How can a vulnerability be hardwired?
Just read this article, which got me thinking. Is there simply vulnerable software running on a piece of hardware that is read/write only or..?
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.Sign up to join this community
A chip is basically works like this: It gets some input (commands and data), does some calculations and generates some output. It may have internal memory.
FPGA (Field-programmable gate array) are blank standard chips that are "programmed" by the customers on the gate level (very close to the hardware).
Let's take Smartcards as an example: The chip offers commands to generate or store a private key to its internal memory. But it does not have a command to output the private key according to specification.
So the private key is protected, and all calculations that involve the private key have to be done on card.
But if there were a hidden command to read the private key from the protected area of internal memory, an attacker could copy the card.
Many chips are not completely hard-wired but execute Microcode. This microcode runs within the chip and provides the programming interface (machine code) that is used to access the chip from the outside. Typically the microcode can only be written to the chip but not read from it. This might be used to protect intellectual property or sensitive algorithms and keys.
There may be a debug interface, which allows reading of the code, unless a flag was set on upload. But a backdoor might offer access anyway.
This topic is not new: In 2009 a paper on Hardware Trojan Horse Detection Using Gate-Level Characterization was published for example. (Link in comment section because of StackExchange bug).
It is perfectly fine to have such features for debugging, as long as they are documented and can be switched off for production use. According to the press coverage in the recent case, the company sold their chips as "military grade", advertising that the stored information cannot be read. So this debug features turns into a backdoor.
It tends to boil down to whether or not the implementer created it to act as a backdoor or to serve a non-insidious function.
Generally it's a set of connections on the hardware/chip/etc that allow direct access to things like memory and whatnot.
Most times they are installed for debugging and testing purposes; e.g. diagnostic tasks. When they are connected to networks that allow for remote access they are really useful for determining problems without having to plug a probe directly into the hardware, like in the belly of a plane. On the flip side, if they are poorly secured then they become an easy attack vector.
Robert Graham has a great write up about one of the latest backdoors-in-hardware stories: http://erratasec.blogspot.ca/2012/05/bogus-story-no-chinese-backdoor-in.html