Dear viewer, these subtitles were generated by a machine via the service YouTube and therefore are (very) buggy. If you are capable, please help us to create good quality subtitles: https://c3subtitles.de/talk/3032 Thanks!
[Music]
okay to our first talk of the surd day
um it's unlocking Hardware security red
team blue team and Jon tals our speakers
will present a case study on a Red Team
Versus Blue Team approach to protect
Hardware against children
horses and our speakers um trying to get
the a correct Stefan Becker then Renee
valeni and e7p they are all um
affiliated with the max plun Institute
for security and privacy as well as the
um rity B please welcome them with a
huge round of
[Applause]
applause
all right thank you very much for the
warm welcome and for the kind
introduction um yeah it's great to see
so many of you here early in the morning
um yeah our talk red team blue team and
Trojan Tales um evolves around an
academic paper which was uh this year
published at i e S&P and it deals with
the detection of a certain kind of
Hardware troen in chips which are
manufactured in modern seos Technologies
um This research was of course a team
effort so of course with e7p and Renee
but also um Kudos go to uh Tobin
Christian Amia and Kristoff were part of
the
project so to give you a rough idea of
what to expect today um I show you this
slide so our talk is split um into three
parts um first um I will try to lay
ground and provide some background um
information on Hardware Trojans then
second um e7p will present our Red Team
Versus Blue Team study and the results
and then last um Renee will talk about
some of our ideas regarding human
centered uh reverse
engineering so let me start with a bit
of
background um these days like even like
trillions of digital ic's are deployed
in a multitude of systems um and devices
um and on the one hand they are in um
everyday devices like smartphones
laptops or cars yeah and um but they
also uh deployed in critical
infrastructure such as energy or
telecommunication grids or power
plants um oh and due to the superior
performance um for many many tasks um
those application specific integrated
circuits um fulfill many Mission
critical objectives yeah and I've listed
some of those here um they directly um
um do like Implement cryptographic um um
algorithms um and encrypt they do
location services they Implement
Wireless communication real-time
monitoring and so on um so to give you a
feeling for those tiny and complex
devices let me show you this short video
here um so it starts zooming um into an
opened IC yeah which was etched um with
a digital camera yeah and at this point
we can only anticipate um the many tiny
structures here yeah we don't we don't
see much and then as a resolution of
roughly 1 millimeter it switches to the
scanning electron microscope um and here
we already see the metal structures
forming
interconnections um and as we go as we
go deeper and deeper we can imagine um
we have like three dimensional
structures yeah and then the width um of
um of one one of those um metal tracks
was like one micron here so like a th000
nanometers um and modern transistors
these days are below um 20 nanometers so
in the width of one of those metal
tracks you can um Implement more than 50
or even 100 transistors these days so to
just give you a feeling and in our
experiment which we will show later we
went down to 28 nanometer um transistors
so um the production of such highly uh
complex microchips um requires many
process steps and now of course like I
cannot cover all of this um in this talk
so I will give like a very simplified uh
version of the IC design flow and of the
globally distributed supply chain so um
the design flow starts um with a high
level design um on the left side um
where where Hardware is implemented
usually with Hardware description
languages yeah then next comes the the
synthesis um where um this this Hardware
description languages is transferred um
to to a logic of say Boolean Gates next
comes the physical layout the mapping to
the physical resources and then of
course during all those steps but
especially at this step we have um
extensive verification so that we can
actually kind of make sure that the
design which goes into
fabrication um will work in the end we
can still not make sure 100% but um we
can do our best to to verify this then
comes the actual verification of the IC
um on wafers in highly specialized
facilities um and then um the Silicon
dyes which come out of those Wafers are
packaged um and maybe those packaged
dies are assembled on
PCB um so um this is again um
distributed across a globalized supply
chain we have many many designers of
intellectual property um but uh we have
only very few uh design synthesis or
placement route tools and many of those
are even proprietary now and then the IC
fabrication is mostly outsourced there
are only very few uh who maintain their
own
capabilities um and also the packaging
and PCB assembly is usually outsourced
so um looking at this distribution
design flow is crucial for realistic
threat
assessment um through active attackers
yeah and now coming back to our Miss
Mission critical um objectives which the
chips fulfill we can see some of the
supply chain threats by active attackers
as a weakening of cryptographic
Primitives information leakage denial of
service or even safety hazards and the
rule of Thum here is like the lower the
level of abstraction so the further we
go to fabrication um the harder it
become comes to meaningfully temper with
a design um but also to detect malicious
manipulations yeah um so now let's take
a closer look at what an active attacker
can do in this distributed supply chain
so um first uh malicious designer um
might interfere with a circuit um um
