hsm-attack

name	hsm-attack
description	Hardware Security Module attacks — physical (side-channel, fault injection, decapping) and logical (PKCS#11 API abuse, key extraction, M-of-N quorum bypass, RDP, firmware exploitation). Covers Thales Luna (SafeNet), Utimaco SecurityServer, nCipher nShield, YubiHSM, AWS CloudHSM, Azure Dedicated HSM, Google Cloud HSM. Includes 2024-2025 CVEs (CVE-2024-47787 Thales Luna, CVE-2024-45294 Utimaco), HSM-as-a-Service tenant isolation attacks, and quorum-spoofing scenarios. Distinct from crypto-attacks (algorithm-level) and pam-privilege-attack (credential management).
origin	kali-claw Wave 10 (v0.1.41) — 2026-06-28
version	0.2.0.2
compatibility	{"kali_version":"2025.2","python_version":">=3.11","pkcs11_tool_required":true,"openssl_required":true}
allowed-tools	["pkcs11-tool","opensc-tool","openssl","yubihsm-shell","ykman","python3","ltrace","strace","gdb","chipwhisperer","saleae-logic","glitchcat","hashcat","john","jtagenum","binwalk","ghidra"]
metadata	{"domain":"hardware-security","tool_count":16,"guide_count":2,"mitre":"TA0006-Credential Access, TA0010-Exfiltration, T1552-Unsecured Credentials, T1552.007 Container and Cloud Instance Credentials API, T1041-Exfiltration Over C2 Channel","last_reviewed":"2026-07-26"}

HSM (Hardware Security Module) Attack Skill

Red-team operations against Hardware Security Modules — thetamper-resistant hardware that anchors enterprise PKI, payment HSMs, code signing, and increasingly blockchain / Web3 key custody. This skill covers both physical access attacks (fault injection, side-channel, decap) and logical API attacks (PKCS#11 abuse, quorum bypass, tenant escape in cloud HSM).

Summary

Hardware Security Modules (HSMs) are dedicated cryptographic appliances that generate, store, and use keys without ever exposing them in plaintext outside the device. Common HSMs in 2024-2026:

• Thales Luna (SafeNet) Network HSM 7 / 10 — dominant in enterprise PKI
• Utimaco SecurityServer — European gov / banking
• Entrust nShield n3 / n5 — UK gov, finance, code signing
• Yubico YubiHSM 2 — cloud-native dev / staging
• AWS CloudHSM — HSM-as-a-service
• Azure Dedicated HSM — Thales PayShield / Luna as-a-service
• Google Cloud HSM — FIPS 140-2 L3
• Marvell / ATKey / SoloKey — USB form-factor

HSMs are sold as "impossible to extract keys" — and for the most part that's true at the cryptographic primitive level. But attackers don't break AES; they break the operational envelope: API abuse, quorum-spoofing, firmware vulnerabilities, tenant isolation flaws in cloud HSM, and physical access for side-channel / fault injection.

This skill covers:

• PKCS#11 API abuse — extracting key material via attributes, key wrapping with attacker keys
• NTLS / RDP attacks (Thales Luna Network HSM) — exploiting client-side channels
• M-of-N quorum bypass — recovering quorum tokens from client workstations
• Firmware exploitation — CVE-2024-47787 Thales Luna RCE, CVE-2024-45294 Utimaco
• Side-channel attacks — power analysis on USB HSMs, timing on RSA operations
• Fault injection — voltage / clock glitching on lower-tier HSMs
• Decapping — invasive silicon-level attacks (for motivated nation-states)
• Cloud HSM tenant isolation — side-channel between co-tenants on shared infrastructure
• Payment HSM attacks — Thales PayShield, Atalla AT1000 PIN translation / DUKPT attacks

Distinct from adjacent skills: