Interdiction in practice—Hardware Trojan against a high-security USB flash drive

Abstract

As part of the revelations about the NSA activities, the notion of interdiction has become known to the public: the interception of deliveries to manipulate hardware in a way that backdoors are introduced. Manipulations can occur on the firmware or at hardware level. With respect to hardware, FPGAs are particular interesting targets as they can be altered by manipulating the corresponding bitstream which configures the device. In this paper, we demonstrate the first successful real-world FPGA hardware Trojan insertion into a commercial product. On the target device, a FIPS-140-2 level 2 certified USB flash drive from Kingston, the user data are encrypted using AES-256 in XTS mode, and the encryption/decryption is processed by an off-the-shelf SRAM-based FPGA. Our investigation required two reverseengineering steps, related to the proprietary FPGA bitstream and to the firmware of the underlying ARM CPU. In our Trojan insertion scenario, the targeted USB flash drive is intercepted before being delivered to the victim. The physical Trojan insertion requires the manipulation of the SPI flash memory content, which contains the FPGA bitstream as well as the ARM CPU code. The FPGA bitstream manipulation alters the exploited AES-256 algorithm in a way that it turns into a linear function which can be broken with 32 known plaintext-ciphertext pairs. After the manipulated USB flash drive has been used by the victim, the attacker is able to obtain all user data from the ciphertexts. Our work indeed highlights the security risks and especially the practical relevance of bitstream modification attacks that became realistic due to FPGA bitstream manipulations. B Pawel Swierczynski

Hardware Security For and Beyond CMOS Technology

“…The notion of Trojans is wide-ranging and requires multiple dimensions for classification [65]-it relates to malicious hardware modifications that are (i) working at the system level, register-transfer level (RTL), gate/transistor level, or the physical level; (ii) seeking to leak information from an IC, reduce the IC's performance, or disrupt an IC's working altogether; (iii) are always on, triggered internally, or triggered externally; etc. Trojans are likely introduced by untrustworthy third-party IP, adversarial designers, or through "hacking" of design tools [66], or, arguably even more likely, during distribution and deployment of ICs [67]. 2 Defense schemes can be classified into (i) Trojan detection during design and manufacturing time and (ii) Trojan mitigation at runtime.…”

Insights into the mind of a trojan designer

“…To accomplish this goal, the adversary targets to attach a payload circuit to the existing set-key circuit to permanently write the known key bits of k st into the FFs that process k. Thus, the external self-test falsely confirms the integrity of the FPGA AES IP core. To sum up, the described Trojan can trick an external self-test in cases where the self-test key is known like in [21].…”

“…Knowing the entire bitstream file format, the security of cryptographic hardware configuration can be appropriately analyzed. Thus quick-and-easy malicious bitstream manipulation attacks [1,4,[20][21][22], leading to a potential security breach, can be pentested beforehand and accordingly addressed by a security analyst. Defending of FPGA designs is even more crucial since most FPGA bitstream encryption schemes of older FPGA generations are vulnerable to side-channel attacks [10][11][12][13]23] or do not offer any bitstream encryption/authentication at all.…”

Hardware reverse engineering: Overview and open challenges

“…Hence, a reverse engineer can either access the non-volatile memory and dump its content, or wire-tap the communication between FPGA and non-volatile memory upon boot-up, cf. [18] Bitstream Decryption. In order to provide confidentiality of the bitstream, FPGA manufacturers deployed a bitstream encryption scheme for various device series using strong cryptographic primitives.…”