Future of Fault Injection - Expanding the Keysight Device Security Toolset
Show Description
Modern embedded devices are becoming faster, smaller, and more complex. At the same time, attack techniques are evolving just as quickly, making effective security testing increasingly challenging.
In this webinar, we explore how fault injection is evolving, both from a tooling and methodology perspective, and through a real, hands-on attack against a modern IoT device.
The session is structured in three parts:
Part 1: Product Manager Erwin in ’t Veld introduces the Future of Fault Injection, presenting the latest advancements in Keysight’s Embedded Security Testbench and how they address modern fault injection challenges.
Part 2: External expert partner Niek Timmers presents an in-depth research case study, demonstrating how a PXI testbench and electromagnetic fault injection can be used to compromise a real-world device.
Part 3: A live Q&A session where experts answer attendee questions covering practical testing considerations, equipment requirements, and real-world attack behavior.
Part 1: Erwin, Product Manager [04:40 – 26:00]
At the beginning of 2025, the Keysight Device Security team introduced the Next-Generation PXI-based Embedded Security Testbench. This modular and scalable platform is designed to meet the increasing speed, complexity, and customization requirements of modern embedded devices.
The PXI architecture enables high-performance security testing while remaining flexible, allowing seamless integration of Keysight and third-party modules. This makes it possible to build complete side-channel analysis and fault injection setups that can evolve alongside attacker capabilities.
A key new addition to the Testbench is the PXI Glitch Pattern Generator, designed for advanced fault injection testing. The module provides precise control over glitch timing, strength, and sequencing across voltage, electromagnetic, and laser-based attacks. Compared to the previous generation, it delivers up to 10× higher performance, improved timing resolution, higher sampling rates, more channels, and increased output power.
The module integrates into existing workflows of Inspector Software through both a graphical user interface and Python API, supporting ease of use as well as advanced automation.
This section covers:
Why modern embedded devices are harder to test than ever before
How PXI-based architectures enable scalable and modular security testing
The role of the new glitch pattern generator in improving precision, speed, and reproducibility
Key performance improvements compared to previous generations
How fault injection and side-channel analysis can be combined within a single platform
Built-in automation, usability improvements, and support for GUI- and script-based workflows
This part is ideal for security evaluators, product vendors, and lab managers looking to future-proof their test setups.
Part 2: Niek Timmers, External Partner [26:00 – 41:00]
In the second part of the webinar, Niek Timmers presents a real-world fault injection case study targeting a modern Android-based device, the Google TV Streamer powered by a MediaTek system-on-chip. Using electromagnetic fault injection, he demonstrates how carefully timed hardware disturbances can corrupt CPU instruction execution and bypass kernel-level security checks.
This section walks through:
Target selection and hardware reconnaissance
Understanding the security architecture of a modern SoC
Using electromagnetic glitching to disturb CPU instruction execution
How instruction corruption can break software-based security assumptions
Bypassing Linux kernel checks to obtain root access at runtime
Lessons learned from attacking a real, commercially deployed device
The case study shows that Fault injection attacks remain practical and effective, even against high-performance, multi-core SoCs running at gigahertz speeds, and highlights why hardware-level testing
Part 3: Q&A [47:00 – 60:00]
What hardware do I need to start with EM fault injection?
EMFI probe, glitch pattern generator, and target communication interface (USB/I²C/SPI). A PXI testbench with embedded controller covers the essentials.
Will EM fault injection damage my device?
Rarely. EM glitching typically causes memory overwrites rather than permanent chip damage,much safer than laser injection.
Which fault injection technique works best?
Depends on your target. EM requires minimal device modification but isn't always effective. Having multiple techniques available is essential.
Can these tools extract AI models?
Yes. Side-channel analysis and fault injection have successfully extracted AI model parameters in published research.
Full Q&A Available
Want access to all audience questions and detailed expert answers? Subscribe here.
Key Takeaways
Embedded security testing must go beyond theory, incorporating real hardware attacks using professional-grade tools. This webinar provides both a platform-level overview and a concrete example of fault injection in practice.
For Security Engineers & Researchers:
Next-generation PXI platforms deliver 10x performance improvements, enabling comprehensive testing (15-20 billion traces per day) without sacrificing time-to-market
Real-world demonstration proves that modern high-speed processors (1.8 GHz+) remain vulnerable to electromagnetic fault injection
Advanced test equipment makes sophisticated attacks more accessible and repeatable, revealing vulnerabilities that software analysis alone cannot detect
For Product & Business Leaders:
As embedded devices become faster and more complex, attackers are evolving—your test equipment must outperform both
Software security models can fail completely when hardware is manipulated; defense-in-depth strategies are essential
Physical security testing is no longer optional for devices handling sensitive data or requiring certification compliance
