_key": "f103_json", "requested_url": "https://forum.newae.com/t/breaking-crp-level-1-stm32f103/1799.json", "source_url": "https://forum.newae.com/t/breaking-crp-level-1-stm32f103/1799.json", "title": null, "http_status": 200, "scrape_id": "01a19769-2c8e-709b-beaa-c878d7b907cd", "published_time": null, "modified_time": null, "credits_used": 1, "error": null, "full_text_retained_in_deliverable": false } } }, { "url": "https://forum.newae.com/t/1799/posts.json?post_ids%5B%5D=7516&post_ids%5B%5D=7518&post_ids%5B%5D=10043&post_ids%5B%5D=13728", "title": null, "type": "public forum later replies", "reviewedAt": "2026-11-01T14:07:57Z", "readStatus": "partial", "supports": "Post 22 reports obtaining firmware material; posts 23–25 retain unresolved repeatability and artifact questions.", "limitations": [ "All four previously omitted post IDs retrieved, including late updates." ], "provenance": { "source_key": "f103_tail", "url": "https://forum.newae.com/t/1799/posts.json?post_ids%5B%5D=7516&post_ids%5B%5D=7518&post_ids%5B%5D=10043&post_ids%5B%5D=13728", "title": null, "source_type": "public forum later replies", "supports": "Post 22 reports obtaining firmware material; posts 23–25 retain unresolved repeatability and artifact questions.", "reviewed_at": "2026-11-01T14:07:57Z", "scrape_id": "01a19769-e277-7013-8015-51d50b58c9d3", "http_status": 200, "captureRegistry": { "source_key": "f103_tail", "requested_url": "https://forum.newae.com/t/1799/posts.json?post_ids%5B%5D=7516&post_ids%5B%5D=7518&post_ids%5B%5D=10043&post_ids%5B%5D=13728", "source_url": "https://forum.newae.com/t/1799/posts.json?post_ids%5B%5D=7516&post_ids%5B%5D=7518&post_ids%5B%5D=10043&post_ids%5B%5D=13728", "title": null, "http_status": 200, "scrape_id": "01a19769-e277-7013-8015-51d50b58c9d3", "published_time": null, "modified_time": null, "credits_used": 1, "error": null, "full_text_retained_in_deliverable": false } } } ], "followUp": { "actions": [ "Used the forum's public JSON endpoint because the HTML scrape omitted post bodies.", "Retrieved all four remaining post IDs and checked the end of the discussion." ], "results": [ "Reviewed 24 visible posts represented in the topic stream, including late follow-ups.", "Success reports do not remove the reported erasure/data-integrity risks." ], "contradictions": [ "A positive protocol response or returned bytes alone does not establish a valid complete dump." ], "limitations": [ "Pseudonymous first-person reports; exact parts, target firmware and recovered artifacts are not independently verified.", "A second poster's related result is not a controlled reproduction of the first configuration.", "No claim that this method applies to all STM32F2/F4 devices." ] }, "limitations": [ "Pseudonymous first-person reports; exact parts, target firmware and recovered artifacts are not independently verified.", "A second poster's related result is not a controlled reproduction of the first configuration.", "No claim that this method applies to all STM32F2/F4 devices." ], "mappings": { "emb3d": [ { "id": "TID-105", "name": "Hardware Fault Injection – Control Flow Modification", "url": "https://emb3d.mitre.org/threats/TID-105.html", "basis": "analyst-inference", "rationale": "Reported faults alter a read-protection decision; the mapping concerns the mechanism claimed in these reports.", "officialCaseAttribution": false, "scope": "reported mechanism", "provenance": { "id": "TID-105", "title": "Hardware Fault Injection – Control Flow Modification", "url": "https://emb3d.mitre.org/threats/TID-105.html", "mapping_basis": "analyst_inference", "scope": "reported mechanism", "rationale": "Reported faults alter a read-protection decision; the mapping concerns the mechanism claimed in these reports.", "verified_against": "MITRE official EMB3D repository commit 0d7c25bb4e2928c516fb5811aaab9ff8bab2896c, threat description read 2026-11-01", "official_case_mapping": false } }, { "id": "TID-115", "name": "Firmware/Data Extraction via Hardware Interface", "url": "https://emb3d.mitre.org/threats/TID-115.html", "basis": "analyst-inference", "rationale": "Reported consequence is firmware readout through a hardware-connected programming/bootloader interface.", "officialCaseAttribution": false, "scope": "reported mechanism", "provenance": { "id": "TID-115", "title": "Firmware/Data Extraction via Hardware Interface", "url": "https://emb3d.mitre.org/threats/TID-115.html", "mapping_basis": "analyst_inference", "scope": "reported mechanism", "rationale": "Reported consequence is firmware readout through a hardware-connected programming/bootloader interface.", "verified_against": "MITRE official EMB3D repository commit 0d7c25bb4e2928c516fb5811aaab9ff8bab2896c, threat description read 2026-11-01", "official_case_mapping": false } } ], "attack": [] }, "confidence": { "total": 52, "components": { "provenance": { "score": 14, "max": 20, "rationale": null }, "technicalEvidence": { "score": 19, "max": 35, "rationale": null }, "configurationSpecificity": { "score": 10, "max": 20, "rationale": null }, "independentCorroboration": { "score": 0, "max": 15, "rationale": null }, "followUpResolution": { "score": 9, "max": 10, "rationale": null } }, "rationale": "Detailed historical first-person results and failure modes, but no exact configuration or artifact validation; all independent-reproduction points are withheld." } }, { "id": "LRRK-COM-003", "title": "PicoGlitcher STM32F4 result and a separately documented STM32F401 example", "canonicalUrl": "https://hackaday.io/project/196357/log/231745-july-8-2024-later-this-day-glitches", "strand": "community", "scope": "hardware", "publicationDate": "2024-08-05", "eventDate": "2024-07-08", "reviewDate": "2026-11-01", "dateNotes": "The log title says July 8; its displayed posting timestamp is August 5. Event date follows the title and is author-asserted, not independently verified. Current documentation has no verified publication date.", "device": { "log_test": "STM32F4 microcontroller, exact part unspecified, RDP level 1 reported", "separate_documentation_example": "STM32F401 Black Pill board", "tool": "PicoGlitcher", "scope": "The generic F4 log must not be silently equated to the later F401 documentation example." }, "access": "Physical laboratory access to target board and fault-injection hardware.", "claim": "An original project log reports a positive bootloader response under readout protection; current author documentation separately shows a STM32F401 readout example and supplied implementation.", "outcome": "The log itself establishes an author-reported positive protocol response, not a verified complete firmware dump. The separate F401 documentation claims a memory dump and documents unintended erasure and invalid-data outcomes.", "evidenceStatus": "author_demonstration_limited_result", "evidenceGroup": "demonstration", "hardwareBoundary": "The generic F4 log must not be silently equated to the later F401 documentation example.", "mechanisms": [ "voltage fault injection", "protected firmware readout" ], "sources": [ { "url": "https://hackaday.io/project/196357/log/231745-july-8-2024-later-this-day-glitches", "title": "July 8 2024, later this day: Glitches! | Details | Hackaday.io", "type": "original project log", "reviewedAt": "2026-11-01T14:07:57Z", "readStatus": "reviewed", "supports": "STM32F4 RDP1 positive-response claim and differing event/posting dates.", "limitations": [ "Public source reviewed for the scoped claim and/or linked-artifact context." ], "provenance": { "source_key": "pico_log", "url": "https://hackaday.io/project/196357/log/231745-july-8-2024-later-this-day-glitches", "title": "July 8 2024, later this day: Glitches! | Details | Hackaday.io", "source_type": "original project log", "supports": "STM32F4 RDP1 positive-response claim and differing event/posting dates.", "reviewed_at": "2026-11-01T14:07:57Z", "scrape_id": "01a19767-c8f8-71d8-bebe-98a000201149", "http_status": 200, "captureRegistry": { "source_key": "pico_log", "requested_url": "https://hackaday.io/project/196357/log/231745-july-8-2024-later-this-day-glitches", "source_url": "https://hackaday.io/project/196357/log/231745-july-8-2024-later-this-day-glitches", "title": "July 8 2024, later this day: Glitches! | Details | Hackaday.io", "http_status": 200, "scrape_id": "01a19767-c8f8-71d8-bebe-98a000201149", "published_time": null, "modified_time": null, "credits_used": 1, "error": null, "full_text_retained_in_deliverable": false } } }, { "url": "https://fault-injection-library.readthedocs.io/en/latest/examples/", "title": "Examples - PicoGlitcher / findus", "type": "author project documentation", "reviewedAt": "2026-11-01T14:07:57Z", "readStatus": "reviewed", "supports": "Explicit STM32F401 board, reported memory-dump example and failure cases.", "limitations": [ "Public source reviewed for the scoped claim and/or linked-artifact context." ], "provenance": { "source_key": "pico_examples", "url": "https://fault-injection-library.readthedocs.io/en/latest/examples/", "title": "Examples - PicoGlitcher / findus", "source_type": "author project documentation", "supports": "Explicit STM32F401 board, reported memory-dump example and failure cases.", "reviewed_at": "2026-11-01T14:07:57Z", "scrape_id": "01a1976a-edd2-779f-b2ef-2c348d7e40a0", "http_status": 200, "captureRegistry": { "source_key": "pico_examples", "requested_url": "https://fault-injection-library.readthedocs.io/en/latest/examples/", "source_url": "https://fault-injection-library.readthedocs.io/en/latest/examples/", "title": "Examples - PicoGlitcher / findus", "http_status": 200, "scrape_id": "01a1976a-edd2-779f-b2ef-2c348d7e40a0", "published_time": null, "modified_time": null, "credits_used": 1, "error": null, "full_text_retained_in_deliverable": false } } }, { "url": "https://github.com/MKesenheimer/fault-injection-library/blob/master/projects/stm32f40x/stm32f4-glitching.py", "title": "fault-injection-library/projects/stm32f40x/stm32f4-glitching.py at master · MKesenheimer/fault-injection-library · GitHub", "type": "author source artifact", "reviewedAt": "2026-11-01T14:07:57Z", "readStatus": "reviewed", "supports": "Linked implementation exists at the actual stm32f40x path.", "limitations": [ "Source artifact availability checked; operational implementation is not copied into deliverables or executed." ], "provenance": { "source_key": "pico_f401_artifact", "url": "https://github.com/MKesenheimer/fault-injection-library/blob/master/projects/stm32f40x/stm32f4-glitching.py", "title": "fault-injection-library/projects/stm32f40x/stm32f4-glitching.py at master · MKesenheimer/fault-injection-library · GitHub", "source_type": "author source artifact", "supports": "Linked implementation exists at the actual stm32f40x path.", "reviewed_at": "2026-11-01T14:07:57Z", "scrape_id": "01a1976b-997c-777a-9a4c-0885849524aa", "http_status": 200, "captureRegistry": { "source_key": "pico_f401_artifact", "requested_url": "https://github.com/MKesenheimer/fault-injection-library/blob/master/projects/stm32f40x/stm32f4-glitching.py", "source_url": "https://github.com/MKesenheimer/fault-injection-library/blob/master/projects/stm32f40x/stm32f4-glitching.py", "title": "fault-injection-library/projects/stm32f40x/stm32f4-glitching.py at master · MKesenheimer/fault-injection-library · GitHub", "http_status": 200, "scrape_id": "01a1976b-997c-777a-9a4c-0885849524aa", "published_time": null, "modified_time": null, "credits_used": 1, "error": null, "full_text_retained_in_deliverable": false } } }, { "url": "https://github.com/MKesenheimer/fault-injection-library", "title": "GitHub - MKesenheimer/fault-injection-library: Python library to perform fault-injection attacks on microcontrollers · GitHub", "type": "author repository", "reviewedAt": "2026-11-01T14:07:57Z", "readStatus": "reviewed", "supports": "Source repository and project structure exist.", "limitations": [ "Public source reviewed for the scoped claim and/or linked-artifact context." ], "provenance": { "source_key": "pico_root", "url": "https://github.com/MKesenheimer/fault-injection-library", "title": "GitHub - MKesenheimer/fault-injection-library: Python library to perform fault-injection attacks on microcontrollers · GitHub", "source_type": "author repository", "supports": "Source repository and project structure exist.", "reviewed_at": "2026-11-01T14:07:57Z", "scrape_id": "01a19769-e296-7456-92c3-2509856a44b1", "http_status": 200, "captureRegistry": { "source_key": "pico_root", "requested_url": "https://github.com/MKesenheimer/fault-injection-library", "source_url": "https://github.com/MKesenheimer/fault-injection-library", "title": "GitHub - MKesenheimer/fault-injection-library: Python library to perform fault-injection attacks on microcontrollers · GitHub", "http_status": 200, "scrape_id": "01a19769-e296-7456-92c3-2509856a44b1", "published_time": null, "modified_time": null, "credits_used": 1, "error": null, "full_text_retained_in_deliverable": false } } } ], "followUp": { "actions": [ "Read the dated log instead of treating the whole project page as one experiment.", "Followed the author documentation to the actual linked STM32F401 artifact.", "Checked for independent follow-up and explicit failure cases." ], "results": [ "Author documentation distinguishes successful protocol response from returned memory data and records possible erasure/invalid data.", "A guessed repository directory was absent; the actual source link was resolved from the documentation." ], "contradictions": [ "The log's generic F4 identity and the documentation's F401 identity are not evidence of one identical test." ], "limitations": [ "No independent reproduction was verified.", "Linked figures were not validated as raw captures or as complete binary artifacts.", "Versionless documentation can change; exact target firmware and die revision remain unknown." ] }, "limitations": [ "No independent reproduction was verified.", "Linked figures were not validated as raw captures or as complete binary artifacts.", "Versionless documentation can change; exact target firmware and die revision remain unknown." ], "mappings": { "emb3d": [ { "id": "TID-105", "name": "Hardware Fault Injection – Control Flow Modification", "url": "https://emb3d.mitre.org/threats/TID-105.html", "basis": "analyst-inference", "rationale": "The described voltage fault targets a readout-protection decision.", "officialCaseAttribution": false, "scope": "reported mechanism", "provenance": { "id": "TID-105", "title": "Hardware Fault Injection – Control Flow Modification", "url": "https://emb3d.mitre.org/threats/TID-105.html", "mapping_basis": "analyst_inference", "scope": "reported mechanism", "rationale": "The described voltage fault targets a readout-protection decision.", "verified_against": "MITRE official EMB3D repository commit 0d7c25bb4e2928c516fb5811aaab9ff8bab2896c, threat description read 2026-11-01", "official_case_mapping": false } }, { "id": "TID-115", "name": "Firmware/Data Extraction via Hardware Interface", "url": "https://emb3d.mitre.org/threats/TID-115.html", "basis": "analyst-inference", "rationale": "The documentation's claimed consequence is firmware/memory extraction via the bootloader interface.", "officialCaseAttribution": false, "scope": "reported mechanism", "provenance": { "id": "TID-115", "title": "Firmware/Data Extraction via Hardware Interface", "url": "https://emb3d.mitre.org/threats/TID-115.html", "mapping_basis": "analyst_inference", "scope": "reported mechanism", "rationale": "The documentation's claimed consequence is firmware/memory extraction via the bootloader interface.", "verified_against": "MITRE official EMB3D repository commit 0d7c25bb4e2928c516fb5811aaab9ff8bab2896c, threat description read 2026-11-01", "official_case_mapping": false } } ], "attack": [] }, "confidence": { "total": 66, "components": { "provenance": { "score": 18, "max": 20, "rationale": null }, "technicalEvidence": { "score": 25, "max": 35, "rationale": null }, "configurationSpecificity": { "score": 14, "max": 20, "rationale": null }, "independentCorroboration": { "score": 0, "max": 15, "rationale": null }, "followUpResolution": { "score": 9, "max": 10, "rationale": null } }, "rationale": "First-party log, detailed project documentation and retrieved artifact support a scoped laboratory claim; generic and exact-part experiments remain separate." } }, { "id": "LRRK-COM-004", "title": "STM32G0 RDP1 attempt: unsuccessful public discussion", "canonicalUrl": "https://forum.newae.com/t/stm32g0-rdp-level-1-bypass/6375", "strand": "community", "scope": "hardware", "publicationDate": "2026-04-28", "eventDate": null, "reviewDate": "2026-11-01", "dateNotes": "Five visible posts reviewed through 2026-05-13.", "device": { "target": "STM32G0 family, exact part unspecified", "tool": "ChipWhisperer Husky", "reported_obstacle": "Author reports no accessible internal-regulator output pin.", "firmware_revision": null }, "access": "Physical access to a target microcontroller and laboratory equipment.", "claim": "A participant reports that an attempted transfer of an STM32 voltage-glitch approach is not working on their STM32G0 configuration.", "outcome": "No successful readout or bypass is reported in the reviewed thread. Replies discuss hardware differences and other possibilities; none establish success.", "evidenceStatus": "discussion_unsuccessful_attempt", "evidenceGroup": "discussion", "hardwareBoundary": null, "mechanisms": [ "voltage fault injection" ], "sources": [ { "url": "https://forum.newae.com/t/stm32g0-rdp-level-1-bypass/6375.json", "title": null, "type": "public forum original discussion", "reviewedAt": "2026-11-01T14:07:57Z", "readStatus": "reviewed", "supports": "Complete five-post topic, including unsuccessful attempt and advice.", "limitations": [ "All five visible posts in public topic stream reviewed." ], "provenance": { "source_key": "g0_json", "url": "https://forum.newae.com/t/stm32g0-rdp-level-1-bypass/6375.json", "title": null, "source_type": "public forum original discussion", "supports": "Complete five-post topic, including unsuccessful attempt and advice.", "reviewed_at": "2026-11-01T14:07:57Z", "scrape_id": "01a19769-2cd9-72d8-a2cc-93896e56ea83", "http_status": 200, "captureRegistry": { "source_key": "g0_json", "requested_url": "https://forum.newae.com/t/stm32g0-rdp-level-1-bypass/6375.json", "source_url": "https://forum.newae.com/t/stm32g0-rdp-level-1-bypass/6375.json", "title": null, "http_status": 200, "scrape_id": "01a19769-2cd9-72d8-a2cc-93896e56ea83", "published_time": null, "modified_time": null, "credits_used": 1, "error": null, "full_text_retained_in_deliverable": false } } }, { "url": "https://chipwhisperer.readthedocs.io/en/latest/cw_tips_tricks/advanced_usage/regulators.html", "title": "Targets with Internal Regulators — ChipWhisperer Documentation", "type": "tool vendor documentation", "reviewedAt": "2026-11-01T14:07:57Z", "readStatus": "reviewed", "supports": "General internal-regulator considerations; not proof of STM32G0 resistance or of a successful attack.", "limitations": [ "Public source reviewed for the scoped claim and/or linked-artifact context." ], "provenance": { "source_key": "regulator_doc", "url": "https://chipwhisperer.readthedocs.io/en/latest/cw_tips_tricks/advanced_usage/regulators.html", "title": "Targets with Internal Regulators — ChipWhisperer Documentation", "source_type": "tool vendor documentation", "supports": "General internal-regulator considerations; not proof of STM32G0 resistance or of a successful attack.", "reviewed_at": "2026-11-01T14:07:57Z", "scrape_id": "01a1976b-999f-7261-a68a-8e47fb04baf6", "http_status": 200, "captureRegistry": { "source_key": "regulator_doc", "requested_url": "https://chipwhisperer.readthedocs.io/en/latest/cw_tips_tricks/advanced_usage/regulators.html", "source_url": "https://chipwhisperer.readthedocs.io/en/latest/cw_tips_tricks/advanced_usage/regulators.html", "title": "Targets with Internal Regulators — ChipWhisperer Documentation", "http_status": 200, "scrape_id": "01a1976b-999f-7261-a68a-8e47fb04baf6", "published_time": null, "modified_time": null, "credits_used": 1, "error": null, "full_text_retained_in_deliverable": false } } }, { "url": "https://www.anvilsecure.com/blog/glitching-stm32-read-out-protection-with-voltage-fault-injection.html", "title": "Glitching STM32 Read Out Protection", "type": "original report linked by forum poster", "reviewedAt": "2026-11-01T14:07:57Z", "readStatus": "reviewed", "supports": "The source experiment is STM32F401CC, not the forum's unspecified STM32G0.", "limitations": [ "Same public URL retrieved with main-content filtering disabled; substantive article recovered and reviewed. Distinct extraction-mode follow-up, not an uncertain paid retry." ], "provenance": { "source_key": "anvil_full", "url": "https://www.anvilsecure.com/blog/glitching-stm32-read-out-protection-with-voltage-fault-injection.html", "title": "Glitching STM32 Read Out Protection", "source_type": "original report linked by forum poster", "supports": "The source experiment is STM32F401CC, not the forum's unspecified STM32G0.", "reviewed_at": "2026-11-01T14:07:57Z", "scrape_id": "01a1976e-62a1-75da-b03a-e19e9319ec6b", "http_status": 200, "captureRegistry": { "source_key": "anvil_full", "requested_url": "https://www.anvilsecure.com/blog/glitching-stm32-read-out-protection-with-voltage-fault-injection.html", "source_url": "https://www.anvilsecure.com/blog/glitching-stm32-read-out-protection-with-voltage-fault-injection.html", "title": "Glitching STM32 Read Out Protection", "http_status": 200, "scrape_id": "01a1976e-62a1-75da-b03a-e19e9319ec6b", "published_time": "2025-04-18T11:09:25+00:00", "modified_time": "2025-04-19T05:46:59+00:00", "credits_used": 1, "error": null, "full_text_retained_in_deliverable": false } } } ], "followUp": { "actions": [ "Retrieved the complete public topic JSON to inspect replies hidden in the HTML scrape.", "Read the linked regulator documentation and distinguished general guidance from a device-specific result." ], "results": [ "No later success appears in the five-post topic stream.", "The linked Anvil report was read and explicitly concerns STM32F401CC with dummy test firmware; it is a different configuration." ], "contradictions": [], "limitations": [ "An unsuccessful attempt does not establish that the device is resistant.", "The cited regulator document primarily discusses measurement access and does not validate this exact attempted fault-injection configuration.", "No exact STM32G0 part or firmware revision is supplied." ] }, "limitations": [ "An unsuccessful attempt does not establish that the device is resistant.", "The cited regulator document primarily discusses measurement access and does not validate this exact attempted fault-injection configuration.", "No exact STM32G0 part or firmware revision is supplied." ], "mappings": { "emb3d": [ { "id": "TID-105", "name": "Hardware Fault Injection – Control Flow Modification", "url": "https://emb3d.mitre.org/threats/TID-105.html", "basis": "analyst-inference", "rationale": "The discussed intended mechanism is a voltage-fault bypass of a readout decision.", "officialCaseAttribution": false, "scope": "attempted mechanism only", "provenance": { "id": "TID-105", "title": "Hardware Fault Injection – Control Flow Modification", "url": "https://emb3d.mitre.org/threats/TID-105.html", "mapping_basis": "analyst_inference", "scope": "attempted mechanism only", "rationale": "The discussed intended mechanism is a voltage-fault bypass of a readout decision.", "verified_against": "MITRE official EMB3D repository commit 0d7c25bb4e2928c516fb5811aaab9ff8bab2896c, threat description read 2026-11-01", "official_case_mapping": false } } ], "attack": [] }, "confidence": { "total": 41, "components": { "provenance": { "score": 14, "max": 20, "rationale": null }, "technicalEvidence": { "score": 8, "max": 35, "rationale": null }, "configurationSpecificity": { "score": 9, "max": 20, "rationale": null }, "independentCorroboration": { "score": 0, "max": 15, "rationale": null }, "followUpResolution": { "score": 10, "max": 10, "rationale": null } }, "rationale": "Confidence concerns the narrow fact of an unresolved public attempt, not the feasibility or impossibility of bypass." } }, { "id": "LRRK-COM-005", "title": "Clock-glitch laboratory support thread with ambiguous success wording", "canonicalUrl": "https://forum.newae.com/t/cw1200-stm32f303-cw308t-clock-glitching-to-bypass-password/3091", "strand": "community", "scope": "hardware", "publicationDate": "2022-03-14", "eventDate": null, "reviewDate": "2026-11-01", "dateNotes": "All 18 visible posts in the topic stream were reviewed through 2022-03-21.", "device": { "clock_lab": "CW1200 capture hardware, STM32F303, CW308 target", "later_distinct_experiment": "PSOC62 side-channel exercise", "scope": "Educational labs and capture-firmware troubleshooting, not a production access-control bypass." }, "access": "Physical access to the educational target and capture setup.", "claim": "The thread discusses a password-bypass clock-glitch lab, successful glitches in a preceding lab, capture-firmware faults and a later separate side-channel exercise.", "outcome": "Some replies report that work succeeded after support, but the public text does not supply a complete artifact proving the titled password bypass. The last success message belongs to a discussion that had shifted to a separate side-channel exercise.", "evidenceStatus": "discussion_tooling_and_lab", "evidenceGroup": "discussion", "hardwareBoundary": "Educational labs and capture-firmware troubleshooting, not a production access-control bypass.", "mechanisms": [ "clock fault injection", "educational side-channel analysis" ], "sources": [ { "url": "https://forum.newae.com/t/cw1200-stm32f303-cw308t-clock-glitching-to-bypass-password/3091.json", "title": null, "type": "public forum original discussion", "reviewedAt": "2026-11-01T14:07:57Z", "readStatus": "reviewed", "supports": "Complete topic lets the separate glitch, firmware and side-channel conversations be distinguished.", "limitations": [ "All 18 visible posts in public topic stream reviewed; absent post numbers are not reconstructed." ], "provenance": { "source_key": "clock_json", "url": "https://forum.newae.com/t/cw1200-stm32f303-cw308t-clock-glitching-to-bypass-password/3091.json", "title": null, "source_type": "public forum original discussion", "supports": "Complete topic lets the separate glitch, firmware and side-channel conversations be distinguished.", "reviewed_at": "2026-11-01T14:07:57Z", "scrape_id": "01a19769-2d30-74a7-b91e-eee9949bf5b2", "http_status": 200, "captureRegistry": { "source_key": "clock_json", "requested_url": "https://forum.newae.com/t/cw1200-stm32f303-cw308t-clock-glitching-to-bypass-password/3091.json", "source_url": "https://forum.newae.com/t/cw1200-stm32f303-cw308t-clock-glitching-to-bypass-password/3091.json", "title": null, "http_status": 200, "scrape_id": "01a19769-2d30-74a7-b91e-eee9949bf5b2", "published_time": null, "modified_time": null, "credits_used": 1, "error": null, "full_text_retained_in_deliverable": false } } } ], "followUp": { "actions": [ "Read the complete topic JSON rather than relying on the title or isolated success message.", "Checked preceding messages to identify which experiment each success reply referred to." ], "results": [ "Avoided upgrading a firmware-fix or side-channel success reply into a demonstrated clock-based authentication bypass." ], "contradictions": [ "Thread title and isolated success text do not establish a single demonstrated outcome." ], "limitations": [ "Some post numbers are absent from the public stream; their contents are not reconstructed.", "No exact test firmware, build or independently verified bypass artifact.", "The separate PSOC62 exercise must not be attributed to STM32F303 clock glitching." ] }, "limitations": [ "Some post numbers are absent from the public stream; their contents are not reconstructed.", "No exact test firmware, build or independently verified bypass artifact.", "The separate PSOC62 exercise must not be attributed to STM32F303 clock glitching." ], "mappings": { "emb3d": [ { "id": "TID-105", "name": "Hardware Fault Injection – Control Flow Modification", "url": "https://emb3d.mitre.org/threats/TID-105.html", "basis": "analyst-inference", "rationale": "Clock-fault control-flow bypass is the intended lab mechanism; this is a conceptual mapping rather than a proven production attack.", "officialCaseAttribution": false, "scope": "discussed educational mechanism", "provenance": { "id": "TID-105", "title": "Hardware Fault Injection – Control Flow Modification", "url": "https://emb3d.mitre.org/threats/TID-105.html", "mapping_basis": "analyst_inference", "scope": "discussed educational mechanism", "rationale": "Clock-fault control-flow bypass is the intended lab mechanism; this is a conceptual mapping rather than a proven production attack.", "verified_against": "MITRE official EMB3D repository commit 0d7c25bb4e2928c516fb5811aaab9ff8bab2896c, threat description read 2026-11-01", "official_case_mapping": false } } ], "attack": [] }, "confidence": { "total": 47, "components": { "provenance": { "score": 14, "max": 20, "rationale": null }, "technicalEvidence": { "score": 9, "max": 35, "rationale": null }, "configurationSpecificity": { "score": 16, "max": 20, "rationale": null }, "independentCorroboration": { "score": 0, "max": 15, "rationale": null }, "followUpResolution": { "score": 8, "max": 10, "rationale": null } }, "rationale": "Detailed setup and complete visible context, but outcome wording is ambiguous and the thread mixes separate exercises." } }, { "id": "LRRK-COM-006", "title": "STM32F415 hardware-AES discussion and an unresolved later reproduction", "canonicalUrl": "https://forum.newae.com/t/stm32f415-hardware-crypto/2295", "strand": "community", "scope": "hardware", "publicationDate": "2021-02-12", "eventDate": null, "reviewDate": "2026-11-01", "dateNotes": "All 23 visible posts checked, including follow-ups through 2025-02-04.", "device": { "target": "STM32F415 hardware AES discussed; CW308 STM32F4 setup in later posts", "exact_later_mcu": null, "target_firmware_revision": null, "scope": "Educational/vendor-support context." }, "access": "Physical laboratory power-trace acquisition and access to the target test interface.", "claim": "Maintainer replies describe attacks on unmasked hardware AES and prior partial key recovery. A later participant's reproduction remains unresolved in the thread.", "outcome": "The discussion is useful background and contains a first-party historical partial-recovery claim, but the later participant does not demonstrate successful key recovery.", "evidenceStatus": "discussion_maintainer_claim_and_unresolved_reproduction", "evidenceGroup": "discussion", "hardwareBoundary": "Educational/vendor-support context.", "mechanisms": [ "power side-channel analysis" ], "sources": [ { "url": "https://forum.newae.com/t/stm32f415-hardware-crypto/2295.json", "title": null, "type": "public forum original discussion", "reviewedAt": "2026-11-01T14:07:57Z", "readStatus": "partial", "supports": "Maintainer leakage-model explanation and limited historical recovery claim.", "limitations": [ "First 20 of 23 public topic-stream posts; three remaining IDs retrieved separately." ], "provenance": { "source_key": "power_json", "url": "https://forum.newae.com/t/stm32f415-hardware-crypto/2295.json", "title": null, "source_type": "public forum original discussion", "supports": "Maintainer leakage-model explanation and limited historical recovery claim.", "reviewed_at": "2026-11-01T14:07:57Z", "scrape_id": "01a19769-2d2f-75ba-92c8-23e298d1a38c", "http_status": 200, "captureRegistry": { "source_key": "power_json", "requested_url": "https://forum.newae.com/t/stm32f415-hardware-crypto/2295.json", "source_url": "https://forum.newae.com/t/stm32f415-hardware-crypto/2295.json", "title": null, "http_status": 200, "scrape_id": "01a19769-2d2f-75ba-92c8-23e298d1a38c", "published_time": null, "modified_time": null, "credits_used": 1, "error": null, "full_text_retained_in_deliverable": false } } }, { "url": "https://forum.newae.com/t/2295/posts.json?post_ids%5B%5D=14903&post_ids%5B%5D=14906&post_ids%5B%5D=14907", "title": null, "type": "public forum final replies", "reviewedAt": "2026-11-01T14:07:57Z", "readStatus": "partial", "supports": "Latest participant still reports incorrect results and asks whether the installed chip might be non-original.", "limitations": [ "All three previously omitted post IDs retrieved; no successful final reproduction." ], "provenance": { "source_key": "power_tail", "url": "https://forum.newae.com/t/2295/posts.json?post_ids%5B%5D=14903&post_ids%5B%5D=14906&post_ids%5B%5D=14907", "title": null, "source_type": "public forum final replies", "supports": "Latest participant still reports incorrect results and asks whether the installed chip might be non-original.", "reviewed_at": "2026-11-01T14:07:57Z", "scrape_id": "01a19769-e2b0-7418-a2bf-620e18597c1c", "http_status": 200, "captureRegistry": { "source_key": "power_tail", "requested_url": "https://forum.newae.com/t/2295/posts.json?post_ids%5B%5D=14903&post_ids%5B%5D=14906&post_ids%5B%5D=14907", "source_url": "https://forum.newae.com/t/2295/posts.json?post_ids%5B%5D=14903&post_ids%5B%5D=14906&post_ids%5B%5D=14907", "title": null, "http_status": 200, "scrape_id": "01a19769-e2b0-7418-a2bf-620e18597c1c", "published_time": null, "modified_time": null, "credits_used": 1, "error": null, "full_text_retained_in_deliverable": false } } } ], "followUp": { "actions": [ "Retrieved both the initial public JSON topic and all remaining post IDs.", "Checked whether the 2025 discussion ended with a successful reproduction." ], "results": [ "No successful 2025 reproduction is shown.", "A participant's question about a possibly non-original chip is speculation, not evidence of supply-chain tampering." ], "contradictions": [ "A participant's statement that needed data is impossible to obtain is disputed by the maintainer; applicability depends on the actual system interface." ], "limitations": [ "No raw trace dataset or recovered-key verification was reviewed.", "No independent exact-configuration reproduction.", "No counterfeit, implant or malicious-supply-chain finding can be inferred from the unanswered chip question." ] }, "limitations": [ "No raw trace dataset or recovered-key verification was reviewed.", "No independent exact-configuration reproduction.", "No counterfeit, implant or malicious-supply-chain finding can be inferred from the unanswered chip question." ], "mappings": { "emb3d": [ { "id": "TID-101", "name": "Power Consumption Analysis Side Channel", "url": "https://emb3d.mitre.org/threats/TID-101.html", "basis": "analyst-inference", "rationale": "The discussion concerns inferring AES secrets from physical power leakage.", "officialCaseAttribution": false, "scope": "discussed/reported side-channel mechanism", "provenance": { "id": "TID-101", "title": "Power Consumption Analysis Side Channel", "url": "https://emb3d.mitre.org/threats/TID-101.html", "mapping_basis": "analyst_inference", "scope": "discussed/reported side-channel mechanism", "rationale": "The discussion concerns inferring AES secrets from physical power leakage.", "verified_against": "MITRE official EMB3D repository commit 0d7c25bb4e2928c516fb5811aaab9ff8bab2896c, threat description read 2026-11-01", "official_case_mapping": false } } ], "attack": [] }, "confidence": { "total": 53, "components": { "provenance": { "score": 16, "max": 20, "rationale": null }, "technicalEvidence": { "score": 13, "max": 35, "rationale": null }, "configurationSpecificity": { "score": 15, "max": 20, "rationale": null }, "independentCorroboration": { "score": 0, "max": 15, "rationale": null }, "followUpResolution": { "score": 9, "max": 10, "rationale": null } }, "rationale": "Primary support discussion supplies technical context, but the empirical claim is limited and the later reproduction is unresolved." } }, { "id": "LRRK-COM-007", "title": "PCILeech Kernel DMA Protection issue: protection limits and an aged bypass hypothesis", "canonicalUrl": "https://github.com/ufrisk/pcileech/issues/172", "strand": "community", "scope": "hardware", "publicationDate": "2021-07-14", "eventDate": null, "reviewDate": "2026-11-01", "dateNotes": "Replies read through closure on 2024-06-01; historical claims are not current Windows validation.", "device": { "scenario": "PCILeech FPGA/peripheral against Windows Kernel DMA Protection", "exact_target": null, "operating_system_build": null, "protection_state": "Central to the discussion; no controlled target configuration established." }, "access": "Proposed physically connected DMA-capable device; a separate historical firmware-compromise hypothesis has stronger prior-access assumptions.", "claim": "The issue asks whether alternative interfaces or firmware changes could bypass DMA protections.", "outcome": "The maintainer says enabled DMA protection blocks the original locked-computer use case and that an older preboot blog is less relevant. This is not a demonstrated universal