Keynote: How to Build Hardware Trojans
summary
Demonstrates concrete hardware Trojans that work: a doping-level transistor flip to permanently set outputs that evades optical inspection but becomes visible with SEM, a RNG Trojan that fixes 224/256 bits leaving 32 bits entropy to reduce key search to ~2^32 and pass standard manufacturing CRC tests, and FPGA attacks that replace AES S-boxes via bitstream tampering with a working proof-of-concept on FPGA and an infected USB stick, noting most devices lack effective bitstream protection.
AI-written summary · about
chapters (18)
- 0:00Introduction
- 1:09What are Hardware Trojans
- 2:53Manufacturing
- 3:58Hardware Blocks
- 7:20The Scientific Community
- 8:24Hardware Trojans
- 9:38Our origins
- 10:07Inverters
- 16:00Random Number Generator
- 19:44Inverter Trick
- 24:02Conclusion
- 26:33SPG Trojans
- 27:28FPGAs
- 28:09How does it work
- 30:25Bitstream
- 33:11Sboxes
- 35:33payload
- 41:06FPGA
related talks
40mWhen hardware attacks scale
43mThe Tao of Hardware the Te of Implants
51mExploiting Hardware Glitches And Side Channels In Perfect Software
47mTrojanizing Hardware: Be Careful What (USB) You Plug In and Where
44mPractical Software Countermeasures 4 Hardware Glitch Attacks
44mSilicon Under Attack Physical Exploitation Of Modern Chips
27mProtecting Data In-Use from Firmware and Physical Attacks
51mA Measured Response to a Grain of Rice