already at the IC design level so um
we've seen this for example with uh
deliberately weakened cryptographic
algorithm
um by by nation state actors um and um
we also see this in say export
regulations yeah um another threat um is
the implementation of malicious third
party um intellectual property um that
may compromise my whole IC so
progressing through the design flow um
there also may be manipulated design
tools yeah either um X Factory or um
they could also be um mod ified um
through maware and such tools may
automatically insert manipulations
during the synthesis or layout uh steps
and even temper with the verification
tools to prevent
detection um so now for a moment let's
jump to the end of the design flow to
the PCB assembly um here it might be
possible that an attacker adds spy ic's
um to the PCB or even manipulates the
routing on the printed circuit board um
and this could happen either during the
assembly or during Transportation
through shipping interdiction that's
what the three letter agencies uh like
to do like uh on those photo uh from the
Snowden files um so in theory those
manipulations May well be detected
through several means for example
Optical inspection or product tear down
um there's a big story about such a
system level Hardware Trojan how we um
coin it which caught considerable um
attention in the media um so it was
published by Bloomberg work called the
big hack um it's based on Anonymous
sources um and uh this Hardware Trojan
which was presumably found it consisted
of an additional chip placed on super
micro server blades next to the
baseboard management controller BMC um
and this BMC includes an interface uh
for remote control so those allegedly
trojanized boards were used by some of
important players here Apple Amazon um
for tasks such as video compression or
drone operations um or secure video
conferences so it was definitely a high
impact Target for Hardware
Trojans um so while all those players
Amazon apple and Co they denied the
attack um the article still caused a lot
of media attention and sparked political
discussions and maybe even some
decisions with respect to the recent um
EU and us chips acts but the technical
details um they remained largely unknown
at least to the public so um this is why
I would like to to refer to this talk um
which uh was given by by treml Hudson um
at 35 C3 and where all the technical
details were actually covered and he
concluded that such an implant to The
BMC to the baseboard management
controller is indeed feasible however
hiding the implant um that is not an
easy task yeah so now let's switch to
the main focus of our talk here of our
work um silicon level Hardware Trojans
so those um on chip manipulations they
go directly to the silicon and can
enable um arbitrary manipulations and
are arguably really really hard to
detect um they may consist for example
of added or modified um logic cells or
um even rooting manipulations or
manipulations to the dopings of the
transistors um and they could be
inserted just before fabric rication
Yeah by a so-called malicious FB um to
the already placed and routed design
files or even after fabrication um
through edits say with a focused iron
beam so um to get a to get a Gras of
this let's make um a basic example this
simple circuit here for debug
authentication yeah only um if both um
signature valid and data ready here are
true um the debug debug interface will
be enabled
um now consider an attacker who changes
this end gate to an or gate and um we
can see that um this way it is enough to
only have one of the values true say the
data ready value um and we can bypass
the debug authentication yeah so this is
a minimal example of such a silicon
level Hardware
trojen um so now let's take a look um at
the actual um threat model so um how
does it look like um and how would one
go about detecting such a Trojan so um
remember those fabless design house here
on the left yeah this would prepare the
design and send the Finish PL and place
and routed and trojen free so we don't
have a malicious designer here trojen
free design to the um external fap which
is malicious in this case yeah um now
the malicious fap inserts the trojen to
the silicon and produces the chips and
then there's also a detection lab which
receives both um the original design
from the design house um androgenized
chips and it needs now to detect the
manipulations and this is usually done
by Imaging the chips and comparing
design and images so to get a feeling
how this works here we see a
cross-section um of a chip um and for
Imaging it's important to know about the
general buildup of this chip so on the
lowest layers um there's a transistor
level and this is where all the logic
cells um are placed yeah and we're
looking for manipulations of um logic
cells and above on all those layers are
the interconnections between the cells
and they are realized um with 3D routed
tracks and as a detection lab again is
interested in finding modifications at
the cell level um we have to put chip on
microscope upside down so to image it
from the back side as symbolized um here
so for this
um um I have to say that this is a
distru Ive um method and that the chip
won't work anymore and you might need
even um more than one chip before you
figured out the correct recipe because
you need to thin it from the backside
before you can take the
pictures um so here is an examply um
exemplary scanning electron microscope
image taken from the uh backside from
the bottom um the horizontal lines which
you can see in both those images um are
power and ground and then the dots
between those lines are vas um and those
vas um connect to other layers yeah and
um one observation which we can make
here um is that standard cells with the
same functionality have the same V
