conv.

All stories
SecurityQuiet 4d · day 4

Ledger Donjon breaks RP2350 debug lock using laser fault injection

Security researchers used a focused laser to flip bits and unlock debug access on Raspberry Pi's RP2350 microcontroller, solving the chip's own hacking challenge.

newest coverage 3d agosummary written 3d ago5 pieces15 likes & upvotes MastodonHacker NewsGoogle News

What to know

  • Ledger Donjon defeated the RP2350's debug lock via laser fault injection, bypassing secure boot, TrustZone and the chip's built-in glitch detection.
  • The attack required decapsulating the chip and using photon-emission electron microscopy to locate the debug-enable register before firing an IR laser through the backside silicon.
  • The team recovered the 128-bit secret from the Raspberry Pi Foundation's official RP2350 hacking challenge, confirming full debug access was restored.
  • Coverage notes the flaw is fixable in future silicon by changing the DEBUGEN bit encoding, and raises questions about EU Cyber Resilience Act compliance.

Ledger Donjon Security research teamRaspberry Pi Foundation Maker of the RP2350 chip

Ledger Donjon breaks RP2350 debug lock using laser fault injection
hackaday.com

How it unfolded 1 development · click the chart to see its coverage posts

Peak 3 pieces in one hour at Sep 19, 9 PM; 5 pieces over 4 days (2 articles · 3 posts) Sep 19, 9 PM — 3 pieces · 2 articles · 1 post — Mastodon 2, Google News 1Sep 19, 10 PM — quietSep 19, 11 PM — quietSep 20, 12 AM — quietSep 20, 1 AM — quietSep 20, 2 AM — 1 piece · 1 post — Hacker News 1Sep 20, 3 AM — quietSep 20, 4 AM — 1 piece · 1 post — Mastodon 1Sep 20, 5 AM — quietSep 20, 6 AM — quietSep 20, 7 AM — quietSep 20, 8 AM — quietSep 20, 9 AM — quietSep 20, 10 AM — quietSep 20, 11 AM — quietSep 20, 12 PM — quietSep 20, 1 PM — quietSep 20, 2 PM — quietSep 20, 3 PM — quietSep 20, 4 PM — quietSep 20, 5 PM — quietSep 20, 6 PM — quietSep 20, 7 PM — quietSep 20, 8 PM — quietSep 20, 9 PM — quietSep 20, 10 PM — quietSep 20, 11 PM — quietSep 21, 12 AM — quietSep 21, 1 AM — quietSep 21, 2 AM — quietSep 21, 3 AM — quietSep 21, 4 AM — quietSep 21, 5 AM — quietSep 21, 6 AM — quietSep 21, 7 AM — quietSep 21, 8 AM — quietSep 21, 9 AM — quietSep 21, 10 AM — quietSep 21, 11 AM — quietSep 21, 12 PM — quietSep 21, 1 PM — quietSep 21, 2 PM — quietSep 21, 3 PM — quietSep 21, 4 PM — quietSep 21, 5 PM — quietSep 21, 6 PM — quietSep 21, 7 PM — quietSep 21, 8 PM — quietSep 21, 9 PM — quietSep 21, 10 PM — quietSep 21, 11 PM — quietSep 22, 12 AM — quietSep 22, 1 AM — quietSep 22, 2 AM — quietSep 22, 3 AM — quietSep 22, 4 AM — quietSep 22, 5 AM — quietSep 22, 6 AM — quietSep 22, 7 AM — quietSep 22, 8 AM — quietSep 22, 9 AM — quietSep 22, 10 AM — quietSep 22, 11 AM — quietSep 22, 12 PM — quietSep 22, 1 PM — quietSep 22, 2 PM — quietSep 22, 3 PM — quietSep 22, 4 PM — quietSep 22, 5 PM — quietSep 22, 6 PM — quietSep 22, 7 PM — quietSep 22, 8 PM — quietSep 22, 9 PM — quietSep 22, 10 PM — quietSep 22, 11 PM — quietYesterday, 12 AM — quietYesterday, 1 AM — quietYesterday, 2 AM — quietYesterday, 3 AM — quietYesterday, 4 AM — quietYesterday, 5 AM — quietYesterday, 6 AM — quietYesterday, 7 AM — quietYesterday, 8 AM — quietYesterday, 9 AM — quietYesterday, 10 AM — quietYesterday, 11 AM — quietYesterday, 12 PM — quietYesterday, 1 PM — quietYesterday, 2 PM — quietYesterday, 3 PM — quietYesterday, 4 PM — quietYesterday, 5 PM — quietYesterday, 6 PM — quietYesterday, 7 PM — quietYesterday, 8 PM — quietYesterday, 9 PM — quietYesterday, 10 PM — quietYesterday, 11 PM — quietToday, 12 AM — quietToday, 1 AM — quietToday, 2 AM — quiet 1
Sep 20Sep 21Sep 22yesterdaynow · 3:43 AM ET
  1. 1

    Story circulates via Hackaday's Mastodon and syndication

    Hackaday's Mastodon account and a syndicated aggregator post spread the article further, with no additional facts added.

    “went full Bond Villain and strapped everyone's favourite fruit-flavoured microcontroller to a table with a slowly-approaching laser beam…”
    — Hackaday, Publication · source
    • us@pubeurope.com

      https://www. europesays.com/us/1074328/ Laser Your Way Into Debug Mode On The RP2350 # Technology # UnitedStates # UnitedStates # US

      us@pubeurope.comMastodon3d agoview on Mastodon ↗
  2. background

    Hackaday outlines fixes for future RP-series chips — The writeup suggests the exploit is not unavoidable: a future chip could require neighboring DEBUGEN bits to be set to a specific pattern like "01" rather than simple all-1s, and software could set additional debug-blocking registers (DBGFORCE, BUSCTRL) to raise the number of bits an attacker must flip.

  3. background

    Team reads the RP2350 hacking challenge's hidden 128-bit secret — After resetting the chip with debug access restored, Ledger's team retrieved the 128-bit secret the Raspberry Pi Foundation had hidden in memory as part of its official RP2350 hacking challenge, demonstrating the attack's success.

  4. background

    Ledger Donjon details laser attack unlocking RP2350 debug mode — Hackaday reports that Ledger Donjon located the RP2350's debug-enable register via photon-emission microscopy on a decapsulated chip, then used a focused IR laser through the backside silicon to flip bits and re-enable debug access, defeating secure boot, TrustZone and glitch detection.