On-Chip Debug and Test Interface With Improper Access Control

Stable Base

Structure: Simple

Description

This vulnerability occurs when a hardware chip's debug or test interface (like JTAG) lacks proper access controls. Without correct authorization checks, unauthorized users can read or modify sensitive internal registers and bypass the chip's built-in security protections.

Extended Description

Chips often include a debug interface, such as JTAG, which creates a serial scan chain to access internal registers for testing and debugging. Since this interface can expose almost all data on the device, manufacturers must implement strong authentication and authorization. If these controls are missing or flawed, attackers can use the exposed interface to circumvent on-chip security measures and extract sensitive information. Sometimes, designers hide debug pins within the board layers to compensate for the lack of proper chip-level authorization. This is a physical security workaround, not a fix. If an attacker physically accesses these hidden pins, the chip's internals become completely exposed. Managing hardware-level vulnerabilities like this across a complex software supply chain is challenging; an ASPM platform like Plexicus can help correlate these underlying hardware risks with your application's security posture, providing a unified view for remediation.

Common Consequences 6

Scope: Confidentiality

Impact: Read Application Data

Scope: Confidentiality

Impact: Read Memory

Scope: Authorization

Impact: Execute Unauthorized Code or Commands

Scope: Integrity

Impact: Modify Memory

Scope: Integrity

Impact: Modify Application Data

Scope: Access Control

Impact: Bypass Protection Mechanism

Detection Methods 3

Dynamic Analysis with Manual Results Interpretation

Authentication and authorization of debug and test interfaces should be part of the architecture and design review process. Withholding of private register documentation from the debug and test interface public specification ("Security by obscurity") should not be considered as sufficient security.

Dynamic Analysis with Manual Results Interpretation

Dynamic tests should be done in the pre-silicon and post-silicon stages to verify that the debug and test interfaces are not open by default.

FuzzingModerate

Tests that fuzz Debug and Test Interfaces should ensure that no access without appropriate authentication and authorization is possible.

Potential Mitigations 1

Phase: Architecture and Design

Strategy: Separation of Privilege

If feasible, the manufacturer should disable the JTAG interface or implement authentication and authorization for the JTAG interface. If authentication logic is added, it should be resistant to timing attacks. Security-sensitive data stored in registers, such as keys, etc. should be cleared when entering debug mode.

Effectiveness: High

Demonstrative Examples 3

A home, WiFi-router device implements a login prompt which prevents an unauthorized user from issuing any commands on the device until appropriate credentials are provided. The credentials are protected on the device and are checked for strength against attack.

Code Example:

Bad

Other

If the JTAG interface on this device is not hidden by the manufacturer, the interface may be identified using tools such as JTAGulator. If it is hidden but not disabled, it can be exposed by physically wiring to the board.

By issuing a "halt" command before the OS starts, the unauthorized user pauses the watchdog timer and prevents the router from restarting (once the watchdog timer would have expired). Having paused the router, an unauthorized user is able to execute code and inspect and modify data in the device, even extracting all of the router's firmware. This allows the user to examine the router and potentially exploit it.

JTAG is useful to chip and device manufacturers during design, testing, and production and is included in nearly every product. Without proper authentication and authorization, the interface may allow tampering with a product.

Code Example:

Good

Other

In order to prevent exposing the debugging interface, manufacturers might try to obfuscate the JTAG interface or blow device internal fuses to disable the JTAG interface. Adding authentication and authorization to this interface makes use by unauthorized individuals much more difficult.

The following example code is a snippet from the JTAG wrapper module in the RISC-V debug module of the HACK@DAC'21 Openpiton SoC [REF-1355]. To make sure that the JTAG is accessed securely, the developers have included a primary authentication mechanism based on a password.

The developers employed a Finite State Machine (FSM) to implement this authentication. When a user intends to read from or write to the JTAG module, they must input a password.

In the subsequent state of the FSM module, the entered password undergoes Hash-based Message Authentication Code (HMAC) calculation using an internal HMAC submodule. Once the HMAC for the entered password is computed by the HMAC submodule, the FSM transitions to the next state, where it compares the computed HMAC with the expected HMAC for the password.

If the computed HMAC matches the expected HMAC, the FSM grants the user permission to perform read or write operations on the JTAG module. [REF-1352]

Code Example:

Bad

Verilog

verilog

if(exp_hash == pass_hash) begin**

verilog

verilog

pass_check = 1'b0;** end state_d = Idle; end else begin ``` state_d = PassChkValid; end end ...

However, in the given vulnerable part of the code, the JTAG module has not defined a limitation for several continuous wrong password attempts. This omission poses a significant security risk, allowing attackers to carry out brute-force attacks without restrictions.

Without a limitation on wrong password attempts, an attacker can repeatedly guess different passwords until they gain unauthorized access to the JTAG module. This leads to various malicious activities, such as unauthorized read from or write to debug module interface.

To mitigate the mentioned vulnerability, developers need to implement a restriction on the number of consecutive incorrect password attempts allowed by the JTAG module, which can achieve by incorporating a mechanism that temporarily locks the module after a certain number of failed attempts.[REF-1353][REF-1354]

Code Example:

Good

Verilog

verilog

(miss_pass_check_cnt_q != 2'b11)** ) begin ``` state_d = Write; pass_mode = 1'b1; end ... end ... PassChkValid: begin if(hashValid) begin if(exp_hash == pass_hash) begin pass_check = 1'b1; end else begin pass_check = 1'b0;

verilog

The example code below is taken from the JTAG access control mechanism of the HACK@DAC'21 buggy OpenPiton SoC [REF-1364]. Access to JTAG allows users to access sensitive information in the system. Hence, access to JTAG is controlled using cryptographic authentication of the users. In this example (see the vulnerable code source), the password checker uses HMAC-SHA256 for authentication. It takes a 512-bit secret message from the user, hashes it using HMAC, and compares its output with the expected output to determine the authenticity of the user.

Code Example:

Bad

Verilog

...

logic [31-1:0] data_d, data_q; ...

logic [512-1:0] pass_data; ...

verilog

pass_data = { {60{8'h00}}, data_d};** state_d = PassChk; pass_mode = 1'b0; ... end ...

The vulnerable code shows an incorrect implementation of the HMAC authentication where it only uses the least significant 32 bits of the secret message for the authentication (the remaining 480 bits are hard coded as zeros). As a result, the system is susceptible to brute-force attacks on the access control mechanism of JTAG, where the attacker only needs to determine 32 bits of the secret message instead of 512 bits.

To mitigate this issue, remove the zero padding and use all 512 bits of the secret message for HMAC authentication [REF-1365].