pattern and those with other
functionality um um can be distinguished
yeah so um if we make here the example
of our um simple droan and put this
under an electron microscope this is how
it might differ um from the original
implementation yeah you can see the
differences um in the Via positions here
um and then remember we operate here on
very tiny devices um which potentially
have many many many standard
cells so um I just want to give one more
uh quick uh reference um because I only
superficially covered um some of the IC
design and Manufacturing Basics here the
ones needed um for this talk I would
like um to refer you to this talk so if
you would like to know more um about how
chips are made I highly recommend this
34 C3 talk by Ari um with this I would
like to hand over to e7p who will
present the details of our Hardware
detection case study yeah hello so I
presenting yeah the technical aspects
and also our proposed algorithms that we
want to uh show you for the uh
comparison between design and
so as we just learned Hardware CH that
are some broad term both from the attack
perspective as well as the actual um
modifications and our goal is to find
even smallest ones just requiring
changes in a few or even maybe one a
single transistor or maybe a logic gate
uh in the design and even such small
modifications could lead to undesired
Behavior as we have
seen and on the bottom of the slide
there you can see
again uh here a additional standard cell
on the top and on the bottom again this
replaced
cell so um now how should an attacker be
enabled to fiddle around with the cell
layout well until a chip is produced
many steps often outsourced to companies
all over the world had to to be taken
and due to this distributed
manufacturing uh you can't control every
single step maybe or maybe an attacker
gets in the hand of the design F and can
modify it in between uh when it's sent
to the fa uh to the fabric so our main
research question is now how efficiently
can we detect such an Hardware troen in
full-sized ic's in modern seos
Technologies yeah so uh how how do we do
that um we somehow adapt this um
analysis um uh a bit to our needs as uh
we have some um yeah chips already
produced so now we um actually modify
the design file instead of the chips uh
before sending them to the um fabric
because in the end uh the
um the detection lab here on the right
uh it's just important that the the uh
design file and the actual chip images
or the actual physical samples differ
and have this difference and we can
emulate that by simply um editing the
design
file so we have here this uh strictly
split setup and we have a red team that
actually makes this uh malicious
modification and we have the blue team
that is our analysis lab that wants to
find
these and um how that works
in yeah in practice we I will show
later so now let's get started uh with
the red team and how the uh malicious
modifications were introduced in the
integrated
circuits first of all here we can
already see uh the four different ic's
that we had at hand um they were um part
of different research projects and this
were deplo uh
developed
beforehand so we can could um simply
take these chips and then uh process um
progress with them as you can see um
these are um in different technology
sizes ranging from 90 Nom over 6 5 NM
and 40 NM down to as small as 28 nanom
uh technology sizes and the uh
dimensions of these chips are roughly
2x2 mm so these are quite small already
but um yeah they contain a lot of
standard cell based logic which is great
for us uh when we want to find uh logic
based heart
Regin so how does this um emulation now
Works uh in
detail coming back to these uh different
pictures here what we want to reach is
that the original chip at some spots
does not have some standard s that the
trojanized chip would would have so we
turned um basically around our um um our
progress here by uh
removing uh selected logic cells so the
original chip would not have these uh
but the design file has the uh added
logic cells
right and uh for the replaced logic
cells nothing would change really
because uh it doesn't matter if we
replace inor with an end or vice versa
for our detection
methods and yeah in total the red team
introduced 10 modifications per chip so
we have 40 modifications in total that's
uh six added logic cells per chip and
four replaced logic cells of Chip uh per
chip and in total we have over 3.4
million of standard cells so we just
modified a fraction of a
percent so now I'm coming to the blue
team and how we progressed with the
chips The Blue Team receives the
physical samples as well as the design
file uh by the red team so now the blue
team uh the blue team's part is to
somehow U prove that there is some
difference and where exactly these
differences are and in which St
position so the physical samples need to
somehow be imaged with a microscope and
then uh prog processed by some algorithm
that then could uh compare the design
file on the one hand with the actual
images from the
microscope for Imaging again uh it's
important we are looking from the down
as we are interested in the standard
cell
layer so uh what do we do now so we flip
over the chip then um Mill down the
Silicon substrate layer uh down to a
very thin uh uh yeah down to very thin
then um Edge away some even some more
silicon with a Coline hydroxide eding
process and then actually scanning the
whole standard cell layer uh with a
scanning electron
microscope uh not worthy to say is that
this last step is very costly both in
time and effort so um and the machines
are you can't afford them basically yeah
multiple millions of of
but in the end uh we can get these uh
silicon dce d shots of the standard cell
layer and here uh on the down you can