bypass.", "evidenceStatus": "discussion_hypothesis_with_correction", "evidenceGroup": "discussion", "hardwareBoundary": null, "mechanisms": [ "direct memory access", "malicious connected peripherals" ], "sources": [ { "url": "https://github.com/ufrisk/pcileech/issues/172", "title": "Bypassing Kernel DMA Protection · Issue #172 · ufrisk/pcileech", "type": "public repository issue", "reviewedAt": "2026-11-01T14:07:57Z", "readStatus": "reviewed", "supports": "Initial hypotheses, maintainer limitations/corrections and age-related closure.", "limitations": [ "Public source reviewed for the scoped claim and/or linked-artifact context." ], "provenance": { "source_key": "pcileech_172", "url": "https://github.com/ufrisk/pcileech/issues/172", "title": "Bypassing Kernel DMA Protection · Issue #172 · ufrisk/pcileech", "source_type": "public repository issue", "supports": "Initial hypotheses, maintainer limitations/corrections and age-related closure.", "reviewed_at": "2026-11-01T14:07:57Z", "scrape_id": "01a19768-f215-7439-b54e-66e68c0ebbc6", "http_status": 200, "captureRegistry": { "source_key": "pcileech_172", "requested_url": "https://github.com/ufrisk/pcileech/issues/172", "source_url": "https://github.com/ufrisk/pcileech/issues/172", "title": "Bypassing Kernel DMA Protection · Issue #172 · ufrisk/pcileech", "http_status": 200, "scrape_id": "01a19768-f215-7439-b54e-66e68c0ebbc6", "published_time": null, "modified_time": null, "credits_used": 1, "error": null, "full_text_retained_in_deliverable": false } } }, { "url": "https://attack.mitre.org/techniques/T1200/", "title": "Hardware Additions, Technique T1200 - Enterprise | MITRE ATT&CK®", "type": "official framework reference", "reviewedAt": "2026-11-01T14:07:57Z", "readStatus": "reviewed", "supports": "ATT&CK defines hardware additions including DMA-capable peripherals; it does not endorse this issue's hypotheses.", "limitations": [ "Official technique definition read; mapping is analyst inference, not an official case assignment." ], "provenance": { "source_key": "attack_t1200", "url": "https://attack.mitre.org/techniques/T1200/", "title": "Hardware Additions, Technique T1200 - Enterprise | MITRE ATT&CK®", "source_type": "official framework reference", "supports": "ATT&CK defines hardware additions including DMA-capable peripherals; it does not endorse this issue's hypotheses.", "reviewed_at": "2026-11-01T14:07:57Z", "scrape_id": "01a1976a-ed30-729c-8e35-14c650ca94c1", "http_status": 200, "captureRegistry": { "source_key": "attack_t1200", "requested_url": "https://attack.mitre.org/techniques/T1200/", "source_url": "https://attack.mitre.org/techniques/T1200/", "title": "Hardware Additions, Technique T1200 - Enterprise | MITRE ATT&CK®", "http_status": 200, "scrape_id": "01a1976a-ed30-729c-8e35-14c650ca94c1", "published_time": null, "modified_time": null, "credits_used": 1, "error": null, "full_text_retained_in_deliverable": false } } } ], "followUp": { "actions": [ "Read the full issue, including 2022 correction and 2024 closure, instead of relying on its bypass title.", "Separated a prior-firmware-compromise hypothesis from a standalone peripheral bypass." ], "results": [ "The issue's title overstates what is demonstrated.", "The historical preboot claim was qualified by its author as less relevant to newer systems." ], "contradictions": [ "The proposed universal bypass is not supported; maintainer explicitly recognizes effective DMA protections when enabled." ], "limitations": [ "No new live test of any operating system was performed.", "Interface support, IOMMU configuration and boot state cannot be generalized.", "Closure as completed in the issue tracker is not proof that the proposed attack succeeded." ] }, "limitations": [ "No new live test of any operating system was performed.", "Interface support, IOMMU configuration and boot state cannot be generalized.", "Closure as completed in the issue tracker is not proof that the proposed attack succeeded." ], "mappings": { "emb3d": [ { "id": "TID-107", "name": "Unauthorized Direct Memory Access (DMA)", "url": "https://emb3d.mitre.org/threats/TID-107.html", "basis": "analyst-inference", "rationale": "The scenario concerns unauthorized peripheral access to host memory, with IOMMU/DMA protections as a boundary.", "officialCaseAttribution": false, "scope": "discussed DMA scenario", "provenance": { "id": "TID-107", "title": "Unauthorized Direct Memory Access (DMA)", "url": "https://emb3d.mitre.org/threats/TID-107.html", "mapping_basis": "analyst_inference", "scope": "discussed DMA scenario", "rationale": "The scenario concerns unauthorized peripheral access to host memory, with IOMMU/DMA protections as a boundary.", "verified_against": "MITRE official EMB3D repository commit 0d7c25bb4e2928c516fb5811aaab9ff8bab2896c, threat description read 2026-11-01", "official_case_mapping": false } } ], "attack": [ { "id": "T1200", "name": "Hardware Additions", "url": "https://attack.mitre.org/versions/v20/techniques/T1200/", "basis": "analyst-inference", "rationale": "T1200 explicitly includes physically introduced hardware capable of DMA memory access. This issue is only a related scenario, not an ATT&CK procedure example.", "officialCaseAttribution": false, "domain": "enterprise", "scope": "discussed scenario, not proof of observed adversary use", "provenance": { "id": "T1200", "title": "Hardware Additions", "domain": "enterprise", "url": "https://attack.mitre.org/versions/v20/techniques/T1200/", "mapping_basis": "analyst_inference", "scope": "discussed scenario, not proof of observed adversary use", "rationale": "T1200 explicitly includes physically introduced hardware capable of DMA memory access. This issue is only a related scenario, not an ATT&CK procedure example.", "verified_against": "Official live ATT&CK T1200 page retrieved via Firecrawl; page advertises v20 and version permalink.", "official_case_mapping": false } } ] }, "confidence": { "total": 46, "components": { "provenance": { "score": 18, "max": 20, "rationale": null }, "technicalEvidence": { "score": 10, "max": 35, "rationale": null }, "configurationSpecificity": { "score": 8, "max": 20, "rationale": null }, "independentCorroboration": { "score": 0, "max": 15, "rationale": null }, "followUpResolution": { "score": 10, "max": 10, "rationale": null } }, "rationale": "Verified public maintainer correction resolves a misleading title; actual bypass evidence and a reproducible target configuration are absent." } }, { "id": "LRRK-COM-008", "title": "Shark robot-vacuum customization reports with redacted evidence and model ambiguity", "canonicalUrl": "https://hackaday.io/project/185493-shark-robot-vacuum-reverse-engineering", "strand": "community", "scope": "hardware", "publicationDate": "2022-05-30", "eventDate": null, "reviewDate": "2026-11-01", "dateNotes": "Publication date is the earliest reviewed surviving log, not a verified project creation date. Later logs and public discussion checked through August 2022.", "device": { "project_description": "Shark RV1001", "linked_demo_title": "Shark RV1100", "exact_board_revision": null, "scope": "Model names conflict; do not infer a shared vulnerability across the product family." }, "access": "Author's laboratory access to robot mainboards and physical servicing/programming interfaces; exact decisive path is not fully documented in surviving content.", "claim": "The author reports partial eMMC acquisition, root access, remote-shell enablement and custom sounds on robot-vacuum hardware.", "outcome": "Surviving logs contain first-person progress reports and a linked custom-sound video, but substantial supporting material was removed. The ADB discussion separately reports an unauthorized connection, not working ADB access.", "evidenceStatus": "author_report_with_redacted_evidence", "evidenceGroup": "reported-result", "hardwareBoundary": "Model names conflict; do not infer a shared vulnerability across the product family.", "mechanisms": [ "nonvolatile memory readout", "physical device interfaces" ], "sources": [ { "url": "https://hackaday.io/project/185493-shark-robot-vacuum-reverse-engineering", "title": "Shark Robot Vacuum Reverse Engineering | Hackaday.io", "type": "original community project/logs", "reviewedAt": "2026-11-01T14:07:57Z", "readStatus": "reviewed", "supports": "Surviving readout, root/customization reports, unsuccessful ADB state, model-name inconsistency and redaction notice.", "limitations": [ "Surviving public logs only; redactions and model conflict retained, removed artifacts not sought." ], "provenance": { "source_key": "vacuum_case", "url": "https://hackaday.io/project/185493-shark-robot-vacuum-reverse-engineering", "title": "Shark Robot Vacuum Reverse Engineering | Hackaday.io", "source_type": "original community project/logs", "supports": "Surviving readout, root/customization reports, unsuccessful ADB state, model-name inconsistency and redaction notice.", "reviewed_at": "2026-11-01T14:07:57Z", "scrape_id": "01a19768-f241-7693-b55b-5bccdd4bd742", "http_status": 200, "captureRegistry": { "source_key": "vacuum_case", "requested_url": "https://hackaday.io/project/185493-shark-robot-vacuum-reverse-engineering", "source_url": "https://hackaday.io/project/185493-shark-robot-vacuum-reverse-engineering", "title": "Shark Robot Vacuum Reverse Engineering | Hackaday.io", "http_status": 200, "scrape_id": "01a19768-f241-7693-b55b-5bccdd4bd742", "published_time": null, "modified_time": null, "credits_used": 1, "error": null, "full_text_retained_in_deliverable": false } } } ], "followUp": { "actions": [ "Read the surviving dated logs and public comments.", "Checked whether device visibility was being confused with authorized ADB access.", "Recorded redactions without seeking removed files or reconstructing deleted material." ], "results": [ "Identified RV1001/RV1100 ambiguity and incomplete evidence.", "A publisher comment independently confirms receiving a takedown notice; it does not independently corroborate the technical attack." ], "contradictions": [ "Project description and linked video use different model names.", "Reported ADB device presence remains unauthorized in the cited log." ], "limitations": [ "No original firmware dumps, unredacted method, complete configuration or independent reproduction was reviewed.", "Linked video was discovered but not independently watched/validated.", "Do not infer an exposed privileged UART or debug bypass from normal serial wiring alone." ] }, "limitations": [ "No original firmware dumps, unredacted method, complete configuration or independent reproduction was reviewed.", "Linked video was discovered but not independently watched/validated.", "Do not infer an exposed privileged UART or debug bypass from normal serial wiring alone." ], "mappings": { "emb3d": [ { "id": "TID-108", "name": "ROM/NVRAM Data Extraction or Modification", "url": "https://emb3d.mitre.org/threats/TID-108.html", "basis": "analyst-inference", "rationale": "The narrow reported physical acquisition concerns nonvolatile eMMC content; exact access path and protections remain unresolved.", "officialCaseAttribution": false, "scope": "reported storage-readout mechanism", "provenance": { "id": "TID-108", "title": "ROM/NVRAM Data Extraction or Modification", "url": "https://emb3d.mitre.org/threats/TID-108.html", "mapping_basis": "analyst_inference", "scope": "reported storage-readout mechanism", "rationale": "The narrow reported physical acquisition concerns nonvolatile eMMC content; exact access path and protections remain unresolved.", "verified_against": "MITRE official EMB3D repository commit 0d7c25bb4e2928c516fb5811aaab9ff8bab2896c, threat description read 2026-11-01", "official_case_mapping": false } } ], "attack": [] }, "confidence": { "total": 45, "components": { "provenance": { "score": 16, "max": 20, "rationale": null }, "technicalEvidence": { "score": 14, "max": 35, "rationale": null }, "configurationSpecificity": { "score": 8, "max": 20, "rationale": null }, "independentCorroboration": { "score": 0, "max": 15, "rationale": null }, "followUpResolution": { "score": 7, "max": 10, "rationale": null } }, "rationale": "First-party historical logs support a limited report; redactions, absent artifacts and model ambiguity substantially limit confidence." } }, { "id": "LRRK-COM-009", "title": "TinyUSBHacker: public HID-injector design proposal, not a completed demonstration", "canonicalUrl": "https://hackaday.io/project/21580-tinyusbhacker", "strand": "community", "scope": "hardware", "publicationDate": null, "eventDate": null, "reviewDate": "2026-11-01", "dateNotes": "The page participates in the 2017 Hackaday Prize and attached files show 2017 dates; those do not establish the project's exact publication date.", "device": { "proposal": "NXP MK20 Cortex-M4 with microSD storage and keyboard/mouse emulation", "target_host": null, "implementation_state": "PCB fabrication marked done; assembly awaiting components and firmware not yet developed on the reviewed page." }, "access": "Proposed physical connection to a compatible host USB port.", "claim": "The project description proposes keyboard/mouse emulation and scripted input injection.", "outcome": "The page's own implementation checklist contradicts reading its promotional description as a completed working device. No attack or working target-host result is established.", "evidenceStatus": "design_proposal", "evidenceGroup": "discussion", "hardwareBoundary": null, "mechanisms": [ "malicious peripheral emulation", "HID keystroke injection" ], "sources": [ { "url": "https://hackaday.io/project/21580-tinyusbhacker", "title": "TinyUSBHacker | Hackaday.io", "type": "original project proposal", "reviewedAt": "2026-11-01T14:07:57Z", "readStatus": "reviewed", "supports": "Description, architecture and explicit unfinished assembly/firmware checklist.", "limitations": [ "Implementation checklist contradicts completed-device interpretation; classified as proposal." ], "provenance": { "source_key": "tinyusb_case", "url": "https://hackaday.io/project/21580-tinyusbhacker", "title": "TinyUSBHacker | Hackaday.io", "source_type": "original project proposal", "supports": "Description, architecture and explicit unfinished assembly/firmware checklist.", "reviewed_at": "2026-11-01T14:07:57Z", "scrape_id": "01a1976a-ed52-77bf-ada2-ecd8cabbf1b8", "http_status": 200, "captureRegistry": { "source_key": "tinyusb_case", "requested_url": "https://hackaday.io/project/21580-tinyusbhacker", "source_url": "https://hackaday.io/project/21580-tinyusbhacker", "title": "TinyUSBHacker | Hackaday.io", "http_status": 200, "scrape_id": "01a1976a-ed52-77bf-ada2-ecd8cabbf1b8", "published_time": null, "modified_time": null, "credits_used": 1, "error": null, "full_text_retained_in_deliverable": false } } }, { "url": "https://attack.mitre.org/techniques/T1200/", "title": "Hardware Additions, Technique T1200 - Enterprise | MITRE ATT&CK®", "type": "official framework reference", "reviewedAt": "2026-11-01T14:07:57Z", "readStatus": "reviewed", "supports": "Hardware-addition scenario includes keystroke-injection accessories.", "limitations": [ "Official technique definition read; mapping is analyst inference, not an official case assignment." ], "provenance": { "source_key": "attack_t1200", "url": "https://attack.mitre.org/techniques/T1200/", "title": "Hardware Additions, Technique T1200 - Enterprise | MITRE ATT&CK®", "source_type": "official framework reference", "supports": "Hardware-addition scenario includes keystroke-injection accessories.", "reviewed_at": "2026-11-01T14:07:57Z", "scrape_id": "01a1976a-ed30-729c-8e35-14c650ca94c1", "http_status": 200, "captureRegistry": { "source_key": "attack_t1200", "requested_url": "https://attack.mitre.org/techniques/T1200/", "source_url": "https://attack.mitre.org/techniques/T1200/", "title": "Hardware Additions, Technique T1200 - Enterprise | MITRE ATT&CK®", "http_status": 200, "scrape_id": "01a1976a-ed30-729c-8e35-14c650ca94c1", "published_time": null, "modified_time": null, "credits_used": 1, "error": null, "full_text_retained_in_deliverable": false } } } ], "followUp": { "actions": [ "Checked the implementation checklist, files and discussion rather than treating the description as a demonstration.", "Distinguished a linked external inspiration video from proof that this device works." ], "results": [ "No completed firmware or demonstrated host outcome appears in the reviewed project page." ], "contradictions": [ "Present-tense capability claims conflict with the unfinished implementation checklist." ], "limitations": [ "No device was built or tested.", "Attached datasheets and a schematic are design evidence, not working attack evidence.", "No drone/robot target or fleet applicability is established." ] }, "limitations": [ "No device was built or tested.", "Attached datasheets and a schematic are design evidence, not working attack evidence.", "No drone/robot target or fleet applicability is established." ], "mappings": { "emb3d": [ { "id": "TID-111", "name": "Untrusted External Storage", "url": "https://emb3d.mitre.org/threats/TID-111.html", "basis": "analyst-inference", "rationale": "The official threat cites BadUSB-style firmware-controlled behavior as an example. This proposal is only conceptually related; no malicious-code execution or functional device is established.", "officialCaseAttribution": false, "scope": "proposed USB threat concept", "provenance": { "id": "TID-111", "title": "Untrusted External Storage", "url": "https://emb3d.mitre.org/threats/TID-111.html", "mapping_basis": "analyst_inference", "scope": "proposed USB threat concept", "rationale": "The official threat cites BadUSB-style firmware-controlled behavior as an example. This proposal is only conceptually related; no malicious-code execution or functional device is established.", "verified_against": "MITRE official EMB3D repository commit 0d7c25bb4e2928c516fb5811aaab9ff8bab2896c, threat description read 2026-11-01", "official_case_mapping": false } } ], "attack": [ { "id": "T1200", "name": "Hardware Additions", "url": "https://attack.mitre.org/versions/v20/techniques/T1200/", "basis": "analyst-inference", "rationale": "The proposed physically connected HID injector is conceptually consistent with hardware additions and keystroke injection; no adversarial deployment is shown.", "officialCaseAttribution": false, "domain": "enterprise", "scope": "discussed scenario, not proof of observed adversary use", "provenance": { "id": "T1200", "title": "Hardware Additions", "domain": "enterprise", "url": "https://attack.mitre.org/versions/v20/techniques/T1200/", "mapping_basis": "analyst_inference", "scope": "discussed scenario, not proof of observed adversary use", "rationale": "The proposed physically connected HID injector is conceptually consistent with hardware additions and keystroke injection; no adversarial deployment is shown.", "verified_against": "Official live ATT&CK T1200 page retrieved via Firecrawl; page advertises v20 and version permalink.", "official_case_mapping": false } } ] }, "confidence": { "total": 41, "components": { "provenance": { "score": 15, "max": 20, "rationale": null }, "technicalEvidence": { "score": 4, "max": 35, "rationale": null }, "configurationSpecificity": { "score": 12, "max": 20, "rationale": null }, "independentCorroboration": { "score": 0, "max": 15, "rationale": null }, "followUpResolution": { "score": 10, "max": 10, "rationale": null } }, "rationale": "The incomplete design state is clear, but demonstrated attack evidence is absent; score applies to classification as a proposal." } }, { "id": "LRRK-COM-010", "title": "PicoEMP community thread: beta tooling and unsuccessful fault attempts", "canonicalUrl": "https://forum.newae.com/t/picoemp-low-cost-emfi/2905", "strand": "community", "scope": "hardware", "publicationDate": "2021-12-22", "eventDate": null, "reviewDate": "2026-11-01", "dateNotes": "All nine visible posts retrieved; unsuccessful experiments are dated November 2022.", "device": { "tool": "PicoEMP", "community_targets": [ "CW322 educational EMFI target", "XMEGA ChipWhisperer target", "STM32F303 ChipWhisperer target" ], "linked_distinct_demo": "Remoticon repository includes Raspberry Pi 3 Model B+ example code; it is a different artifact and not proof these users induced faults." }, "access": "Physical laboratory access and proximity to the target; hardware-specific coupling and configuration are material.", "claim": "The original announcement describes beta EMFI hardware; later participants report that they could not induce faults on their educational targets.", "outcome": "The retrieved thread does not resolve those users' failed experiments into successful target faults. Later component tests concern tool waveforms, not a demonstrated security bypass.", "evidenceStatus": "discussion_tooling_and_unsuccessful_attempts", "evidenceGroup": "discussion", "hardwareBoundary": null, "mechanisms": [ "electromagnetic fault injection" ], "sources": [ { "url": "https://forum.newae.com/t/picoemp-low-cost-emfi/2905.json", "title": null, "type": "public forum original discussion", "reviewedAt": "2026-11-01T14:07:57Z", "readStatus": "reviewed", "supports": "Complete beta announcement, failed target attempts and later tool-component discussion.", "limitations": [ "All nine visible topic-stream posts retrieved; target failures distinguished from tool waveform checks." ], "provenance": { "source_key": "emfi_forum", "url": "https://forum.newae.com/t/picoemp-low-cost-emfi/2905.json", "title": null, "source_type": "public forum original discussion", "supports": "Complete beta announcement, failed target attempts and later tool-component discussion.", "reviewed_at": "2026-11-01T14:07:57Z", "scrape_id": "01a1976a-ed53-730e-b24a-59fc53972165", "http_status": 200, "captureRegistry": { "source_key": "emfi_forum", "requested_url": "https://forum.newae.com/t/picoemp-low-cost-emfi/2905.json", "source_url": "https://forum.newae.com/t/picoemp-low-cost-emfi/2905.json", "title": null, "http_status": 200, "scrape_id": "01a1976a-ed53-730e-b24a-59fc53972165", "published_time": null, "modified_time": null, "credits_used": 1, "error": null, "full_text_retained_in_deliverable": false } } }, { "url": "https://github.com/colinoflynn/remoticon-2021-levelup-hardware-hacking", "title": "GitHub - colinoflynn/remoticon-2021-levelup-hardware-hacking: Colin O'Flynn's Hacakday talk at Remoticon 2021 support repo. · GitHub", "type": "linked author repository", "reviewedAt": "2026-11-01T14:07:57Z", "readStatus": "partial", "supports": "Repository is real and distinguishes demonstration resources; it does not independently reproduce the forum users' tests.", "limitations": [ "Parent repository reviewed; target code and talk are a partial-review follow-up lead, not a verified new result." ], "provenance": { "source_key": "remoticon_repo", "url": "https://github.com/colinoflynn/remoticon-2021-levelup-hardware-hacking", "title": "GitHub - colinoflynn/remoticon-2021-levelup-hardware-hacking: Colin O'Flynn's Hacakday talk at Remoticon 2021 support repo. · GitHub", "source_type": "linked author repository", "supports": "Repository is real and distinguishes demonstration resources; it does not independently reproduce the forum users' tests.", "reviewed_at": "2026-11-01T14:07:57Z", "scrape_id": "01a1976b-997c-768e-aa33-69dfb49bafba", "http_status": 200, "captureRegistry": { "source_key": "remoticon_repo", "requested_url": "https://github.com/colinoflynn/remoticon-2021-levelup-hardware-hacking", "source_url": "https://github.com/colinoflynn/remoticon-2021-levelup-hardware-hacking", "title": "GitHub - colinoflynn/remoticon-2021-levelup-hardware-hacking: Colin O'Flynn's Hacakday talk at Remoticon 2021 support repo. · GitHub", "http_status": 200, "scrape_id": "01a1976b-997c-768e-aa33-69dfb49bafba", "published_time": null, "modified_time": null, "credits_used": 1, "error": null, "full_text_retained_in_deliverable": false } } } ], "followUp": { "actions": [ "Read all nine public topic posts and followed the linked Remoticon repository.", "Separated successful tool-component waveform checks from successful target attacks." ], "results": [ "Target fault or bypass success is not established for the reported failed setups.", "The separate Raspberry Pi resources remain a primary-artifact lead, not an independently reviewed RSA result in this case." ], "contradictions": [ "A working pulse generator is not proof of a target fault or bypass." ], "limitations": [ "No target-fault raw data or exact repeatable configuration was reviewed.", "Beta status and later revisions must not be treated as one fixed design.", "Unsuccessful reports do not prove EMFI cannot affect those device families." ] }, "limitations": [ "No target-fault raw data or exact repeatable configuration was reviewed.", "Beta status and later revisions must not be treated as one fixed design.", "Unsuccessful reports do not prove EMFI cannot affect those device families." ], "mappings": { "emb3d": [ { "id": "TID-105", "name": "Hardware Fault Injection – Control Flow Modification", "url": "https://emb3d.mitre.org/threats/TID-105.html", "basis": "analyst-inference", "rationale": "EMFI is a method for fault-induced control-flow modification, but these posts do not establish the intended security outcome.", "officialCaseAttribution": false, "scope": "discussed/attempted mechanism only", "provenance": { "id": "TID-105", "title": "Hardware Fault Injection – Control Flow Modification", "url": "https://emb3d.mitre.org/threats/TID-105.html", "mapping_basis": "analyst_inference", "scope": "discussed/attempted mechanism only", "rationale": "EMFI is a method for fault-induced control-flow modification, but these posts do not establish the intended security outcome.", "verified_against": "MITRE official EMB3D repository commit 0d7c25bb4e2928c516fb5811aaab9ff8bab2896c, threat description read 2026-11-01", "official_case_mapping": false } } ], "attack": [] }, "confidence": { "total": 45, "components": { "provenance": { "score": 18, "max": 20, "rationale": null }, "technicalEvidence": { "score": 8, "max": 35, "rationale": null }, "configurationSpecificity": { "score": 10, "max": 20, "rationale": null }, "independentCorroboration": { "score": 0, "max": 15, "rationale": null }, "followUpResolution": { "score": 9, "max": 10, "rationale": null } }, "rationale": "Primary tooling announcement and direct reports are authentic public evidence, but no successful target-security result is established here." } }, { "id": "LRRK-COM-011", "title": "STM32F401CC dummy-firmware readout: Anvil Secure laboratory demonstration", "canonicalUrl": "https://www.anvilsecure.com/blog/glitching-stm32-read-out-protection-with-voltage-fault-injection.html", "strand": "community", "scope": "hardware", "publicationDate": "2025-04-18", "eventDate": null, "reviewDate": "2026-11-01", "dateNotes": "Article published 2025-04-18 and modified 2025-04-19; experiment date is not stated.", "device": { "target": "STM32F401CC developer board", "test_firmware": "Dummy firmware installed for the experiment", "tool": "CW1173 ChipWhisperer-Lite", "firmware_version": null, "die_revision": null, "scope": "Author explicitly limits observations to the tested STM32F401CC product; this is not an operational drone/robot compromise." }, "access": "Physical laboratory access to the development board, power circuitry and bootloader communications; invasive preparation described in the original is not reproduced in the library.", "claim": "The author reports bypassing configured readout protection and extracting the complete dummy firmware from the tested STM32F401CC.", "outcome": "A first-party lab demonstration reports firmware recovery after substantial setup work. The article also records configuration corruption, unintended protection changes and temporarily unusable targets.", "evidenceStatus": "author_demonstration", "evidenceGroup": "demonstration", "hardwareBoundary": "Author explicitly limits observations to the tested STM32F401CC product; this is not an operational drone/robot compromise.", "mechanisms": [ "voltage fault injection", "protected firmware readout" ], "sources": [ { "url": "https://www.anvilsecure.com/blog/glitching-stm32-read-out-protection-with-voltage-fault-injection.html", "title": "Glitching STM32 Read Out Protection", "type": "original technical article", "reviewedAt": "2026-11-01T14:07:57Z", "readStatus": "reviewed", "supports": "Exact target, dummy test firmware, complete-readout claim, failure modes and explicit product limitation.", "limitations": [ "Same public URL retrieved with main-content filtering disabled; substantive article recovered and reviewed. Distinct extraction-mode follow-up, not an uncertain paid retry." ], "provenance": { "source_key": "anvil_full", "url": "https://www.anvilsecure.com/blog/glitching-stm32-read-out-protection-with-voltage-fault-injection.html", "title": "Glitching STM32 Read Out Protection", "source_type": "original technical article", "supports": "Exact target, dummy test firmware, complete-readout claim, failure modes and explicit product limitation.", "reviewed_at": "2026-11-01T14:07:57Z", "scrape_id": "01a1976e-62a1-75da-b03a-e19e9319ec6b", "http_status": 200, "captureRegistry": { "source_key": "anvil_full", "requested_url": "https://www.anvilsecure.com/blog/glitching-stm32-read-out-protection-with-voltage-fault-injection.html", "source_url": "https://www.anvilsecure.com/blog/glitching-stm32-read-out-protection-with-voltage-fault-injection.html", "title": "Glitching STM32 Read Out Protection", "http_status": 200, "scrape_id": "01a1976e-62a1-75da-b03a-e19e9319ec6b", "published_time": "2025-04-18T11:09:25+00:00", "modified_time": "2025-04-19T05:46:59+00:00", "credits_used": 1, "error": null, "full_text_retained_in_deliverable": false } } }, { "url": "https://github.com/giggi0x00/faultinjection-scripts", "title": "GitHub - giggi0x00/faultinjection-scripts: Set of scripts used during voltage fault injection attacks · GitHub", "type": "author-linked source repository", "reviewedAt": "2026-11-01T14:07:57Z", "readStatus": "reviewed", "supports": "Linked repository is accessible and contains STM32F401 and STM32F103 directories.", "limitations": [ "Linked repository availability and target directory names checked; code not executed." ], "provenance": { "source_key": "anvil_artifact", "url": "https://github.com/giggi0x00/faultinjection-scripts", "title": "GitHub - giggi0x00/faultinjection-scripts: Set of scripts used during voltage fault injection attacks · GitHub", "source_type": "author-linked source repository", "supports": "Linked repository is accessible and contains STM32F401 and STM32F103 directories.", "reviewed_at": "2026-11-01T14:07:57Z", "scrape_id": "01a1976e-b096-7227-bcf6-f15e9a357445", "http_status": 200, "captureRegistry": { "source_key": "anvil_artifact", "requested_url": "https://github.com/giggi0x00/faultinjection-scripts", "source_url": "https://github.com/giggi0x00/faultinjection-scripts", "title": "GitHub - giggi0x00/faultinjection-scripts: Set of scripts used during voltage fault injection attacks · GitHub", "http_status": 200, "scrape_id": "01a1976e-b096-7227-bcf6-f15e9a357445", "published_time": null, "modified_time": null, "credits_used": 1, "error": null, "full_text_retained_in_deliverable": false } } }, { "url": "https://forum.newae.com/t/stm32g0-rdp-level-1-bypass/6375.json", "title": null, "type": "public forum follow-up attempt", "reviewedAt": "2026-11-01T14:07:57Z", "readStatus": "reviewed", "supports": "A different user cites this article but reports an unsuccessful STM32G0 attempt, which is not a reproduction on the same target.", "limitations": [ "All five visible posts in public topic stream reviewed." ], "provenance": { "source_key": "g0_json", "url": "https://forum.newae.com/t/stm32g0-rdp-level-1-bypass/6375.json", "title": null, "source_type": "public forum follow-up attempt", "supports": "A different user cites this article but reports an unsuccessful STM32G0 attempt, which is not a reproduction on the same target.", "reviewed_at": "2026-11-01T14:07:57Z", "scrape_id": "01a19769-2cd9-72d8-a2cc-93896e56ea83", "http_status": 200, "captureRegistry": { "source_key": "g0_json", "requested_url": "https://forum.newae.com/t/stm32g0-rdp-level-1-bypass/6375.json", "source_url": "https://forum.newae.com/t/stm32g0-rdp-level-1-bypass/6375.json", "title": null, "http_status": 200, "scrape_id": "01a19769-2cd9-72d8-a2cc-93896e56ea83", "published_time": null, "modified_time": null, "credits_used": 1, "error": null, "full_text_retained_in_deliverable": false } } } ], "followUp": { "actions": [ "Detected that Firecrawl main-content extraction returned only the heading and publication metadata.", "Retrieved the same public URL with main-content filtering disabled to recover the actual article.", "Read the actual target/result sections and followed the linked repository.", "Compared the article with the STM32G0 forum attempt." ], "results": [ "Confirmed exact STM32F401CC target and dummy-firmware laboratory scope.", "Confirmed accessible author-linked artifacts.", "No successful STM32G0 transfer was shown in the forum." ], "contradictions": [ "A successful STM32F401CC experiment does not establish the same outcome for STM32G0 or every STM32 part." ], "limitations": [ "No independent reproduction of the exact board, firmware and die revision was verified.", "Linked figures and code were reviewed as reported artifacts; no device was acted on or tested.", "The article's potential secrets consequence is not evidence that real customer secrets were extracted." ] }, "limitations": [ "No independent reproduction of the exact board, firmware and die revision was verified.", "Linked figures and code were reviewed as reported artifacts; no device was acted on or tested.", "The article's potential secrets consequence is not evidence that real customer secrets were extracted." ], "mappings": { "emb3d": [ { "id": "TID-105", "name": "Hardware Fault Injection – Control Flow Modification", "url": "https://emb3d.mitre.org/threats/TID-105.html", "basis": "analyst-inference", "rationale": "The reported voltage fault bypasses a bootloader readout-protection decision.", "officialCaseAttribution": false, "scope": "reported mechanism", "provenance": { "id": "TID-105", "title": "Hardware Fault Injection – Control Flow Modification", "url": "https://emb3d.mitre.org/threats/TID-105.html", "mapping_basis": "analyst_inference", "scope": "reported mechanism", "rationale": "The reported voltage fault bypasses a bootloader readout-protection decision.", "verified_against": "MITRE official EMB3D repository commit 0d7c25bb4e2928c516fb5811aaab9ff8bab2896c, threat description read 2026-11-01", "official_case_mapping": false } }, { "id": "TID-115", "name": "Firmware/Data Extraction via Hardware Interface", "url": "https://emb3d.mitre.org/threats/TID-115.html", "basis": "analyst-inference", "rationale": "The reported consequence is protected firmware readout via the board's hardware-connected bootloader interface.", "officialCaseAttribution": false, "scope": "reported mechanism", "provenance": { "id": "TID-115", "title": "Firmware/Data Extraction via Hardware Interface", "url": "https://emb3d.mitre.org/threats/TID-115.html", "mapping_basis": "analyst_inference", "scope": "reported mechanism", "rationale": "The reported consequence is protected firmware readout via the board's hardware-connected bootloader interface.", "verified_against": "MITRE official EMB3D repository commit 0d7c25bb4e2928c516fb5811aaab9ff8bab2896c, threat description read 2026-11-01", "official_case_mapping": false } } ], "attack": [] }, "confidence": { "total": 78, "components": { "provenance": { "score": 20, "max": 20, "rationale": null }, "technicalEvidence": { "score": 29, "max": 35, "rationale": null }, "configurationSpecificity": { "score": 20, "max": 20, "rationale": null }, "independentCorroboration": { "score": 0, "max": 15, "rationale": null }, "followUpResolution": { "score": 9, "max": 10, "rationale": null } }, "rationale": "Strong first-party technical lab report with an exact part, test-firmware context and accessible source artifact; exact-configuration independent reproduction remains unverified." } }, { "id": "LRRK-20261101-DR-001", "originLeadIds": [], "title": "PX4-derived failsafe logic: voltage faults on a development board, with a separate SITL landing limit", "canonicalUrl": "https://arxiv.org/html/2604.16699v1", "strand": "drones-robotics", "scope": "hardware", "publicationDate": "2026-04-17", "eventDate": null, "reviewDate": "2026-11-01", "dateNotes": "Canonical v1 submission: 2026-04-17. The paper-index update date is not a new experiment date. Canonical page labels this a Technical Report.", "device": { "description": "STM32F407-Discovery running PX4-derived failsafe code; separate ARMORY and Gazebo Classic software experiments", "configuration": "The paper explicitly removed the PX4 API layer for the physical bench experiment. No PX4 commit, release pin, assembled flight-controller model or flown-aircraft configuration was established." }, "access": "Physical bench access to the development board and laboratory voltage-fault instrumentation; software simulation is a separate access/evidence