Skip to content

Spying on Microcontrollers using Current Sensing and embedded TinyML models

License

Notifications You must be signed in to change notification settings

Santandersecurityresearch/CurrentSense-TinyML

Repository files navigation

Welcome to CurrentSense-TinyML

Intro

CurrentSense-TinyML is all about detecting microcontroller behaviour with current sensing and TinyML. Basically we are trying to work out what is happening on a target PCB.

This work is inspired by prior work I have done, as well as the work of Stacksmashing at leveldown security. This work is intended to be a working Proof of Concept (PoC) for what is the next logical step in these kinds of attacks - using Machine Learning (ML) in current monitoring side-channel analysis attacks.

GOAL - To detect an LED flashing on a target using an TensorFlow Lite ML model running on a different microcontroller speaking to an INA219 power monitor that is reading the power going into the target.

See TinyML-CurrentSense-Writeup.ipynb for the writeup of this project. The Arduino_CurrentSense_ML folder contains the Arduino IDE .ino file that will load the model onto an Arduino Nano 33 Sense board. The rest of the code - for generating training data, recording it, and processing it, can all be found in the jupyter notebook and the DataCollection folder.

We've also uploaded it to Google Colaboratory for those who would like to have a play but not install stuff locally first: https://colab.research.google.com/github/Santandersecurityresearch/CurrentSense-TinyML/blob/main/TinyML-CurrentSense-Writeup.ipynb

This is a taster of the resulting behaviour - reading the state of the target LED (in RED) and copying it using the analyser's LED (Yellow):

PoC

What is CurrentSense-TinyML (and does it work?)

Despite prior evidence that says 'yes!' from the work we cited above, there are a few good indicators that this should work. If we setup the INA219 with the Nano 33 Sense and just monitor the Nano target running blink, we can see the following output when we use Arduino IDE's Serial Plotter (using the get_current_data.ino code for those who want to play along at home)

initial motivation

How Do I Install It?

First things first, we need to get the environment ready. TensorFlow does not support Python v3.9.x, so if you need to, you should run conda activate to enable a python 3.8.x environment.

We recommend you use a Jupyter Notebook instance as this makes life much easier.

We first install TensorFlow and then do our imports...

Tensorflow

Next up, you will need some hardware:

  • INA219 Current Measuring over I2C board
  • Arduino Nano ATMEGA329P target board (AliExpress or eBay is good here)
  • Arduino Nano 33 Sense ML capable board
  • USB Cables and Laborkabel
  • A Breadboard is handy

On the software side, your IDE Platformio or the Arduino should work with the Arduino Nano 33 Sense. You'll also need to add the INA219 library

How Do I Use It?

Ok, so we've convinced ourselves that this should work... or might work... or could work... so let's get started!

We recommend you load the TinyML-CurrentSense-Writeup.ipynb into your Jupyter instance as this is the most detailed explaination as to how you make magic happen.

Who Is Behind It?

CurrentSense-TinyML is a research project by Work done by Mark Carney of the Santander Group Cyber Security Research Team. (@LargeCardinal).

About

Spying on Microcontrollers using Current Sensing and embedded TinyML models

Topics

Resources

License

Stars

Watchers

Forks

Releases

No releases published

Packages

No packages published