actually see the the images we now
received from
the um
microscope and in the orange rectangles
there are the uh uh interested
areas and on the top for comparison
there is again the design
files the total file size of these uh
tiled images they are tied in a mosa
because they are so large is around 300
GB uncompressed grayscale images and the
actual resolution is uh down to 4.8
nanom per
pixel so that's very huge and um
manually I would say not handle uh you
cannot hand
them so when zooming into these pictures
you can clearly see how different the
different Technologies look like but all
of them have in common that the each
standard cell is standing out by these
bright white spots that is uh the wires
that connect with the routing layers
above and if you zoom in even more you
can really see every single standard
cell
and uh can feed them to the algorithm
later so
and with that I continue to um present
you the actual um analysis algorithms
that can detect
manipulations so for that we have a
small road map uh first of all we need
somehow all the coordinates in the same
format or um yeah maybe overlay them
somehow so we have a good assignment
between the design file um positions and
where they are in the actual microscope
images for that we might need to somehow
transform the image or to scale them or
um some something so in the end we have
uh a perfectly overlaid design file to
the chip and uh then in the third step
uh we apply our algorithms uh to every
single cutout standard cell and then can
compare them or uh do further
stuff yeah for the first part the design
file they are in the standard
gds2 uh format and luckily there's open
source Library called uh GDs Pi for
Python and with that it's very simple to
just extract all the coordinates of the
bounding boxes of each standard
cell and in the next step we take each
of the tile uh positions of the
stitched mosa image of the whole
chip and uh we also import these into
our python
script then uh we need to uh find out
about the correct rotation or flipping
maybe and um and to be able to actually
overlay design file with the chip images
and for that we start with a
simple uh yeah four edges so so where
are the four edges in in the image and
then we try to Overlay the gds2 file
over this and we already see how the
rotation and flipping might need to be
but then there is still some um offset
in the alignment and to um yeah to
correct this uh we again take the four
edges of our chip and do a perspective
transformation uh that um is then able
to um yeah make it more precise where
the actual standard cells
are so now uh we we can basically cut
out every single cell and also every
single area where no cell should be or
no standard cell and now we can uh start
with processing them in our
algorithms so um now we have two
categories of algorithms one is uh that
we want to uh detect if there are
additional cells that are not planned
due to the um design file and the second
case would be replaced cells yeah so we
need kind of some different algorithms
for each other and uh I present both of
them so um the first one is the wire
detector which detects bright white
spots inside the standard cell and if
there are bright white spots then we are
perfectly certain that we have an
additional cell that is not in the
design file
for that we um use classical image
processing techniques with open CV and
to get uh reproducible
results and yeah we basically binary
threshold the image then verify that the
contrast is high enough and in the end
also uh apply
some
um uh template matching with a
ball-shaped gradient
and this on the right top side you can
see uh Works quite well uh even with uh
some distorted or lowquality images but
on the other hand which we absolutely
don't want is that uh these Force
positives uh that could be detected
where no bright white spot is or fire
yeah but uh these Force positives are
very few as we can can see in the
results
later finding Replacements is a bit
different as uh now we might uh more or
less compare uh multiple standard cells
with against each
other and for that uh we uh iterate
through all of the standard cells and
the first uh occurrence of a unique
label of the standard cell is taken as a
golden model or template for all further
uh cells of the same label and now the
template matching algorithm is
applied um to other occurances with the
same label so we expect that a cell that
is labeled the same also
looks very similar or maybe equally
yeah and uh yeah so we have three
pictures now the first one is the first
occurence that is taken as a gold model
then the second one uh the second
occurence uh our algorithm would tell
well the images are equal so the we
don't have any manipulation here and the
third one looks quite different so our
algorithm would say that is a
modification but not everything is
perfect um this simple template
algorithm leads to too many Force
positives when the threshold is too low
to uh say if it's a modification or not
so we need some additional measure and
for that again we take our via detector
which we used for these additional cells
but uh now we use it to generate
artificial um V masks and apply the uh
template matching with these between
these fire masks instead
so we can get more precise uh results
here and now I have some uh live
demonstration of our algorithms if uh
the vog can switch over here uh so I
just start this uh run script and this
uh first loads the GDs file and then uh
it rates over each of the tile
images which I have fed into the uh
algorithm and and now the wire detector
is uh going over every single standard
cell detected in every tile
image and after some tiles uh there will
be a
match or basically a m
mismatch as we can see
here and so this is the whole tile image
and the orange um borders um are empty
