A pair of security researchers in England recently released a draft of a paper that documents what they describe as the “first real-world detection of a backdoor” in a microchip—an opening that could allow a malicious actor to monitor or change the information on the chip. The researchers, Sergei Skorobogatov of the University of Cambridge and Christopher Woods of Quo Vadis Labs in London, conclude that the vulnerability made it possible to reprogram the contents of supposedly secure memory and obtain information about the internal logic of the chip. The chip's manufacturer, California-based Microsemi, issued a statement saying it had “not been able to confirm or deny the researchers' claims.”

The reported security breach is a particular concern because of the type of chip involved. The affected chip, ProASIC3 A3P250, is a field-programmable gate array (FPGA). FPGAs are used in an enormous variety of applications, including communications and networking systems, the financial markets, industrial-control systems and a long list of military systems. Each customer configures an FPGA to implement a unique—and often highly proprietary—set of logical operations. Any mechanism that could allow unauthorized access to the internal configuration of an FPGA creates the risk of intellectual-property theft. In addition, the computations and data in the chip could be maliciously altered.

Assuming that the researchers' claims stand up to scrutiny, an important question immediately comes to mind: How did this vulnerability end up in the hardware in the first place? It is possible that the backdoor was inserted at the behest of a nation-state with malicious intent. It is also possible that the backdoor exists because of carelessness. Someone in the design process could have inserted it to enable testing without realizing that it would later be discovered and potentially exploited.

Regardless of the source of the vulnerability, its presence should serve as a wake-up call about the importance of hardware security. The overwhelming majority of cybersecurity vulnerabilities identified to date have involved software, which can be replaced, updated, altered and downloaded from the Internet. In contrast, a hardware vulnerability is built into the actual circuitry of a chip and can be very difficult to address without replacing the chip itself.

This certainly won't be the last time that a hardware security vulnerability will be identified, and we should put in place preemptive measures to minimize the risks they might pose.

Adapted from the Guest Blog at blogs.ScientificAmerican.com/guest-blog

Comments