Is hardware really secure?

Hardware plays the most important role in a system’s security and trust. It enables, enhances, and enforces security. However, if the hardware is not designed and implemented properly (with security in mind), it becomes a system’s weakest security point. In contrast to other security domains (e.g., software and network security), hardware security is a fairly young field. Until very recently, hardware was considered inherently secure and unbreakable. Not any more.

The dawn of hardware attacks started with fault injection attacks on smart cards. Then side-channels on earlier cryptographic implementations became attractive. The transition from vertical to horizontal business models in the IC supply chain opened the doors to a new class of attacks, where design houses may no longer have full control over their products. Today, hardware’s role as a trust anchor is challenged.

This blog post is the first of three in a series on hardware security, in which we give a brief overview on hardware attacks. HENSOLDT Cyber’s MITHRIL (Maßnahmen der IT-Sicherheit zur Hochsicheren HardwaRe IndustriaLisierung) project aims to contribute to the initiative for highly secure hardware industrialization by analysing and evaluating the security of embedded hardware and software but moreover, by defining security requirements and creating a prototype that can be resilient against many attacks discussed below.

Who is the attacker?

When talking about attacks, we must discuss the attack model first, i.e., the attacker’s intentions and capabilities. The final goal of every attack is either stealing or manipulating sensitive information (e.g., cryptographic keys, configuration, user data), or controlling the device, making it malicious or even non-functional. The motive behind these attacks might be financial gain, espionage, state security, sabotage, competitive analysis, and might even result in impacting people’s lives, especially in the embedded domain (e.g., medical equipment, automotive, aerospace, military, smart things, critical infrastructure). Mindful hardware manufacturers face a trade-off between cost and security of their products. By knowing the attack model, they can put different countermeasures in place. Hardware attacks can take many different forms: remote or physical, invasive or non-invasive, triggered by and targeted towards both hardware and software. The software and each component of the Integrated Circuit (IC) can be part of the attack surface including CPU, memory, internal and external buses, clock and power supplies.

The famous RowHammer attack was triggered by malicious software targeting faults, i.e., bit flips in memory. A single bit flip can have a huge impact on the security of a device, circumventing security checks like signature verification and password authentication. Similar fault-injection attacks can be triggered by hardware as well (e.g., laser attacks).

Trust issues in the IC supply chain

The majority of semiconductor companies cannot afford their own fabrication facilities. In the last two decades, pressured by time-to-market and manufacturing costs, they have shifted towards a horizontal business model and have outsourced parts of the design process as well as the fabrication, testing, and packaging phases.

As a result of the involvement of potentially untrustworthy entities in the hardware lifecycle, including IP providers, CAD tool vendors, foundries, as shown in figure 1, security and by extension safety concerns have emerged: reverse engineering, malicious hardware modifications, IP piracy and counterfeiting, etc.