mode.", "claim": "Authors report that physical voltage faults altered failsafe outputs on a simplified STM32 test setup. The separately instrumented SITL experiment altered return-to-launch behavior in two scenarios but retained emergency-battery landing.", "outcome": "Bench results report absent or altered failsafe responses. In Gazebo Classic SITL, manually forcing the selected action to None produced Hold instead of RTL for RC-loss and critical-battery scenarios; the emergency-battery scenario still landed. This does not demonstrate a hijacked or crashed flying UAV.", "evidenceStatus": "author-reported-controlled-demonstration", "evidenceGroup": "demonstration", "hardwareBoundary": "Direct voltage disturbance of an STM32 development board; control-logic proxy, not a tested autonomous implant or production drone.", "mechanisms": [ "Voltage fault injection", "Control-flow/failsafe decision disturbance", "Separate software fault simulation" ], "sources": [ { "url": "https://arxiv.org/html/2604.16699v1", "title": "Glitch in the Sky, arXiv:2604.16699v1", "type": "primary-source", "reviewedAt": "2026-11-01", "readStatus": "reviewed", "supports": "Bench setup, explicit API-layer removal, physical results, and the SITL emergency-landing counterexample.", "locators": [ "IV-B Hardware Characterization", "V-B through V-D", "V-E, Table II" ], "limitations": [], "provenance": { "receipt": "receipts/glitch-sky-paper.json", "scrapeId": "01a197eb-c718-721b-bdd6-9c11783c041b", "httpStatus": 200, "reportedCredits": 1, "parsedPages": null, "bodyCharacters": 66611 } }, { "url": "https://arxiv.org/abs/2604.16699", "title": "Canonical arXiv record and version history", "type": "primary-source", "reviewedAt": "2026-11-01", "readStatus": "reviewed", "supports": "Technical Report; v1 submitted 17 April 2026; no later version or withdrawal notice displayed in the retrieved record.", "locators": [], "limitations": [], "provenance": { "receipt": "receipts/glitch-sky-abs.json", "scrapeId": "01a197ed-3186-75ec-85bc-764310fa4293", "httpStatus": 200, "reportedCredits": 1, "parsedPages": null, "bodyCharacters": 7171 } } ], "followUp": { "performed": [ "Read the full original v1 HTML and canonical submission record.", "Separated the implant threat model, development-board experiment and manually modified SITL experiment.", "Searched the exact title for code and independent validation; retained hits provided no reviewed independent reproduction." ], "result": "Source review supports a bounded physical voltage-fault demonstration on extracted flight logic. Abstract-level hijacking implications are not treated as demonstrated flight outcomes.", "next_steps": [ "Locate a published experiment artifact and exact PX4 revision, if released.", "Review any independent replication or author correction before broadening applicability." ] }, "limitations": [ "Technical-report/preprint evidence; no independent physical reproduction reviewed.", "Clock glitching is background discussion, not the demonstrated fault mechanism in this study.", "The autonomous concealed implant and supply-chain scenario are proposed threat-model elements, not experimentally validated deployments.", "Board-level failures cannot be generalized to a current PX4 release or every STM32 flight controller.", "The emergency-battery SITL result retained Land; do not claim all failsafes were bypassed.", "No LrrK hardware experiment or flight test was performed." ], "mappings": { "emb3d": [ { "id": "TID-105", "name": "Hardware Fault Injection – Control Flow Modification", "url": "https://emb3d.mitre.org/threats/TID-105.html", "basis": "analyst-inference", "rationale": "Physical voltage disturbance changed reported decisions/control behavior; the official threat covers physical fault-induced execution changes.", "scope": "Mechanism mapping to this board-level result only.", "officialCaseAttribution": false, "modelVersion": "2.0.1", "sourcePin": "mitre/emb3d@0d7c25bb4e2928c516fb5811aaab9ff8bab2896c" } ], "attack": [] }, "confidence": { "total": 71, "components": { "provenance": { "score": 20, "max": 20, "rationale": "Original author technical report and canonical arXiv version inspected." }, "technicalEvidence": { "score": 29, "max": 35, "rationale": "Full methods and reported physical results reviewed; no experiment repository or raw traces independently validated." }, "configurationSpecificity": { "score": 14, "max": 20, "rationale": "Named board and API-layer removal are explicit; firmware commit and integrated flight-controller configuration are missing." }, "independentCorroboration": { "score": 0, "max": 15, "rationale": "Search results and author metadata do not constitute independent reproduction." }, "followUpResolution": { "score": 8, "max": 10, "rationale": "Resolved the crucial hardware/SITL/implant/clock distinctions and retained the emergency-landing counterexample; artifact follow-up remains open." } }, "rationale": "Confidence in this bounded evidence claim; not probability, severity, device applicability or a MITRE rating." }, "droneRoboticsRelevance": "Flight-logic bench proxy; no physical drone or robot motion was demonstrated.", "mappingExclusions": [ "No TID-110/Rowhammer mapping: the demonstrated physical method is voltage injection, not DRAM disturbance.", "No ATT&CK/ICS procedure attribution: neither an operational adversary sequence nor ICS asset applicability was established." ], "sourceChangeType": "addition", "sourceArtifact": "drones-robotics/candidate-additions.json", "originDraftId": "DRAFT-DR-001", "researchStrand": "drones-robotics-followup" }, { "id": "LRRK-20261101-HW-CLOCK-001", "originLeadIds": [], "title": "Controlled STM32 clock-glitch experiments and GLITCHRESISTOR defenses", "canonicalUrl": "https://gzs715.github.io/pubs/GLITCHING_DSN21.pdf", "strand": "primary", "scope": "hardware", "publicationDate": "2021", "eventDate": null, "reviewDate": "2026-11-01", "dateNotes": "IEEE publication year2021; author repository view shows latest commit03fe4fb dated2020-01-31. Review date is not an experiment date.", "device": { "description": "STM32F071RBT6 Cortex-M0 in clock-fault experiments; Nucleo64 STM32F303RE in a separate defense-overhead exercise", "configuration": "The attack experiments deliberately use test-equipment-driven clocking and a precisely instrumented trigger on synthetic branch/loop workloads. These are explicitly ideal attacker conditions, not a production drone/robot firmware test." }, "access": "Physical laboratory control over a target clock and instrumented execution; generic embedded benchmark access.", "claim": "The DSN2021 study reports real clock-induced control-flow faults on a named STM32 test target and evaluates software defense patterns, separately from its instruction-set emulation.", "outcome": "Authors report escapes from controlled branch/loop workloads and configuration-dependent defense results. Neither a drone nor robot compromise nor universal immunity from fault injection was established.", "evidenceStatus": "author-reported-controlled-demonstration", "evidenceGroup": "demonstration", "hardwareBoundary": "Physical clock manipulation on an instrumented MCU benchmark; no operational aircraft/robot applicability established.", "mechanisms": [ "Clock glitching", "Control-flow disturbance", "Compiler/software fault-injection defenses" ], "sources": [ { "url": "https://gzs715.github.io/pubs/GLITCHING_DSN21.pdf", "title": "Glitching Demystified, complete author-hosted DSN2021 paper", "type": "primary-source", "reviewedAt": "2026-11-01", "readStatus": "reviewed", "supports": "Physical target, ideal attacker assumptions, distinction from emulation, and defense evaluation.", "locators": [ "V Real-World Glitching", "VII Evaluation of Defenses" ], "limitations": [ "Some PDF table extraction is damaged; no precise table-derived success-rate claim is adopted." ], "provenance": { "receipt": "receipts/clock-glitch-original.json", "scrapeId": "01a197ed-cae2-74ee-b79b-c640c53c0e1a", "httpStatus": 200, "reportedCredits": 13, "parsedPages": 13, "bodyCharacters": 92658 } }, { "url": "https://www.computer.org/csdl/proceedings-article/dsn/2021/357200a400/1vQDohVhku4", "title": "IEEE Computer Society DSN2021 publication record", "type": "primary-source", "reviewedAt": "2026-11-01", "readStatus": "reviewed", "supports": "Bibliographic identity: 2021, pages400–412, DOI10.1109/DSN48987.2021.00051.", "locators": [], "limitations": [], "provenance": { "receipt": "receipts/clock-ieee.json", "scrapeId": "01a197f0-a6cc-7582-92d9-3df9edb08e31", "httpStatus": 200, "reportedCredits": 1, "parsedPages": null, "bodyCharacters": 7756 } }, { "url": "https://github.com/ucsb-seclab/glitch_resistor", "title": "Authors' GLITCHRESISTOR repository", "type": "primary-source", "reviewedAt": "2026-11-01", "readStatus": "reviewed", "supports": "Public code/tree and README observed at03fe4fb8cced4c00b27357ca8faba085fa5b0841; neither built nor executed in this review.", "locators": [], "limitations": [], "provenance": { "receipt": "receipts/glitchresistor-repository.json", "scrapeId": "01a197ef-5d7e-72fc-a423-f2e5b94260ec", "httpStatus": 200, "reportedCredits": 1, "parsedPages": null, "bodyCharacters": 11259 } } ], "followUp": { "performed": [ "Read the full13-page author-hosted paper and official IEEE metadata.", "Reviewed the linked author repository without installing or executing it.", "Separated physical M0 clock experiments, emulation across ISAs, and M4 overhead testing." ], "result": "Suitable as a bounded clock-glitch learning/reference record. Same-author artifacts support inspectability, not independent reproduction or applicability to a flight controller.", "next_steps": [ "Review independently retained reproductions and exact target/build configurations if located.", "Keep current-device assessment scope separate from this historical benchmark." ] }, "limitations": [ "Idealized attacker clock/trigger control and synthetic code; no sealed product or aircraft was tested.", "Internal-clock devices and other fault mechanisms are not equivalent to the experimental setup.", "The M4 overhead board must not be substituted for the M0 attack target.", "No independent hardware reproduction or LrrK bench experiment was performed.", "Avoid transferring numerical rates from damaged extracted tables or applying a benchmark success rate to arbitrary firmware." ], "mappings": { "emb3d": [ { "id": "TID-105", "name": "Hardware Fault Injection – Control Flow Modification", "url": "https://emb3d.mitre.org/threats/TID-105.html", "basis": "analyst-inference", "rationale": "The study's physical clock faults change intended execution/control flow; clock-glitch protection is also referenced through CWE-1247 on the official threat page.", "scope": "Generic MCU benchmark only; not a documented drone/robot case.", "officialCaseAttribution": false, "modelVersion": "2.0.1", "sourcePin": "mitre/emb3d@0d7c25bb4e2928c516fb5811aaab9ff8bab2896c" } ], "attack": [] }, "confidence": { "total": 74, "components": { "provenance": { "score": 20, "max": 20, "rationale": "Author-hosted full paper and matching official IEEE record inspected." }, "technicalEvidence": { "score": 30, "max": 35, "rationale": "Physical methods and results plus an author repository are inspectable; artifacts were not built/run and damaged table extraction limits precise numeric claims." }, "configurationSpecificity": { "score": 17, "max": 20, "rationale": "Attack MCU, clock-control assumptions and synthetic workload are explicit; production firmware applicability is absent." }, "independentCorroboration": { "score": 0, "max": 15, "rationale": "Author repository and publisher abstract are not independent reproduction." }, "followUpResolution": { "score": 7, "max": 10, "rationale": "Resolved clock-versus-emulation and M0-attack-versus-M4-overhead distinctions; independent reproduction remains open." } }, "rationale": "Confidence in this bounded evidence claim; not probability, severity, device applicability or a MITRE rating." }, "droneRoboticsRelevance": "Generic embedded clock-glitch learning reference; not direct evidence of drone or robot compromise.", "sourceChangeType": "addition", "sourceArtifact": "drones-robotics/candidate-additions.json", "originDraftId": "DRAFT-HW-CLOCK-001", "researchStrand": "drones-robotics-followup" }, { "strand": "community", "reviewDate": "2026-11-01", "eventDate": "2014-12-27", "publicationDate": "2014-12-27", "dateNotes": "Schedule dates talk 2014-12-27; media page also displays 2014-12-28. Presentation/media dates kept distinct.", "disposition": "candidate-new-case", "id": "LRRK-20261101-COM-003", "title": "31C3 clock glitching: reported code execution and extraction from unnamed security IC", "canonicalUrl": "https://fahrplan.events.ccc.de/congress/2014/Fahrplan/system/attachments/2540/original/31c3_-_exide_-_Glitching_For_n00bs.pdf", "scope": "hardware", "sourceLeadIds": [ "LRRK-COM-LEAD-003" ], "device": { "description": "Undisclosed production security microcontroller communicating with a partner through ISO7816-style serial protocol.", "configuration": "No exact victim chip, silicon revision, firmware or product identified. FPGA/Arduino boards earlier in the slides are laboratory tools, not established victim models." }, "access": "Physical target electrical/communication access and a laboratory clock-fault setup.", "claim": "Original 31C3 slides report clock faulting of a command-length check on an unnamed production security IC, enabling code execution and code/data extraction.", "outcome": "Example reports oversized-command acceptance, output-pin changes used to confirm code execution and serial extraction of address space. These are author-reported milestones; no named affected product, raw recovered image or independent reproduction was validated.", "evidenceStatus": "original_conference_author_reported_result", "evidenceGroup": "reported-result", "hardwareBoundary": "Clock faults affect a security check followed by a serial-interface code-execution/extraction chain.", "mechanisms": [ "Clock fault injection affecting a security check", "Hardware-connected serial extraction" ], "sources": [ { "url": "https://fahrplan.events.ccc.de/congress/2014/Fahrplan/system/attachments/2540/original/31c3_-_exide_-_Glitching_For_n00bs.pdf", "title": "31c3-slides", "type": "original_conference_slides", "reviewedAt": "2026-11-01T16:25:44Z", "readStatus": "reviewed", "supports": "Full 66-page presentation, target description and example milestones.", "limitations": [ "66/66 pages parsed; no raw target image independently validated." ], "provenance": { "receiptKey": "31c3-slides", "scrapeId": "01a197ed-28b9-717c-b59d-9befe565354a", "httpStatus": 200, "sourceURL": "https://fahrplan.events.ccc.de/congress/2014/Fahrplan/system/attachments/2540/original/31c3_-_exide_-_Glitching_For_n00bs.pdf", "retrievedURL": "https://fahrplan.events.ccc.de/congress/2014/Fahrplan/system/attachments/2540/original/31c3_-_exide_-_Glitching_For_n00bs.pdf", "cacheState": "miss", "cachedAt": null, "reportedCredits": 66, "parsedPages": 66, "totalPages": 66 } }, { "url": "https://events.ccc.de/congress/2014/Fahrplan/events/6499.html", "title": "Schedule 31. Chaos Communication Congress", "type": "original_conference_schedule", "reviewedAt": "2026-11-01T16:25:44Z", "readStatus": "reviewed", "supports": "Talk identity/date, original slides and production-target description.", "limitations": [ "Same talk provenance, not independent reproduction." ], "provenance": { "receiptKey": "31c3-fahrplan", "scrapeId": "01a197ec-e08b-74fc-a811-081946d57781", "httpStatus": 200, "sourceURL": "https://events.ccc.de/congress/2014/Fahrplan/events/6499.html", "retrievedURL": "https://fahrplan.events.ccc.de/congress/2014/Fahrplan/events/6499.html", "cacheState": "miss", "cachedAt": null, "reportedCredits": 1, "parsedPages": null, "totalPages": null } }, { "url": "https://media.ccc.de/v/31c3_-_6499_-_en_-_saal_2_-_201412271715_-_glitching_for_n00bs_-_exide", "title": "Glitching For n00bs\n\n- media.ccc.de", "type": "original_conference_archive", "reviewedAt": "2026-11-01T16:25:44Z", "readStatus": "reviewed", "supports": "Canonical talk and archived video links.", "limitations": [ "Video itself not watched/transcribed in this Firecrawl-only review." ], "provenance": { "receiptKey": "31c3-original", "scrapeId": "01a197ec-bfda-755e-acaa-df0cc8721d97", "httpStatus": 200, "sourceURL": "https://media.ccc.de/v/31c3_-_6499_-_en_-_saal_2_-_201412271715_-_glitching_for_n00bs_-_exide", "retrievedURL": "https://media.ccc.de/v/31c3_-_6499_-_en_-_saal_2_-_201412271715_-_glitching_for_n00bs_-_exide", "cacheState": "miss", "cachedAt": null, "reportedCredits": 1, "parsedPages": null, "totalPages": null } }, { "url": "https://www.eevblog.com/forum/chat/ic-glitching-video-from-31c3-(ccc)/", "title": "IC Glitching Video from 31c3 (CCC) - Page 1", "type": "public_forum_discussion", "reviewedAt": "2026-11-01T16:25:44Z", "readStatus": "reviewed", "supports": "Community discovery context dated January 2015.", "limitations": [ "Embedded YouTube account is terminated." ], "provenance": { "receiptKey": "eev-31c3", "scrapeId": "01a197ea-a1c0-73fc-843b-de5a4dac6d21", "httpStatus": 200, "sourceURL": "https://www.eevblog.com/forum/chat/ic-glitching-video-from-31c3-(ccc)/", "retrievedURL": "https://www.eevblog.com/forum/chat/ic-glitching-video-from-31c3-(ccc)/", "cacheState": "miss", "cachedAt": null, "reportedCredits": 1, "parsedPages": null, "totalPages": null } } ], "followUp": { "performed": [ "Read forum and inspected public HTML to recover dead embed ID.", "Disambiguated unrelated Black Hat 2015 results.", "Read original schedule and all 66 slides; subtitle page reports no completed transcription." ], "result": "Bounded historical clock-fault account supported; broad target-interest list is not demonstration coverage.", "next_steps": [ "Identify exact victim and inspect original trace/dump or independent reproduction.", "Separate claimed example from general target/outcome lists." ] }, "limitations": [ "Architecture guesses in slides do not identify an exact commercial victim.", "No drone/robot result inferred from laboratory-tool boards or possible-target lists.", "AI-assisted desk review; no LrrK physical reproduction or independent human verification of the experiment is claimed.", "No drone, robot, flight controller, PLC or operational deployment is demonstrated by this record." ], "mappings": { "emb3d": [ { "id": "TID-105", "name": "Hardware Fault Injection – Control Flow Modification", "url": "https://emb3d.mitre.org/threats/TID-105.html", "basis": "analyst-inference", "rationale": "Example explicitly reports clock faults affecting a security check before code execution; analyst mechanism relation, not official case citation.", "officialCaseAttribution": false, "provenance": { "referenceReceipt": "emb3d-tid105", "verifiedAt": "2026-11-01T16:25:44Z", "model": "EMB3D 2.0.1", "relationship": "analyst_inference" } } ], "attack": [] }, "confidence": { "total": 62, "components": { "provenance": { "score": 20, "max": 20, "rationale": "Original conference archive/schedule and complete slides inspected." }, "technicalEvidence": { "score": 26, "max": 35, "rationale": "Outcome milestones and diagrams supplied; no raw result/video validation." }, "configurationSpecificity": { "score": 9, "max": 20, "rationale": "Interface/setup described but victim identity and firmware undisclosed." }, "independentCorroboration": { "score": 0, "max": 15, "rationale": "Mirrors, schedule and forum derive from same talk." }, "followUpResolution": { "score": 7, "max": 10, "rationale": "Original slides recovered; dead mirror, unrelated talk and incomplete subtitles resolved." } }, "rationale": "Analyst evidence strength for the bounded claim, not severity, probability, untested-device applicability or an official MITRE rating." }, "deduplication": { "datasetVersion": "2026-11-01.1", "datasetSHA256": "0c1811a2e4009455742363cdc0dea98e117715902193dd69328903db492f089f", "comparedCaseCount": 67, "nearbyExistingCaseIds": [ "primary-clkscrew-2017", "LRRK-COM-005" ], "result": "Distinct 2014 production-IC account, not CLKSCREW energy-management research or later NewAE laboratory support thread." }, "mappingNotes": "Only the explicit clock-fault security-check mechanism is mapped. TID-115 is not assigned because the example's normal serial communications path is not established as an unprotected programming/debug interface; no broad extraction crosswalk is forced.", "sourceChangeType": null, "sourceArtifact": "community/candidate-additions.json", "originLeadIds": [ "LRRK-COM-LEAD-003" ], "originDraftId": "DRAFT-COM-003", "researchStrand": "community" }, { "strand": "primary", "scope": "hardware", "reviewDate": "2026-11-01", "publicationAuthorized": false, "hardwareActionsPerformed": false, "id": "LRRK-20261101-FI-004", "originLeadIds": [ "primary-lead-glitch-switch" ], "relatedPublishedCaseIds": [], "title": "NVIDIA Tegra X2 on Jetson TX2: author-reported voltage-fault activation of a hidden bootloader", "canonicalUrl": "https://arxiv.org/html/2108.06131v2", "publicationDate": "2021-08-16", "eventDate": null, "dateNotes": "Reviewed arXiv v2 is dated 2021-08-16. The separate Switch event is dated 2018-06-28 and is not the same experiment. Exact experimental dates were not established.", "device": { "soc": "NVIDIA Tegra X2 / T186, Parker", "platform": "Jetson TX2 module with Jetson TX2 developer-kit carrier board", "targetProcessor": "Boot and Power Management Processor / boot-ROM trust boundary", "boardRevision": null, "firmwareBuild": null, "scope": "Development-module laboratory experiment; no production vehicle, deployed robot or flight controller tested." }, "access": "Physical access to the Jetson module/carrier and laboratory voltage-fault equipment. Claimed recurring implant use is an impact scenario, not an operational deployment established here.", "claim": "The original research reports re-enabling a fuse-disabled manufacturer bootloader using voltage fault injection, gaining high-privilege code execution and extracting bootloader material.", "outcome": "Authors report full boot-ROM code and key-material extraction and decryption of the next boot stage on their tested platform. They attribute reproduction/confirmation to NVIDIA, but an independent vendor record was not located in this pass. No key bytes, proprietary boot-ROM artifacts or exploit implementation are retained.", "evidenceStatus": "original-research-manuscript-controlled-demonstration", "evidenceGroup": "demonstration", "hardwareBoundary": "Physical voltage fault against the tested Tegra X2 boot processor. It does not establish results on the original Switch Tegra X1, later Tegra generations or an integrated autonomous system.", "mechanisms": [ "voltage fault injection", "hidden bootloader activation" ], "sources": [ { "url": "https://arxiv.org/html/2108.06131v2", "title": "The Forgotten Threat of Voltage Glitching:A Case Study on Nvidia Tegra X2 SoCs", "type": "original-author-research-manuscript", "reviewedAt": "2026-11-01T16:27:55Z", "readStatus": "partial", "supports": "Sections on threat model, exact platform, results/applicability and conclusion support the bounded Tegra X2 laboratory claim; prior-generation section contextualizes the Switch lead.", "limitations": [ "Full HTML manuscript was returned; review focused on platform, threat model, result, applicability/disclosure and prior-generation sections.", "This is an author manuscript version. Vendor confirmation is attributed by the authors, not independently re-observed.", "Paper refers to leaked/proprietary boot-ROM repositories; those were not retrieved or copied." ], "provenance": { "sourceKey": "tegra_x2_paper", "scrapeId": "01a197ec-2cd0-721e-bc9b-6e5bdc915f0d", "httpStatus": 200, "publicationDate": "2021-08-16", "numPages": null, "totalPages": null, "creditsUsed": 1 } }, { "url": "https://media.ccc.de/v/c4.openchaos.2018.06.glitching-the-switch", "title": "\nGlitching the Switch\n\n- media.ccc.de\n", "type": "original-conference-event-metadata", "reviewedAt": "2026-11-01T16:27:55Z", "readStatus": "partial", "supports": "Confirms the separate 2018 Switch event, author and recording identity; event text is not a reviewed technical transcript.", "limitations": [ "The 92-minute recording was not watched/transcribed. No technical outcome is scored from metadata alone." ], "provenance": { "sourceKey": "switch_event", "scrapeId": "01a197ec-2c62-703f-b2d0-cdad5ed303df", "httpStatus": 200, "publicationDate": "2018-06-28", "numPages": null, "totalPages": null, "creditsUsed": 1 } } ], "followUp": { "performed": [ "Searched for original Switch slides/transcripts and author artifacts.", "Checked the publicly linked subtitle route; it returns a dataset-not-present response and was not bypassed or retried.", "Read the related original Tegra X2 paper coauthored by the Switch speaker.", "Searched official NVIDIA domains for an independent matching confirmation." ], "results": [ "The accessible later paper documents its own Jetson TX2 setup and keeps earlier Switch history separate.", "The original Switch recording remains unreviewed; no subtitle dataset was available through the linked service.", "No matching independent vendor confirmation was verified; generic search hits were excluded." ], "contradictions": [], "openQuestions": [ "Original 2018 Switch recording/slides/transcript and exact silicon/boot stage still require review.", "An accessible independent vendor record and exact tested build/revision for Tegra X2.", "No evidence of the tested method in a deployed drone or robot." ] }, "limitations": [ "This is a related new original-source case discovered while following the Switch lead; it does not close the original recording-review gap.", "Manufacturer-reproduction statements in the paper are not independently verified corroboration.", "Same-author historical citations are not independent reproductions of the 2018 Switch result.", "No physical actuation, hardware implant installation or device test was performed." ], "mappings": { "emb3d": [ { "id": "TID-105", "name": "Hardware Fault Injection – Control Flow Modification", "url": "https://emb3d.mitre.org/threats/TID-105.html", "basis": "analyst-inference", "rationale": "The reported voltage fault changes the boot processor's security-control execution and enables an otherwise disabled boot path.", "scope": "tested Tegra X2 boot trust boundary", "officialCaseAttribution": false, "provenance": { "modelVersion": "2.0.1", "sourcePin": "MITRE/emb3d@0d7c25bb4e2928c516fb5811aaab9ff8bab2896c" } }, { "id": "TID-116", "name": "Latent Privileged Access Port", "url": "https://emb3d.mitre.org/threats/TID-116.html", "basis": "analyst-inference", "rationale": "The reported privileged UART bootloader is a latent manufacturer access path whose availability is changed by the fault.", "scope": "reported hidden bootloader/access-port consequence", "officialCaseAttribution": false, "provenance": { "modelVersion": "2.0.1", "sourcePin": "MITRE/emb3d@0d7c25bb4e2928c516fb5811aaab9ff8bab2896c" } }, { "id": "TID-115", "name": "Firmware/Data Extraction via Hardware Interface", "url": "https://emb3d.mitre.org/threats/TID-115.html", "basis": "analyst-inference", "rationale": "The reported enabled bootloader permits firmware/data readout through a physical interface.", "scope": "reported boot-ROM/data readout consequence", "officialCaseAttribution": false, "provenance": { "modelVersion": "2.0.1", "sourcePin": "MITRE/emb3d@0d7c25bb4e2928c516fb5811aaab9ff8bab2896c" } } ], "attack": [] }, "confidence": { "total": 74, "components": { "provenance": { "score": 20, "max": 20, "rationale": "Original technical manuscript with named authors and a separate original event record were inspected." }, "technicalEvidence": { "score": 31, "max": 35, "rationale": "Manuscript reports concrete privileged execution and readout/decryption outcomes with technical platform analysis; no raw artifacts were independently reproduced." }, "configurationSpecificity": { "score": 15, "max": 20, "rationale": "T186/Jetson TX2 module and carrier are specific; exact board, fuse and firmware build pins remain incomplete." }, "independentCorroboration": { "score": 0, "max": 15, "rationale": "Vendor reproduction is only attributed in the author's report; no independent confirmation was retrieved, so no corroboration points are awarded." }, "followUpResolution": { "score": 8, "max": 10, "rationale": "Separated the 2018 and 2021 experiments and excluded generic vendor hits; original recording and vendor/build gaps remain." } }, "rationale": "74/100 applies to the tested Jetson TX2 account. It is not evidence of a flight-controller or robotics compromise." }, "sourceChangeType": "new", "sourceArtifact": "fault-injection/candidate-additions.json", "originDraftId": "DRAFT-FI-004", "researchStrand": "manual-follow-up-01/fault-injection" }, { "strand": "primary", "scope": "hardware", "reviewDate": "2026-11-01", "publicationAuthorized": false, "hardwareActionsPerformed": false, "id": "LRRK-20261101-FI-001", "originLeadIds": [ "LRRK-COM-LEAD-008", "LRRK-COM-LEAD-009" ], "relatedPublishedCaseIds": [ "LRRK-COM-003", "LRRK-COM-004", "LRRK-COM-011" ], "title": "STM32L051K8 test-firmware readout through voltage-induced flash-erase suppression", "canonicalUrl": "https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2025-033.txt", "publicationDate": "2025-05-23", "eventDate": "2025-04-04", "dateNotes": "Advisory reports discovery 2025-04-04, vendor notification 2025-04-07 and public disclosure 2025-05-23. Detailed blog is dated 2025-06-06. These are source-reported dates, not LRRK experiments.", "device": { "testedPart": "STM32L051K8, as explicitly named in SYSS-2025-033", "family": "STM32L0 / Cortex-M0+", "testFirmware": "Simple LED-toggle test program with readout protection enabled", "firmwareRevision": null, "dieRevision": null, "blogProductLink": "The blog links an STM32L051C6 product page; this does not override the advisory's tested K8 part.", "artifactVersion": "Linked working repositories have changes in 2026, so current source is not assumed identical to the 2025 experiment." }, "access": "Physical laboratory access to the MCU, power supply and SWD/debug interface; tested on prepared laboratory hardware.", "claim": "The author reports reducing readout protection while suppressing the associated flash erase, then reading the retained test firmware.", "outcome": "SYSS-2025-033 reports recovery of the sample firmware. The detailed blog separately says its conventional bootloader voltage-glitch attempts did not work on the tested STM32L051 setup. Failed erase-suppression attempts can destroy the data sought.", "evidenceStatus": "original-author-demonstration-and-advisory", "evidenceGroup": "demonstration", "hardwareBoundary": "Voltage perturbation during a protection-downgrade/erase operation on a laboratory MCU. No clock-glitch, deployed flight-controller, robot or customer-secret extraction result is established.", "mechanisms": [ "voltage fault injection", "flash-erase suppression" ], "sources": [ { "url": "https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2025-033.txt", "title": null, "type": "original-research-advisory", "reviewedAt": "2026-11-01T16:27:55Z", "readStatus": "reviewed", "supports": "Exact tested K8 part, LED test program, bounded recovery claim and disclosure timeline.", "limitations": [ "The PGP-signed-text wrapper was observed, but its signature was not independently verified. No personal contact/key fields are copied into the record." ], "provenance": { "sourceKey": "syss_advisory", "scrapeId": "01a197eb-be56-71db-8106-7385919b35a7", "httpStatus": 200, "publicationDate": "2025-05-23", "numPages": null, "totalPages": null, "creditsUsed": 1 } }, { "url": "https://blog.syss.com/posts/voltage-glitching-the-stm32l05-microcontroller/", "title": "STM32L05 Voltage Glitching | SySS Tech Blog\n ", "type": "original-author-technical-report", "reviewedAt": "2026-11-01T16:27:55Z", "readStatus": "reviewed", "supports": "Distinguishes unsuccessful bootloader attempts from the successful erase-suppression method and describes data-loss failure modes.", "limitations": [], "provenance": { "sourceKey": "syss_article", "scrapeId": "01a197ea-9fe7-7479-bd17-313ee8aa9326", "httpStatus": 200, "publicationDate": "2025-06-06", "numPages": null, "totalPages": null, "creditsUsed": 1 } }, { "url": "https://github.com/MKesenheimer/fault-injection-library/tree/master/projects/stm32l05x", "title": "fault-injection-library/projects/stm32l05x at master · MKesenheimer/fault-injection-library · GitHub", "type": "author-linked-source-artifact", "reviewedAt": "2026-11-01T16:27:55Z", "readStatus": "reviewed", "supports": "Linked STM32L05x project exists; current project metadata includes later double-fault improvements.", "limitations": [ "Availability is not independent reproduction. Code/binaries were not executed or copied." ], "provenance": { "sourceKey": "syss_project", "scrapeId": "01a197ed-ca56-71ce-a349-8b4ebde37360", "httpStatus": 200, "publicationDate": null, "numPages": null, "totalPages": null, "creditsUsed": 1 } }, { "url": "https://github.com/MKesenheimer/stm32-test-programs/tree/master/rdp-downgrade", "title": "stm32-test-programs/rdp-downgrade at master · MKesenheimer/stm32-test-programs · GitHub", "type": "author-linked-source-artifact", "reviewedAt": "2026-11-01T16:27:55Z", "readStatus": "reviewed", "supports": "Linked downgrade test-program project exists.", "limitations": [ "Same author as the blog/advisory and PicoGlitcher project; not independent corroboration." ], "provenance": { "sourceKey": "syss_ram_program", "scrapeId": "01a197ed-ca9a-70d8-b727-84eb9dc8b9ca", "httpStatus": 200, "publicationDate": null, "numPages": null, "totalPages": null, "creditsUsed": 1 } }, { "url": "https://tches.iacr.org/index.php/TCHES/article/download/11422/10927", "title": "Unlock the Door to my Secrets, but don't Forget to Glitch", "type": "peer-reviewed-research-method-follow-up", "reviewedAt": "2026-11-01T16:27:55Z", "readStatus": "partial", "supports": "Earlier flash-erase-suppression study supports the attack-class context and method-dependent positive/negative results on different parts.", "limitations": [ "All 42 PDF pages were returned. Review focused on target tables, methodology, voltage/EMFI results and limitations; implementation details were not reproduced.", "The study does not list STM32L051 and does not independently reproduce this exact K8 result." ], "provenance": { "sourceKey": "erase_paper_pdf", "scrapeId": "01a197ec-2c84-7518-8c93-44633e2f0d53", "httpStatus": 200, "publicationDate": "2024-03-12", "numPages": 42, "totalPages": 42, "creditsUsed": 42 } } ], "followUp": { "performed": [ "Read the original advisory and detailed blog, not only the Penthertz summary.", "Checked original linked artifacts and the earlier 2024 paper's exact device table and method-specific results.", "Searched for an independent STM32L051 erase-suppression reproduction." ], "results": [ "Resolved the exact tested part to STM32L051K8 and separated the generic/C6 product link.", "The CWE title mentions voltage and clock glitches, but the actual demonstrated mechanism here is voltage injection.", "Earlier paper used different STM32L1/L4 and other-vendor targets. Its successful EMFI results must not be described as universal voltage-glitch success." ], "contradictions": [ "Blog's generic product link and advisory's explicit K8 test identity differ in specificity; use the advisory part for the tested claim." ], "openQuestions": [ "No exact die revision or independently validated raw readout artifact.", "No independently verified same-configuration reproduction or current vendor remedy matrix found." ] }, "limitations": [ "Same-team blog, advisory and repositories are not independent experiments.", "Success rates in the source are configuration-specific and are not vulnerability probabilities.", "No result on a drone, robot or LRRK device is inferred.", "The earlier paper reports method-specific failures and device variation; those are preserved rather than generalized away." ], "mappings": { "emb3d": [ { "id": "TID-105", "name": "Hardware Fault Injection – Control Flow Modification", "url": "https://emb3d.mitre.org/threats/TID-105.html", "basis": "analyst-inference", "rationale": "A voltage fault defeats a hardware-enforced readout decision/critical erase operation. The precise physical fault model is not independently verified as instruction skipping.", "scope": "bounded protection-bypass outcome; no universal fault model", "officialCaseAttribution": false, "provenance": { "modelVersion": "2.0.1", "sourcePin": "MITRE/emb3d@0d7c25bb4e2928c516fb5811aaab9ff8bab2896c" } }, { "id": "TID-115", "name": "Firmware/Data Extraction via Hardware Interface", "url": "https://emb3d.mitre.org/threats/TID-115.html", "basis": "analyst-inference", "rationale": "After the reported downgrade, retained test firmware is read through a physical debug interface.", "scope": "reported firmware-readout