space cells as well as the blue borders
that uh depict um standard cells and
when zooming in here on the
bottom yeah okay try uh this is actually
a orange border cell so it should
contain nothing but here there are some
buas so this is a detected
manipulation now the uh algorithm
switches over to the replaced cell
detection because this for this life
demonstration and uh as you can see it
takes a bit more longer uh to analyze uh
for S Replacements this is just because
of the template matching algorithms but
also after some tiles we have another
tire here where uh here on the on the
top there's a cell detected which should
look like the one below here but instead
looks different so also detected here
and in the end after the whole iteration
of all tiles uh some reports are
generated where are some details of the
algorithms like um here the cell
replacement uh here is the cutout cell
and here's the golden reference
model so these are this is a true
positive
right and we have the same and some
debug information as well for the V
detector and additional cells
so now we can switch back to the slides
please so now I'm coming to the results
uh how did our detection uh algorithms
perform let's review some chip
statistics so all four chips contain
between hundreds of thousands up to 1.5
million cells each and they have areas
between one M square m and two square
mm and yeah so now coming to our results
they show that our um simple algorithms
perform very well here and um especially
for the additional cells we have uh no
misted cell so we could detect all of
them and uh by that we also have uh very
few Force positives in the um additional
cell detection
while the replaced cells uh were also
all detected for 90 NM 65 nanom and 40
nanom we still have three undetected uh
cells in the 28 nanom chip and we will
see in a few slides why that
is so uh yeah and also we have some more
Force positives here and while the
scanning electron microscope takes one 1
to two days uh for recording these chips
the detection algorithms all run yeah
like between two and 5 hours so that's
quite fast compared
here here are some selected true
positives uh in the cell replacement
detection and as you can see yeah they
are really uh true positives they are
differing between the top row and the
bottom
row
and yeah some of the false positives are
shown here and uh yeah most of them are
caused by uh debris or dust that settled
down on the Chip And so uh covering the
standard cells we want to
analyze so um this will be detected as a
replacement but as you can
see nobody knows from the image if the
cell below is actually a replacement or
not
um yeah this um debris happens when the
uh yeah during the preparation steps
when uh some parts or particles of of
the Silicon that is removed maybe
settles down there and uh even polishing
does not uh remove all of
them here's uh one of the false
negatives instead so uh this is one we
could not find with the algorithm and on
the left side you can see the tube
images and they are very very similar
but uh maybe you can spot that on the uh
top of these
there's minimal differences so uh we
could
improve uh maybe it is um possible with
a better scanning electron microscope to
record this 28 Nom
chip or we can maybe machine learning
BAS based uh algorithms could be
developed that can deal with such low
quality
images leading to a cheaper
Imaging so what are the
takeaways so um troj that are easier to
implement Maybe by taking not existing
cells but adding additional cells to the
chip uh that are also easier to detect
and whereas the replaced cells are a bit
more OB unobstrusive and harder to
detect with uh shrinking technology
sizes the detection can likely be
improved by Advanced detection
algorithms and semm images uh beta
images and if the quality is high enough
we can uh detect um these mod ifications
very well one uh last point I would note
is that we released all of the uh 300 GB
of image data as well as design files on
uh uh yeah and linked uh to them on our
GitHub repository where you can also
find all the algorithms
implementations
[Applause]
so
and now I would like to hand over to um
Rene who will tell us something about
human aspects of reverse engineering all
right thanks so much 7p so um you know
all go to our website you download the
algorithms and I don't have any mic
apparently hello t t Okay so thanks so
much e7p um now into the human
perspective so we now all just go to the
website and we grab all the algorithms
we run them and Hardware security is a
solve problem
no well it's not that
easy uh I recall that I promised in our
abstract that I talk a bit about how
I'll blue team worked and uh it will
then become very clear pretty soon that
automate all the things is really nice
in theory but it doesn't work that well
in practice um we have some ideas how we
can that complexity and also have couple
ideas how you can help with that so
perhaps the most prominent issue that we
found while working with those
algorithms is that we ended up with a
ton of different parameters that we need
to F tune to be able to use our
algorithms
efficiently and this is required to some
extent because we need to match those
parameters to our input data and I have
some some examples here so those are
four STS you've probably seen those
before in 7 pie slides from the four
different chips and you can very clearly
see uh if I find here that the the image
quality is very different in terms of
contrast sharpness brightness and this
of course affects all the thresholds in
the algorithms and those thresholds
control what the algorithm considers a
positive in in the sense of
manipulation yeah so this leads to this
kind of setup where all the different
algorithms have different parameters and
