Laser Beams & Light Streams: Building Affordable Light-Based Hardware Security Tooling

The talk starts from the cost barrier in hardware fault injection. Commercial laser fault injection rigs often run well into six figures, which the presenters argue has led people to assume the technique is out of reach outside well-funded labs. They break a working setup into three parts: an imaging system, a positioning stage and a laser source.

The speakers describe a home-built rig using a 3D-printed flexure microscope stage, standard optics and a cheap low-power laser module, with a total cost under 500 dollars. They show it glitching a small test microcontroller so that a calculation is skipped or altered, and they explain why a longer, lower-power pulse can still induce a fault within a single clock cycle. They then reuse the same hardware for infrared imaging through the back of a die. In one case this revealed that a chip they expected to be an FTDI part had a different die than its markings suggested, a practical example of supply-chain verification. The final section covers laser logic state imaging, which maps SRAM cells by modulating supply voltage and measuring the reflected laser. A convolutional neural network trained on a published dataset reads bit values from the resulting images, and the speakers report about 96 percent accuracy on a test set.

The takeaways are that affordable tooling can reproduce parts of lab-grade hardware attacks, that open-sourcing designs lowers the barrier to research and verification, and that laser safety is a real hazard that needs proper eye protection. The speakers also note that other groups released similar open designs around the same period.