consequence", "officialCaseAttribution": false, "provenance": { "modelVersion": "2.0.1", "sourcePin": "MITRE/emb3d@0d7c25bb4e2928c516fb5811aaab9ff8bab2896c" } } ], "attack": [] }, "confidence": { "total": 78, "components": { "provenance": { "score": 20, "max": 20, "rationale": "Original research advisory, detailed author article and linked artifacts were inspected." }, "technicalEvidence": { "score": 30, "max": 35, "rationale": "Sources state a sample-firmware readout and retain unsuccessful attempts/data-loss outcomes; no physical execution or raw binary validation by LRRK." }, "configurationSpecificity": { "score": 19, "max": 20, "rationale": "Exact advisory part and test-program context are known; die/board revisions and complete build pin remain absent." }, "independentCorroboration": { "score": 0, "max": 15, "rationale": "All exact-result artifacts are same-author; the earlier paper uses different parts and is not exact-configuration reproduction." }, "followUpResolution": { "score": 9, "max": 10, "rationale": "Part-identity/date/mechanism ambiguities were narrowed; independent reproduction and current remediation remain open." } }, "rationale": "78/100 concerns the narrowly reported laboratory result, not device applicability, severity or a probability." }, "sourceChangeType": "new", "sourceArtifact": "fault-injection/candidate-additions.json", "originDraftId": "DRAFT-FI-001", "researchStrand": "manual-follow-up-01/fault-injection" }, { "strand": "community", "reviewDate": "2026-11-01", "eventDate": null, "publicationDate": null, "dateNotes": "Article date is not exposed in the capture. The EEVblog link is dated 2025-08-05; that is a reference date, not an inferred publication date.", "disposition": "candidate-new-case", "id": "LRRK-20261101-COM-001", "title": "STM32F401CCU6 RDP1: FEV Secure Lab reports validated full-flash readout", "canonicalUrl": "https://jerinsunny.github.io/stm32_vglitch/", "scope": "hardware", "sourceLeadIds": [ "LRRK-COM-LEAD-002" ], "device": { "description": "STM32F401CCU6 minimum-system development board, Cortex-M4, 256 KB internal flash.", "configuration": "Sample firmware was captured before enabling RDP1. The laboratory used custom physical voltage faulting and a hardware-connected ROM bootloader. Silicon stepping and a retained raw acquisition artifact were not established." }, "access": "Physical possession, board modification, power and bootloader communication access in a controlled laboratory.", "claim": "The original FEV Secure Lab authors report circumventing RDP1 on their STM32F401CCU6 board and reading full internal flash, compared with the sample firmware captured before enabling protection.", "outcome": "The article reports eventual full-flash acquisition and comparison with the original sample. Earlier positive acknowledgements yielded all-zero data, attributed by the authors to an unintended PCROP setting. RDP2 was not tested.", "evidenceStatus": "author_demonstration_with_validation_limits", "evidenceGroup": "reported-result", "hardwareBoundary": "Physical power-fault injection at an MCU protection decision followed by firmware readout over a hardware-connected bootloader.", "mechanisms": [ "Voltage fault injection against readout protection", "Firmware readout via hardware-connected bootloader" ], "sources": [ { "url": "https://jerinsunny.github.io/stm32_vglitch/", "title": "Voltage glitching on STM32F4 MCUs", "type": "original_researcher_article", "reviewedAt": "2026-11-01T16:25:44Z", "readStatus": "reviewed", "supports": "Exact target/RDP1, pre-protection baseline, failed all-zero reads and reported eventual full-flash acquisition.", "limitations": [ "Images/narrative read; no raw recovered image was downloaded or independently compared." ], "provenance": { "receiptKey": "jerin-vglitch", "scrapeId": "01a197ea-fafa-745d-a3be-167aa790c6d3", "httpStatus": 200, "sourceURL": "https://jerinsunny.github.io/stm32_vglitch/", "retrievedURL": "https://jerinsunny.github.io/stm32_vglitch/", "cacheState": "miss", "cachedAt": null, "reportedCredits": 1, "parsedPages": null, "totalPages": null } }, { "url": "https://www.eevblog.com/forum/microcontrollers/stm-32f4xx-what-hacks-are-known-around-level-2-security/75/", "title": "STM 32F4xx - what hacks are known around Level 2 security? - Page 4", "type": "public_forum_discussion", "reviewedAt": "2026-11-01T16:25:44Z", "readStatus": "reviewed", "supports": "Shows the linked experiment is presented in a thread about RDP2.", "limitations": [ "This context does not turn an RDP1 result into an RDP2 bypass." ], "provenance": { "receiptKey": "eev-rdp2", "scrapeId": "01a197ea-a07c-74c9-b864-ee90b14d6169", "httpStatus": 200, "sourceURL": "https://www.eevblog.com/forum/microcontrollers/stm-32f4xx-what-hacks-are-known-around-level-2-security/75/", "retrievedURL": "https://www.eevblog.com/forum/microcontrollers/stm-32f4xx-what-hacks-are-known-around-level-2-security/75/", "cacheState": "miss", "cachedAt": null, "reportedCredits": 1, "parsedPages": null, "totalPages": null } } ], "followUp": { "performed": [ "Read the entire original FEV article linked from EEVblog.", "Separated RDP1 from the thread's RDP2 topic and preserved unsuccessful reads.", "Compared authors, artifacts and claimed experiment against all 67 cases." ], "result": "A distinct original-lab RDP1 account is supported; same-family research is not independent replication of this experiment.", "next_steps": [ "Require retained original/recovered data, exact silicon revision and protection-state evidence for stronger validation.", "Do not apply this result to RDP2 or a drone/robot without new device-specific evidence." ] }, "limitations": [ "Only author-reported validation was inspected; no independent raw-byte comparison.", "The protection-bypass fault model and PCROP explanation remain the authors' interpretations.", "AI-assisted desk review; no LrrK physical reproduction or independent human verification of the experiment is claimed.", "No drone, robot, flight controller, PLC or operational deployment is demonstrated by this record." ], "mappings": { "emb3d": [ { "id": "TID-105", "name": "Hardware Fault Injection – Control Flow Modification", "url": "https://emb3d.mitre.org/threats/TID-105.html", "basis": "analyst-inference", "rationale": "The reported fault bypasses a bootloader protection decision. This analyst mechanism relation does not independently verify a particular instruction mutation.", "officialCaseAttribution": false, "provenance": { "referenceReceipt": "emb3d-tid105", "verifiedAt": "2026-11-01T16:25:44Z", "model": "EMB3D 2.0.1", "relationship": "analyst_inference" } }, { "id": "TID-115", "name": "Firmware/Data Extraction via Hardware Interface", "url": "https://emb3d.mitre.org/threats/TID-115.html", "basis": "analyst-inference", "rationale": "The reported consequence is internal firmware readout through the hardware-connected bootloader after faulting RDP1 enforcement.", "officialCaseAttribution": false, "provenance": { "referenceReceipt": "emb3d-tid115", "verifiedAt": "2026-11-01T16:25:44Z", "model": "EMB3D 2.0.1", "relationship": "analyst_inference" } } ], "attack": [] }, "confidence": { "total": 73, "components": { "provenance": { "score": 20, "max": 20, "rationale": "Named original researchers and lab-attributed article inspected." }, "technicalEvidence": { "score": 28, "max": 35, "rationale": "Baseline comparison and failed outcomes reported, without independently checked raw images." }, "configurationSpecificity": { "score": 18, "max": 20, "rationale": "MCU model, flash size and RDP1 explicit; silicon stepping/reproducibility incomplete." }, "independentCorroboration": { "score": 0, "max": 15, "rationale": "No independent reproduction of this exact FEV experiment inspected." }, "followUpResolution": { "score": 7, "max": 10, "rationale": "Protection-level ambiguity resolved and raw-artifact limits retained." } }, "rationale": "Analyst evidence strength for the bounded claim, not severity, probability, untested-device applicability or an official MITRE rating." }, "deduplication": { "datasetVersion": "2026-11-01.1", "datasetSHA256": "0c1811a2e4009455742363cdc0dea98e117715902193dd69328903db492f089f", "comparedCaseCount": 67, "nearbyExistingCaseIds": [ "LRRK-COM-002", "LRRK-COM-003", "LRRK-COM-011" ], "result": "Different original lab/authors and account from the NewAE, PicoGlitcher and Anvil records; same MCU family is not a duplicate or independent replication." }, "sourceChangeType": null, "sourceArtifact": "community/candidate-additions.json", "originLeadIds": [ "LRRK-COM-LEAD-002" ], "originDraftId": "DRAFT-COM-001", "researchStrand": "community" }, { "id": "LRRK-20261101-DR-002", "originLeadIds": [ "DR-L03" ], "title": "NAO robot ransomware-style PoC: software and recovery disruption; Pepper applicability was asserted", "canonicalUrl": "https://www.ioactive.com/robots-want-bitcoins-too/", "strand": "drones-robotics", "scope": "device-interface", "publicationDate": "2018-03-09", "eventDate": null, "reviewDate": "2026-11-01", "dateNotes": "Original metadata published 2018-03-09; modified 2025-03-26. Retrospective published 2026-04-27. Neither later date is treated as a new PoC experiment.", "device": { "description": "SoftBank NAO in the authors' 2018 post-exploitation experiment", "configuration": "Exact NAO firmware/NAOqi revision was not established in the original blog. Authors explicitly say they only had a NAO; Pepper support is argued from similar OS and vulnerabilities, not a separately reported test." }, "access": "Access to a vulnerable robot software service followed by privileged post-exploitation modification; physical fault injection is not involved.", "claim": "IOActive reports a controlled NAO PoC that modifies robot software/behaviors and disrupts administrative and recovery functionality.", "outcome": "Author narrative describes altered libraries/behavior files and interference with factory reset. It is not evidence of an operational ransom campaign, separately tested Pepper outcome or demonstrated file-encryption mechanism.", "evidenceStatus": "author-reported-controlled-demonstration", "evidenceGroup": "demonstration", "hardwareBoundary": "Embedded robot software and recovery boundary, not chip tampering or electrical fault injection.", "mechanisms": [ "Robot application/library modification", "Recovery disruption after software compromise" ], "sources": [ { "url": "https://www.ioactive.com/robots-want-bitcoins-too/", "title": "Robots Want Bitcoins too!, original 2018 report", "type": "primary-source", "reviewedAt": "2026-11-01", "readStatus": "reviewed", "supports": "NAO-only testing statement, reported software modification and factory-reset interference.", "locators": [ "Our PoC Ransomware", "The Difficulty in Removing Ransomware" ], "limitations": [ "Embedded video playback/transcript was not reviewed; narrative and linked artifacts are author evidence." ], "provenance": { "receipt": "receipts/robots-ransomware-original.json", "scrapeId": "01a197eb-38a4-73fd-b61f-579d718e9376", "httpStatus": 200, "reportedCredits": 1, "parsedPages": null, "bodyCharacters": 12579 } }, { "url": "https://www.ioactive.com/from-skynet-to-ai-agents-the-state-of-robot-security-nine-years-later/", "title": "From Skynet to AI Agents, 2026 retrospective", "type": "primary-source", "reviewedAt": "2026-11-01", "readStatus": "reviewed", "supports": "Later same-team characterization; not independent replication or a new 2018 experiment.", "locators": [], "limitations": [], "provenance": { "receipt": "receipts/robot-retrospective.json", "scrapeId": "01a197ea-f390-76cd-ad68-1e91e5802ebb", "httpStatus": 200, "reportedCredits": 1, "parsedPages": null, "bodyCharacters": 11171 } } ], "followUp": { "performed": [ "Followed the 2026 retrospective to the original 2018 report.", "Compared the retrospective's NAO-and-Pepper wording against the original NAO-only testing statement.", "Read the official ATT&CK recovery-inhibition definition; did not inherit MITRE's unrelated procedure examples." ], "result": "Reviewed as adjacent robot-software evidence with the tested-platform qualification explicit. Current remediation and Pepper-specific replication remain unknown.", "next_steps": [ "Locate exact historic firmware and original public video evidence through normal permitted access.", "Review a vendor advisory or independent device-specific replication before making current-product claims." ] }, "limitations": [ "Author-reported PoC; no independent reproduction was reviewed.", "No physical voltage, clock or EM fault injection was demonstrated.", "Pepper applicability is asserted from similarity and must not be counted as a second tested robot.", "A malfunction/vendor-repair anecdote does not establish that this payload caused hardware damage.", "No encryption outcome, ransom payment, operational campaign or present-day unpatched status is established." ], "mappings": { "emb3d": [ { "id": "TID-301", "name": "Applications Binaries Modified", "url": "https://emb3d.mitre.org/threats/TID-301.html", "basis": "analyst-inference", "rationale": "The original report describes modification of application libraries and behavior code on the robot.", "scope": "Reported post-exploitation software behavior only.", "officialCaseAttribution": false, "modelVersion": "2.0.1", "sourcePin": "mitre/emb3d@0d7c25bb4e2928c516fb5811aaab9ff8bab2896c" } ], "attack": [ { "id": "T1490", "name": "Inhibit System Recovery", "url": "https://attack.mitre.org/techniques/T1490/", "matrix": "enterprise", "basis": "analyst-inference", "officialCaseAttribution": false, "rationale": "The original PoC report describes interference with built-in reset/recovery functions; this matches recovery-inhibition behavior. No claim that MITRE documents NAO as a procedure example." } ] }, "confidence": { "total": 64, "components": { "provenance": { "score": 20, "max": 20, "rationale": "Original researcher report read and linked from a later same-team retrospective." }, "technicalEvidence": { "score": 25, "max": 35, "rationale": "Detailed narrative and screenshots/linked video exist; video execution and raw artifacts were not independently reviewed." }, "configurationSpecificity": { "score": 11, "max": 20, "rationale": "NAO is the stated test platform; exact firmware and authenticated-service prerequisites are incomplete." }, "independentCorroboration": { "score": 0, "max": 15, "rationale": "Same-team retrospective adds no independent reproduction points." }, "followUpResolution": { "score": 8, "max": 10, "rationale": "Resolved tested NAO versus asserted Pepper and recovery disruption versus encryption; current remediation remains open." } }, "rationale": "Confidence in this bounded evidence claim; not probability, severity, device applicability or a MITRE rating." }, "publicationRecommendation": "Adjacent device-interface section; exclude from physical fault-injection demonstrations.", "mappingExclusions": [ "T1486 Data Encrypted for Impact is not admitted: the read original does not establish file encryption.", "No automatic ICS cross-reference for an educational/service robot." ], "sourceChangeType": "addition", "sourceArtifact": "drones-robotics/candidate-additions.json", "originDraftId": "DRAFT-DR-002", "researchStrand": "drones-robotics-followup" }, { "id": "LRRK-20261101-DR-003", "originLeadIds": [ "DR-L04" ], "title": "APWeb CVE-2022-28711: component memory-corruption report and upstream correction", "canonicalUrl": "https://talosintelligence.com/vulnerability_reports/TALOS-2022-1512", "strand": "drones-robotics", "scope": "device-interface", "publicationDate": "2022", "eventDate": null, "reviewDate": "2026-11-01", "dateNotes": "Year precision retained because advisory header, timeline and current forum timestamps differ; all dated evidence is described in limitations.", "device": { "description": "ArduPilot APWeb standalone web-server component", "configuration": "Reported affected master commits 50b6b7ac through 46177cb9. The README describes an HTTP server connected to a MAVLink serial device; it does not establish inclusion or enablement in default flight-controller firmware. Upstream PR20 merged fix ca1c15739b33ad7076cffb6017e5564e89e0e336." }, "access": "Network reachability to the vulnerable APWeb HTTP service in an affected installation; no physical glitching is required.", "claim": "Cisco Talos describes an out-of-bounds read/write condition in APWeb URL decoding, and an upstream maintainer acknowledged and merged its correction.", "outcome": "Component-level memory overwrite is supported by the original analysis and vendor patch. No deployed-aircraft compromise, reliable code execution or flight-control takeover is demonstrated by these sources.", "evidenceStatus": "original-vulnerability-report-with-upstream-correction", "evidenceGroup": "advisory", "hardwareBoundary": "Software/parser vulnerability in a device-management interface; not a physical hardware-layer fault attack.", "mechanisms": [ "Out-of-bounds memory access in a network-facing component" ], "sources": [ { "url": "https://talosintelligence.com/vulnerability_reports/TALOS-2022-1512", "title": "TALOS-2022-1512 original advisory", "type": "primary-source", "reviewedAt": "2026-11-01", "readStatus": "reviewed", "supports": "Root-cause description, affected commit range and reported impact.", "locators": [ "Tested Versions", "Details", "Vendor Response" ], "limitations": [], "provenance": { "receipt": "receipts/apweb-talos.json", "scrapeId": "01a197eb-c5d3-711e-a330-c62806850b37", "httpStatus": 200, "reportedCredits": 1, "parsedPages": null, "bodyCharacters": 3210 } }, { "url": "https://github.com/ArduPilot/APWeb/pull/20", "title": "APWeb upstream PR20", "type": "primary-source", "reviewedAt": "2026-11-01", "readStatus": "reviewed", "supports": "Maintainer acknowledgment and merged correction dated 11 April 2022.", "locators": [], "limitations": [], "provenance": { "receipt": "receipts/apweb-upstream-pr.json", "scrapeId": "01a197ed-32a6-733c-a8bb-c4c4802dda3d", "httpStatus": 200, "reportedCredits": 1, "parsedPages": null, "bodyCharacters": 4874 } }, { "url": "https://github.com/ArduPilot/APWeb", "title": "APWeb project README", "type": "primary-source", "reviewedAt": "2026-11-01", "readStatus": "reviewed", "supports": "Standalone HTTP/MAVLink-serial architecture; does not establish default drone installation.", "locators": [], "limitations": [], "provenance": { "receipt": "receipts/apweb-repository.json", "scrapeId": "01a197f1-3dff-705c-9c11-d94b519a5b98", "httpStatus": 200, "reportedCredits": 1, "parsedPages": null, "bodyCharacters": 7452 } }, { "url": "https://discuss.ardupilot.org/t/talos-2022-1512-memory-corruption-vulnerability/84107/3", "title": "Original ArduPilot/Talos public discussion", "type": "primary-source", "reviewedAt": "2026-11-01", "readStatus": "reviewed", "supports": "Researcher disclosure, developer response and impact qualification.", "locators": [], "limitations": [], "provenance": { "receipt": "receipts/apweb-maintainer-discussion.json", "scrapeId": "01a197ed-cb12-7234-9d49-313de6f48329", "httpStatus": 200, "reportedCredits": 1, "parsedPages": null, "bodyCharacters": 11553 } }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-28711", "title": "NVD CVE-2022-28711", "type": "primary-source", "reviewedAt": "2026-11-01", "readStatus": "reviewed", "supports": "CVE identity and separate NVD impact enrichment; not an independent exploit demonstration.", "locators": [], "limitations": [], "provenance": { "receipt": "receipts/apweb-nvd.json", "scrapeId": "01a197eb-38fe-7141-b610-e582a575a204", "httpStatus": 200, "reportedCredits": 1, "parsedPages": null, "bodyCharacters": 5661 } } ], "followUp": { "performed": [ "Resolved the CISA-discovered lead to the original Talos advisory and upstream project.", "Read upstream acknowledgment/merge and the maintainer discussion.", "Checked the README to separate the web component from default flight-controller firmware.", "Preserved the source severity/date discrepancies rather than averaging or silently choosing one." ], "result": "Reviewed adjacent interface vulnerability with bounded impact. A specific deployed controller build and exploit consequence remain unestablished.", "next_steps": [ "Establish whether any proposed assessment target actually includes/exposes affected APWeb code.", "Consult a version-specific vendor or distribution advisory before claiming current exposure." ] }, "limitations": [ "Talos lists CVSS5.3 while the retrieved NVD enrichment lists9.8; this disagreement is not evidence of demonstrated flight takeover and does not set the LrrK confidence score.", "The Talos header is dated April14 while its timeline says public release July27; the forum and fix are dated April11. Exact first public disclosure is not inferred from the current edited pages.", "Patch merge confirms source correction, not deployment to every user's system.", "No code-execution exploit, physical fault injection, public-internet exposure or default firmware inclusion was established." ], "mappings": { "emb3d": [ { "id": "TID-327", "name": "Out of Bounds Memory Access", "url": "https://emb3d.mitre.org/threats/TID-327.html", "basis": "analyst-inference", "rationale": "The original component analysis explicitly identifies out-of-bounds reads and a possible out-of-bounds write/memory overwrite.", "scope": "Component weakness only, not a demonstrated control-flow exploit.", "officialCaseAttribution": false, "modelVersion": "2.0.1", "sourcePin": "mitre/emb3d@0d7c25bb4e2928c516fb5811aaab9ff8bab2896c" } ], "attack": [] }, "confidence": { "total": 78, "components": { "provenance": { "score": 20, "max": 20, "rationale": "Original researcher advisory and upstream maintainer evidence read." }, "technicalEvidence": { "score": 28, "max": 35, "rationale": "Root cause and source patch support memory corruption, without an executed flight/remote-code-execution artifact." }, "configurationSpecificity": { "score": 15, "max": 20, "rationale": "Commit range and fix are named; actual controller hardware, packaging and enablement remain unknown." }, "independentCorroboration": { "score": 7, "max": 15, "rationale": "Maintainer independently acknowledges/corrects the code; no independent exploit reproduction was reviewed." }, "followUpResolution": { "score": 8, "max": 10, "rationale": "Resolved original disclosure, patch, deployment boundary and severity/date conflicts; field exposure remains open." } }, "rationale": "Confidence in this bounded evidence claim; not probability, severity, device applicability or a MITRE rating." }, "publicationRecommendation": "Adjacent device-interface section; not a hardware fault-injection case.", "sourceChangeType": "addition", "sourceArtifact": "drones-robotics/candidate-additions.json", "originDraftId": "DRAFT-DR-003", "researchStrand": "drones-robotics-followup" }, { "strand": "primary", "scope": "hardware", "reviewDate": "2026-11-01", "publicationAuthorized": false, "hardwareActionsPerformed": false, "id": "LRRK-20261101-FI-003", "originLeadIds": [ "LRRK-COM-LEAD-009" ], "relatedPublishedCaseIds": [ "LRRK-COM-004" ], "title": "STM32-TraceRip: conditional firmware recovery from debug-visible processor state, without electrical fault injection", "canonicalUrl": "https://github.com/Marcus-Engineering/tracerip-analysis", "publicationDate": "2025", "eventDate": null, "dateNotes": "Original authors identify Hardwear.io USA 2025 as the presentation. PDF v1.1 contains a 6/10/2025 footer whose date formatting was not resolved. The inspected analysis repository has a public-release commit dated 2026-03-27. Upload-path dates are not experiment dates.", "device": { "primaryFamily": "STM32G0, exact part/revision not established from the reviewed text", "context": "Refrigerator-controller research, not a drone or robot test", "flashCapacity": "128 kB described in the presentation", "firmwarePrerequisite": "Running application/boot code performs a startup integrity calculation whose inputs/derivatives become visible in CPU state", "debugPrerequisite": "Relevant core-register/SRAM observations remain available under the tested protection behavior", "crossFamilyClaim": "Slides state tests on F0/F1/G0/C0 but do not provide a complete model/revision/configuration matrix.", "collectionToolAvailability": "Public repository covers analysis; collection repository is still marked TBA in the inspected README." }, "access": "Physical access to the hardware debug connection and repeated processor-state captures on a target with the required debug and firmware behavior.", "claim": "Authors report reconstructing protected application bytes by analyzing debug-visible execution states of the target's integrity calculation.", "outcome": "Slides report recovery of the complete application partition in their target, while also stating that early boot-region bytes are missed by the current collection startup delay. Repository describes target-program-specific analysis and incomplete/ambiguous ranges when capture data is insufficient.", "evidenceStatus": "original-author-presentation-and-analysis-artifact", "evidenceGroup": "demonstration", "hardwareBoundary": "Debug-interface information leakage and target-specific program analysis. Clock jitter is an observation problem/future-work topic, not a demonstrated clock-injection attack.", "mechanisms": [ "hardware debug processor-state observation", "target-specific integrity-calculation data recovery" ], "sources": [ { "url": "https://community.penthertz.com/t/breaking-stm32-readout-protection-from-uv-light-to-cpu-state-tracing/27.json", "title": null, "type": "public-community-discussion", "reviewedAt": "2026-11-01T16:27:55Z", "readStatus": "reviewed", "supports": "Discovery and follow-up assertions; complete six-post public topic read. Its broad flash-recovery wording is checked against original sources.", "limitations": [ "Secondary synthesis and speculative dongle mechanisms are not independent demonstrations." ], "provenance": { "sourceKey": "penthertz_thread", "scrapeId": "01a197ea-9fdb-731d-883a-3912238b2296", "httpStatus": 200, "publicationDate": null, "numPages": null, "totalPages": null, "creditsUsed": 1 } }, { "url": "https://github.com/Marcus-Engineering/tracerip-analysis", "title": "GitHub - Marcus-Engineering/tracerip-analysis: Analysis code from \"Tracing the Untraceable: Extracting Protected Flash with STM32-TraceRip\". · GitHub", "type": "original-author-analysis-repository", "reviewedAt": "2026-11-01T16:27:55Z", "readStatus": "reviewed", "supports": "Target-dependent recovery model, analysis-only release, insufficient-data limitations and original presentation links.", "limitations": [], "provenance": { "sourceKey": "tracerip_repo", "scrapeId": "01a197ed-c9ff-7351-9159-e4bae9618593", "httpStatus": 200, "publicationDate": "2026-03-27", "numPages": null, "totalPages": null, "creditsUsed": 1 } }, { "url": "https://hardwear.io/wp-content/uploads/2026/03/TraceRip-Hardwear.pdf", "title": "TraceRip-STM32", "type": "original-author-conference-slides", "reviewedAt": "2026-11-01T16:27:55Z", "readStatus": "partial", "supports": "Architecture/prerequisites, unsuccessful earlier methods, application-partition result and missed early bytes.", "limitations": [ "All 95 PDF pages were returned. Review focused on target architecture, prior-method failures, result and limitation slides, including pages 84–95; this is not independent validation of every implementation/figure.", "The old 2025 presentation-path URL returned 404. This current URL was explicitly linked by the original repository; it is not an independent source." ], "provenance": { "sourceKey": "tracerip_current_slides", "scrapeId": "01a197ee-89db-712f-8390-5b49b3b4c6c1", "httpStatus": 200, "publicationDate": "2025", "numPages": 95, "totalPages": 95, "creditsUsed": 95 } }, { "url": "https://markomo.me/", "title": "Home | Mark Omo", "type": "original-author-project-index", "reviewedAt": "2026-11-01T16:27:55Z", "readStatus": "reviewed", "supports": "Independent URL route from the author confirms the presentation's current location; not independent technical reproduction.", "limitations": [], "provenance": { "sourceKey": "tracerip_author", "scrapeId": "01a197ed-c9ff-75ac-8b32-a68bf224eba0", "httpStatus": 200, "publicationDate": null, "numPages": null, "totalPages": null, "creditsUsed": 1 } } ], "followUp": { "performed": [ "Read all six Penthertz posts and followed the core TraceRip claim to its original repository.", "Recorded the obsolete PDF link's 404, then resolved a current PDF through original-author links.", "Reviewed primary result/limitation slides and the analysis repository.", "Searched for an independent reproduction tied to the published analysis implementation." ], "results": [ "Narrowed '100% flash' to the reported application-partition recovery; early boot bytes remain a stated limitation.", "The authors qualify unsuccessful prior methods as methods they could not get working on their STM32G0 setup, not proof of universal resistance.", "Current analysis release is not a complete public acquisition toolchain.", "This is not evidence that the published COM-004 unsuccessful voltage attempt actually succeeded." ], "contradictions": [ "Penthertz's unqualified complete-flash/family language is broader than the target-dependent result and collection limitations in the original sources." ], "openQuestions": [ "Exact primary MCU part, firmware/revision and reproducible capture pin.", "Complete collection artifact availability and independently validated recovered image.", "Exact applicability to each listed family and to any deployed drone/robot remains unestablished." ] }, "limitations": [ "Do not describe normal clock drift, controlled timing or the suggested future clock control as clock fault injection.", "No physical capture, binary validation, firmware execution, robot motion or drone flight was performed.", "Multiple author links, slides and code are one research lineage, not independent experiments.", "Penthertz's proposed mechanism for a commercial STM32 dongle remains speculative and is not admitted as a scored attack case." ], "mappings": { "emb3d": [ { "id": "TID-115", "name": "Firmware/Data Extraction via Hardware Interface", "url": "https://emb3d.mitre.org/threats/TID-115.html", "basis": "analyst-inference", "rationale": "The bounded report concerns firmware/data extraction through a hardware debug interface, using permitted processor-state observations rather than direct flash reads.", "scope": "conditional debug-based data-extraction mechanism; not voltage/clock/EMFI", "officialCaseAttribution": false, "provenance": { "modelVersion": "2.0.1", "sourcePin": "MITRE/emb3d@0d7c25bb4e2928c516fb5811aaab9ff8bab2896c" } } ], "attack": [] }, "confidence": { "total": 69, "components": { "provenance": { "score": 20, "max": 20, "rationale": "Original authors' conference slides, repository and project index were inspected." }, "technicalEvidence": { "score": 27, "max": 35, "rationale": "Primary sources describe a concrete recovery result and retain missed-region/insufficient-data limitations; no recovered binary or capture was independently validated." }, "configurationSpecificity": { "score": 12, "max": 20, "rationale": "Family, capacity, CRC/program prerequisite and debug boundary are described, but exact part/revision and target program pin are absent." }, "independentCorroboration": { "score": 0, "max": 15, "rationale": "Forum posts and author artifact releases do not independently reproduce the experiment; no such reproduction was verified." }, "followUpResolution": { "score": 10, "max": 10, "rationale": "Broken-link, complete-flash, method-classification and incomplete-toolchain ambiguities were resolved into explicit limits." } }, "rationale": "69/100 supports the specific author-reported conditional recovery, not universal STM32 firmware extraction or an electrical-glitch claim." }, "sourceChangeType": "new", "sourceArtifact": "fault-injection/candidate-additions.json", "originDraftId": "DRAFT-FI-003", "researchStrand": "manual-follow-up-01/fault-injection" }, { "strand": "primary", "scope": "hardware", "reviewDate": "2026-11-01", "verificationBoundary": "AI-assisted desk review of public evidence; no hardware actuation, exploit execution, LrrK physical reproduction, or independent human acceptance.", "id": "LRRK-20261101-PRI-001", "originLeadIds": [ "primary-lead-arduino-dpa" ], "title": "Arduino Uno round-1 AES-128 power analysis in a white-box laboratory implementation", "canonicalUrl": "https://doi.org/10.1080/23742917.2016.1231523", "publicationDate": "2016-09-19", "eventDate": null, "dateNotes": "Published online 19 September 2016; the publisher PDF cites the 2017 journal issue 1(2), pages 88–107. No separate experiment date established.", "device": { "description": "Arduino Uno using an ATmega328P and author-controlled AES round-1 code", "configuration": "AddRoundKey and SubBytes operations implemented for the experiment; instrumented power observation with Keysight MSOX4104A. This is a white-box target with an author-controlled capture trigger, rather than a tested commercial black-box cryptographic product." }, "access": "Physical power-observation instrumentation and repeated operations on an author-programmed device; the white-box trigger and known implementation are prerequisites of this demonstration.", "claim": "DPA and CPA can recover the test AES-128 key from power leakage of the specified implementation.", "outcome": "The authors report recovering the complete 16-byte test key with both methods; CPA produced clearer interpretation in their comparison. The article identifies alignment and implementation knowledge as barriers when transferring the result to black-box devices.", "evidenceStatus": "published_research_demonstration_white_box", "evidenceGroup": "demonstration", "hardwareBoundary": "Arduino Uno/ATmega328P, the tested round-1 implementation and laboratory observability only; no arbitrary AES product, complete deployed protocol, robot or drone compromise is demonstrated.", "mechanisms": [ "Power Consumption Analysis Side Channel" ], "sources": [ { "url": "https://napier-repository.worktribe.com/output/426370/power-analysis-attacks-on-the-aes-128-s-box-using-differential-power-analysis-dpa-and-correlation-power-analysis-cpa", "title": "Power analysis attacks on the AES-128 S-box using differential power analysis (DPA) and correlation power analysis (CPA)", "type": "author_institutional_repository", "reviewedAt": "2026-11-01", "readStatus": "reviewed", "supports": "Corroborates title, authors, DOI, publication dates and abstract claim; no attached manuscript was exposed by this repository read.", "limitations": [ "Repository metadata/abstract only; it is the same study and not independent reproduction." ], "provenance": { "key": "arduino-author-repo", "scrapeId": "01a197ec-27d8-71ce-a525-b152f0caf4e7", "sourceURL": "https://napier-repository.worktribe.com/output/426370/power-analysis-attacks-on-the-aes-128-s-box-using-differential-power-analysis-dpa-and-correlation-power-analysis-cpa", "url": "https://napier-repository.worktribe.com/output/426370/power-analysis-attacks-on-the-aes-128-s-box-using-differential-power-analysis-dpa-and-correlation-power-analysis-cpa", "statusCode": 200, "title": "Power analysis attacks on the AES-128 S-box using differential power analysis (DPA) and correlation power analysis (CPA)", "creditsUsed": 1, "cacheState": "miss", "contentType": "text/html; charset=UTF-8", "readScope": "Relevant identity, configuration, results and limitations inspected." } }, { "url": "https://artefacts-discovery.researcher.life/full_text/DA-2/7c/7cbd8fadecbf3fb6aa75315bd8bb4078/full_text/1d851858a87d29baeb364ffbe353769f.pdf", "title": "Power analysis attacks on the AES-128 S-box using differential power analysis (DPA) and correlation", "type": "primary_research_paper_mirrored", "reviewedAt": "2026-11-01", "readStatus": "partial", "supports": "Original article identity, setup, results sections 4.1–4.3 and section 6 limitations inspected.", "limitations": [ "Public third-party PDF mirror; identity matched against the institutional repository and DOI. Publisher original route did not previously return substantive body.", "Parser reports 20 of 21 PDF pages; methods, results and limitations were available, but a complete-page review is not claimed." ], "provenance": { "key": "arduino-paper", "scrapeId": "01a197ee-22e0-77d5-babe-21ce6f1be493", "sourceURL": "https://artefacts-discovery.researcher.life/full_text/DA-2/7c/7cbd8fadecbf3fb6aa75315bd8bb4078/full_text/1d851858a87d29baeb364ffbe353769f.pdf", "url": "https://artefacts-discovery.researcher.life/full_text/DA-2/7c/7cbd8fadecbf3fb6aa75315bd8bb4078/full_text/1d851858a87d29baeb364ffbe353769f.pdf", "statusCode": 200, "title": "Power analysis attacks on the AES-128 S-box using differential power analysis (DPA) and correlation ", "numPages": 20, "totalPages": 21, "creditsUsed": 20, "cacheState": "miss", "contentType": "application/pdf", "readScope": "Parser reports 20 of 21 PDF pages; methods, results and limitations were available, but a complete-page review is not claimed." } } ], "followUp": { "performed": [ "Matched the accessible article to the institutional