then for each of the different chips the
blue team had to sit down and
iteratively tune those parameters in
order to dial in those algorithms to
work
well and in the end those parameters
control the detection sensitivity so
what amount of deviation from our golden
sample do we consider normal and what do
we consider in manipulation ask
differently well if your analysis
process doesn't find any
manipulation is that because because
your chip was not manipulated is it
clean or are your parameters just too
LAX and then on the other hand use your
thresholds too tightly and you produce
thousands of false positives and then
that's really tedious to manually check
and so you can think of this somewhat as
like an ignorant paranoid dial on those
on those algorithms um and getting that
dial tuned just right uh is a real
challenge so let assume for a second
that you've done all of this you've
tuned all of your parameters well but
unfortunately we still have some
challenges ahead of us so here are two
really nice logic cells super crisp
clean images uh from one of our chips
and we've looked at the design files and
we're pretty sure that those are the
right ones and now in another place on
the chip you see
this are those the same cells and the
image quality is just really bad or is
this a samping artifact who knows
and I think the point I'm trying to get
across here is that well automation is
nice and we certainly need it to tackle
the vast amount of data that we have
like 300 gab of data but it has limits
and for a good result you will always
need an experienced analyst to work with
those algorithms to tune them properly
and to interpret the
results so how do we get there and to
figure out whether we actually have a
manipulation on not chip or whether it's
just a sing
artifact it kind of helps to put
yourself in the perspective of the
adversary so what would this
manipulation cause here was this a
manipulation that appears to be of some
use to the attacker in that case it's
pretty likely that you actually found
true positive or is it just
garbage so let's look at this example
here let's look at this this uh black
area in the in the top left here where
there's nothing before and let's now
assume that we image our chip and we
find oops there's a few dots in there so
there's a cell now and let's assume for
a second that this cell is an inverter
yeah so there's this one wire um and you
connect an inverter that has Chip enable
as an input and Chip enable as an output
that doesn't make too much sense does it
so what would happen here is what you CA
a short circuit the chip would
immediately hold and Catch Fire the
moment you try to turn it on that would
be somewhat obvious to the end User it's
not really a good manipulation is it so
it's pretty likely that this is just a
sampling artifact there's like some spec
of dust on there and there not really a
manipulation going back to the example
that we had before uh that that's
different brought up um if you look at
this area and we assume that we've
replaced this end with an all
cell and looking at the signals we now
have an debug authentication
bypass that's pretty likely to be
actually manipulation because it's
really helpful for the attacker yeah of
course this is just an example good
testing should well maybe catch this um
but more sophisticated instances that
are a lot harder to to to track and that
that require some amount of triggers uh
can be built in the same way so this all
sounds like a pretty straightforward
process now you look at the the circuit
diagram and the wait circuit diagram
well how do we even get
from the left side to the
right well we're obviously missing a
couple steps so we still need to figure
out what logic gates each of those
little vires and and and and black areas
really are and we need to know how
they're connected so we can actually
draw the circuit diagram and make this
make this educated
guess and that means we need to get a
bit into net reverse engineering so I
only touch on this really briefly here
there couple CP of great talks out there
that that uh you should really watch if
you're interested in this uh but the
essence is you need to go from the left
side of like I need to put the chip
under the microscope to the right side
of understanding the data flow and all
the logic functions that are implemented
on the chip and bonus points if we can
do this in a machine readable way um
because well automation is
nice so we've actually doubled in all of
those things if you want to learn more
about this so hit us up after the talk
we can about this um the brief overview
here is um well those are the the first
couple steps that we shown in the case
study already so you take the chip you
image it uh you detect the various cells
on
it this is this is all something we know
and then we need to recover the netless
so we need to recover the like abstract
description of the Su diagram and if we
recall the the the stack of the chip
here me means we need to image all of
those layers potentially as long long as
we don't have the design file so it's
quite tedious to actually do that but it
is
possible and then we end up with some
kind of net list which well in practice
looks a bit more like this and that's
like a really tiny excerp of a really
tiny module of a really tiny chip so you
can get like hundreds thousands of
millions of gates um which means that to
make any real sense of it you need to
petition the net list you need to
recover this high level information of
what is this functional block here like
which Gates do well the debugger
Authentication for example and then in
the end if you do this properly you end
up with this kind of diagram here where
you have all of the different input and
output signals of the different blocks
