Be Write Back: An in-depth Study of Fault Injection Effects on FRAM Technology

Ferroelectric random access memory (FRAM) corruption has primarily been investigated in the context of safety for space applications and the associated radiation. In this work, we present the first in-depth analysis of the effects of fault injection on FRAM technology from a security perspective. This includes the identification of potentially vulnerable signals in the control circuit. Based on a theoretical consideration of possible weak points, we carry out practical attacks on external memory devices from different manufacturers. After a detailed analysis, we demonstrate the feasibility of this attack on an FRAM-based microcontroller, namely the MSP430FR. We show how the write-back operation, an FRAM intrinsic operation, can be exploited to reactivate the debug interface of the microcontroller. The attack can be carried out in less than a minute and with modest equipment costs, highlighting its practicability. Based on our analysis, we conclude with different mitigations that manufacturers can implement to enhance security.