How can a vulnerability be hardwired?

Just read this article, which got me thinking. Is there simply vulnerable software running on a piece of hardware that is read/write only or..?


A chip is basically works like this: It gets some input (commands and data), does some calculations and generates some output. It may have internal memory.

FPGA (Field-programmable gate array) are blank standard chips that are "programmed" by the customers on the gate level (very close to the hardware).


Let's take Smartcards as an example: The chip offers commands to generate or store a private key to its internal memory. But it does not have a command to output the private key according to specification.

So the private key is protected, and all calculations that involve the private key have to be done on card.

But if there were a hidden command to read the private key from the protected area of internal memory, an attacker could copy the card.

Progammable Chips

Many chips are not completely hard-wired but execute Microcode. This microcode runs within the chip and provides the programming interface (machine code) that is used to access the chip from the outside. Typically the microcode can only be written to the chip but not read from it. This might be used to protect intellectual property or sensitive algorithms and keys.

There may be a debug interface, which allows reading of the code, unless a flag was set on upload. But a backdoor might offer access anyway.

Have there been successful attacks on hardware?

  • The rent-a-bike service by Deutsche Bahn was hacked because they forgot to set the no-debug flags, which allowed the attacker to read the memory.
  • Stuxnet used the official programming interface by manipulating the management software, so this is no real backdoor.
  • The university of Uni Cambridge published a paper about such a backdoor in standard chips used by the military for weapons, flight control and by industry for nuclear power plants. According to their analysis the backdoor was not inserted by the Chinese hardware vendors but by the US-American designers.

This topic is not new: In 2009 a paper on Hardware Trojan Horse Detection Using Gate-Level Characterization was published for example. (Link in comment section because of StackExchange bug).

It is perfectly fine to have such features for debugging, as long as they are documented and can be switched off for production use. According to the press coverage in the recent case, the company sold their chips as "military grade", advertising that the stored information cannot be read. So this debug features turns into a backdoor.


It tends to boil down to whether or not the implementer created it to act as a backdoor or to serve a non-insidious function.

Generally it's a set of connections on the hardware/chip/etc that allow direct access to things like memory and whatnot.

Most times they are installed for debugging and testing purposes; e.g. diagnostic tasks. When they are connected to networks that allow for remote access they are really useful for determining problems without having to plug a probe directly into the hardware, like in the belly of a plane. On the flip side, if they are poorly secured then they become an easy attack vector.

Robert Graham has a great write up about one of the latest backdoors-in-hardware stories: http://erratasec.blogspot.ca/2012/05/bogus-story-no-chinese-backdoor-in.html

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.