repository using title, authors, DOI and online date.", "Inspected the actual tested code scope and white-box limitations.", "Compared against published primary-dpa-1999; this is a different implementation and study." ], "result": "Original Arduino study is now supported beyond its abstract, with laboratory and implementation limits retained.", "next_steps": [ "A separate assessment would need the exact device implementation, observability and countermeasures; no target applicability is inferred here." ] }, "limitations": [ "No independent replication was reviewed; the repository abstract and mirror are two access routes to one study.", "The experiment implements two first-round operations and supplies capture assistance; black-box transfer was discussed rather than demonstrated.", "No circuit, firmware or production-device version beyond the source's stated platform was established.", "Partial PDF extraction is recorded rather than promoted to a complete-paper read." ], "mappings": { "emb3d": [ { "id": "TID-101", "name": "Power Consumption Analysis Side Channel", "url": "https://emb3d.mitre.org/threats/TID-101.html", "basis": "official-case-reference", "rationale": "The pinned official TID-101 page explicitly cites this exact Arduino DPA/CPA paper and its round-1 implementation.", "officialCaseAttribution": true, "provenance": { "repo": "https://github.com/mitre/emb3d", "commit": "0d7c25bb4e2928c516fb5811aaab9ff8bab2896c", "source_url": "https://emb3d.mitre.org/threats/TID-101.html", "relationship": "official_case_reference", "evidenceChain": [ "https://www.tandfonline.com/doi/full/10.1080/23742917.2016.1231523" ] } } ], "attack": [], "attackMappingRationale": "No current ATT&CK/ICS technique is forced onto a laboratory physical side-channel mechanism." }, "confidence": { "total": 77, "components": { "provenance": { "score": 19, "max": 20, "rationale": "Institutional metadata matches the original authored article obtained through a public mirror; the mirror is not the publisher." }, "technicalEvidence": { "score": 31, "max": 35, "rationale": "Setup, successful bounded result and limitations were read; extraction is partial by page count." }, "configurationSpecificity": { "score": 18, "max": 20, "rationale": "Chip, laboratory observability and partial AES implementation are explicit; exact firmware revision is not established." }, "independentCorroboration": { "score": 0, "max": 15, "rationale": "No independently executed reproduction was reviewed; two copies of one study count once." }, "followUpResolution": { "score": 9, "max": 10, "rationale": "The previously missing article body was obtained and the key white-box-to-black-box limitation resolved." } }, "rationale": "LrrK analyst confidence in this bounded public evidence account; not probability, severity, device applicability, an official MITRE score, or LrrK bench verification." }, "sharedSourceGroup": "study-lo-buchanan-carson-arduino-aes-dpa-cpa", "sourceChangeType": "new-case", "sourceArtifact": "primary/candidate-additions.json", "originDraftId": "DRAFT-PRI-001", "researchStrand": "primary" }, { "strand": "primary", "scope": "hardware", "reviewDate": "2026-11-01", "verificationBoundary": "AI-assisted desk review of public evidence; no hardware actuation, exploit execution, LrrK physical reproduction, or independent human acceptance.", "id": "LRRK-20261101-PRI-002", "originLeadIds": [ "primary-lead-coldboot-2013" ], "title": "2013 cold-boot evaluation: DDR1/DDR2 recovery and a bounded five-configuration DDR3 negative result", "canonicalUrl": "https://doi.org/10.1109/ARES.2013.52", "publicationDate": "2013", "eventDate": null, "dateNotes": "Conference 2–6 September 2013; IEEE indexing date 7 November 2013 is not the experiment date.", "device": { "description": "Seventeen non-ECC SDRAM system/configuration combinations, including five DDR3 combinations M–Q", "configuration": "DDR3 configurations: ASRock H77M-ITX/CMX8GX3M2A1600C9 (8192 MiB); Fujitsu ESPRIMO P900 E90+/M378B5773CHO-CK0 (2048 MiB); ASRock Z77 Pro4/HMT351U6BFR8C-H9 (4096 MiB); Asus PBP67LE/M378B5773DHO-CH9 (2048 MiB); ASRock Z77 Pro3/KHX2133C8D3T1K2/4G (4096 MiB), as transcribed by the PDF extraction. BIOS/CPU revisions for these rows are not supplied in the inspected table. The reported unsuccessful cooled DDR3 trials included cooling to about −10 °C; this temperature does not establish a universal retention threshold." }, "access": "Physical access to the running system or its RAM; the paper evaluates reset, power-cycle and RAM-transplantation conditions. Cooling and boot behavior materially affect outcomes.", "claim": "The study tested whether previously reported cold-boot memory recovery transferred across its specified systems and memory generations.", "outcome": "DDR1/DDR2 measurements broadly reproduced earlier recovery behavior. The five DDR3 configurations retained usable contents through warm reset but yielded noise rather than placed data after the tested cold reboots, including cooled trials. This is a negative result for those methods/configurations, not proof that DDR3 cannot retain data.", "evidenceStatus": "published_research_evaluation_with_negative_results", "evidenceGroup": "reported-result", "hardwareBoundary": "Distinguish warm reset (successful on the five tested DDR3 configurations) from the tested power-cycle cold-reboot path (unsuccessful). Seventeen configurations do not mean seventeen distinct computer models.", "mechanisms": [ "RAM Chip Contents Readout" ], "sources": [ { "url": "https://cyberside.net.ee/docs/fares_coldboot.pdf", "title": "coldboot-2013-paper", "type": "primary_research_paper_mirrored", "reviewedAt": "2026-11-01", "readStatus": "reviewed", "supports": "Eight-page authored study; table I configuration set, reset/cold-reboot results and cautious conclusion inspected.", "limitations": [ "Public mirror, with identity matched to the previously reviewed IEEE bibliographic record. Model strings above retain extraction uncertainty." ], "provenance": { "key": "coldboot-2013-paper", "scrapeId": "01a197ec-27d8-744a-ab62-d4678b79b2ab", "sourceURL": "https://cyberside.net.ee/docs/fares_coldboot.pdf", "url": "https://cyberside.net.ee/docs/fares_coldboot.pdf", "statusCode": 200, "numPages": 8, "totalPages": 8, "creditsUsed": 8, "cacheState": "miss", "contentType": "application/pdf", "readScope": "Relevant identity, configuration, results and limitations inspected." } }, { "url": "https://www.johannes-bauer.com/personal/publications/2016-03-Bauer-DFRWS-EU.pdf", "title": "Lest We Forget: Cold-Boot Attacks on Scrambled DDR3 Memory", "type": "primary_author_followup", "reviewedAt": "2026-11-01", "readStatus": "reviewed", "supports": "Later authors demonstrate that Intel DDR3 scrambling and remanence require a more specific explanation; it limits any universal reading of the 2013 negative result.", "limitations": [ "This later paper shares author Michael Gruhn with the 2013 study and uses different configurations/conditions. It is not an independent reproduction of the same five failures." ], "provenance": { "key": "coldboot-2016-paper", "scrapeId": "01a197ec-2786-7788-9344-c937c295f751", "sourceURL": "https://www.johannes-bauer.com/personal/publications/2016-03-Bauer-DFRWS-EU.pdf", "url": "https://www.johannes-bauer.com/personal/publications/2016-03-Bauer-DFRWS-EU.pdf", "statusCode": 200, "title": "Lest We Forget: Cold-Boot Attacks on Scrambled DDR3 Memory", "numPages": 10, "totalPages": 10, "creditsUsed": 10, "cacheState": "miss", "contentType": "application/pdf", "readScope": "Relevant identity, configuration, results and limitations inspected." } } ], "followUp": { "performed": [ "Read the original setup and separated twelve DDR1/DDR2 configurations from five DDR3 configurations.", "Retained the warm-reset success omitted by a broad 'DDR3 failed' summary.", "Read the later DDR3 descrambling experiment rather than treating the early inference as a final memory-generation rule." ], "result": "The original negative result is admitted with its exact boundary and later contrary examples; LRRK-20261101-PRI-003 records the later positive study separately.", "next_steps": [ "Do not infer current device behavior from memory generation alone; preserve power, firmware, controller/scrambling and acquisition conditions in any future evidence." ] }, "limitations": [ "The original explanation of DDR3 noise was uncertain; later work demonstrates usable cold-boot recovery on particular scrambled DDR3 systems.", "No secret-key extraction or modern embedded/drone applicability follows from these placed-data measurements alone.", "The mirror's extracted hardware spelling is not an independent board-identity verification.", "A failed cold-reboot test and a successful warm-reset read are separate observations." ], "mappings": { "emb3d": [ { "id": "TID-109", "name": "RAM Chip Contents Readout", "url": "https://emb3d.mitre.org/threats/TID-109.html", "basis": "official-case-reference", "rationale": "The official TID-109 cold-boot evidence quotes this 2013 study's DDR1/DDR2 evaluation. The five DDR3 negatives are retained from the original paper.", "officialCaseAttribution": true, "provenance": { "repo": "https://github.com/mitre/emb3d", "commit": "0d7c25bb4e2928c516fb5811aaab9ff8bab2896c", "source_url": "https://emb3d.mitre.org/threats/TID-109.html", "relationship": "official_case_reference", "evidenceChain": [ "https://ieeexplore.ieee.org/document/6657268/" ] } } ], "attack": [], "attackMappingRationale": "No direct ATT&CK/ICS match is asserted for this physical-memory evaluation." }, "confidence": { "total": 76, "components": { "provenance": { "score": 18, "max": 20, "rationale": "Authored complete eight-page paper from a public mirror matched to the publisher record, not a publisher-hosted PDF." }, "technicalEvidence": { "score": 31, "max": 35, "rationale": "Measured positive and negative results, warm-reset distinction and author uncertainty were inspected." }, "configurationSpecificity": { "score": 18, "max": 20, "rationale": "Seventeen configurations and five DDR3 board/module pairs are explicit; some platform revisions and OCR spelling remain uncertain." }, "independentCorroboration": { "score": 0, "max": 15, "rationale": "No distinct team repeated these exact negative configurations in the reviewed evidence; the 2016 follow-up shares an author." }, "followUpResolution": { "score": 9, "max": 10, "rationale": "Later contrary evidence was read and prevents an unsupported DDR3-immunity conclusion." } }, "rationale": "LrrK analyst confidence in this bounded public evidence account; not probability, severity, device applicability, an official MITRE score, or LrrK bench verification." }, "sharedSourceGroup": "study-gruhn-mueller-coldboot-2013", "sourceChangeType": "new-case", "sourceArtifact": "primary/candidate-additions.json", "originDraftId": "DRAFT-PRI-002", "researchStrand": "primary" }, { "strand": "primary", "scope": "hardware", "reviewDate": "2026-11-01", "verificationBoundary": "AI-assisted desk review of public evidence; no hardware actuation, exploit execution, LrrK physical reproduction, or independent human acceptance.", "id": "LRRK-20261101-PRI-003", "originLeadIds": [ "primary-lead-coldboot-2013" ], "title": "2016 recovery of cooled, scrambled DDR3 memory on specified Intel systems", "canonicalUrl": "https://www.johannes-bauer.com/personal/publications/2016-03-Bauer-DFRWS-EU.pdf", "publicationDate": "2016", "eventDate": null, "dateNotes": "Author-hosted 2016 DFRWS Europe paper; no separate experiment date established.", "device": { "description": "Predominantly Intel Core i3-3225/MSI B75MA-P45; additional reported CPU/mainboard combinations", "configuration": "The paper also lists i5-760/MSI H55M-P33, i5-2520M/Dell 03PH4G and i5-2400/Esprimo P900 E90+. It distinguishes constant from randomized Intel memory scrambling and single/dual-channel layouts. DDR3 DIMMs are described as produced in 2013, 666/833 MHz types, without exact module part numbers in the inspected results. Reported usable trials used cooling to about −30 °C; operating-temperature trials at about +30 °C produced no usable image." }, "access": "Physical RAM access and controlled cold-boot acquisition; usable recovery in this study depended on substantial cooling, retained data, address/layout information and known-plaintext/related-data assumptions.", "claim": "Intel memory scrambling does not by itself rule out cold-boot recovery on the tested DDR3 configurations.", "outcome": "The authors report restoring placed memory images after cooled cold boots using descrambling and, where required, channel deinterleaving. At operating temperature their captured data had completely decayed and no usable image was obtained. Recovery was near the original image with occasional errors, rather than evidence of arbitrary secret recovery.", "evidenceStatus": "published_research_demonstration_with_negative_boundary", "evidenceGroup": "demonstration", "hardwareBoundary": "Specified older Intel DDR3 systems and the documented cooled acquisition conditions; neither DDR4 support nor uncooled DDR3 recovery was established.", "mechanisms": [ "RAM Chip Contents Readout" ], "sources": [ { "url": "https://www.johannes-bauer.com/personal/publications/2016-03-Bauer-DFRWS-EU.pdf", "title": "Lest We Forget: Cold-Boot Attacks on Scrambled DDR3 Memory", "type": "primary_author_paper", "reviewedAt": "2026-11-01", "readStatus": "reviewed", "supports": "Ten-page author-hosted paper; investigated machines, measured recovery, negative operating-temperature result and conclusions inspected.", "limitations": [ "Known-plaintext/layout assumptions apply; exact DIMM identities are not established in the inspected results." ], "provenance": { "key": "coldboot-2016-paper", "scrapeId": "01a197ec-2786-7788-9344-c937c295f751", "sourceURL": "https://www.johannes-bauer.com/personal/publications/2016-03-Bauer-DFRWS-EU.pdf", "url": "https://www.johannes-bauer.com/personal/publications/2016-03-Bauer-DFRWS-EU.pdf", "statusCode": 200, "title": "Lest We Forget: Cold-Boot Attacks on Scrambled DDR3 Memory", "numPages": 10, "totalPages": 10, "creditsUsed": 10, "cacheState": "miss", "contentType": "application/pdf", "readScope": "Relevant identity, configuration, results and limitations inspected." } }, { "url": "https://cyberside.net.ee/docs/fares_coldboot.pdf", "title": "coldboot-2013-paper", "type": "prior_primary_study", "reviewedAt": "2026-11-01", "readStatus": "reviewed", "supports": "Earlier five-configuration DDR3 negative result is the comparison being qualified.", "limitations": [ "Shared author and different test conditions; not an independent confirmation of the 2016 result." ], "provenance": { "key": "coldboot-2013-paper", "scrapeId": "01a197ec-27d8-744a-ab62-d4678b79b2ab", "sourceURL": "https://cyberside.net.ee/docs/fares_coldboot.pdf", "url": "https://cyberside.net.ee/docs/fares_coldboot.pdf", "statusCode": 200, "numPages": 8, "totalPages": 8, "creditsUsed": 8, "cacheState": "miss", "contentType": "application/pdf", "readScope": "Relevant identity, configuration, results and limitations inspected." } } ], "followUp": { "performed": [ "Compared the measured cooled success and operating-temperature failure.", "Retained hardware, controller scrambling, channel and acquisition assumptions.", "Compared with the 2013 study without claiming identical DIMMs or that all DDR3 behavior was disproved." ], "result": "A scoped positive DDR3 counterexample is supported; the earlier negative study remains valid for its own tested conditions.", "next_steps": [ "Exact controller, firmware, DIMM identity, thermal condition and recovery error bounds remain prerequisites for any new applicability claim." ] }, "limitations": [ "No current Intel platform, different memory encryption design, DDR4/DDR5 system, robot or drone is demonstrated by this paper.", "The reported software/tool link is anonymized in this author PDF; no runnable descrambling artifact was verified or executed.", "Near-complete placed-image recovery is distinct from independently extracting a live production cryptographic secret.", "Later paper and earlier evaluation share an author, so they earn no independent-reproduction points here." ], "mappings": { "emb3d": [ { "id": "TID-109", "name": "RAM Chip Contents Readout", "url": "https://emb3d.mitre.org/threats/TID-109.html", "basis": "analyst-inference", "rationale": "Physical recovery of RAM contents fits TID-109. This 2016 study is a supplemental analyst cross-reference and is not claimed to be named on the pinned MITRE page.", "officialCaseAttribution": false, "provenance": { "repo": "https://github.com/mitre/emb3d", "commit": "0d7c25bb4e2928c516fb5811aaab9ff8bab2896c", "source_url": "https://emb3d.mitre.org/threats/TID-109.html", "relationship": "analyst_inference", "evidenceChain": [] } } ], "attack": [], "attackMappingRationale": "No direct ATT&CK/ICS match is asserted." }, "confidence": { "total": 77, "components": { "provenance": { "score": 20, "max": 20, "rationale": "Original author-hosted paper and ten-page extraction inspected." }, "technicalEvidence": { "score": 31, "max": 35, "rationale": "Measured recovery and negative uncooled boundary were read; no physical reproduction by LrrK." }, "configurationSpecificity": { "score": 17, "max": 20, "rationale": "CPU/mainboard and scrambling/channel conditions are given; exact DIMM and firmware revisions remain incomplete." }, "independentCorroboration": { "score": 0, "max": 15, "rationale": "No independent reproduction was reviewed; shared-author prior work is not counted as such." }, "followUpResolution": { "score": 9, "max": 10, "rationale": "The apparent generation-wide contradiction was resolved into differing configurations and conditions." } }, "rationale": "LrrK analyst confidence in this bounded public evidence account; not probability, severity, device applicability, an official MITRE score, or LrrK bench verification." }, "sharedSourceGroup": "study-bauer-gruhn-freiling-ddr3-descrambling-2016", "sourceChangeType": "new-case", "sourceArtifact": "primary/candidate-additions.json", "originDraftId": "DRAFT-PRI-003", "researchStrand": "primary" }, { "strand": "primary", "scope": "hardware", "reviewDate": "2026-11-01", "verificationBoundary": "AI-assisted desk review of public evidence; no hardware actuation, exploit execution, LrrK physical reproduction, or independent human acceptance.", "id": "LRRK-20261101-PRI-004", "originLeadIds": [ "primary-lead-iommu-2010" ], "title": "2018 IOMMU boot-window bypass demonstrated on a Dell Precision T1700", "canonicalUrl": "https://link.springer.com/article/10.1186/s13173-017-0066-7", "publicationDate": "2018-01-09", "eventDate": null, "dateNotes": "Published 9 January 2018; a preliminary version was presented in 2016. This is not the 2010 Sang/Lacombe/Nicomette/Deswarte study.", "device": { "description": "Dell Precision T1700 with a malicious PCI Express FPGA peripheral", "configuration": "Firmware A06 (source renders 12/05/2013 without disambiguating month/day); Intel i7-4770, PCH C220, Linux 4.3.4 with IOMMU_INTEL enabled, GRUB 2.02.beta2. Physical prototype used a Xilinx ML605-based peripheral, after preliminary hypervisor simulation." }, "access": "A malicious or already compromised DMA-capable PCIe peripheral, precise knowledge of the target hardware/kernel layout, and the vulnerable firmware-to-kernel protection transition. The demonstrated physical FPGA path is separate from the paper's hypothesized remote peripheral-compromise entry.", "claim": "An IOMMU being enabled after boot does not establish that its configuration was protected throughout boot.", "outcome": "Following preliminary hypervisor simulation, the authors report a physical FPGA proof of concept that exploited a boot-time DMA protection window and changed Linux kernel behavior so an unprivileged local program gained effective root privileges. This does not establish a universal VT-d failure or an arbitrary post-boot IOMMU bypass.", "evidenceStatus": "published_research_physical_proof_of_concept", "evidenceGroup": "demonstration", "hardwareBoundary": "Tested firmware/boot/kernel sequence and PCIe access conditions only; the 2010 bridge/requester-identity issue is a different study, and modern platform protection state is not inferred.", "mechanisms": [ "Unauthorized Direct Memory Access (DMA)" ], "sources": [ { "url": "https://link.springer.com/article/10.1186/s13173-017-0066-7", "title": "IOMMU protection against I/O attacks: a vulnerability and a proof of concept | Journal of the Brazilian Computer Society | Springer Nature Link", "type": "primary_open_access_research_article", "reviewedAt": "2026-11-01", "readStatus": "reviewed", "supports": "Full accessible article identity, target configuration, assumptions, separate simulation/FPGA implementations, reported outcome and limitations inspected.", "limitations": [ "The original 2010 IEEE methods remained inaccessible. The 2018 paper describes that older work in related work, which does not replace reading the 2010 original." ], "provenance": { "key": "iommu-extension", "scrapeId": "01a197eb-becd-713b-b3fc-b09478b7313b", "sourceURL": "https://link.springer.com/article/10.1186/s13173-017-0066-7", "url": "https://link.springer.com/article/10.1186/s13173-017-0066-7", "statusCode": 200, "title": "IOMMU protection against I/O attacks: a vulnerability and a proof of concept | Journal of the Brazilian Computer Society | Springer Nature Link", "creditsUsed": 1, "cacheState": "miss", "contentType": "text/html; charset=utf-8", "readScope": "Relevant identity, configuration, results and limitations inspected." } }, { "url": "https://webhost.laas.fr/TSF/deswarte/Page_perso/Actes_de_colloques.html", "title": "[AC] Actes de colloques\n Conference proceedings (102)", "type": "original_2010_author_bibliography", "reviewedAt": "2026-11-01", "readStatus": "reviewed", "supports": "Confirms identity and conference metadata of the separate unresolved 2010 lead.", "limitations": [ "Bibliography only; not original 2010 methods or configuration." ], "provenance": { "key": "iommu-author-list", "scrapeId": "01a197ec-28c2-7381-8e2f-03b260533170", "sourceURL": "https://webhost.laas.fr/TSF/deswarte/Page_perso/Actes_de_colloques.html", "url": "https://webhost.laas.fr/TSF/deswarte/Page_perso/Actes_de_colloques.html", "statusCode": 200, "title": "[AC] Actes de colloques\n Conference proceedings (102)", "creditsUsed": 1, "cacheState": "miss", "contentType": "text/html; charset=UTF-8", "readScope": "Relevant identity, configuration, results and limitations inspected." } } ], "followUp": { "performed": [ "Checked the IEEE PDF route; it returned a sign-in/purchase page with abstract, not the paper.", "Checked the original 2010 coauthor's public bibliography and author-manuscript search routes without bypass.", "Read the accessible 2018 paper and separated its measured boot-window attack from the earlier PCI/PCIe requester-identity discussion." ], "result": "A related 2018 case is admitted. The 2010 lead remains pending for its original methods/configuration, so this record must not silently resolve or rename it.", "next_steps": [ "Read an ordinarily accessible 2010 author manuscript if one becomes available; do not assume the 2018 machine or boot conditions describe the 2010 exploit." ] }, "limitations": [ "Exact hardware/kernel knowledge and malicious-peripheral access are assumed.", "The physical proof of concept is distinct from the preliminary hypervisor simulation.", "Windows/BSD and Intel TXT were discussed as further work, not validated outcomes.", "The article's broad prevalence statements are not treated as measured evidence for every IOMMU system.", "No independent reproduction or present-day vendor remediation status was verified." ], "mappings": { "emb3d": [ { "id": "TID-107", "name": "Unauthorized Direct Memory Access (DMA)", "url": "https://emb3d.mitre.org/threats/TID-107.html", "basis": "analyst-inference", "rationale": "The measured malicious-peripheral DMA outcome fits TID-107. MITRE directly cites the separate 2010 paper; this 2018 case is explicitly a supplemental analyst inference.", "officialCaseAttribution": false, "provenance": { "repo": "https://github.com/mitre/emb3d", "commit": "0d7c25bb4e2928c516fb5811aaab9ff8bab2896c", "source_url": "https://emb3d.mitre.org/threats/TID-107.html", "relationship": "analyst_inference", "evidenceChain": [] } } ], "attack": [], "attackMappingRationale": "No ATT&CK/ICS cross-reference is forced from the physical mechanism alone; no direct official case attribution was located." }, "confidence": { "total": 78, "components": { "provenance": { "score": 20, "max": 20, "rationale": "Original open-access publisher article, authors, date and complete technical account inspected." }, "technicalEvidence": { "score": 32, "max": 35, "rationale": "Both simulation and subsequent physical FPGA evidence are distinguished; reported kernel outcome retained." }, "configurationSpecificity": { "score": 19, "max": 20, "rationale": "Machine, firmware, processor, chipset, Linux version, bootloader and assumptions are explicit." }, "independentCorroboration": { "score": 0, "max": 15, "rationale": "No independently reproduced experiment was reviewed; a same-team preliminary version is not independent." }, "followUpResolution": { "score": 7, "max": 10, "rationale": "The accessible related study was resolved, while the original 2010 evidence gap remains held." } }, "rationale": "LrrK analyst confidence in this bounded public evidence account; not probability, severity, device applicability, an official MITRE score, or LrrK bench verification." }, "sharedSourceGroup": "study-morgan-alata-nicomette-kaaniche-iommu-2018", "sourceChangeType": "new-case", "sourceArtifact": "primary/candidate-additions.json", "originDraftId": "DRAFT-PRI-004", "researchStrand": "primary" }, { "strand": "primary", "scope": "hardware", "reviewDate": "2026-11-01", "verificationBoundary": "AI-assisted desk review of public evidence; no hardware actuation, exploit execution, LrrK physical reproduction, or independent human acceptance.", "id": "LRRK-20261101-PRI-005", "originLeadIds": [ "primary-lead-rowhammer-exploit-2019" ], "title": "2015 Project Zero Rowhammer exploits and bounded non-ECC DDR3 laptop measurements", "canonicalUrl": "https://projectzero.google/2015/03/exploiting-dram-rowhammer-bug-to-gain.html", "publicationDate": "2015-03", "eventDate": null, "dateNotes": "Original Project Zero report is dated March 2015 by its canonical path and the linked original repository; the exact day was not established in this read. Individual experiment dates remain unknown.", "device": { "description": "Anonymized x86-64 Linux/Native Client targets and a 29-laptop non-ECC DDR3 characterization set", "configuration": "Laptop table spans 2010–2014 model years with anonymized models, CPU families and memory vendors. The physical disturbance test found bit flips on 15 of 29 laptops; this count is not a count of successful end-to-end privilege escalations." }, "access": "Execution of local unprivileged x86-64 code on a susceptible memory configuration; the separate Native Client experiment ran inside the then-current sandbox. No physical access is required by the reported software-induced exploit path.", "claim": "Repeatable DRAM disturbance can be turned into privilege or isolation failures in specified susceptible systems.", "outcome": "The authors report two working exploits: a Native Client sandbox escape and an x86-64 Linux page-table corruption exploit yielding access to physical memory. Their characterization table recorded faults on 15 of 29 non-ECC DDR3 laptops and no faults in the remaining fourteen under that test; neither count establishes a population prevalence or universal safety.", "evidenceStatus": "original_author_research_demonstration", "evidenceGroup": "demonstration", "hardwareBoundary": "Historical, anonymized susceptible DDR3 systems and the reported software environments; all tested bit-flip-positive devices are not established as successfully exploited.", "mechanisms": [ "Hardware Fault Injection – Data Manipulation" ], "sources": [ { "url": "https://projectzero.google/2015/03/exploiting-dram-rowhammer-bug-to-gain.html", "title": "Exploiting the DRAM rowhammer bug to gain kernel privileges - Project Zero", "type": "original_researcher_institutional_report", "reviewedAt": "2026-11-01", "readStatus": "reviewed", "supports": "Original mechanism, two reported exploits, 29-row results table, negative-test caution and mitigation discussion inspected.", "limitations": [ "Exact exploited device/model/kernel revisions remain undisclosed in the inspected account; no execution by LrrK." ], "provenance": { "key": "projectzero-original", "scrapeId": "01a197ee-950e-73e2-9f03-ad494b617373", "sourceURL": "https://googleprojectzero.blogspot.com/2015/03/exploiting-dram-rowhammer-bug-to-gain.html", "url": "https://projectzero.google/2015/03/exploiting-dram-rowhammer-bug-to-gain.html", "statusCode": 200, "title": "\n \n Exploiting the DRAM rowhammer bug to gain kernel privileges - Project Zero\n \n ", "creditsUsed": 1, "cacheState": "miss", "contentType": "text/html", "readScope": "Relevant identity, configuration, results and limitations inspected." } }, { "url": "https://github.com/google/rowhammer-test", "title": "GitHub - google/rowhammer-test: Test DRAM for bit flips caused by the rowhammer problem · GitHub", "type": "original_research_repository", "reviewedAt": "2026-11-01", "readStatus": "reviewed", "supports": "The linked public rowhammer-test repository exists and its README identifies the memory disturbance test artifact.", "limitations": [ "Repository/README inspection only, not an audit, execution or independent reproduction." ], "provenance": { "key": "projectzero-repository", "scrapeId": "01a197ef-9b22-776e-88a4-b91d3acae1b1", "sourceURL": "https://github.com/google/rowhammer-test", "url": "https://github.com/google/rowhammer-test", "statusCode": 200, "title": "GitHub - google/rowhammer-test: Test DRAM for bit flips caused by the rowhammer problem · GitHub", "creditsUsed": 1, "cacheState": "miss", "contentType": "text/html; charset=utf-8", "readScope": "Repository/README inspection only, not an audit, execution or independent reproduction." } } ], "followUp": { "performed": [ "Identified arXiv 1904.09724 as a retrospective rather than a new 2019 exploit.", "Read four relevant retrospective passages and followed its historical account to the original Project Zero report.", "Counted the 29-row results table as 15 observed-fault and 14 no-observed-fault entries, retaining its nonrepresentative-sample warning.", "Compared against primary-rowhammer-2014, which is a distinct foundational disturbance study." ], "result": "The 2019 reference receives a bibliographic correction; the actual original 2015 exploitation evidence becomes a separately dated case.", "next_steps": [ "Exact target identities and current platform applicability remain unknown; do not extrapolate the historical table into a drone, GPU or present-day DRAM prevalence claim." ] }, "limitations": [ "The retrospective and the original researchers' repository are not independent reproduction of the original exploit.", "The nonrepresentative laptop table measures fault observations, not successful privilege escalations on all fifteen devices.", "A negative test does not establish absence of vulnerability; the paper's ECC desktop observation is not an ECC-immunity proof.", "The original report also states expectations for other systems; those are not promoted to demonstrated outcomes." ], "mappings": { "emb3d": [ { "id": "TID-110", "name": "Hardware Fault Injection – Data Manipulation", "url": "https://emb3d.mitre.org/threats/TID-110.html", "basis": "analyst-inference", "rationale": "The reported software-induced hardware disturbance and memory corruption fit TID-110. The official page cites the later retrospective, while this original 2015 case is an analyst-resolved historical reference.", "officialCaseAttribution": false, "provenance": { "repo": "https://github.com/mitre/emb3d", "commit": "0d7c25bb4e2928c516fb5811aaab9ff8bab2896c", "source_url": "https://emb3d.mitre.org/threats/TID-110.html", "relationship": "analyst_inference", "evidenceChain": [] } } ], "attack": [], "attackMappingRationale": "No software-exploitation technique is assigned solely because the measured hardware fault had a privilege effect." }, "confidence": { "total": 72, "components": { "provenance": { "score": 20, "max": 20, "rationale": "Original Project Zero institutional report and linked original repository inspected." }, "technicalEvidence": { "score": 32, "max": 35, "rationale": "Working exploit claims and numerical characterization are distinct and supported in the authored report." }, "configurationSpecificity": { "score": 11, "max": 20, "rationale": "Memory type and software context are explicit, but target identities and exact revisions are anonymized." }, "independentCorroboration": { "score": 0, "max": 15, "rationale": "A later survey/citation and the original team's repository do not constitute independent reproduction." }, "followUpResolution": { "score": 9, "max": 10, "rationale": "Wrong-year/new-exploit ambiguity resolved by following the retrospective to the dated original." } }, "rationale": "LrrK analyst confidence in this bounded public evidence account; not probability, severity, device applicability, an official MITRE score, or LrrK bench verification." }, "sharedSourceGroup": "study-projectzero-rowhammer-exploitation-2015", "sourceChangeType": "new-case", "sourceArtifact": "primary/candidate-additions.json", "originDraftId": "DRAFT-PRI-005", "researchStrand": "primary" }, { "strand": "primary", "scope": "hardware", "reviewDate": "2026-11-01", "verificationBoundary": "AI-assisted desk review of public evidence; no hardware actuation, exploit execution, LrrK physical reproduction, or independent human acceptance.", "id": "LRRK-20261101-PRI-006", "originLeadIds": [ "primary-lead-ddr4-2021-secondary" ], "title": "Blacksmith: measured DDR4/LPDDR4X faults with exploitability analysis kept separate", "canonicalUrl": "https://comsec.ethz.ch/wp-content/files/blacksmith_sp22.pdf", "publicationDate": "2021-11-15", "eventDate": null, "dateNotes": "Authors report public disclosure on 15 November 2021; the paper appeared at IEEE S&P 2022. DIMMs were acquired beginning July 2020, not all manufactured in 2021.", "device": { "description": "Forty DDR4 DIMMs characterized on ten Intel i7-8700K machines; nineteen LPDDR4X devices on a development board", "configuration": "PC tests used Ubuntu 18.04 LTS/Linux 4.15.0 and DIMMs anonymously grouped A–D. The LPDDR4X tests used an in-house JEDEC-compliant board. The public tool's address-mapping assumptions include Intel Coffee Lake; arbitrary platform compatibility is not established." }, "access": "Local memory-intensive test execution on a suitably configured host or the study's development platform. This review establishes characterization conditions, not a demonstrated generic remote entry or a privilege-free packaged exploit.", "claim": "Non-uniform memory access patterns can defeat the tested proprietary in-DRAM refresh mitigations and expose susceptible memory faults.", "outcome": "The paper reports faults on all 40 tested DDR4 DIMMs and on 16 of 19 LPDDR4X devices. It then analyzes measured fault locations for compatibility with earlier page-table, RSA and code-corruption attacks. These fault-location/exploitability results are not represented here as completed end-to-end attacks on all devices or all DDR4 memory.", "evidenceStatus": "published_research_characterization_and_exploitability_analysis", "evidenceGroup": "demonstration", "hardwareBoundary": "The actual DDR4/LPDDR4X test pools, platform and mappings only. Three tested LPDDR4X devices had no observed faults under this evaluation; this does not establish permanent safety.", "mechanisms": [ "Hardware Fault Injection – Data Manipulation" ], "sources": [ { "url": "https://comsec.ethz.ch/research/dram/blacksmith/", "title": "Blacksmith – Computer Security Group", "type": "original_author_research_page", "reviewedAt": "2026-11-01", "readStatus": "reviewed", "supports": "Connects the supplied secondary lead to the original study, disclosure date, paper and code; reports test pool and mitigation discussion.", "limitations": [ "The author page's broad headline is narrowed to its measured test pool; it is the same team/study, not independent corroboration." ], "provenance": { "key": "blacksmith-author", "scrapeId": "01a197eb-be55-772b-96e6-c99d2e9dcbf3", "sourceURL": "https://comsec.ethz.ch/research/dram/blacksmith/", "url": "https://comsec.ethz.ch/research/dram/blacksmith/", "statusCode": 200, "title": "Blacksmith – Computer Security Group", "creditsUsed": 1, "cacheState": "miss", "contentType": "text/html; charset=UTF-8", "readScope": "Relevant identity, configuration, results and limitations inspected." } }, { "url": "https://comsec.ethz.ch/wp-content/files/blacksmith_sp22.pdf", "title": "Blacksmith: Scalable Rowhammering in the Frequency