1. Hardware Security – Highlevel Survey Review for Exam 4
CS 3503
Dr. Clincy
Professor of CS
Hardware Security – Highlevel Survey
Review for Exam 4
Dr. Clincy
Lecture
Slide 1 1

2. Hardware security
You only need to know Hardware Security at the level it is covered in the slides The slides will not be available for the exam though

3. What is Roots of Trust (RoT) ?
Hardware security
What is Roots of Trust (RoT) ?
RoT is a set of functions in the trusted computing module that is always trusted by the computer’s operating system (OS).
RoTs serves as a separate computer engine controlling cryptographic processor on a PC
Typically, RoTs are implemented in hardware rather than software because of its immutability (unchangeable object), smaller attack surface, and reliable behavior.

4. Reverse engineering (RE) oF machine code for malware analysis
RE will figure out the program’s flow in understanding program behavior
RE will find out virus and malware signatures used in antivirus programs (Anti-virus program determines a signature of a program and compares that signature to a list of known bad signatures)

5. Intel chipsec
CHIPSEC is a framework developed by Intel for analyzing security of PC platforms including hardware, system firmware (BIOS) and the configuration of platform components.
It allows you the ability to create security test suites, security assessment tools for various low level components and interfaces as well as forensic capabilities for firmware. 

6. Hardware/Firmware worms
What is firmware?
Firmware is a piece of software stored in read-on-memory (ROM) or flash memory that comes with hardware.
Chi worm
CIH is a computer virus developed by a Taiwanese college student in (Chen Ing-hau). This virus erases the first megabyte of a hard drive and PC BIOS firmware. It causes the blue screen - the first megabyte has the partition tables and master boot record (MBR), which causes the computers not to boot.
It hides itself in a Portable Executable (PE) file under Windows 95, 98, and ME. It does not spread via Windows NT-based operating systems such Windows XP, 7, 8, and 10.

7. Hardware/Firmware worms
Thunderstrike 2 worm
The Thunderstrike 2 is a firmware type of worms created to prove that MACs may be attacked via an Apple Thunderbolt Ethernet adapter.
The worm hides in the Option ROM of the Thurderbolt Ethernet adapter, which is loaded and infected when the MAC’s firmware is connected to the network.
An attacker could compromise the boot firmware on MacBooks via a phishing or malicious web site. The compromised MacBook will spread the worm by being connected to any other device.

8. Why ARE firmware VIRUSES hard to DETECT and remove ?
Most the anti-virus software does not have the privilege to scan the firmware simply because its operations rely on the firmware.
Moreover, the firmware may disguise itself by reporting normal responses for any requests made by upper level applications. This makes it difficult to detect.
Also, the firmware is basically part of the hardware. Unless you explicitly flash (clean) and re-store the firmware, re-installing OS will not remove the worm sitting in firmware.

9. Latest hardware attack development
Analog malicious hardware – exploiting the analog properties of circuits (ie. Replace digital gates with analog components and then take away charge from a target wire every time it toggles and store that charge in a capacitor – the capacitor’s voltage exceed some threshold, it deploys a payload) -
“Fabrication-time” attacker can leverage analog circuits to create a hardware attack that is small (i.e., requires as little as one gate and requires an unlikely trigger sequence before effecting a chip’s functionality) – third party companies are typically the culprits/suspects
Countermeasures:
Fingerprinting – fabrication causes microscopic variations in chips that are unpredictable
On-chip sensors – sensors can be used for monitoring
Eliminate unused space – try to eliminate space for hackers to place malicious code in firmware

10. Exam 4 Review All Chapter 4 Sections 5.1 and 5.2 Lectures 17+
Open Book (closed notes and closed PPT) – must make copies of pages if you don’t have a book
T/F, FIB, Matching, Short problems, Assembly