Sheila Ayelen Berta - Backdooring Hardware by Injecting Malicious Payloads on Microcontrollers

Hardware Backdoor Injection

Sheila Ayelen Berta (Security Researcher, ElevenPaths) presents research on hardware supply chain attacks: injecting malicious firmware payloads into commercial microcontrollers (ATmega, STM32, ESP32) without leaving physical evidence.

Microcontroller Programming Attack Surface

Microcontrollers are typically programmed via ISP (In-System Programming), JTAG, or SWD interfaces. During manufacturing, production programming stations connect to these interfaces to flash device firmware. A compromised programming station could inject additional code alongside the legitimate firmware.

Covert Payload Injection

Berta demonstrates techniques for appending malicious code to existing firmware images while preserving the original functionality — the device operates exactly as expected while executing backdoor functions. The injected code occupies unused flash sections and modifies interrupt vectors.

Detection Evasion

Since the device responds normally to functional tests and the backdoor code is not triggered by standard QA procedures, injected hardware backdoors survive the entire manufacturing quality assurance process. Binary comparison of the device's flash against the reference firmware image is required to detect the modification.