Domain", "type": "primary_author_paper", "reviewedAt": "2026-11-01", "readStatus": "partial", "supports": "Hardware setup, DDR4 and LPDDR4X results, section V-C exploitability analysis, limitations and test-pool appendix content inspected.", "limitations": [ "Parser reports 16 of 19 PDF pages. Core methods/results and appendix test-pool text were returned; a complete 19-page review is not claimed.", "The section's conditional exploitability language is not promoted to completed attacks on every test-pool device." ], "provenance": { "key": "blacksmith-paper", "scrapeId": "01a197ec-2782-77fe-aa77-b34f782a4b30", "sourceURL": "https://comsec.ethz.ch/wp-content/files/blacksmith_sp22.pdf", "url": "https://comsec.ethz.ch/wp-content/files/blacksmith_sp22.pdf", "statusCode": 200, "title": "Blacksmith: Scalable Rowhammering in the Frequency Domain", "numPages": 16, "totalPages": 19, "creditsUsed": 16, "cacheState": "miss", "contentType": "application/pdf", "readScope": "Parser reports 16 of 19 PDF pages. Core methods/results and appendix test-pool text were returned; a complete 19-page review is not claimed." } }, { "url": "https://github.com/comsec-group/blacksmith", "title": "GitHub - comsec-group/blacksmith: Next-gen Rowhammer fuzzer that uses non-uniform, frequency-based patterns (IEEE S&P '22). · GitHub", "type": "original_research_repository", "reviewedAt": "2026-11-01", "readStatus": "reviewed", "supports": "README confirms study/tool identity, tested Ubuntu/kernel environment and Coffee Lake mapping assumption.", "limitations": [ "README inspection only; no dependency installation, source audit, compilation or memory-fault execution." ], "provenance": { "key": "blacksmith-repository", "scrapeId": "01a197ef-9b1d-7539-a812-72d577d9c937", "sourceURL": "https://github.com/comsec-group/blacksmith", "url": "https://github.com/comsec-group/blacksmith", "statusCode": 200, "title": "GitHub - comsec-group/blacksmith: Next-gen Rowhammer fuzzer that uses non-uniform, frequency-based patterns (IEEE S&P '22). · GitHub", "creditsUsed": 1, "cacheState": "miss", "contentType": "text/html; charset=utf-8", "readScope": "README inspection only; no dependency installation, source audit, compilation or memory-fault execution." } } ], "followUp": { "performed": [ "Read the Ars lead, then the original author page and paper instead of relying on the broad secondary headline.", "Separated actual memory faults from derived exploitable-bit analysis and conditional end-to-end claims.", "Read the LPDDR4X negative boundary and tool platform assumptions.", "Compared against the already indexed 2014 Rowhammer and later GPU studies; Blacksmith is a distinct historical study." ], "result": "The original DDR4 study is admitted with measured sample counts and a separate exploitability boundary; no universal DDR4/ECC/drone claim is supported.", "next_steps": [ "Any separate device applicability claim requires exact memory/controller/firmware/isolation state and a separately authorized validation; no current product inference is made." ] }, "limitations": [ "Forty of forty is a result for this acquired pool, not a global vulnerability rate.", "Observed faults and fault-location analysis differ from a complete exploit delivery chain.", "Author page, paper, repository and press coverage describe one study and earn no independent-reproduction points.", "No blanket ECC, DDR5, GPU, robot or drone conclusion follows.", "Source page-count partial-read status is retained even though core results were available." ], "mappings": { "emb3d": [ { "id": "TID-110", "name": "Hardware Fault Injection – Data Manipulation", "url": "https://emb3d.mitre.org/threats/TID-110.html", "basis": "analyst-inference", "rationale": "The pinned official page links the 2021 Ars article; that article resolves to this Blacksmith study. The mechanism-level mapping is explicit analyst inference, without claiming MITRE directly reviewed this case.", "officialCaseAttribution": false, "provenance": { "repo": "https://github.com/mitre/emb3d", "commit": "0d7c25bb4e2928c516fb5811aaab9ff8bab2896c", "source_url": "https://emb3d.mitre.org/threats/TID-110.html", "relationship": "analyst_inference", "evidenceChain": [ "https://arstechnica.com/gadgets/2021/11/ddr4-memory-is-even-more-susceptible-to-rowhammer-attacks-than-anyone-thought/", "https://comsec.ethz.ch/research/dram/blacksmith/" ] } } ], "attack": [], "attackMappingRationale": "No direct ATT&CK/ICS match is asserted for memory-fault characterization." }, "confidence": { "total": 79, "components": { "provenance": { "score": 20, "max": 20, "rationale": "Original author page/paper and original linked repository inspected; the secondary source was only the discovery route." }, "technicalEvidence": { "score": 32, "max": 35, "rationale": "Measured faults and exploitability calculations were inspected and kept distinct; PDF extraction remains partial by count." }, "configurationSpecificity": { "score": 18, "max": 20, "rationale": "CPU, operating system, kernel, anonymized DIMM pool and development-board context are stated; full arbitrary-target delivery conditions are not proven." }, "independentCorroboration": { "score": 0, "max": 15, "rationale": "Same-team artifacts and press copies are not independent reproduction." }, "followUpResolution": { "score": 9, "max": 10, "rationale": "The underlying study, measured boundaries, negative LPDDR4X results and broad headline qualification were resolved." } }, "rationale": "LrrK analyst confidence in this bounded public evidence account; not probability, severity, device applicability, an official MITRE score, or LrrK bench verification." }, "sharedSourceGroup": "study-blacksmith-2021-2022", "sourceChangeType": "new-case", "sourceArtifact": "primary/candidate-additions.json", "originDraftId": "DRAFT-PRI-006", "researchStrand": "primary" }, { "title": "CRAFT: clock-fault effects on an FPGA-implemented RISC-V core, with pre/post-silicon differences", "canonicalUrl": "https://dl.acm.org/doi/10.1145/3768725.3768726", "scope": "hardware", "publicationDate": "2025-10-18", "eventDate": null, "reviewDate": "2026-11-01", "dateNotes": "ACM publication history: 18 October 2025, HASP 2025. arXiv v1: 5 March 2025; reviewed latest displayed v4: 22 October 2025. No withdrawal displayed in the retained canonical record.", "device": { "description": "cv32e40x RISC-V soft core deployed on a SAKURA-X Xilinx Kintex-7 XC7K160T FPGA", "configuration": "Vivado 2020.2 pre-silicon/netlist experiments and a separate instrumented physical FPGA implementation running an embedded MNIST inference workload. Internal clock-generation and trigger instrumentation were part of the research setup; exact core commit/bitstream was not established." }, "access": "Control of laboratory clock-generation/trigger instrumentation in the FPGA implementation; not a demonstrated remote vector on a deployed device.", "claim": "The authors report instruction skips and register-data corruption under clock faults, and physically validate selected pre-silicon fault cases on the FPGA core.", "outcome": "Cases 1, 3 and 4 are reported to have similar pre/post-silicon effects; case 2 differs in register values and program-counter behavior. One instruction-skip path raises an illegal-instruction flag and depends on exception handling, while other reported corruption cases lack that flag.", "evidenceStatus": "author-reported-controlled-demonstration", "evidenceGroup": "demonstration", "hardwareBoundary": "Physical FPGA clock faults plus separately labeled simulation; no manufactured RISC-V ASIC, production robot, drone or measured flight/control takeover.", "mechanisms": [ "Processor clock fault injection", "Instruction skip", "Register-data corruption" ], "followUp": { "performed": [ "Followed the formerly abstract-only lead to original v1, the latest displayed v4, and publisher full text.", "Verified the HASP 2025 DOI and publication date; did not mislabel the published work as only a preprint.", "Compared the physical FPGA experiment with pre-silicon cases and retained the case-2 disagreement.", "Searched original artifact and exact-title follow-up routes; no attributable experiment repository or independent reproduction was established.", "An optional versioned PDF attempt returned a non-JSON tool error with no usable body/usage receipt; it was not retried. HTML sources support this record." ], "result": "The clock-fault mechanism is physically demonstrated on an FPGA soft core under author instrumentation; applicability to deployed robotics remains a separate unanswered question.", "next_steps": [ "Review exact RTL commit, bitstream, workload and experiment scripts if released.", "Require device-specific evidence before transferring fault parameters or outcomes to another processor/platform." ] }, "limitations": [ "An FPGA implementation is physical hardware, but is not a fabricated RISC-V ASIC or a fielded robot controller.", "Case 2 does not match between simulation and FPGA; do not describe all simulated faults as physically reproduced.", "The Figure 7 glitched-clock depiction in v4 is hand drawn because the logic analyzer could not resolve that clock shape; it is not an independently measured waveform.", "The instruction-skip example involves exception-handling behavior; no secure-boot/authentication bypass is established by this case.", "Simulation search-space reduction is not a measured physical success rate.", "No independent reproduction, exact implementation pin or deployed-system exploit reviewed.", "No ATT&CK/ICS technique or memory-disturbance/Rowhammer mapping is inferred from register corruption alone." ], "confidence": { "total": 77, "components": { "provenance": { "score": 20, "max": 20, "rationale": "Original publisher full text and versioned author/canonical sources inspected." }, "technicalEvidence": { "score": 31, "max": 35, "rationale": "Relevant physical FPGA and netlist methods/results inspected, including the mismatch and measurement caveat; no raw experimental artifacts independently validated." }, "configurationSpecificity": { "score": 18, "max": 20, "rationale": "Core, FPGA and tool version are named; exact RTL/bitstream and workload revision pins remain missing." }, "independentCorroboration": { "score": 0, "max": 15, "rationale": "Publisher and arXiv copies are the same experiment; no independent reproduction established." }, "followUpResolution": { "score": 8, "max": 10, "rationale": "Resolved publication/version status and physical-versus-simulation scope while retaining case-specific disagreement." } }, "rationale": "LRRK evidence strength for the narrowly stated claim; not severity, exploitation probability, current-device applicability, safety or an official MITRE score." }, "id": "LRRK-20261101-DR2-003", "originDraftId": "DRAFT-DR2-003", "originLeadIds": [ "LRRK-LEAD-CRAFT-2025" ], "strand": "primary", "researchStrand": "drones-robotics-followup02", "sources": [ { "url": "https://dl.acm.org/doi/full/10.1145/3768725.3768726", "title": "CRAFT, HASP 2025, DOI 10.1145/3768725.3768726", "type": "primary-source", "reviewedAt": "2026-11-01", "readStatus": "reviewed-selected-sections", "supports": "Published-workshop metadata, exact core/FPGA names, physical setup and bounded validation results.", "locators": [ "Sections 4.1, 4.5 and 4.6", "Section 5: Attack Validation: Pre- and Post-Silicon", "Sections 6.5 and 6.6", "Publication history" ], "limitations": [ "Full publisher HTML retained; relevant methods/results and textual figure/table descriptions reviewed, not independent visual waveform measurement." ], "provenance": {} }, { "url": "https://arxiv.org/html/2503.03877v4", "title": "CRAFT, arXiv:2503.03877v4", "type": "primary-source", "reviewedAt": "2026-11-01", "readStatus": "reviewed-selected-sections", "supports": "Latest displayed author version, case-by-case pre/post-silicon differences and explicit drawing/measurement caveat.", "locators": [ "Section 5 and Figure 7 caption", "Sections 6.5 and 6.6" ], "limitations": [ "Full HTML retained. Some mathematical text duplicates characters in extraction; core/FPGA names were cross-checked against publisher HTML.", "This is the same author study, not independent replication." ], "provenance": {} }, { "url": "https://arxiv.org/abs/2503.03877", "title": "Canonical arXiv version history", "type": "primary-source", "reviewedAt": "2026-11-01", "readStatus": "reviewed-selected-sections", "supports": "Submission and version dates.", "locators": [ "Submission history" ], "limitations": [], "provenance": {} } ], "mappings": { "emb3d": [ { "id": "TID-105", "name": "Hardware Fault Injection – Control Flow Modification", "url": "https://emb3d.mitre.org/threats/TID-105.html", "basis": "analyst-inference", "officialCaseAttribution": false, "modelVersion": "2.0.1", "sourcePin": "mitre/emb3d@0d7c25bb4e2928c516fb5811aaab9ff8bab2896c", "rationale": "Physical clock faults changed intended instruction execution in the FPGA core; mapping does not imply a tested security-check bypass or applicability to a deployed controller.", "scope": "The described experimental setup and outcome only." } ], "attack": [] } }, { "title": "Remoticon Raspberry Pi: presenter-reported RSA factor recovery during an EM fault-injection recording", "canonicalUrl": "https://www.youtube.com/watch?v=eO-ayS4pbLQ", "scope": "hardware", "publicationDate": "2022-02-03", "eventDate": null, "reviewDate": "2026-11-01", "dateNotes": "Recording and organizer article were published 2022-02-03 and identify Remoticon 2021. Exact session/laboratory date is not established by this review; the upload date is not treated as the experiment date.", "device": { "recordedTarget": "Raspberry Pi described in the narration as model 3.", "linkedHarnessConfiguration": "Previously reviewed author material specifies Raspberry Pi 3 Model B+, 32-bit Raspberry Pi OS release 2021-10-30 and deliberately old PyCryptodome 3.1.", "liveConfigurationQualification": "The transcript alone does not independently verify that the live demonstration used exactly that board revision, OS image and binary build.", "softwareBoundary": "Repeated RSA-signing test with known test factors available for comparison; a later pinned PyCryptodome v3.11.0 source has fault-output validation.", "injectors": "A larger EMFI tool has explicit narrated factor recovery. A later separate low-cost EMFI demonstration has less explicit spoken key-recovery evidence; no identity equivalence with every PicoEMP revision is asserted." }, "access": "Local physical access and EMFI equipment positioned near the Raspberry Pi during an attacker-controlled laboratory signing test. No remote-only path or production-key theft is established.", "claim": "During the larger-injector EMFI segment, the presenter reports a faulty RSA signing output and recovery of factors matching the known test factors on a Raspberry Pi.", "outcome": "Recorded author-reported physical fault and matching-factor recovery in the laboratory test. This review read the transcript and original organizer report; it did not validate screen values, recompute factor equality, watch the entire video frame by frame or reproduce key recovery.", "evidenceStatus": "author_reported_hardware_result_in_original_recording_transcript", "evidenceGroup": "demonstration", "hardwareBoundary": "Physical EM fault injection during cryptographic computation in a deliberately vulnerable educational Raspberry Pi software configuration.", "mechanisms": [ "electromagnetic fault injection", "faulty RSA computation with presenter-reported factor recovery" ], "followUp": { "performed": [ "Located the original HACKADAY upload and read the transcript through the larger-tool and separate low-cost-tool RSA/loop-testing segments.", "Read the original organizer article and author/team README; reused already reviewed test harness, documented configuration and pinned later RSA implementation instead of refetching them.", "Compared with LRRK-COM-010: its unsuccessful STM32F303/XMEGA/CW322 attempts are different experiments and stay unchanged." ], "results": [ "The recording closes the old 'static harness only' gap for an author-reported Raspberry Pi result with the larger EMFI tool.", "Presenter explicitly reports faulty RSA output and matching recovered factors; that spoken report is stronger than a repository-only possibility but is not independent output validation.", "Organizer says the cheap tool extracted keys; the speech in that segment is less explicit. The record's central factor-recovery claim therefore stays with the larger injector.", "The actual method in the reviewed Pi segment is EMFI. A reference to older voltage work is not a new voltage or clock-injection demonstration." ], "contradictions": [ "A Pi recording cannot convert the separate PicoEMP forum users' failed attempts into successful results.", "Do not equate the larger injector, low-cost camera-flash-derived apparatus and all PicoEMP revisions without exact evidence.", "The organizer's broader cheap-tool key-recovery account and the narrower explicit narration are retained as different evidence strengths, not resolved by assumption." ], "openQuestions": [ "Screen-output arithmetic, full visual coverage, exact live OS/library/binary equivalence and injector model/revision are not independently validated.", "The cheap-tool segment's exact recovered-factor output and an independent exact-configuration reproduction remain unreviewed.", "The recording does not establish applicability to current cryptographic libraries, flight controllers, drones or robots." ], "mappingQualification": "No EMB3D assignment is admitted for this result. TID-105: Hardware Fault Injection – Control Flow Modification is related context only, unassigned and excluded from mapping and coverage counts. The internal control-flow-versus-data-fault model is not established. TID-110 is not an automatic substitute." }, "limitations": [ "Transcript-only review with ASR limitations; no complete visual validation or independently observed physical key recovery.", "Known educational test factors and deliberately old cryptographic software materially bound the result.", "A documented Pi 3 B+ harness is not proof that every live demonstration component matches the documented image/version.", "Same-event recording, article and repositories are shared-source evidence, not multiple independent experiments.", "No operational glitch parameters, coil placement, pin details, keys or code are retained; no device or exploit was executed.", "Original unsuccessful PicoEMP forum outcomes and their confidence scores remain unchanged.", "TID-105 is related context only; no specific EMB3D or ATT&CK/ICS technique is assigned. TID-110 is not inferred from an erroneous value alone." ], "confidence": { "total": 72, "components": { "provenance": { "score": 20, "max": 20, "rationale": "Original HACKADAY event upload and contemporaneous organizer article are linked to original author/team material; source identities and publication dates are clear." }, "technicalEvidence": { "score": 27, "max": 35, "rationale": "Explicit presenter narration reports a faulty RSA result and matching factors, supported by an already reviewed test harness. Screen values, arithmetic, physical signals and the cheap-tool key-recovery outcome were not validated." }, "configurationSpecificity": { "score": 16, "max": 20, "rationale": "Repository specifies Pi 3 B+, dated 32-bit OS image and PyCryptodome 3.1; narration identifies model 3. Exact live build/revision and injector identity equivalence are not independently pinned." }, "independentCorroboration": { "score": 0, "max": 15, "rationale": "Recording, organizer article and author/team repositories refer to the same demonstration lineage. No independent exact-configuration key-recovery reproduction was reviewed." }, "followUpResolution": { "score": 9, "max": 10, "rationale": "The original-recording gap is closed for the narrowed larger-injector author report, while cheap-tool ambiguity, exact live configuration and visual output verification remain explicit." } }, "rationale": "Confidence in the bounded recorded author report, not attack probability, severity, general Raspberry Pi applicability or an official MITRE score." }, "mappingDisposition": "Source-supported result; specific EMB3D assignment withheld after independent definition review.", "id": "LRRK-20261101-FR-002", "originDraftId": "DRAFT-FR-002", "originLeadIds": [ "LRRK-COM-LEAD-004" ], "strand": "community", "sources": [ { "url": "https://www.youtube.com/watch?v=eO-ayS4pbLQ", "title": "Remoticon 2021 // Colin O'Flynn Zaps Chips (And They Talk)", "type": "original-organizer-recording", "reviewedAt": "2026-11-01T19:43:40Z", "readStatus": "transcript-read-not-screen-output-validated", "supports": "HACKADAY's 29:54 upload narrates loop-fault testing followed by Raspberry Pi RSA faulting. Larger-tool segment explicitly reports matching recovered factors; later cheap-tool speech is less explicit about that outcome.", "limitations": [ "Automatic transcript can contain recognition errors. No full visual review, numerical comparison, injector model authentication or independent physical validation." ], "provenance": { "retrievedDate": "2026-11-01", "publicationDate": "2022-02-03" } }, { "url": "https://hackaday.com/2022/02/03/remoticon-2021-colin-oflynn-zaps-chips-and-they-talk/", "title": "Remoticon 2021 // Colin O'Flynn Zaps Chips (And They Talk)", "type": "original-organizer-event-writeup", "reviewedAt": "2026-11-01T19:43:40Z", "readStatus": "article-read", "supports": "Organizer identifies and embeds the same recording, describes larger and cheaper EM injection and attributes key extraction to the cheap-tool demonstration.", "limitations": [ "Same event/research lineage, not independent reproduction. Cheap-tool key extraction is an attributed organizer report; it was not separately validated against screen output here." ], "provenance": { "retrievedDate": "2026-11-01", "publicationDate": "2022-02-03" } }, { "url": "https://github.com/colinoflynn/remoticon-2021-levelup-hardware-hacking/tree/master/rpi-glitching", "title": "Remoticon 2021 Raspberry Pi glitching material", "type": "original-author-repository", "reviewedAt": "2026-11-01T19:43:40Z", "readStatus": "previous-static-review-reused", "supports": "Author's documented Pi 3 B+/32-bit OS image/date and deliberately old PyCryptodome version bound the educational setup.", "limitations": [ "Configuration documentation does not prove live binary equivalence or physical success on its own; mutable branch as captured in prior review." ], "provenance": {} }, { "url": "https://github.com/colinoflynn/remoticon-2021-levelup-hardware-hacking/blob/master/rpi-glitching/rsaglitch.py", "title": "Remoticon RSA test harness", "type": "original-author-test-code", "reviewedAt": "2026-11-01T19:43:40Z", "readStatus": "previous-static-review-reused", "supports": "Previously reviewed harness explains the signing test, known-factor comparison and faulty-output detection/recovery context.", "limitations": [ "No test-key file was fetched or printed, no code executed, and code alone was not counted as a physical result." ], "provenance": {} }, { "url": "https://github.com/Legrandin/pycryptodome/blob/v3.11.0/lib/Crypto/PublicKey/RSA.py", "title": "PyCryptodome v3.11.0 RSA implementation", "type": "pinned-upstream-implementation", "reviewedAt": "2026-11-01T19:43:40Z", "readStatus": "previous-static-review-reused", "supports": "The later pinned implementation contains RSA fault-output validation, qualifying generalization from the deliberately old educational build.", "limitations": [ "This is a historical pinned-version check, not a current-package security assessment or a hardware reproduction." ], "provenance": {} }, { "url": "https://github.com/newaetech/chipshouter-picoemp", "title": "ChipSHOUTER PicoEMP project README", "type": "original-team-tool-repository", "reviewedAt": "2026-11-01T19:43:40Z", "readStatus": "readme-context-and-links-read", "supports": "Author/team README links the Remoticon RSA/Pi material and identifies a related signature-fault demonstration.", "limitations": [ "Demonstration image, key files and hardware instructions were not collected; this does not establish which exact low-cost tool/version appears in each recording segment or success on other targets." ], "provenance": { "retrievedDate": "2026-11-01" } } ], "mappings": { "emb3d": [], "attack": [], "relatedThreats": [ { "id": "TID-105", "name": "Hardware Fault Injection – Control Flow Modification", "url": "https://emb3d.mitre.org/threats/TID-105.html", "basis": "analyst-inference", "rationale": "The recording reports physical EMFI, an erroneous RSA computation and test-factor recovery. TID-105 is relevant physical-fault context, but this case does not establish control-flow modification or the internal fault model. This relation is unassigned and excluded from admitted mapping counts.", "scope": "Mechanism-level EMFI relation only; exact control-flow fault and MITRE attribution of this case are not established.", "officialCaseAttribution": false, "provenance": { "modelVersion": "2.0.1", "sourcePin": "MITRE/emb3d@0d7c25bb4e2928c516fb5811aaab9ff8bab2896c" }, "status": "unassigned", "countedAsMapping": false } ] }, "relatedCaseIds": [ "LRRK-COM-010" ] }, { "title": "Tegra X1 development board: author-narrated voltage-fault readout of protected boot ROM in the 2018 Glitching the Switch talk", "canonicalUrl": "https://media.ccc.de/v/c4.openchaos.2018.06.glitching-the-switch", "scope": "hardware", "publicationDate": "2018-06-28", "eventDate": null, "reviewDate": "2026-11-01", "dateNotes": "The canonical CCC recording is dated 2018-06-28. Exact dates of the narrated laboratory experiments are not established. The public YouTube mirror was uploaded 2022-04-02; that upload is not a new experiment.", "device": { "processor": "NVIDIA Tegra X1 / T210", "platform": "Development module and carrier board; exact commercial development-kit model and board revision not established by the reviewed transcript.", "securityConfiguration": "Development-board boot flow already permits unsigned custom user code; the presenter explicitly distinguishes this from the retail Nintendo Switch boot flow.", "firmware": "Exact bootloader/board build and protected-ROM binary version not established.", "notEstablished": [ "Physical voltage glitch demonstrated on a retail Nintendo Switch", "Applicability to later Tegra revisions, flight controllers, drones or robots" ] }, "access": "Local physical/electrical access to the development board for voltage fault injection, plus the development configuration's existing ability to run custom code and inspect memory. No remote-only path is claimed.", "claim": "The presenter reports using voltage fault injection on a Tegra X1/T210 development board to prevent the protected boot-ROM region from becoming unreadable to later code, then reading and saving previously protected ROM content.", "outcome": "Author-narrated development-board ROM readout. The transcript describes newly readable non-placeholder content and a saved dump after the fault. This review did not watch every video frame, inspect the dump, verify its contents or reproduce the electrical result.", "evidenceStatus": "author_reported_hardware_result_in_recording_transcript", "evidenceGroup": "demonstration", "hardwareBoundary": "A boot-time hardware/firmware read-protection transition on the stated development board, despite user code already being allowed to execute.", "mechanisms": [ "voltage fault injection", "boot-ROM read-protection bypass as reported by the presenter" ], "followUp": { "performed": [ "Compared the retained original CCC title, author, abstract, date and rounded duration with the mirror's exact canonical-event link, title, 1:32:40 duration and narrated subject matter.", "Read the development-board security/boot context, hardware fault/result narrative, preliminary failed observation and closing recovery-mode software-exploit discussion.", "Checked MITRE's direct reference to this event from the root researcher's retained official-page receipt.", "Compared with the released 82-case registry: the 2021 Tegra X2/Jetson TX2 study is already indexed and is a separate chip generation, configuration and study." ], "results": [ "The original lead can support an author-reported T210 development-board hardware result; it need not rely on the later TX2 paper as a substitute.", "The earlier apparent failure was attributed by the presenter to reading the wrong address; that explanation and the later readout are reported observations, not independently verified here.", "No clock-injection result is established. Clock synchronization/jitter discussion concerns the setup, while the attack described is a voltage fault." ], "contradictions": [ "The talk title alone can suggest retail Switch hardware glitching. The transcript explicitly puts the physical ROM-readout experiment on a development board and separately discusses the Switch USB recovery-mode vulnerability.", "Neither the mirror nor MITRE's citation is an independent experimental reproduction." ], "openQuestions": [ "Exact development-kit model/revision, bootloader build and ROM dump provenance are not pinned.", "The precise electrical/instruction/bus fault mechanism is not proven by the narrated readout result.", "Original-versus-mirror media hashes, full visual output verification and an independent exact-configuration reproduction remain unreviewed." ] }, "limitations": [ "Transcript-based review of relevant sections, with automatic-transcription and mirror-provenance limitations; not a full audiovisual watch.", "An already permissive development-board code-execution environment is a material prerequisite; this is not evidence of a retail Switch voltage-glitch bypass.", "No physical or numerical result was independently reproduced. No raw ROM or operational glitch parameters are retained.", "The separate USB software exploit and later Tegra X2 study must not be counted as confirmations of this physical experiment.", "This result does not establish an effect on a drone, robot or LRRK-owned device." ], "confidence": { "total": 67, "components": { "provenance": { "score": 18, "max": 20, "rationale": "Canonical CCC event names the speaker and date; a linked, matching-title/duration mirror supplies the transcript. Official MITRE cites the exact event. Mirror/media identity is not authenticated byte-for-byte." }, "technicalEvidence": { "score": 25, "max": 35, "rationale": "Detailed author narration reports a successful protected-ROM readout, distinguishes a preliminary observation error and explains the test context. Raw dump, screen output and electrical behavior were not validated." }, "configurationSpecificity": { "score": 15, "max": 20, "rationale": "Tegra X1/T210, development-board carrier/module, permissive custom-code setting and protected-ROM boundary are explicit. Exact board revision, firmware build and complete electrical setup are not independently pinned." }, "independentCorroboration": { "score": 0, "max": 15, "rationale": "The mirror and MITRE reference point back to the same talk; the later TX2 study is a different configuration. No independent exact-configuration reproduction was reviewed." }, "followUpResolution": { "score": 9, "max": 10, "rationale": "The recording-evidence gap and retail-console ambiguity are resolved for the narrowed author-reported claim. Media authentication, exact build and independently validated outputs remain open." } }, "rationale": "Confidence in the narrowly attributed evidence claim, not probability, severity, device applicability or an official MITRE rating." }, "id": "LRRK-20261101-FR-001", "originDraftId": "DRAFT-FR-001", "originLeadIds": [ "primary-lead-glitch-switch" ], "strand": "primary", "sources": [ { "url": "https://media.ccc.de/v/c4.openchaos.2018.06.glitching-the-switch", "title": "Glitching the Switch", "type": "original-conference-record", "reviewedAt": "2026-11-01T19:43:40Z", "readStatus": "metadata-and-abstract-read-reused", "supports": "Original title, named speaker Andreas Galauner, date, rounded 92-minute duration and abstract; canonical identity used to attribute the mirrored talk.", "limitations": [ "Original event page is not a transcript. No original-media checksum comparison with the mirror was performed." ], "provenance": { "publicationDate": "2018-06-28" } }, { "url": "https://www.youtube.com/watch?v=b-SeoIe1sKM", "title": "Glitching the Switch - CCC", "type": "public-recording-mirror", "reviewedAt": "2026-11-01T19:43:40Z", "readStatus": "transcript-read-targeted-sections-not-full-audiovisual-review", "supports": "Mirror explicitly links the exact CCC event. Its 1:32:40 duration is consistent with CCC's rounded 92 minutes. Transcript distinguishes T210 development-board voltage fault/readout from a separate retail-console USB recovery exploit discussion.", "limitations": [ "Uploaded by Gereon on 2022-04-02, not the original conference publisher. Automatic transcription has errors; speaker identity is attributed through the linked event rather than biometric or byte-for-byte verification. No frame/output/binary validation." ], "provenance": { "retrievedDate": "2026-11-01", "publicationDate": "2022-04-02" } }, { "url": "https://emb3d.mitre.org/threats/TID-105.html", "title": "TID-105: Hardware Fault Injection – Control Flow Modification", "type": "official-framework-case-reference", "reviewedAt": "2026-11-01T19:43:40Z", "readStatus": "threat-and-case-evidence-section-read-from-root-retained-receipt", "supports": "MITRE's evidence section explicitly links this exact CCC event and describes Tegra X1 power glitching to avoid enabling ROM readout protection.", "limitations": [ "A framework citation is curated support, not independent reproduction or endorsement of this record, score or retail-console applicability." ], "provenance": {} } ], "mappings": { "emb3d": [ { "id": "TID-105", "name": "Hardware Fault Injection – Control Flow Modification", "url": "https://emb3d.mitre.org/threats/TID-105.html", "basis": "official-case-reference", "rationale": "The official TID-105 evidence section explicitly links the same canonical CCC event and describes its Tegra X1 power-glitch/readout-protection result. The development-board scope is preserved from the reviewed recording transcript; MITRE does not validate this record's score or a retail-console generalization.", "scope": "Reported T210 development-board boot-ROM read-protection transition; exact instruction-level fault model unproven.", "officialCaseAttribution": true, "provenance": { "modelVersion": "2.0.1", "sourcePin": "MITRE/emb3d@0d7c25bb4e2928c516fb5811aaab9ff8bab2896c" } } ], "attack": [] }, "relatedCaseIds": [ "LRRK-20261101-FI-004" ] }, { "title": "Robotics I2C bus-clock interference: real motor hardware with a virtual navigation trajectory", "canonicalUrl": "https://pmc.ncbi.nlm.nih.gov/articles/PMC5419790/", "scope": "hardware", "publicationDate": "2017-03-25", "eventDate": null, "reviewDate": "2026-11-01", "dateNotes": "PMC publication date and citation metadata are 25 March 2017; April is the collection month, not the experiment date.", "device": { "description": "MD23 motor-driver/controller and real motors/encoders, FPGA communication modules and a MATLAB path controller", "configuration": "Hardware-in-the-loop bench emulating a differential-drive robot. Encoder measurements update a virtual trajectory; no freely navigating assembled robot or UAV was tested. Section 3.4 implements sensor VHDL for a Spartan3AN700 FPGA and separately uses post-route simulation for oscillator behavior. Exact bitstream and controller/firmware revision were not established." }, "access": "Physical control of an added module on the I2C communication path.", "claim": "The authors disrupted the I2C SCL bus clock so selected motor commands were suppressed while acknowledgments kept the controller believing communication had succeeded.", "outcome": "Real motors retained preceding speed commands; encoder-fed virtual navigation deviated from the planned roundabout path. A proposed frequency-sensor defense stopped the motors during the disturbance and resumed the path afterward.", "evidenceStatus": "author-reported-controlled-demonstration", "evidenceGroup": "demonstration", "hardwareBoundary": "Peripheral-bus clock/protocol manipulation; no processor instruction-clock or CPU control-flow fault was demonstrated.", "mechanisms": [ "I2C bus-clock interference", "Command suppression", "False acknowledgment" ], "followUp": { "performed": [ "Read the original methods/results and explicit emulation description.", "Searched exact-title follow-up/correction/replication terms and earlier same-team work.", "Checked the current official TID-114 definition against the pinned framework name." ], "result": "A bounded robotics bus-manipulation account is supported. The word clock in the title does not support a CPU clock-glitch claim.", "next_steps": [ "Review a released experiment artifact or independent reproduction if one becomes available.", "A real mobile-platform assessment needs its own bus topology, software and motion