Arbitrary Data Injection into CMOS Integrated Circuits via Dual-Wave Electromagnetic Irradiation

Intentional electromagnetic interference (IEMI) poses a serious security threat, allowing attackers to disrupt or manipulate electronic equipment remotely by injecting false data through electromagnetic (EM) radiation. Existing methods fall short, often requiring physical access to internal circuitry or depending on the nonlinear characteristics of devices, which results in unreliable logic state injections. This paper introduces a groundbreaking EM dual-wave injection technique that effectively addresses these limitations. Our method stabilizes and precisely controls the injection of logic states into CMOS integrated circuits (ICs). Initial experiments with standard CMOS logic ICs clearly demonstrate the feasibility and reliability of injecting arbitrary logic states using two strategically selected EM wave frequencies. Furthermore, we successfully applied this innovative approach to the widely used Raspberry Pi 4 Model B, equipped with a Broadcom System-on-a-Chip (SoC). We accomplished the remote injection of arbitrary ASCII characters into the Universal Asynchronous Receiver/Transmitter (UART) debug console interface through precise tuning of wave frequencies and power levels. This allowed for data injection into a Linux operating system, including shell commands, without any physical intervention. These results expose critical vulnerabilities inherent in serial communication interfaces like UART and signal potential risks to other prevalent serial protocols, including Inter-Integrated Circuit (I²C) buses. The demonstrated capability for accurate and non-invasive remote manipulation of embedded system operations through EM methods underscores the urgent necessity for enhanced EM protection strategies and robust defensive measures in electronic system design.