that realize specific functions on that
chip um if you want to get into the
details here there's a great talk by
custom n by Starbuck back from 2008 it's
called chip reverse engineering uh it's
pretty nice
one so if you look at this talk for
example you see that tools can support
reverse engineering many of those tools
are closed Source many of those closed
Source ones are exorbitantly expensive
but there are some open source
Alternatives just mentioned briefly this
is Mist this stitching tool it's used to
to align all of the microscopy images we
use this in our case study as well and
then there's a tool called dgate This is
a tool you can use for this okay which
cell is this thing here and then in the
end there's a tool that our group also
developed it's called hell the hardware
analyzer also on GitHub um which is a
tool that we can use to do this netlist
petitioning and then you can also script
the interpretation of that netlist to
some
extent but I'd like to offer a different
perspective here yes tools support
hardare reverse engineering but it's
driven by humans now every single step
in in this in this uh flow here requires
humans there are skilled machine
operators that do the Imaging and
there's there's people who read code to
do the parameter tuning and Custom Tool
development and then also Al there's a
lot of sense making and and Ingenuity
and intuition that goes into this
netless petitioning and sens making
stage and to make a a sensible decision
on what what does this manipulation do
yeah um this has in the recent years led
us to start some interdisciplinary work
in this space and we work with some
psychologists um with a focus on
cognitive science in order to actually
understand how hardw RSE Engineers work
and how we can support them
better so to put this thing a little
more form this is some old work we did
um where we defined that hre success
mostly depends on like yes manual and
Tool supported analysis but to a large
extent it depends on the cognitive
processes of problem solving uh which
would steer this analysis without going
too much into the psychological details
here um there's been really little
research on the letter so the strategies
are pretty poorly understood um but we
believe that if we understand those
human aspects and those cognitive
limitations that people naturally just
have a bit better we can help make heart
with security testing more accessible we
can do it more intuitive more usable
tooling and we can also work on on
training that that tackles those
problems more
precisely some practical applications
for what we can do here um I talked
earlier about like automate all the
things is probably not the solution um I
would argue that Hardware reverse
engineering is inherently a human
computer interaction problem
so the focus should probably not be on
just automate all the things but maybe
the focus can be on automate repetitive
tasks where that makes sense yeah so the
the number crunching the the pattern
recognition maybe throw some ml in there
if you want to um and then spend the
rest of your development time to support
reverse engineers in their cognitive
processes by tools and by accessible
documentation so s there is
what I suggest are three pillars to
making Hardware security and Hardware
security research and testing more
accessible one is we need capable and
open algorithms that are suitable to to
be applied to real world data and
devices not just toy examples and chips
suit and and hell are some examples we
provide here you can look at the the
slides later we have the QR codes if you
want to download the stuff um highly
suggest you check it out we're still
looking for three Trojans um help is
much appreciated
um then it's accessible and intuitive
tools and that means at different levels
of experience that does not just mean
have tools that work really well for the
people that have been working with them
for 10 years it means have tools that
you can adapt to people who start out in
this field to get into it without being
immediately
overwhelmed and it also means we need
training resources which as this is
a traditionally quite closed community
this the security field or Hardware
design field um outside of Enterprise
settings and this is this L part is some
research which just recently started we
have we're running a hardware reverse
engineering course at a university um
and we're trying to look at how this
course performs and come up with some
actual guidelines to how can we teach
people to do Har reverse engineering
efficiently so this is interdisplinary
research we're working on especially
this interdisciplinary research I think
has a huge potential in this field yeah
we've talked a lot about algorithms
we've talked a lot about like making
things more efficient and taking the
latest scanning electron microscope and
throwing it at the
data I think it's not enough we need to
collaborate with other fields because
humans Drive Hardware vers engineering
not
algorithms
so before I sum
up I need your
help we want you to play some games for
science so uh what I've brought uh with
us here is a tiny Hardware reverse
engineering game if you've ever seen a
circuit diagram you can totally play
this yeah there's multiple difficulty
levels um I will release this to the
public now and hope we don't immediately
uh be slashed at
it um I really recommend you check this
out on like a big screen device big
tablet laptop whatever but you can still
grab the the link here we'll probably
later be around at uh labora at car's
bestest uh you can talk with us there
and we probably also have some laptop if
you want to play it there um we use this
game
to to assess cognitive factors of of
reverse engineering uh this is our new
beta of this game uh we're launching a
