1. Hardware Trojans: The Hidden Malicious Insider
Cyber Security Forum
06-07 Feb, 2018 – Amman, Jordan
Malek Al-Zewairi ©2018

2. Malek Al-Zewairi مالك الزويري
About the Presenter
Malek Al-Zewairi مالك الزويري
Education
PhD. Computer Science at PSUT – Intelligence and Security Informatics (2015-)
MSc. Information Systems Security & Digital Criminology ( )
BSc. Computer Information Systems ( )
Professional Experience
Senior Security Consultant and Professional Trainer – Precise Thinking TCT
Head of Information Security – University of Jordan (2 Years)
Information Security & Risk Administrator – Orange Telecom (+2 years)
Certification
16+ Professional Security Certificates

3. What are Hardware Trojans
Analogous to Software Trojan (i.e. malicious software masquerade as a benign application)
Hardware Trojans are malicious modifications (malicious circuit) to the hardware design or implementation
Stays dormant during normal operation
Once triggered by internal or external event, it causes the hardware to Fail!!!

4. What are Hardware Trojans
Injected by intelligent adversary
Have very small probability of occurrence
Have very small hardware overhead
Extremely hard to detect
IT IS NOT LIKE Meltdown or Spectre

5. Example of Hardware Trojan

6. Main Targets of Hardware Trojans
Military & Government Systems
Critical Infrastructure (e.g. Power Grid, Nuclear Power Plant, …)
Transportations (e.g. plans, trains, …)
Telecommunication (e.g. Satellite, … )
Banking Systems

7. Real World Examples…

8. Case 1: Operation Orchard (عملية البستان)
On 5th Sep 2007 at 23:00, Ten Israeli F-15 fighters were tasked with a supposed emergency exercise
At 23:30 three jet fighters were called off the exercise, the remaining 7 fighters were ordered to change course to a new undisclosed coordination
The Syrian Radar system in Tall al-Abuad (تل الأبيض) was deactivated by a secret built-in kill switch *
Syria’s air defense systems, were showing a false sky-picture
At 23:58, Syria's al-Kibar (موقع الكُبر) Nuclear Reactor was targeted with 17 tons of explosives using laser-guided bombs
Syrian Radar systems SoCs have been fabricated with Hardware Trojan
* The Hunt for the Kill Switch, IEEE Spectrum,

9. More Cases…
Hardware Trojan was discovered on some Dell EdgePower servers motherboards firmware ROM during testing, 2008
Operation Cisco Raider, USA, 2008
Hardware Trojan attack on Intel’s CSRNG reduces its entropy from 128- bits to 32-bits, 2010
Spy-chips hidden in electric irons and kettles from China were discovered by Russian technician, 2013

10. A Hardware Trojans can be injected at
Pre Silicon
Design, testing and debugging tools
Malicious IP design
Example: changing the thickness of wires, tampering with the clock speed
Silicon
Add malicious circuits, reconnect wires
Fake or counterfeit chips
Example: adding a simple ring oscillator Trojan to cause power dissipation
Post Silicon
Add malicious ICs in packaging
Malicious 3rd party testers
Example: Dynamic Partial Reconfiguration (DPR) of FPGA

11. Does your organization have an active source-code review policy?

12. Hardware Trojan Detection Methods

13. Problem with current detection methods
Lack of general detection techniques/frameworks
Most proposed techniques cannot guarantee Trojan detection
Destructive methods are not practical
Searching for something that is Unknown!
Test time is expensive (e.g. 2billion States!!!)
Trojans are designed to be stealthy

14. Q&A
Thank You 

15. References
Hardware Trojan: Threats and Emerging Solutions, Chakraborty et al
Understanding Integrated Circuit Security Threats, Asif Iqbal
The Hunt for the Kill Switch, Sally Adee
Stealthy Dopant-Level Hardware Trojans, Becker et al
homeland-security-announce-30-convictions-more-than-143-million-in-seizures-from- initiative-targeting-traffickers-in-counterfeit-network-hardware