Fault Injection.

Fault injection deliberately pushes a system outside its operating envelope — through voltage glitches, clock manipulation, electromagnetic pulses (EMFI), or a focused laser on a decapsulated die — so that a single instruction is skipped or a memory bit flips at a chosen moment. The attacker turns that controlled error into a security failure: bypassing a decision (skipping a PIN check or secure-boot signature verification) or corrupting a cryptographic computation. In differential fault analysis, first described by Boneh, DeMillo and Lipton in 1997 against RSA-CRT, comparing a correct signature with a faulted one reveals the private key; the same idea breaks AES in a handful of faulted encryptions.

Faulting is no longer purely physical. CLKSCREW (2017) and VoltJockey abused a CPU's own power-management registers to glitch ARM TrustZone from software, and Intel's Plundervolt (CVE-2019-11157, 2019) undervolted the core from ring 0 to corrupt SGX enclave computations until Intel disabled the interface via microcode. Hardware-wallet research at wallet.fail (35C3, 2018) glitched Trezor and Ledger devices to reach stored secrets. Rowhammer shows even ordinary memory access can induce faults.

Countermeasures include redundant or randomised computation, fault-detection sensors, voltage and clock monitors, error-correcting memory, and defensive code that double-checks every security branch.

flowchart TD
  A[Attacker with device access] --> B{Fault vector}
  B -->|Voltage / undervolt| C[VCC drop or spike]
  B -->|Clock glitch| D[Overclock pulse]
  B -->|EMFI / laser| E[Localized pulse on die]
  C --> F[Instruction skip or bit flip]
  D --> F
  E --> F
  F --> G{Exploited effect}
  G -->|Skip check| H[Bypass PIN / secure boot]
  G -->|Corrupt crypto| I[Fault analysis leaks key]
  H --> J[System compromised]
  I --> J