The microcontroller security flaws could impact a wide range of equipment

Weak readout protection technology poses a significant threat to endpoint devices. Positive Technologies discovered that potential attackers could bypass readout protection on GigaDevice GD32 chips, allowing them to extract the firmware, identify exploitable vulnerabilities, modify the firmware, or steal it to produce counterfeit devices under a different brand. GigaDevice GD32 microcontrollers are common in charging stations, car engines, batteries, access control systems, and other equipment from manufacturers across multiple countries.

"Many modern devices are built from standard components that are typically much cheaper that the final product," shares Alexey Usanov, Head of Hardware Security at Positive Technologies. "Their primary value lies in the firmware, which enables individual components to function together seamlessly. To protect this critical intellectual property stored in the flash memory of microcontroller units, readout protection technologies are used. However, our research shows that the protection in GigaDevice chips isn't as robust as it could be, especially since the firmware is available for download publicly, making it easier for attackers to find vulnerabilities in equipment. These microcontrollers have been used widely in products around the world over the past year and a half to replace the popular 32-bit microchips from STMicroelectronics."

Security researchers first identified flaws in the readout protection technology on a single device. To objectively evaluate the security of similar chips, they then bought and tested 11 GigaDevice GD32 microcontrollers after first activating their readout protection. Testing confirmed that firmware could be extracted unencrypted, and all examined chips in the GD32F1×0, GD32F3×0, GD32F4xx, GD32L23x, GD32E23x, GD32E50x, GD32C10x, GD32E10x, GD32F20x, GD32F30x, and GD32F403 families were found to be vulnerable.The vendor was informed of the threat in accordance with the responsible disclosure policy. 

Given the challenges of remediating hardware vulnerabilities, Positive Technologies advises vendors developing new endpoint devices to use microcontrollers with firmware readout protection that has been tested independently. Manufacturers can check the names of microcontrollers, and users can request the names from vendors or disassemble devices to check the chip themselves.