study starting next year and I'd be
super happy if you could help us beta
test this and find as many bugs as we
can so fin
slide so hardw Trojans can be really
subtle they can maliciously art or
behavior off the circuit and they're
really hard to find um complex Supply
chains just make this inherent um our
Red Team Versus Blue Team approach and
algorithms can help so you can use
computer vision and actually those
algorithms work on your 5-year-old
laptop just fine yes you need the SCS
but you need the data but then you can
work with those algorithms you don't
need a supercomputer to do this yeah and
finally reverse engineering is a human
computer interaction Challenge and it
starts with enabling humans researching
Hardware and algorithms are just a part
of
that so uh that like to thank you very
much thank you Renee thank you E7 pce
thank you Stefan um if you would like to
ask a questions please queue up at the
microphones um there are four of these
in the room and I would say we start
with a question from the internet in
order to give everyone time to get to
the
mice signal Angel yes uh so the first
question from the internet are the
speakers aware of any real life cases of
malicious attacks performed at the logic
cell
level so we are not aware of any actual
attacks uh so nobody knows if there is
any Harr we didn't find one yet so
but not finding one doesn't mean that
none is out there and also doesn't mean
we shouldn't do research in this
space thank you microphone number four
your question thanks for thanks for the
talk um I was wondering if you can do
this validation in a blackbox manner so
uh when you created the when you
displayed the pipeline how to Pro
process it produce a chip you mentioned
the um validation step which I assume is
software based so why can't you use the
same validation just piping um the
validation into the chip and avoid all
these uh
hassle not quite sure what you mean by
piping the validation into the chip so
the validation Stage Works on verifying
that the design file if you simulate it
works as intended no yes and um if you
could couldn't run this validation but
against the chip isn't this possible yes
so there are validation methods that can
run on the chip right but they wouldn't
catch every single um state of the chip
maybe the hardware troan only triggers
after a year or something and then you
would need to test for a year until you
find this Hardware troen by testing
that's the problem thank you microphone
number two your question um hello um I
have one question what do you think is
the boundary between just simply um
uploading a software onto the Chip And
testing it with software and your method
that you presented right now because I'm
asking because I'm working for a chip
company and fun fact I actually did test
of the debugger was off after switching
it
off yeah so well this was a really like
contracted example like you wouldn't
build Trojan this way because you
mentioned like if you do your chip
design properly and if you do your
validation properly you would catch
this but it's very possible to build
triggers that are way more complex than
this um for example if you if you flip
specific key bits to a certain position
um you can't really test that
exhaustively otherwise you'd be like
root forcing a um so if you have this
kind of thing and well you don't have
the the gate bygate probing capability
which like for us chip you probably
don't have um if you have such a complex
trigger uh then I'd assume that with
those methods it's a lot harder to find
but yes this algorithm or this this
example can certainly be broken with
this yes okay cool thanks thank you uh
singal Angel another question from the
internet please uh yes next one I have
is are the fabric fabric layers also
analyzed to find Trojans Implement by
adding removing or altering the
interconnections of the logic
cells very good question so of course
you can also
um build some simple hardw Trojans I
would say by only um going to the
routing between so the interconnections
between standard cells and we have not
covered that fully because we only have
this single layer which is the standard
cell layer if we want to cover that as
well we would need to delayer the chip
layer by layer scan every track track in
the layer and then uh some
yeah methods for reverse Hardware
reverse engineering would be employed uh
and then you can tell the
difference in the future we we might be
able to use synchrons to scan the
insides the metal insides of of chips
but that's probably still uh maybe a
decade away and until then it's very
complex to do
that thank you um microphone number one
your question yes sir thanks for the
talk um um are there other possibilities
you can think of how a chip could be
like man manipulated I'm thinking of
like
um uh attacking the the dotting of the
of the transistors is there something
else so what you can think
of so we are aware of do Trojans I'm not
sure yeah exactly there's a there's a
case study um showing how a random
number generator could be um manipulated
um by basically um making transistors
always on or always off on the dopant
level um then it was it was also claimed
okay this is not detectable when we're
taking scanning electron microscope
images and then a year later there was
an academic paper which actually
implemented this and then they showed
well if I have a rough idea what I'm
looking for I could also detect those
changes in the doping um Gates that look
like different Gates camouflaged Gates
Maybe in this
direction yes there's ociation of course
um yeah fake bias fake wires so endless
endless opportunities to manipulate
chips um yeah we need to work on the
detection
methods all right thank you so much for
the great talk thank you for answering
the
[Applause]
questions
[Music]