Name
Abstract | ||
|---|---|---|
While the move to smaller transistors has been a boon for performance it has dramatically increased the cost to fabricate chips using those smaller transistors. This forces the vast majority of chip design companies to trust a third party---often overseas---to fabricate their design. To guard against shipping chips with errors (intentional or otherwise) chip design companies rely on post-fabrication testing. Unfortunately, this type of testing leaves the door open to malicious modifications since attackers can craft attack triggers requiring a sequence of unlikely events, which will never be encountered by even the most diligent tester. In this paper, we show how a fabrication-time attacker can leverage analog circuits to create a hardware attack that is small (i.e., requires as little as one gate) and stealthy (i.e., requires an unlikely trigger sequence before affecting a chip's functionality). In the open spaces of an already placed and routed design, we construct a circuit that uses capacitors to siphon charge from nearby wires as they transit between digital values. When the capacitors are fully charged, they deploy an attack that forces a victim flip-flop to a desired value. We weaponize this attack into a remotely controllable privilege escalation by attaching the capacitor to a controllable wire and by selecting a victim flip-flop that holds the privilege bit for our processor. We implement this attack in an OR1200 processor and fabricate a chip. Experimental results show that the purposed attack works. It eludes activation by a diverse set of benchmarks and evades known defenses. |
Year | DOI | Venue |
|---|---|---|
2017 | 10.1145/3068776 | Commun. ACM |
Field | DocType | Volume |
Digital electronics,Computer science,Transistor,Computer hardware | Journal | 60 |
Issue | ISSN | Citations |
9 | 0001-0782 | 3 |
PageRank | References | Authors |
0.43 | 15 | 5 |
Name | Order | Citations | PageRank |
|---|---|---|---|
| Kuiyuan Yang | 1 | 148 | 20.89 |
| Matthew Hicks | 2 | 176 | 8.77 |
| Qing Dong | 3 | 95 | 12.29 |
| Todd Austin | 4 | 6432 | 539.01 |
| Dennis Sylvester | 5 | 5295 | 535.53 |