# About this project ## What it is An educational project about hardware **side-channel analysis**, **fault injection**, and **glitching**, plus adjacent physical signal-injection attacks. Its aim is not to catalogue attacks but to teach a way of *reasoning* about them: why secure-looking systems can still make the wrong decision, because the assumptions beneath those decisions exist in physical reality and can be **observed, influenced, or disrupted**. That reasoning method is set out in [[Every-Security-Boundary-Is-a-Decision|Every security boundary is a decision]]; everything else here, the distilled research corpus, the synthesis maps, and the hands-on walkthroughs, exists as evidence and worked examples that support it. The material is written for a reader who is a strong security generalist but **new to hands-on hardware work**, so the *bench reality* (what hardware, what setup, what success criteria, what failure modes) is made explicit. ## How an entry is made Every entry traces to a captured source. The process: 1. **Ingest** a source (paper, blog, talk, tool) and **harvest** a durable local copy. 2. **Distill** it, in our own words, into Summary / Technique & setup / Relevance, with exact figures (success rates, trace counts, timings) attributed, never inflated. 3. **Enrich** with normalized metadata (tools, targets, techniques, defenses) so the corpus is queryable and the cross-cutting maps stay current. > [!important] One fact, faithfully reported > Summaries are distillations, not reprints. We don't turn "they glitched it" into "fully broken," > and where a source doesn't state something, the entry says so rather than guessing. ## Attribution & licensing - **Every entry links its original source.** The value added here is the synthesis and the defender's framing; credit for the underlying research belongs to the cited authors. - We do **not** republish others' raw artifacts (PDFs/figures); we link to them. - **Original prose on this site is licensed [CC BY-NC 4.0](https://creativecommons.org/licenses/by-nc/4.0/).** You are free to share and adapt it for **non-commercial** purposes with **attribution** (credit Steve Watson and link back). This covers the writing here, not the underlying research it cites, which belongs to its authors under their own terms. - **Any code** (scripts, cookbook tooling) is licensed **MIT**. - Copyright is retained by the author; the licenses above are a grant to you, not a transfer. For commercial use, or anything the licenses don't cover, get in touch. - This material is provided for defensive security, engineering education, interoperability, accessibility, and legitimate technical research. My goal is to make complex technical topics more accessible to engineers, defenders, and researchers. I am Steve Watson. I have spent more than two decades in cyber and product security, digital forensics and investigations. The work I am best known for, focused on embedded and connected devices, is reverse engineering, security architecture, threat modeling, vulnerability evaluation, and penetration testing. I built this to make that field accessible to others, to turn hard-won, often tacit hardware-attack knowledge into something a security engineer or product team can actually reason with. Connect on [LinkedIn](https://www.linkedin.com/in/watsonsteve/). ## Authorization & scope This is **defensive** research. The point of understanding these attacks is to anticipate, detect, and harden against them. Any hands-on experimentation referenced here is performed on **devices the author owns or is explicitly authorized to test, in the author's own lab**, never on third-party or production targets without documented authorization. ## Disclaimer Provided for education and defense. You are responsible for complying with all applicable laws and for only testing systems you own or are authorized to assess. --- © Steve Watson. Prose licensed CC BY-NC 4.0; code licensed MIT. Cited research belongs to its authors.