This Modified Barbecue Lighter Injects an Electromagnetic Pulse Into the Circuit of Your Choice
Designed to glitch a system into interesting states, this simple EMP injector can break through running programs in protected MCUs.
Pseudonymous security researcher "rqu" has put together a guide to turning a piezoelectric igniter for a barbecue into a device capable of sending out an electromagnetic pulse strong enough to glitch a circuit — and thus inject a fault for security research and more.
Voltage glitching, where a circuit's voltages are increased or decreased outside expected levels, is a well-understood approach to investigating how a black-box system works — and to breaking into locked systems: The PocketGlitcher is a great example of an automated system for voltage glitching, while Hagan Fritsch's work on unlocking the STMicro STM8 used easily-accessible and low-cost hardware.
This latest project by rqu, however, has them beat: swapping the voltage glitching for electromagnetic pulse glitching using a device, which requires under $5 in parts to build.
"Ingredients," rqu writes of the build. "1 piezo grill igniter. 1/2 small ferrite ring. 26 AWG (or similar) enameled wire. A splash of solder. (Optional) electrical tape, hot glue, 3d printed shell.
"To make the injection tip, cut the ferrite ring in half and give it a few (8-10 worked best for me) turns of wire. Make sure you leave some extra wire for the next step. Solder the probe tip to the contacts of the igniter. Feel free to add tape or glue for mechanical support, since it can be hard to make good connections to the contacts."
Press the igniter's trigger, and it fires — but instead of a spark designed to light a barbecue, you get an electromagnetic pulse. Get it close enough to a sensitive part of a circuit, and interesting things happen — including breaking out of an infinite loop in a demonstration of its capabilities.
"Or, in technical terms," rqu writes, "EMFI [Electromagnetic Field Interference] goes clicky and makes the code go brrr."
More details are available on rqu's Twitter account.
Freelance journalist, technical author, hacker, tinkerer, erstwhile sysadmin. For hire: freelance@halfacree.co.uk.