[论文解读] Interdiction in Practice -- Hardware Trojan Against a High-Security USB Flash Drive

Pawel Swierczynski, Marc Fyrbiak+3 more|IACR Cryptology ePrint Archive|Oct 1, 2019

Physical Unclonable Functions (PUFs) and Hardware Security被引用 4

一句话总结

本论文通过操纵FPGA位流，首次在商业FIPS-140-2 Level 2认证的USB闪存驱动器中实现了实用化的硬件后门植入，将其中的AES-256 XTS加密功能转变为线性、可分析的函数。该攻击仅需32对已知明文-密文对即可恢复全部用户数据，证明了位流修改是针对高安全设备的切实可行的现实威胁。

ABSTRACT

As part of the revelations about the NSA activities, the notion of interdiction has become known to the public: the interception of deliveries to manipulate hardware in a way that backdoors are introduced. Manipulations can occur on the firmware or at hardware level. With respect to hardware, FPGAs are particular interesting targets as they can be altered by manipulating the corresponding bitstream which configures the device. In this paper, we demonstrate the first successful real-world FPGA hardware Trojan insertion into a commercial product. On the target device, a FIPS-140-2 level 2 certified USB flash drive from Kingston, the user data are encrypted using AES-256 in XTS mode, and the encryption/decryption is processed by an off-the-shelf SRAM-based FPGA. Our investigation required two reverse-engineering steps, related to the proprietary FPGA bitstream and to the firmware of the underlying ARM CPU. In our Trojan insertion scenario, the targeted USB flash drive is intercepted before being delivered to the victim. The physical Trojan insertion requires the manipulation of the SPI flash memory content, which contains the FPGA bitstream as well as the ARM CPU code. The FPGA bitstream manipulation alters the exploited AES-256 algorithm in a way that it turns into a linear function which can be broken with 32 known plaintext-ciphertext pairs. After the manipulated USB flash drive has been used by the victim, the attacker is able to obtain all user data from the ciphertexts. Our work indeed highlights the security risks and especially the practical relevance of bitstream modification attacks that became realistic due to FPGA bitstream manipulations.

研究动机与目标

• 研究在商业认证的高安全USB闪存驱动器中实现真实世界硬件后门植入的可行性。
• 评估在可信设备中使用的FPGA位流操纵所引发的安全风险。
• 证明即使经过FIPS-140-2 Level 2认证的产品，也可通过低层级FPGA逻辑修改被攻破。
• 评估在XTS模式下对弱化的AES-256实现进行密码分析的实际可行性。

提出的方法

• 逆向分析了金士顿DataTraveler 5000 USB闪存驱动器的专有Xilinx FPGA位流。
• 修改位流中的AES-256 IP核心，将其转换为线性函数，使其易受密码分析攻击。
• 植入一个硬件后门，在正常运行期间捕获明文-密文对和初始扇区编号。
• 编写恶意固件载荷，将捕获的对存储在SPI闪存中，以便后续外泄。
• 利用XTS模式的特性，仅用32对已知明文-密文对即可解密所有密文。
• 在修改后的设备上实际验证了明文恢复过程。

实验结果

研究问题

• RQ1 能否通过FPGA位流操纵，在商业FIPS-140-2 Level 2认证的USB闪存驱动器中成功植入硬件后门？
• RQ2 在真实世界高安全设备中修改FPGA位流的实际影响是什么？
• RQ3 通过低层级逻辑修改，密码学安全的AES-256实现能在多大程度上被削弱？
• RQ4 当底层AES核心被改为线性后，XTS模式在保护数据方面的有效性如何？
• RQ5 有哪些对策可以防止基于位流的攻击在FPGA安全系统中发生？

主要发现

• 成功逆向并修改了FIPS-140-2 Level 2认证USB闪存驱动器的FPGA位流，削弱了AES-256核心。
• 修改后的AES-256核心被转化为线性函数，仅需32对已知明文-密文对即可被密码分析攻破。
• 该攻击在实际中得以实现，且在修改后的设备上成功验证了明文恢复。
• 恶意固件通过SPI闪存捕获并外泄了所需的加密对，实现了完整数据恢复。
• 该攻击表明，即使在高保障系统中，位流操纵也是一种现实威胁，尤其当FPGA作为主控设备时更为显著。
• 本研究强调了保护位流完整性、实施硬件自检以及采用HSM辅助验证在安全嵌入式系统中的关键必要性。