evidence." ] }, "limitations": [ "Virtual trajectory reconstructed from real encoder speeds; no physical robot navigation, crash or flown drone compromise was demonstrated.", "No independent reproduction or original experiment repository reviewed.", "Earlier and later papers by the same research group do not count as independent corroboration.", "The frequency-sensor motor-stop observation is a bounded bench result; separate post-route sensor simulations do not establish fabricated-CMOS validation or a safety guarantee.", "No ATT&CK/ICS procedure mapping is asserted; the study did not establish an industrial-control intrusion." ], "confidence": { "total": 76, "components": { "provenance": { "score": 20, "max": 20, "rationale": "Original peer-reviewed article and publication metadata were inspected." }, "technicalEvidence": { "score": 30, "max": 35, "rationale": "Relevant experimental methods and reported encoder/control results were read; raw measurements and implementation artifacts were not independently validated." }, "configurationSpecificity": { "score": 18, "max": 20, "rationale": "MD23, real motor/encoder components, sensor FPGA family and virtual-trajectory boundary are explicit; exact bitstream/firmware artifact pins remain missing." }, "independentCorroboration": { "score": 0, "max": 15, "rationale": "No independent reproduction established; same-team publications and catalogs are not reproductions." }, "followUpResolution": { "score": 8, "max": 10, "rationale": "Resolved bus-clock versus CPU-clock ambiguity and real-hardware versus virtual-navigation scope; artifact follow-up remains open." } }, "rationale": "LRRK evidence strength for the narrowly stated claim; not severity, exploitation probability, current-device applicability, safety or an official MITRE score." }, "id": "LRRK-20261101-DR2-001", "originDraftId": "DRAFT-DR2-001", "originLeadIds": [], "strand": "drones-robotics", "sources": [ { "url": "https://pmc.ncbi.nlm.nih.gov/articles/PMC5419790/", "title": "A Smart Sensor for Defending against Clock Glitching Attacks on the I2C Protocol in Robotic Applications", "type": "primary-source", "reviewedAt": "2026-11-01", "readStatus": "reviewed-selected-sections", "supports": "Experimental hardware, virtual-motion boundary, command suppression, encoder results and bounded sensor-defense result.", "locators": [ "Sections 2 and 3", "Section 4.1: virtual navigation and real motor/encoder bench", "Section 4.2", "Section 5, Figures 14-17 and captions", "Section 6" ], "limitations": [ "Full HTML retained; relevant text and figure captions reviewed. Waveforms/figures were not independently visually inspected." ], "provenance": {} } ], "mappings": { "emb3d": [ { "id": "TID-114", "name": "Peripheral Data Bus Interception", "url": "https://emb3d.mitre.org/threats/TID-114.html", "basis": "analyst-inference", "officialCaseAttribution": false, "modelVersion": "2.0.1", "sourcePin": "mitre/emb3d@0d7c25bb4e2928c516fb5811aaab9ff8bab2896c", "rationale": "An inserted module manipulates messages and acknowledgments between the controller and a peripheral motor driver; the official description explicitly includes I2C.", "scope": "The described experimental setup and outcome only." } ], "attack": [] } }, { "title": "Dynamixel AX-12A actuator interposer: command suppression and fabricated status on a bench", "canonicalUrl": "https://www.mdpi.com/2079-9292/14/24/4909", "scope": "hardware", "publicationDate": "2025-12-14", "eventDate": null, "reviewDate": "2026-11-01", "dateNotes": "Publisher date: 14 December 2025; experiment dates not separately established.", "device": { "description": "Dynamixel AX-12A servomotor using protocol 1.0 and FPGA controller/interposer logic on an Artix-7 XC7A100T", "configuration": "Half-duplex UART actuator chain and a laboratory FPGA attack module. The concrete illustrated suppression/status trace uses an LED instruction; the complete hybrid hexapod is future work." }, "access": "Physical insertion of an active module between the low-level controller and actuator communication chain.", "claim": "The authors implemented an inline FPGA module that can forward, suppress or alter actuator communication. The illustrated suppression experiment returns fabricated status while withholding the controller instruction from the actuator.", "outcome": "The controller completes the communication protocol despite the withheld instruction. The paper separately evaluates response-timing detection of the inserted module under its tested message sequences and latency conditions.", "evidenceStatus": "author-reported-controlled-demonstration", "evidenceGroup": "demonstration", "hardwareBoundary": "Physical peripheral-bus interposition; no processor clock fault, demonstrated supply-chain implant, full-hexapod takeover or drone attack.", "mechanisms": [ "Peripheral-bus interposition", "Command suppression", "Status spoofing" ], "followUp": { "performed": [ "Read the original hardware, protocol and attack-module sections.", "Read the conclusion and future-work boundary rather than generalizing the platform description.", "Searched the exact title for artifacts, correction and independent validation.", "Compared the demonstrated bus behavior with official TID-114." ], "result": "The bench interposer result is supportable; operation of the complete hexapod under attack was explicitly deferred by the authors.", "next_steps": [ "Review original HDL, traces or a physical-platform follow-up if released.", "Validate response-timing detection under different firmware, message loads and environmental conditions before adopting it." ] }, "limitations": [ "Do not generalize the AX-12A/protocol-1.0 experiment to every Dynamixel product or an assembled operational robot.", "The clearest illustrated suppression experiment concerns an LED command; unsafe physical movement or gait takeover is not established.", "No independent reproduction or original implementation repository reviewed.", "The reported 100% true-positive result applies to the tested sequences, including a transparent interposer; it is not universal detection accuracy. Table 6 reports material LED false positives (21.4%), versus 1.2% for Move and 0.25% for Ping.", "A miniaturized concealed implant is proposed, not an observed deployment.", "No ATT&CK/ICS procedure mapping is asserted for this bench study." ], "confidence": { "total": 77, "components": { "provenance": { "score": 20, "max": 20, "rationale": "Original publisher article, author list and date were inspected." }, "technicalEvidence": { "score": 30, "max": 35, "rationale": "The original attack design, reported communication traces and table text were read; raw captures/HDL were not independently validated." }, "configurationSpecificity": { "score": 19, "max": 20, "rationale": "Named actuator, protocol and FPGA are explicit, with the LED-command and full-robot limits retained." }, "independentCorroboration": { "score": 0, "max": 15, "rationale": "No independent reproduction found; shared authors with the 2017 study do not add independent evidence." }, "followUpResolution": { "score": 8, "max": 10, "rationale": "Resolved the bench versus full-hexapod scope and preserved the timing-detector false-positive limits." } }, "rationale": "LRRK evidence strength for the narrowly stated claim; not severity, exploitation probability, current-device applicability, safety or an official MITRE score." }, "id": "LRRK-20261101-DR2-002", "originDraftId": "DRAFT-DR2-002", "originLeadIds": [], "strand": "drones-robotics", "sources": [ { "url": "https://www.mdpi.com/2079-9292/14/24/4909", "title": "Exploring Hardware Vulnerabilities in Robotic Actuators: A Case of Man-in-the-Middle Attacks", "type": "primary-source", "reviewedAt": "2026-11-01", "readStatus": "reviewed-selected-sections", "supports": "Named actuator/FPGA setup, illustrated suppression/status exchange, timing-defense limits and explicit full-platform future work.", "locators": [ "Sections 2 and 3", "Section 3.3 and Figure 9 captions/text", "Section 5 and Table 6", "Sections 6 and 7" ], "limitations": [ "Full HTML retained; relevant methods/results, table text and figure captions reviewed. Figure images were not independently visually inspected." ], "provenance": {} } ], "mappings": { "emb3d": [ { "id": "TID-114", "name": "Peripheral Data Bus Interception", "url": "https://emb3d.mitre.org/threats/TID-114.html", "basis": "analyst-inference", "officialCaseAttribution": false, "modelVersion": "2.0.1", "sourcePin": "mitre/emb3d@0d7c25bb4e2928c516fb5811aaab9ff8bab2896c", "rationale": "An inline physical module suppresses or changes controller-to-actuator data and returns fabricated peripheral status over the UART bus.", "scope": "The described experimental setup and outcome only." } ], "attack": [] } }, { "title": "SSTIC 2010: shared PCI requester identity and author-reported ARP-cache corruption", "canonicalUrl": "https://www.sstic.org/media/SSTIC2010/SSTIC-actes/Analyse_de_l_efficacite_du_service_fourni_par_une_/SSTIC2010-Article-Analyse_de_l_efficacite_du_service_fourni_par_une_IOMMU-lacombe_lone-sang_nicomette_deswarte.pdf", "scope": "hardware", "publicationDate": "2010-06", "eventDate": null, "reviewDate": "2026-11-01", "dateNotes": "Author bibliography dates the SSTIC paper to June 2010, pages 189–214. Experiment dates are not established. The separate MALWARE/IEEE paper is listed for October 2010; this record does not substitute its venue or date.", "device": { "description": "Intel VT-d-capable Linux desktop scenario with conventional PCI Ethernet and FireWire devices behind one PCI-to-PCIe bridge", "configuration": "The Ethernet component is identified as VIA Rhine VT6102. The proof-of-concept assumes identical known host layouts and Intel VT-d enabled in both BIOS and kernel. Exact motherboard, firmware and tested kernel revision are not established. A Q45/ICH10/Core 2 Duo architecture figure is not treated as verified test-unit identity; discussion of Linux support beginning at 2.6.24 is not a tested-version pin." }, "access": "A DMA-capable peripheral connected through the victim's FireWire path and the shared legacy PCI topology, plus prior target-layout knowledge. No generic remote entry or access to all host memory is established.", "claim": "Bridge-translated conventional PCI devices sharing one requester/source identity cannot be isolated from each other's authorized DMA buffers by the per-identity VT-d boundary.", "outcome": "The authors present a proof of concept with before/after ARP-cache output, reporting modification through the Ethernet receive-memory region shared with the FireWire controller's protection domain. Separately, their direct kernel-code injection control failed with VT-d enabled. The shared-buffer result is not proof of unrestricted kernel-memory access with VT-d active.", "evidenceStatus": "original_conference_author_reported_dma_proof_of_concept", "evidenceGroup": "reported-result", "hardwareBoundary": "Conventional PCI devices sharing a translated requester identity behind one bridge; not arbitrary PCIe, Thunderbolt/USB4, GPU, embedded, drone or robot configurations.", "mechanisms": [ "Unauthorized Direct Memory Access (DMA)", "Shared requester identity across a legacy PCI bridge" ], "followUp": { "performed": [ "Checked the exact DOI and exact-title HAL metadata routes; both returned zero matching records, which is not proof no deposit exists.", "Read the author's normally accessible bibliography and followed its SSTIC article link.", "Separated the protected kernel-memory control from the reported shared-buffer outcome and retained requester-identity/topology requirements.", "Compared with the already published 2018 Dell boot-window case; it is a different mechanism and configuration." ], "result": "A related original 2010 conference account is now source-supported. The exact IEEE 5665798 methods remain unread; that original lead stays pending and unscored.", "next_steps": [ "If a normally accessible original IEEE manuscript becomes available, compare its methods and lineage with this SSTIC account before resolving the original lead or counting a separate experiment." ] }, "limitations": [ "The author lists the two 2010 publications separately. No verified statement that they are identical translations or the same measured experiment was located.", "The proof-of-concept narrative uses a modified FireWire peripheral/iPod scenario; the exact physical peripheral model used for measurement is not established.", "Do not generalize the authors' reasoning about other IOMMU implementations into a demonstrated AMD outcome.", "The enabled-VT-d negative control and successful shared-domain alteration are different results.", "This companion account and any later IEEE version must not automatically count as independent experiments.", "AI-assisted public-source desk review only; no LrrK hardware test or independent human verification of the experiment." ], "confidence": { "total": 69, "components": { "provenance": { "score": 20, "max": 20, "rationale": "Original conference-hosted article and its coauthor's bibliography were read." }, "technicalEvidence": { "score": 29, "max": 35, "rationale": "The technical identity-boundary explanation, reported output and negative control were inspected; no raw independent reproduction was verified." }, "configurationSpecificity": { "score": 13, "max": 20, "rationale": "Relevant bus, bridge, device and IOMMU-state conditions are explicit, but exact host and software revisions are absent." }, "independentCorroboration": { "score": 0, "max": 15, "rationale": "The author bibliography, article and later citations are one research lineage, not independently executed corroboration." }, "followUpResolution": { "score": 7, "max": 10, "rationale": "A useful original companion source was recovered while the exact IEEE identity/methods gap was deliberately left open." } }, "rationale": "LrrK analyst evidence strength for the bounded source claim, not probability, severity, applicability to another device, a MITRE score, or LrrK physical validation." }, "studyIdentity": "Separate titled/venued author publication; relation to the unread IEEE paper remains unverified.", "sharedSourceGroup": "sstic-2010-lone-sang-lacombe-nicomette-deswarte-iommu", "id": "LRRK-20261101-PRI2-001", "originDraftId": "DRAFT-PRI2-001", "originLeadIds": [ "primary-lead-iommu-2010" ], "strand": "primary", "sources": [ { "url": "https://www.sstic.org/media/SSTIC2010/SSTIC-actes/Analyse_de_l_efficacite_du_service_fourni_par_une_/SSTIC2010-Article-Analyse_de_l_efficacite_du_service_fourni_par_une_IOMMU-lacombe_lone-sang_nicomette_deswarte.pdf", "title": "Analyse de l’efficacité du service fourni par une IOMMU", "type": "original_conference_research_paper", "reviewedAt": "2026-11-01", "readStatus": "reviewed", "supports": "The 26-page SSTIC article supplies source-identity analysis, required topology, peer-buffer proof of concept, the successful isolation control and countermeasure discussion.", "limitations": [ "All 26 pages were returned. Relevant sections 3.2, 4.2, 5 and 6–7 were substantively reviewed; no experiment code was executed.", "The proof is an author-presented account/output, with no independent capture or reproduction verified.", "Exact physical victim identifiers and full software/firmware version pins remain missing." ], "provenance": { "url": "https://www.sstic.org/media/SSTIC2010/SSTIC-actes/Analyse_de_l_efficacite_du_service_fourni_par_une_/SSTIC2010-Article-Analyse_de_l_efficacite_du_service_fourni_par_une_IOMMU-lacombe_lone-sang_nicomette_deswarte.pdf", "sourceURL": "https://www.sstic.org/media/SSTIC2010/SSTIC-actes/Analyse_de_l_efficacite_du_service_fourni_par_une_/SSTIC2010-Article-Analyse_de_l_efficacite_du_service_fourni_par_une_IOMMU-lacombe_lone-sang_nicomette_deswarte.pdf", "numPages": 26, "totalPages": 26 } }, { "url": "https://kamino.github.io/", "title": "Fernand Lone-Sang - Security Researcher", "type": "original_author_bibliography", "reviewedAt": "2026-11-01", "readStatus": "reviewed", "supports": "The coauthor separately lists the June SSTIC paper and October MALWARE paper, establishing authorship/venue links without proving textual or experimental identity.", "limitations": [ "Homepage link labels for slides/article are swapped relative to the returned PDF contents; the 26-page article content, not the label, determines this source's type.", "A personal bibliography and the author's paper are not independent corroboration." ], "provenance": { "url": "https://kamino.github.io/", "sourceURL": "https://kamino.github.io/" } } ], "mappings": { "emb3d": [ { "id": "TID-107", "name": "Unauthorized Direct Memory Access (DMA)", "url": "https://emb3d.mitre.org/threats/TID-107.html", "basis": "analyst-inference", "rationale": "The reported peripheral DMA access to another device's buffers fits TID-107. The official page cites the separate IEEE/MALWARE publication, not this SSTIC paper; this companion-source mapping is explicitly analyst inference.", "officialCaseAttribution": false, "provenance": { "repository": "https://github.com/mitre/emb3d", "commit": "0d7c25bb4e2928c516fb5811aaab9ff8bab2896c", "siteRelease": "2.0.2", "modelBundle": "2.0.1", "relationship": "analyst_mechanism_inference" } } ], "attack": [], "attackMappingRationale": "No ATT&CK/ICS technique is forced from an author's hardware isolation proof of concept; no operational campaign is claimed." }, "relatedCaseIds": [ "LRRK-20261101-PRI-004" ] }, { "title": "Security Innovation's 2018 UART example: author-reported root shell on a TP-Link TL-WR841N", "canonicalUrl": "https://blog.securityinnovation.com/iot_uart", "scope": "hardware", "publicationDate": "2018-08-30", "eventDate": null, "reviewDate": "2026-11-01", "dateNotes": "Original archived page byline names Satish S and displays 30 August 2018; a separate public referral agrees. The reviewed archive capture is 23 October 2020 at 09:15:51 UTC, not the publication or experiment date. No claim of continuous content stability or present-day vulnerability is made.", "device": { "description": "TP-Link TL-WR841N home router in the original author's UART access example", "configuration": "Article identifies an Attify-Badge 2.0 interface, but does not establish the tested router's exact hardware revision or firmware build. It references FCC photos for TE7WR841NXV9; that reference alone does not prove the demonstrated unit is revision v9." }, "access": "Physical access to the router's internal UART/service interface and local serial-observation equipment; no remote route or device actuation was performed in this review.", "claim": "The original author reports reaching a privileged shell through the router's UART interface.", "outcome": "The archived article explicitly identifies the TL-WR841N and labels its final outcome as root-shell access, linking two screenshots. This review confirms the authored claim and target in the retained text; the screenshots and underlying console/privilege evidence were not independently inspected or reproduced. Firmware extraction and secret recovery are discussed as possible consequences, not reported results retained here.", "evidenceStatus": "archived_original_author_reported_privileged_console_access", "evidenceGroup": "reported-result", "hardwareBoundary": "A historical, physically accessed TL-WR841N example with missing revision/build information; not a general property of every router, UART interface, robot or drone.", "mechanisms": [ "Latent Privileged Access Port", "UART service-console access" ], "followUp": { "performed": [ "Retained the known original TLS failure without retrying, weakening TLS or changing provider policy.", "Inspected a public referral and the publisher's normal homepage redirect without treating an unrelated current page as the original article.", "Queried the public archive index, then read the exact 2020 capture of the original article.", "Separated its explicit reported shell result from generic consequences, screenshot proof not reviewed, and missing device/firmware revision.", "Verified the exact canonical article reference on pinned MITRE TID-116." ], "result": "The original source identity, named target and bounded author-reported result are now reviewed through an archival original. This closes the missing-article lead for this scored record, without establishing independently verified root access or current product applicability.", "next_steps": [ "Any stronger privilege/firmware outcome claim would require review of the retained screenshots or a separately available original console artifact, and exact hardware/firmware identification; no physical test or source-author contact is authorized." ] }, "limitations": [ "No successful LrrK UART connection or hardware test is implied.", "The article's general claims about what a root shell could enable are not firmware-extraction or credential-recovery demonstrations.", "The pinned MITRE page also cites a different TL-WR840N EU v6.20 vulnerability reference; it is not assigned to this TL-WR841N record.", "The pre-existing BHIS case concerns a Linksys E2500 v3 and remains separate.", "The archive, referral and official taxonomy citation are not independent technical corroboration.", "AI-assisted public-source desk review; exact build, authentication behavior, raw console evidence and underlying screenshot validation remain incomplete." ], "confidence": { "total": 60, "components": { "provenance": { "score": 19, "max": 20, "rationale": "A public capture retains the exact original publisher article, title, byline and displayed date; current original access is still unavailable." }, "technicalEvidence": { "score": 21, "max": 35, "rationale": "The article explicitly reports the shell result but its visual/raw proof was not independently inspected, limiting technical strength." }, "configurationSpecificity": { "score": 12, "max": 20, "rationale": "Router family and local interface are named; actual hardware revision, firmware and authentication behavior remain unknown." }, "independentCorroboration": { "score": 0, "max": 15, "rationale": "Archive/referral/taxonomy references support source identity only and do not reproduce the experiment." }, "followUpResolution": { "score": 8, "max": 10, "rationale": "The missing original article and generic-versus-specific result distinction were resolved; screenshot and build-level questions remain explicit." } }, "rationale": "LrrK analyst evidence strength for the bounded source claim, not probability, severity, applicability to another device, a MITRE score, or LrrK physical validation." }, "sharedSourceGroup": "security-innovation-satish-s-uart-2018", "archive": { "url": "https://web.archive.org/web/20201023091551/https://blog.securityinnovation.com/iot_uart", "capturedAt": "2020-10-23T09:15:51Z", "publishedDateDisplayed": "2018-08-30", "contentContinuityVerified": false }, "id": "LRRK-20261101-PRI2-002", "originDraftId": "DRAFT-PRI2-002", "originLeadIds": [ "primary-lead-uart-securityinnovation" ], "strand": "primary", "sources": [ { "url": "https://web.archive.org/web/20201023091551/https://blog.securityinnovation.com/iot_uart", "title": "IoT Devices - The Not-So-Hidden Risk of UART Interface", "type": "archived_original_publisher_article", "reviewedAt": "2026-11-01", "readStatus": "partial", "supports": "Original title, byline/date, named device and explicit final privileged-shell claim recovered at the original publisher URL's public capture.", "limitations": [ "Main article text/metadata reviewed. Embedded terminal screenshots are linked but were not visually inspected; underlying raw console bytes, authentication sequence and privilege validation are not established in this pass.", "Archive capture date is 2020-10-23T09:15:51Z; the page's displayed publication date is 2018-08-30.", "The current original HTTPS route previously failed TLS and was not retried or bypassed." ], "provenance": { "url": "https://web.archive.org/web/20201023091551/https://blog.securityinnovation.com/iot_uart", "sourceURL": "https://web.archive.org/web/20201023091551/https://blog.securityinnovation.com/iot_uart" } }, { "url": "https://web.archive.org/cdx/search/cdx?url=blog.securityinnovation.com%2Fiot_uart&output=json&filter=statuscode%3A200&filter=mimetype%3Atext%2Fhtml&collapse=digest", "title": null, "type": "public_archive_capture_index", "reviewedAt": "2026-11-01", "readStatus": "reviewed", "supports": "Supplies the exact archived URL/timestamp selected through normal public access.", "limitations": [ "Capture metadata confirms an archival route, not the technical outcome or original publication date." ], "provenance": { "url": "https://web.archive.org/cdx/search/cdx?url=blog.securityinnovation.com%2Fiot_uart&output=json&filter=statuscode%3A200&filter=mimetype%3Atext%2Fhtml&collapse=digest", "sourceURL": "https://web.archive.org/cdx/search/cdx?url=blog.securityinnovation.com%2Fiot_uart&output=json&filter=statuscode%3A200&filter=mimetype%3Atext%2Fhtml&collapse=digest" } }, { "url": "https://github.com/WilsonHuha/cbr-doc/blob/master/posts/cc/Router_post_sort_by_cc_cnt.md", "title": "cbr-doc/posts/cc/Router_post_sort_by_cc_cnt.md at master · WilsonHuha/cbr-doc · GitHub", "type": "third_party_public_bibliographic_referral", "reviewedAt": "2026-11-01", "readStatus": "reviewed", "supports": "Links the exact publisher URL/title and lists 2018-08-30, supporting identification of the recovered article.", "limitations": [ "Bibliographic agreement is not independent replication of the root-shell claim." ], "provenance": { "url": "https://github.com/WilsonHuha/cbr-doc/blob/master/posts/cc/Router_post_sort_by_cc_cnt.md", "sourceURL": "https://github.com/WilsonHuha/cbr-doc/blob/master/posts/cc/Router_post_sort_by_cc_cnt.md" } } ], "mappings": { "emb3d": [ { "id": "TID-116", "name": "Latent Privileged Access Port", "url": "https://emb3d.mitre.org/threats/TID-116.html", "basis": "official-case-reference", "rationale": "The pinned TID-116 page explicitly names Satish S's exact 'IoT Devices - The Not-So-Hidden Risk of UART Interface' article and links its original publisher URL. This is a verified direct case reference; the archival source preserves the same URL/title/byline.", "officialCaseAttribution": true, "provenance": { "repository": "https://github.com/mitre/emb3d", "commit": "0d7c25bb4e2928c516fb5811aaab9ff8bab2896c", "siteRelease": "2.0.2", "modelBundle": "2.0.1", "relationship": "verified_exact_official_case_reference" } } ], "attack": [], "attackMappingRationale": "No ATT&CK/ICS mapping is inferred from the stated shell-access outcome alone; command execution or a campaign was not independently established." }, "relatedCaseIds": [ "primary-bhis-uart-2019" ] } ], "leads": [ { "id": "primary-lead-arduino-dpa", "title": "Arduino AES DPA/CPA paper cited by EMB3D", "url": "https://www.tandfonline.com/doi/full/10.1080/23742917.2016.1231523", "status": "reviewed-original-source-scoped-results", "workflowStatus": "resolved-to-cases", "resolvedCaseIds": [ "LRRK-20261101-PRI-001" ], "followUpResult": "Institutional identity and abstract matched to the public authored PDF mirror. Methods, results and white-box limitations reviewed; parser returned 20/21 pages. Distinct from the foundational DES DPA study already indexed.", "reason": "Institutional identity and abstract matched to the public authored PDF mirror. Methods, results and white-box limitations reviewed; parser returned 20/21 pages. Distinct from the foundational DES DPA study already indexed.", "nextCheck": "Owner review of this private candidate and mirror provenance; no target or physical validation is implied.", "confidence": null, "previousReview": { "status": "unreviewed_or_unsupported_lead", "workflowStatus": "pending-or-unresolved", "resolvedCaseIds": [], "followUpResult": null, "reason": "Publisher HTTP200 returned only 435 characters of sharing/navigation content; the article body was not obtained.", "nextCheck": "Obtain an accessible author manuscript or publisher full text through normal permitted access; no access-control bypass." } }, { "id": "primary-lead-iommu-2010", "title": "Exploiting an I/OMMU vulnerability", "url": "https://ieeexplore.ieee.org/document/5665798", "status": "source-review-gap-retained", "workflowStatus": "pending-or-unresolved", "resolvedCaseIds": [], "followUpResult": "A coauthor's public bibliography separately lists the June 2010 SSTIC and October 2010 MALWARE publications. The accessible 26-page SSTIC article supplies shared-requester-identity bridge prerequisites, a reported peer-buffer/ARP-cache result and a failed direct kernel-injection control with VT-d active. No verified identity statement makes it the exact IEEE paper. Exact DOI and title HAL queries returned zero records, without proving absence of a deposit. The known gated IEEE paths were not requested again. The exact IEEE methods lead remains pending and unscored.", "reason": "Companion original-source evidence materially narrows the mechanism, but neither the SSTIC paper nor the existing 2018 Dell paper silently resolves the unread IEEE 5665798 original.", "nextCheck": "Compare a normally accessible original IEEE manuscript with the SSTIC account if one becomes available. Retain publication/experiment lineage and avoid counting both venues as independent proof without distinct outcomes.", "confidence": null, "previousReview": { "status": "abstract_only_lead", "workflowStatus": "pending-or-unresolved", "resolvedCaseIds": [], "followUpResult": null, "reason": "Only publisher abstract/metadata inspected; full methods/configuration were not available in this read.", "nextCheck": "Locate an author-deposited original paper and establish the exact VT-d configuration before promoting an exploit account." }, "relatedCaseIds": [ "LRRK-20261101-PRI-004", "LRRK-20261101-PRI2-001" ], "weeklyDraftPriority": "original-source-gap", "reviewHistory": [ { "edition": "2026-11-01.2", "status": "follow-up-reviewed-unresolved", "workflowStatus": "pending-or-unresolved", "resolvedCaseIds": [], "relatedCaseIds": [ "LRRK-20261101-PRI-004" ], "followUpResult": "IEEE PDF route redirected to sign-in/purchase HTML. Coauthor bibliography confirmed metadata but exposed no manuscript. The distinct 2018 primary paper tests a boot-window DMA weakness on a Dell T1700; its related-work section describes the 2010 bridge/requester-identity issue. The 2018 configuration cannot stand in for unavailable 2010 methods.", "reason": "IEEE PDF route redirected to sign-in/purchase HTML. Coauthor bibliography confirmed metadata but exposed no manuscript. The distinct 2018 primary paper tests a boot-window DMA weakness on a Dell T1700; its related-work section describes the 2010 bridge/requester-identity issue. The 2018 configuration cannot stand in for unavailable 2010 methods. Original claim remains unresolved; related evidence does not close it.", "nextCheck": "An ordinarily accessible original 2010 manuscript is still needed for the exact methods/configuration gap. No further request was made to the same gated route." } ], "classificationBoundary": "LRRK-20261101-PRI2-001's score of 69 applies only to the bounded SSTIC account, not to unread IEEE methods." }, { "id": "primary-lead-coldboot-2013", "title": "On the Practicability of Cold Boot Attacks", "url": "https://ieeexplore.ieee.org/document/6657268/", "status": "reviewed-original-source-scoped-results", "workflowStatus": "resolved-to-cases", "resolvedCaseIds": [ "LRRK-20261101-PRI-002", "LRRK-20261101-PRI-003" ], "followUpResult": "Read the eight-page 2013 study and ten-page author-hosted 2016 follow-up. Original set has seventeen system/configuration combinations, five DDR3: warm resets retained data but tested cold reboots failed to recover placed data. Later cooled, scrambled-DDR3 recovery has explicit controller/layout/known-data and thermal prerequisites; operating-temperature acquisitions failed.", "reason": "Read the eight-page 2013 study and ten-page author-hosted 2016 follow-up. Original set has seventeen system/configuration combinations, five DDR3: warm resets retained data but tested cold reboots failed to recover placed data. Later cooled, scrambled-DDR3 recovery has explicit controller/layout/known-data and thermal prerequisites; operating-temperature acquisitions failed.", "nextCheck": "Owner review of two separate bounded outcomes; do not merge configurations or treat the 2023 embedded-device paper as a test of these Intel systems.", "confidence": null, "previousReview": { "status": "abstract_only_lead", "workflowStatus": "pending-or-unresolved", "resolvedCaseIds": [], "followUpResult": null, "reason": "Publisher abstract/metadata read; full paper not obtained. Retained as a partially reviewed lead, without a confidence score.\nCounterevidence: The abstract reports agreement for DDR1/DDR2 but failure to reproduce cold-boot attacks on tested DDR3. This is retained as published counterevidence, not an absence-of-attack conclusion.", "nextCheck": "Read the complete original study and later DDR3 work before treating memory-generation behavior as general." } }, { "id": "primary-lead-uart-securityinnovation", "title": "IoT Devices — The Not-So-Hidden Risk of UART Interface", "url": "https://blog.securityinnovation.com/iot_uart", "status": "reviewed-archival-original-author-reported-result", "workflowStatus": "resolved-to-cases", "resolvedCaseIds": [ "LRRK-20261101-PRI2-002" ], "followUpResult": "The public archive index exposed the exact original publisher URL; its 2020-10-23 capture retains Satish S's 2018-08-30 article. It names a TP-Link TL-WR841N and explicitly reports root-shell access, rather than only generic UART possibilities. The reviewed source remains partial for visual proof: embedded screenshots were not independently inspected, and the tested router revision, firmware and authentication behavior are not established. The article is explicitly referenced on pinned MITRE TID-116. No original TLS retry or insecure workaround was performed.", "reason": "The original article identity and bounded authored claim are now readable through an archival original. Resolution means admission of an author-reported historical account, not independent confirmation of root access, current susceptibility or a LrrK hardware result.", "nextCheck": "Any stronger device/privilege claim requires original screenshot or console validation and exact build identity; no physical test or source-author contact is authorized by this library entry.", "confidence": null, "previousReview": { "status": "unreviewed_or_unsupported_lead", "workflowStatus": "pending-or-unresolved", "resolvedCaseIds": [], "followUpResult": null, "reason": "Terminal Firecrawl SCRAPE_SSL_ERROR; no body obtained. No repeated or insecure workaround attempted.", "nextCheck": "Use a normal accessible publisher/author source or record the source as unavailable." }, "relatedCaseIds": [ "primary-bhis-uart-2019", "LRRK-20261101-PRI2-002" ], "reviewHistory": [ { "edition": "2026-11-01.2", "status": "follow-up-reviewed-unresolved", "workflowStatus": "pending-or-unresolved", "resolvedCaseIds": [], "relatedCaseIds": [], "followUpResult": "Prior original-source scrape ended in SCRAPE_SSL_ERROR and was not retried or bypassed. Focused title/URL/current-publisher searches exposed no normal accessible author/publisher copy. Search absence does not prove nonexistence. Existing BHIS UART coverage is not a substitute identity for this unread source.", "reason": "Prior original-source scrape ended in SCRAPE_SSL_ERROR and was not retried or bypassed. Focused title/URL/current-publisher searches exposed no normal accessible author/publisher copy. Search absence does not prove nonexistence. Existing BHIS UART coverage is not a substitute identity for this unread source. Original claim remains unresolved; related evidence does not close it.", "nextCheck": "Read a normal accessible publisher/author copy if available; retain held null confidence in the meantime, with no insecure TLS workaround." } ], "classificationBoundary": "Do not substitute the existing Linksys BHIS result, infer a firmware-extraction outcome, or assign a different TP-Link model's vulnerability identifier." }, { "id": "primary-lead-glitch-switch", "title": "Glitching the Switch conference recording", "url": "https://media.ccc.de/v/c4.openchaos.2018.06.glitching-the-switch", "status": "reviewed-original-recording-with-scope-qualification", "workflowStatus": "resolved-to-cases", "resolvedCaseIds": [ "LRRK-20261101-FR-001" ], "followUpResult": "Original CCC metadata and full-talk mirror were matched by canonical link/title/rounded duration; relevant transcript sections attribute physical voltage-glitch ROM readout to a Tegra X1/T210 development board with custom-code execution already permitted. Retail Switch USB recovery exploitation is a separate path.", "reason": "The missing recording evidence is now reviewed at transcript level. A narrowly attributed development-board author result is recorded with scope qualification; full audiovisual, dump and independent-reproduction checks remain explicit limitations.", "nextCheck": "If stronger evidence is needed, verify original-media parity and exact development-kit/build/dump provenance; do not treat the different TX2 study as reproduction.", "confidence": null, "previousReview": { "status": "unreviewed_or_unsupported_lead", "workflowStatus": "pending-or-unresolved", "resolvedCaseIds": [], "followUpResult": null, "reason": "Event metadata and publication date 2018-06-28 read, but recording/transcript and technical artifact were not reviewed.", "nextCheck": "Review an accessible author transcript/slides and compare the exact silicon/boot stage before scoring." }, "relatedCaseIds": [ "LRRK-20261101-FI-004" ], "reviewHistory": [ { "edition": "2026-11-01.2", "status": "follow-up-reviewed-unresolved", "workflowStatus": "pending-or-unresolved", "resolvedCaseIds": [], "relatedCaseIds": [ "LRRK-20261101-FI-004" ], "followUpResult": "Conference metadata and a related original Tegra X2 manuscript were reviewed. The original 2018 Switch recording/transcript remains unreviewed, so the original lead keeps null confidence.", "reason": "Conference metadata and a related original Tegra X2 manuscript were reviewed. The original 2018 Switch recording/transcript remains unreviewed, so the original lead keeps null confidence. Original claim remains unresolved; related evidence does not close it.", "nextCheck": "Review the 92-minute original recording or a legitimately available original transcript/slides; verify exact Tegra X1 silicon and boot stage. Do not substitute the later Tegra X2 experiment." } ] }, { "id": "primary-lead-usbkill-vendor", "title": "USBKill product claims and linked demonstration compilation", "url": "https://usbkill.com/", "status": "reviewed-universal-vendor-claim-excluded", "workflowStatus": "reviewed-excluded", "resolvedCaseIds": [], "followUpResult": "Read the V4 product page after reusing the prior homepage capture. Broad USB-C/Lightning advertising lacks reviewed target/protection-circuit measurements here; promotional clips were not treated as independent validation. The existing DOJ case establishes a separate reported 2019 damage incident without proving V4 model-specific claims.", "reason": "Read the V4 product page after reusing the prior homepage capture. Broad USB-C/Lightning advertising lacks reviewed target/protection-circuit measurements here; promotional clips were not treated as independent validation. The existing DOJ case establishes a separate reported 2019 damage incident without proving V4 model-specific claims.", "nextCheck": "Excluded from attack-case admission on current evidence. Reopen only for an accessible specific technical report with exact conditions or a documented correction; no destructive follow-up requested.", "confidence": null, "previousReview": { "status": "unreviewed_or_unsupported_lead", "workflowStatus": "pending-or-unresolved", "resolvedCaseIds": [], "followUpResult": null, "reason": "Product page read; clips not reviewed and advertised universal bypass/destruction claims lack measured configuration evidence in this strand.