DeepAI AI Chat
Log In Sign Up

Interdiction in Practice – Hardware Trojan Against a High-Security USB Flash Drive

by   Pawel Swierczynski, et al.

As part of the revelations about the NSA activities, the notion of interdiction has become known to the public: the interception of deliveries to manipulate hardware in a way that backdoors are introduced. Manipulations can occur on the firmware or at hardware level. With respect to hardware, FPGAs are particular interesting targets as they can be altered by manipulating the corresponding bitstream which configures the device. In this paper, we demonstrate the first successful real-world FPGA hardware Trojan insertion into a commercial product. On the target device, a FIPS-140-2 level 2 certified USB flash drive from Kingston, the user data are encrypted using AES-256 in XTS mode, and the encryption/decryption is processed by an off-the-shelf SRAM-based FPGA. Our investigation required two reverse-engineering steps, related to the proprietary FPGA bitstream and to the firmware of the underlying ARM CPU. In our Trojan insertion scenario, the targeted USB flash drive is intercepted before being delivered to the victim. The physical Trojan insertion requires the manipulation of the SPI flash memory content, which contains the FPGA bitstream as well as the ARM CPU code. The FPGA bitstream manipulation alters the exploited AES-256 algorithm in a way that it turns into a linear function which can be broken with 32 known plaintext-ciphertext pairs. After the manipulated USB flash drive has been used by the victim, the attacker is able to obtain all user data from the ciphertexts. Our work indeed highlights the security risks and especially the practical relevance of bitstream modification attacks that became realistic due to FPGA bitstream manipulations.


Versatile and concurrent FPGA-based architecture for practical quantum communication systems

This work presents a hardware and software architecture which can be use...

JackHammer: Efficient Rowhammer on Heterogeneous FPGA-CPU Platforms

After years of development, FPGAs are finally making an appearance on mu...

Hardware Security Evaluation of MAX 10 FPGA

With the ubiquity of IoT devices there is a growing demand for confident...

Secure Boot from Non-Volatile Memory for Programmable SoC Architectures

In modern embedded systems, the trust in comprehensive security standard...

The Unpatchable Silicon: A Full Break of the Bitstream Encryption of Xilinx 7-Series FPGAs

The security of FPGAs is a crucial topic, as any vulnerability within th...

ERIC: An Efficient and Practical Software Obfuscation Framework

Modern cloud computing systems distribute software executables over a ne...

Intrinsic Rowhammer PUFs: Leveraging the Rowhammer Effect for Improved Security

Physically Unclonable Functions (PUFs) have become an important and prom...