\nCounterevidence: The separate DOJ case supplies an actual reported damage incident, while leaving exact device model susceptibility unknown.", "nextCheck": "Evaluate independent reports and exact protection circuitry; do not generalize model-level failures from advertising." } }, { "id": "primary-lead-rowhammer-exploit-2019", "title": "Rowhammer exploit reference linked by EMB3D", "url": "https://arxiv.org/pdf/1904.09724.pdf", "status": "reviewed-original-source-scoped-results", "workflowStatus": "resolved-to-cases", "resolvedCaseIds": [ "LRRK-20261101-PRI-005" ], "followUpResult": "Canonical metadata and four relevant body passages identify a retrospective, not a newly demonstrated 2019 exploit. Followed its historical reference to the original March 2015 Project Zero report and repository. The 2014 disturbance experiment remains separate.", "reason": "Canonical metadata and four relevant body passages identify a retrospective, not a newly demonstrated 2019 exploit. Followed its historical reference to the original March 2015 Project Zero report and repository. The 2014 disturbance experiment remains separate.", "nextCheck": "Owner review of correction and distinct 2015 case. Retrospective was read as targeted passages, not an entire version-pinned paper.", "confidence": null, "previousReview": { "status": "unreviewed_or_unsupported_lead", "workflowStatus": "pending-or-unresolved", "resolvedCaseIds": [], "followUpResult": null, "reason": "Inventoried from the official evidence chain but not substantively read in this pass.", "nextCheck": "Read canonical metadata and paper methods/outcomes before asserting an exploit-specific result." } }, { "id": "primary-lead-ddr4-2021-secondary", "title": "DDR4 Rowhammer secondary reference linked by EMB3D", "url": "https://arstechnica.com/gadgets/2021/11/ddr4-memory-is-even-more-susceptible-to-rowhammer-attacks-than-anyone-thought/", "status": "reviewed-original-source-scoped-results", "workflowStatus": "resolved-to-cases", "resolvedCaseIds": [ "LRRK-20261101-PRI-006" ], "followUpResult": "Ars links Blacksmith. Original page, paper and repository were inspected. The paper reports 40/40 tested DDR4 and 16/19 LPDDR4X fault-positive devices, then analyzes fault locations against prior attack types; a completed exploit on every device is not established.", "reason": "Ars links Blacksmith. Original page, paper and repository were inspected. The paper reports 40/40 tested DDR4 and 16/19 LPDDR4X fault-positive devices, then analyzes fault locations against prior attack types; a completed exploit on every device is not established.", "nextCheck": "Owner review of measured-versus-derived wording and partial PDF count (16/19); no current device validation implied.", "confidence": null, "previousReview": { "status": "unreviewed_or_unsupported_lead", "workflowStatus": "pending-or-unresolved", "resolvedCaseIds": [], "followUpResult": null, "reason": "Inventoried secondary lead; its underlying primary study was not followed in this strand.", "nextCheck": "Resolve the original study and tested DIMM/configuration before adding a case." } }, { "id": "DR-L01", "title": "Holy Stone HS175D/HS720/HS360S firmware acquisition and validation study", "url": "https://arxiv.org/html/2605.11040v1", "status": "reviewed-original-preprint-scoped-acquisition-results", "workflowStatus": "resolved-to-cases", "resolvedCaseIds": [ "DR-018", "DR-019", "DR-020" ], "followUpResult": "Full original HTML inspected. Validated external-flash reads and explicit HS175D SWD readout admitted as acquisition/debug cases; HS360S incomplete read retained as a negative result. No secure-boot bypass, malicious firmware execution or flight takeover established.", "reason": "Full original HTML inspected. Validated external-flash reads and explicit HS175D SWD readout admitted as acquisition/debug cases; HS360S incomplete read retained as a negative result. No secure-boot bypass, malicious firmware execution or flight takeover established.\nResolved to scoped records: DR-018, DR-019, DR-020.\nLead follow-up reviewed: 2026-11-01T14:11:49Z.", "nextCheck": "Independent version-pinned reproduction and vendor reference images remain unavailable; no unrelated sources pursued.", "confidence": null }, { "id": "DR-L02", "title": "IOActive broader robot technical appendix: Baxter/Sawyer, Alpha 1S and other platforms", "url": "https://www.ioactive.com/wp-content/uploads/pdfs/Hacking-Robots-Before-Skynet-Technical-Appendix.pdf", "status": "reviewed-complete-technical-appendix", "workflowStatus": "resolved-to-cases", "resolvedCaseIds": [ "DR-021", "DR-022", "DR-023", "DR-024", "DR-025", "DR-026" ], "followUpResult": "All 46 PDF pages read. Added specific robot firmware/update and controller-interface findings. Generic exposed ports/BadUSB possibilities, companion APK updates, account binding, cloud data and phone SD-card QR storage were not promoted to physical hardware exploits. Existing Universal Robots case was not duplicated.", "reason": "All 46 PDF pages read. Added specific robot firmware/update and controller-interface findings. Generic exposed ports/BadUSB possibilities, companion APK updates, account binding, cloud data and phone SD-card QR storage were not promoted to physical hardware exploits. Existing Universal Robots case was not duplicated.\nResolved to scoped records: DR-021, DR-022, DR-023, DR-024, DR-025, DR-026.\nLead follow-up reviewed: 2026-11-01T14:11:49Z.", "nextCheck": "Current vendor remediation and independent device-specific validation remain open; exact appendix publication date was not established.", "confidence": null }, { "id": "DR-L03", "title": "IOActive later robot-ransomware demonstration and 2026 retrospective", "url": "https://www.ioactive.com/from-skynet-to-ai-agents-the-state-of-robot-security-nine-years-later/", "status": "reviewed-original-source-scoped-results", "workflowStatus": "resolved-to-cases", "resolvedCaseIds": [ "LRRK-20261101-DR-002" ], "followUpResult": "Original2018NAO-only PoC read; Pepper is an asserted extension. Later retrospective is not independent replication. Physical fault injection/encryption/campaign claims excluded.", "reason": "Original2018NAO-only PoC read; Pepper is an asserted extension. Later retrospective is not independent replication. Physical fault injection/encryption/campaign claims excluded.", "nextCheck": "Reopen only if new original evidence changes this bounded review.", "confidence": null, "previousReview": { "status": "unread-retrospective-and-original-followup", "workflowStatus": "pending-or-unresolved", "resolvedCaseIds": [], "followUpResult": null, "reason": "unread-retrospective-and-original-followup", "nextCheck": "Follow the original 2018 demonstration artifact; distinguish controlled encryption/persistence from observed operational ransom campaigns." } }, { "id": "DR-L04", "title": "ArduPilot APWeb 2022 vulnerability series", "url": "https://www.cisa.gov/news-events/bulletins/sb22-108", "status": "reviewed-original-source-scoped-results", "workflowStatus": "resolved-to-cases", "resolvedCaseIds": [ "LRRK-20261101-DR-003" ], "followUpResult": "Resolved one original APWeb CVE and upstream fix with exact commit range. Installation/enablement on a deployed flight controller remains unproved; no claim of a whole exploited vulnerability series.", "reason": "Resolved one original APWeb CVE and upstream fix with exact commit range. Installation/enablement on a deployed flight controller remains unproved; no claim of a whole exploited vulnerability series.", "nextCheck": "Reopen only if new original evidence changes this bounded review.", "confidence": null, "previousReview": { "status": "search-discovered-secondary-bulletin", "workflowStatus": "pending-or-unresolved", "resolvedCaseIds": [], "followUpResult": null, "reason": "search-discovered-secondary-bulletin", "nextCheck": "Resolve original researcher/vendor advisories, exact APWeb commit range and whether deployed controller builds enable the affected interface." } }, { "id": "DR-L05", "title": "Drone firmware dynamic-analysis methodology", "url": "https://arxiv.org/html/2312.16818v3", "status": "reviewed-methodology-only-no-distinct-attack-admitted", "workflowStatus": "reviewed-excluded", "resolvedCaseIds": [], "followUpResult": "Full v3 HTML inspected. Paper reports DJI firmware collection/decryption, BeagleBone Black rehosting and a reported 3.85x per-test-case throughput comparison. Its evaluation does not identify a new CVE, specific exploitable crash or tested attack consequence. Dataset count differs between prose (762) and table (764); no aggregate count is adopted.", "reason": "Full v3 HTML inspected. Paper reports DJI firmware collection/decryption, BeagleBone Black rehosting and a reported 3.85x per-test-case throughput comparison. Its evaluation does not identify a new CVE, specific exploitable crash or tested attack consequence. Dataset count differs between prose (762) and table (764); no aggregate count is adopted.\nLead follow-up reviewed: 2026-11-01T14:11:49Z.", "nextCheck": "No attack case added. Reopen only if original artifact-specific defects or reproducible attack outcomes become available.", "confidence": null }, { "id": "DR-L06", "title": "2011 Predator/Reaper support-computer malware: conflicting public accounts", "url": "https://www.warren.af.mil/News/Article/331620/flash-media-possible-cause-of-predator-drone-virus/", "status": "source-review-gap-retained", "workflowStatus": "pending-or-unresolved", "resolvedCaseIds": [], "followUpResult": "Read additional contemporary Dark Reading coverage quoting the Air Force account: malware was described as a nuisance on a standalone mission-support network, with aircraft control reportedly unaffected. Repeated quotations are one statement chain, not independent forensic evidence. The original AF Space Command press record remains unlocated.", "reason": "Read additional contemporary Dark Reading coverage quoting the Air Force account: malware was described as a nuisance on a standalone mission-support network, with aircraft control reportedly unaffected. Repeated quotations are one statement chain, not independent forensic evidence. The original AF Space Command press record remains unlocated.", "nextCheck": "Locate a normal public original AF Space Command record or authenticated official archival copy before resolving the competing accounts; retain as context, not a hardware-attack demonstration.", "confidence": null, "previousReview": { "status": "context-read-but-primary-incident-statement-unresolved", "workflowStatus": "pending-or-unresolved", "resolvedCaseIds": [], "followUpResult": null, "reason": "context-read-but-primary-incident-statement-unresolved\nRelated source URLs (lead context, not independent confirmation): https://www.nextgov.com/cybersecurity/2011/10/air-force-disputes-drone-virus-reports/49936/", "nextCheck": "Locate original Air Force Space Command declassified statement. Base-news page retells possible USB/keylogging; contemporary reporting quotes officials calling it credential-stealing malware and saying control was never at risk. No drone firmware or flight-control takeover admitted." }, "relatedCaseIds": [], "weeklyDraftPriority": "original-source-gap", "reviewHistory": [ { "edition": "2026-11-01.2", "status": "follow-up-reviewed-unresolved", "workflowStatus": "pending-or-unresolved", "resolvedCaseIds": [], "relatedCaseIds": [], "followUpResult": "Official base-news page retells a media account; contemporary reporting attributes a different malware characterization and says flight control was not affected. Original AFSpaceCommand statement was not recovered, so no hardware attack case or score is admitted.", "reason": "Official base-news page retells a media account; contemporary reporting attributes a different malware characterization and says flight control was not affected. Original AFSpaceCommand statement was not recovered, so no hardware attack case or score is admitted. Original claim remains unresolved; related evidence does not close it.", "nextCheck": "Locate an accessible original2011AFSpaceCommand statement or retained technical incident record, without an access bypass." } ], "materialGaps": [ "Original official release and underlying forensic evidence unavailable.", "Contemporary accounts conflict on malware characterization and statement date.", "No evidence of physical chip tampering, firmware compromise or flight-control compromise established." ], "checks": [ "Targeted the quoted official, exact statement language and af.mil/afspc.af.mil/DVIDS routes.", "Separated article publication on 14 October 2011 from the still ambiguous original statement date.", "A NYT archive scrape returned unsupported-site 403; no retry or alternate mirror was used." ], "sources": [ { "url": "https://www.darkreading.com/cyberattacks-data-breaches/air-force-says-malware-discovered-a-nuisance-not-a-keylogger", "title": "Air Force Says Malware Discovered A Nuisance, Not A Keylogger", "type": "contemporary-journalism", "readStatus": "reviewed", "publicationDate": "2011-10-14", "supports": "Contemporary quotation chain only; not the missing original official statement.", "reviewedAt": null, "limitations": [] } ] }, { "id": "LRRK-COM-LEAD-001", "title": "STM32F103 voltage-glitch Reddit discussion", "url": "https://www.reddit.com/r/hardwarehacking/comments/usigm3/vcc_glitching_stm32f103_in_to_circumventing_the/", "status": "source-review-gap-retained", "workflowStatus": "pending-or-unresolved", "resolvedCaseIds": [], "followUpResult": "Three new targeted public origin-discovery queries, in addition to the three retained follow-up01 queries, did not establish a public original-author artifact attributable to the supplied Reddit post. The known unsupported Reddit URL was not resubmitted and no mirror was used. Search snippets and unrelated STM32-family studies remain discovery only.", "reason": "Three new targeted public origin-discovery queries, in addition to the three retained follow-up01 queries, did not establish a public original-author artifact attributable to the supplied Reddit post. The known unsupported Reddit URL was not resubmitted and no mirror was used. Search snippets and unrelated STM32-family studies remain discovery only.", "nextCheck": "A normally accessible original-author artifact with a defensible identity connection to this post is required before claim review. Do not retry or mirror the restricted source.", "confidence": null, "previousReview": { "status": "blocked_unreviewed", "workflowStatus": "pending-or-unresolved", "resolvedCaseIds": [], "followUpResult": null, "reason": "Firecrawl rejects this site with unsupported-site 403. Search excerpt is discovery only.", "nextCheck": null }, "relatedCaseIds": [], "weeklyDraftPriority": "fault-injection-and-protection-state", "reviewHistory": [ { "edition": "2026-11-01.2", "status": "follow-up-reviewed-unresolved", "workflowStatus": "pending-or-unresolved", "resolvedCaseIds": [], "relatedCaseIds": [], "followUpResult": "Known unsupported-site restriction retained; no Reddit scrape resubmitted. Three permitted origin-discovery queries found no attributable original author artifact. A junk exact-ID result was not opened. Claim remains unread and unscored.", "reason": "Known unsupported-site restriction retained; no Reddit scrape resubmitted. Three permitted origin-discovery queries found no attributable original author artifact. A junk exact-ID result was not opened. Claim remains unread and unscored. Original claim remains unresolved; related evidence does not close it.", "nextCheck": "A permitted original-author public artifact is needed. Do not retry known unsupported Reddit URL or use a mirror to bypass the restriction." } ], "materialGaps": [ "Original post remains unread under the known site restriction.", "No attributable public original-author artifact or tested device/protection/result evidence was established." ], "checks": [ "Reused prior query/receipt history to avoid repeating the known unsupported operation.", "Searched exact title terms with GitHub and independent-domain framing.", "Rejected unrelated search recommendations, unlinked family-level studies and non-author copies as identity substitutes." ] }, { "id": "LRRK-COM-LEAD-002", "title": "EEVblog STM32F4 level-2 protection discussion", "url": "https://www.eevblog.com/forum/microcontrollers/stm-32f4xx-what-hacks-are-known-around-level-2-security/75/", "status": "source-review-gap-retained", "workflowStatus": "pending-or-unresolved", "resolvedCaseIds": [], "followUpResult": "New captures of the first three forum pages were reviewed with the reused last-page capture. Earlier success assertions do not establish F4 RDP2: one contributor explicitly says F4 was untested and cannot identify the F3 model involved. The later RDP2 assertion still lacks an exact tested F4 part/revision, protection-state evidence and a retained validated result. Searches returned only the known assertion and the already published FEV RDP1 article.", "reason": "New captures of the first three forum pages were reviewed with the reused last-page capture. Earlier success assertions do not establish F4 RDP2: one contributor explicitly says F4 was untested and cannot identify the F3 model involved. The later RDP2 assertion still lacks an exact tested F4 part/revision, protection-state evidence and a retained validated result. Searches returned only the known assertion and the already published FEV RDP1 article.", "nextCheck": "Require an original F4/RDP2 configuration and validated result, or a normally accessible original correction. Reconcile the uncertain ST operation before any decision to retry it; no bypass or unrequested paid repeat.", "confidence": null, "previousReview": { "status": "blocked_unreviewed", "workflowStatus": "pending-or-unresolved", "resolvedCaseIds": [], "followUpResult": null, "reason": "Firecrawl capture returned host 502; no forum content was read from that capture.", "nextCheck": null }, "relatedCaseIds": [ "LRRK-20261101-COM-001" ], "weeklyDraftPriority": "fault-injection-and-protection-state", "reviewHistory": [ { "edition": "2026-11-01.2", "status": "follow-up-reviewed-unresolved", "workflowStatus": "pending-or-unresolved", "resolvedCaseIds": [], "relatedCaseIds": [ "LRRK-20261101-COM-001" ], "followUpResult": "Supplied forum now returned HTTP200. RDP2 assertion has no tested-target/technical proof; linked FEV source supports a distinct RDP1 result only. Original RDP2 question remains unresolved.", "reason": "Supplied forum now returned HTTP200. RDP2 assertion has no tested-target/technical proof; linked FEV source supports a distinct RDP1 result only. Original RDP2 question remains unresolved. Original claim remains unresolved; related evidence does not close it.", "nextCheck": "Exact original RDP2 target, protection state and validated result needed; RDP1 research does not resolve the RDP2 assertion." } ], "materialGaps": [ "No exact F4 RDP2 test configuration, retained extraction/validation artifact or independent reproduction found in the reviewed source chain.", "Original vendor errata body was not obtained by this pass; forum commentary is not vendor confirmation.", "The earlier private discussion score 27 is not applied to this unresolved lead; published RDP1 score 73 is not transferred to RDP2." ], "checks": [ "Reviewed the relevant target/protection assertions across all four captured pages, reusing the last-page capture.", "Separated topic-author F417 hardware from an actually validated bypass target.", "Separated unidentified F3 assertions, F0 background and FEV RDP1 from actual F4 RDP2 evidence.", "Attempted the original linked ST errata PDF once; no structured response/error reason/billing receipt was retained, so its source claim and charge remain unknown. No retry." ] }, { "id": "LRRK-COM-LEAD-003", "title": "EEVblog 31C3 IC-glitching video discussion", "url": "https://www.eevblog.com/forum/chat/ic-glitching-video-from-31c3-(ccc)/", "status": "reviewed-original-source-scoped-results", "workflowStatus": "resolved-to-cases", "resolvedCaseIds": [ "LRRK-20261101-COM-003" ], "followUpResult": "Original CCC archive/schedule and full 66-page slides read. Clock-fault result reported on undisclosed IC; no drone/robot target or independent reproduction established.", "reason": "Original CCC archive/schedule and full 66-page slides read. Clock-fault result reported on undisclosed IC; no drone/robot target or independent reproduction established.", "nextCheck": "Victim identity and retained result or independent reproduction missing.", "confidence": null, "previousReview": { "status": "unreviewed_search_lead", "workflowStatus": "pending-or-unresolved", "resolvedCaseIds": [], "followUpResult": null, "reason": "Search discovery only. Original conference talk and forum assertions not reviewed.", "nextCheck": null } }, { "id": "LRRK-COM-LEAD-004", "title": "Remoticon Raspberry Pi 3 Model B+ fault example", "url": "https://github.com/colinoflynn/remoticon-2021-levelup-hardware-hacking/tree/master/rpi-glitching", "status": "reviewed-original-recording-with-scope-qualification", "workflowStatus": "resolved-to-cases", "resolvedCaseIds": [ "LRRK-20261101-FR-002" ], "followUpResult": "Original HACKADAY recording explicitly narrates faulty RSA output and matching-factor recovery using the larger EMFI tool on a Raspberry Pi. Exact screen values, live build and physical recovery are not independently verified. Separate cheap-tool narration is less explicit.", "reason": "The old harness-only gap is closed for the larger-injector author report. The failed PicoEMP forum attempts on other targets remain unchanged and are not upgraded.", "nextCheck": "For stronger evidence, inspect the original screen-output sequence and exact live software/injector configuration; independent exact-configuration reproduction remains a separate question.", "confidence": null, "previousReview": { "status": "artifact_lead_partial_review", "workflowStatus": "pending-or-unresolved", "resolvedCaseIds": [], "followUpResult": null, "reason": "Parent repository read; target code, talk, exact outcome and independent reproduction not yet reviewed.", "nextCheck": null }, "relatedCaseIds": [ "LRRK-COM-010" ], "reviewHistory": [ { "edition": "2026-11-01.2", "status": "follow-up-reviewed-unresolved", "workflowStatus": "pending-or-unresolved", "resolvedCaseIds": [], "relatedCaseIds": [], "followUpResult": "Exact target/OS/old-library configuration and original source were read. A pinned later library contains a fault check. No live RSA fault/recovery was independently verified; original forum failures remain unchanged.", "reason": "Exact target/OS/old-library configuration and original source were read. A pinned later library contains a fault check. No live RSA fault/recovery was independently verified; original forum failures remain unchanged. Original claim remains unresolved; related evidence does not close it.", "nextCheck": "Original live recording/output or an independent exact-configuration reproduction would be needed before admitting a physical key-recovery result." } ], "mappingQualification": "Source-review resolution only; the specific fault model and EMB3D assignment remain unestablished. LRRK-20261101-FR-002 is retained as unmapped." }, { "id": "LRRK-COM-LEAD-005", "title": "DMA Android ARM64 configuration discussion", "url": "https://github.com/ufrisk/pcileech/issues/271", "status": "reviewed-context-no-demonstrated-attack-admitted", "workflowStatus": "reviewed-context-only", "resolvedCaseIds": [], "followUpResult": "Original issue and all visible activity read. Initial acquisition-device error and self-reported resolution preserved; no successful memory artifact.", "reason": "Original issue and all visible activity read. Initial acquisition-device error and self-reported resolution preserved; no successful memory artifact.", "nextCheck": "Exact board/kernel/protection configuration and validated acquisition output missing.", "confidence": null, "previousReview": { "status": "unreviewed_search_lead", "workflowStatus": "pending-or-unresolved", "resolvedCaseIds": [], "followUpResult": null, "reason": "Potential embedded-specific DMA discussion; not opened or qualified.", "nextCheck": null } }, { "id": "LRRK-COM-LEAD-006", "title": "EvilDuck DIY HID-injector project", "url": "https://hackaday.io/project/198041-evilduck-diy-usb-rubber-ducky-for-ethical-hacking", "status": "reviewed-context-no-demonstrated-attack-admitted", "workflowStatus": "reviewed-context-only", "resolvedCaseIds": [], "followUpResult": "Project, details, repository and pinned SD source read. Implementation exists but no host-specific successful run verified; later ESP32-S3 kept separate.", "reason": "Project, details, repository and pinned SD source read. Implementation exists but no host-specific successful run verified; later ESP32-S3 kept separate.", "nextCheck": "Uncut host/device result and exact hardware/host configuration needed for demonstration claim.", "confidence": null, "previousReview": { "status": "unreviewed_search_lead", "workflowStatus": "pending-or-unresolved", "resolvedCaseIds": [], "followUpResult": null, "reason": "Search discovery only; completion and target-host demonstration not verified.", "nextCheck": null } }, { "id": "LRRK-COM-LEAD-007", "title": "EEVblog QSPI flash protection discussion", "url": "https://www.eevblog.com/forum/microcontrollers/how-to-protect-qspi-flash/", "status": "reviewed-context-no-demonstrated-attack-admitted", "workflowStatus": "reviewed-context-only", "resolvedCaseIds": [], "followUpResult": "Both public discussion pages read. Named processor/flash design is not an extraction or bus-interception demonstration.", "reason": "Both public discussion pages read. Named processor/flash design is not an extraction or bus-interception demonstration.", "nextCheck": "Original physical acquisition and validation needed before accepting an attack result.", "confidence": null, "previousReview": { "status": "unreviewed_search_lead", "workflowStatus": "pending-or-unresolved", "resolvedCaseIds": [], "followUpResult": null, "reason": "Search discovery only; no physical-bus attack or extraction result established.", "nextCheck": null } }, { "id": "LRRK-COM-LEAD-008", "title": "PicoGlitcher STM32L05 report", "url": "https://blog.syss.com/posts/voltage-glitching-the-stm32l05-microcontroller/", "status": "reviewed-original-source-scoped-results", "workflowStatus": "resolved-to-cases", "resolvedCaseIds": [ "LRRK-20261101-FI-001" ], "followUpResult": "Read original SySS advisory/blog and linked artifacts. Tested part is K8; actual method is voltage-induced erase suppression, while the common bootloader approach was unsuccessful. Exact-result evidence is same-team.", "reason": "Read original SySS advisory/blog and linked artifacts. Tested part is K8; actual method is voltage-induced erase suppression, while the common bootloader approach was unsuccessful. Exact-result evidence is same-team.", "nextCheck": "Independent same-part/revision reproduction or original validated readout artifact and current vendor remedy record.", "confidence": null, "previousReview": { "status": "unreviewed_search_lead", "workflowStatus": "pending-or-unresolved", "resolvedCaseIds": [], "followUpResult": null, "reason": "Search discovery only; exact device/outcome and relationship to project author not checked.", "nextCheck": null } }, { "id": "LRRK-COM-LEAD-009", "title": "Penthertz STM32 readout-protection discussion", "url": "https://community.penthertz.com/t/breaking-stm32-readout-protection-from-uv-light-to-cpu-state-tracing/27", "status": "reviewed-original-source-scoped-results", "workflowStatus": "resolved-to-cases", "resolvedCaseIds": [ "LRRK-20261101-FI-001", "LRRK-20261101-FI-003" ], "followUpResult": "All six public posts reviewed. Reused Anvil source already exists in the published corpus. TraceRip original sources narrow full-flash/family claims and distinguish non-fault debug recovery from glitching. Commodity dongle mechanism and broad clone-transfer claims remain unverified.", "reason": "All six public posts reviewed. Reused Anvil source already exists in the published corpus. TraceRip original sources narrow full-flash/family claims and distinguish non-fault debug recovery from glitching. Commodity dongle mechanism and broad clone-transfer claims remain unverified.", "nextCheck": "Independent TraceRip capture/recovered-image validation and exact chip/firmware pin. Review original artifacts before scoring the separate commodity-dongle or clone claims.", "confidence": null, "previousReview": { "status": "unreviewed_search_lead", "workflowStatus": "pending-or-unresolved", "resolvedCaseIds": [], "followUpResult": null, "reason": "Discovered during Anvil follow-up; original forum text and cited artifacts are not yet reviewed.", "nextCheck": null } }, { "id": "LRRK-LEAD-CRAFT-2025", "title": "CRAFT: clock-fault effects on an FPGA-implemented RISC-V core, with pre/post-silicon differences", "url": "https://dl.acm.org/doi/10.1145/3768725.3768726", "status": "reviewed-original-source-scoped-results", "workflowStatus": "resolved-to-cases", "resolvedCaseIds": [ "LRRK-20261101-DR2-003" ], "confidence": null, "followUpResult": "Original methods, the latest reviewed v4 and publisher text support the bounded CRAFT FPGA record. Its source confidence belongs to the case, not this discovery lead; deployed-device applicability and artifact gaps remain explicit.", "reason": "Original methods and latest displayed version reviewed; confidence belongs to the bounded case, not the discovery lead.", "nextCheck": "Review exact RTL commit, bitstream, workload and experiment scripts if released. Require device-specific evidence before transferring fault parameters or outcomes to another processor/platform.", "materialGaps": [ "Review exact RTL commit, bitstream, workload and experiment scripts if released.", "Require device-specific evidence before transferring fault parameters or outcomes to another processor/platform." ] }, { "title": "HOBOT S7 Pro: author-reported OTA data writes need an installation-boundary follow-up", "url": "https://arxiv.org/html/2603.08665v2", "reason": "The original paper reports unauthenticated OTA data writes using non-destructive payloads. A data-transfer characteristic accepting writes does not by itself prove firmware-image installation, activation or bypass of a later signature check. Official TID-211 requires an installation/authentication boundary, so no admitted TID-211 case is proposed.", "nextCheck": "Review a normally accessible original artifact or follow-up documenting the on-device verification/installation state, or a vendor security response; do not operate a robot or attempt firmware writes.", "materialGaps": [ "Exact target firmware revision and OTA state/validation sequence missing.", "No reviewed demonstration of unauthorized image commit, activation, boot or persistence.", "No independent reproduction, vendor security response or fix status established." ], "id": "LRRK-LEAD-HOBOT-2026", "status": "source-reviewed-installation-boundary-gap", "workflowStatus": "pending-or-unresolved", "resolvedCaseIds": [], "confidence": null, "followUpResult": "Selected HOBOT S7 Pro sections report non-destructive unauthenticated OTA data writes. Image installation, activation, signature-check bypass and current firmware applicability remain unestablished; no scored case or admitted mapping is added.", "sources": [ { "url": "https://arxiv.org/html/2603.08665v2", "title": "Cybersecurity AI: Hacking Consumer Robots in the AI Era, v2", "type": "primary-source", "reviewedAt": "2026-11-01", "readStatus": "reviewed-selected-sections", "supports": "Methods and HOBOT subsection report non-destructive unauthenticated OTA data writes; no malicious image install/boot result established.", "locators": [ "Section 2", "Section 3.3: HOBOT S7 Pro" ], "limitations": [ "Selected relevant sections reviewed; aggregate fleet/cloud/privacy claims not admitted." ], "provenance": {} }, { "url": "https://arxiv.org/abs/2603.08665", "title": "CAI canonical arXiv record", "type": "primary-source", "reviewedAt": "2026-11-01", "readStatus": "reviewed-selected-sections", "supports": "v1 9 March 2026; latest displayed v2 10 March 2026.", "locators": [ "Submission history" ], "limitations": [], "provenance": {} }, { "url": "https://www.hobot.com.tw/hobot-s7/", "title": "HOBOT S7 Pro official product page", "type": "primary-source", "reviewedAt": "2026-11-01", "readStatus": "reviewed-selected-sections", "supports": "Product identity and availability of OTA updates only.", "locators": [ "OTA Firmware Update & Cleaning Reminder" ], "limitations": [ "Marketing documentation is not security validation or a vendor response to the paper." ], "provenance": {} } ], "mappings": { "emb3d": [], "attack": [] }, "mappingReview": { "considered": "TID-211", "decision": "withheld", "officialCaseAttribution": false, "reference": "https://emb3d.mitre.org/threats/TID-211.html" }, "weeklyDraftPriority": "firmware-installation-boundary" } ], "editionHistory": { "previousEdition": "2026-11-01.2", "previousSHA256": "5f84389f1bef4d706026234ed1bccd69dd3436375d555d9c49441a4871107b0a", "addedRecords": 7, "originalRecordsUnchanged": true, "sourceBatchId": "2026-11-01-manual-follow-up-02", "sourcePacketSHA256": "61966c044c9a9cbf365b227b602398bd606ea17c7cd91b5460fc1e441fb90ba4", "sourceLeadUpdatesSHA256": "a425724e4ce146b1dbb683a7fb2d6460dbc931b7fb09b89fb1a33c64cdf69003", "review": "Owner authorized publication of all seven bounded source-reviewed additions. Source-review lead resolution is not vulnerability remediation or physical validation. Independent release checks and deployment evidence are tracked separately.", "previousHistory": { "previousEdition": "2026-11-01.1", "previousSHA256": "0c1811a2e4009455742363cdc0dea98e117715902193dd69328903db492f089f", "addedRecords": 15, "originalRecordsUnchanged": true, "review": "AI-assisted source and independent curation review; publication authorized by the owner. No independent physical reproduction or human verification of the experiments is claimed." } } }