And if you’re in need of a design firm to help you implement genuine security by design with your next device, NeuronicWorks has over a decade of experience designing secure devices across multiple industries, including wearables, automotive, medical, and transportation, to name just a few. Be in touch today to find out how NeuronicWorks can help you design your most secure device —all from the outset.
Minimizing Hardware Attacks
With more devices connecting to the internet each year—from smart phones, to medical devices, to Internet of Things-enabled devices in the home and workplace—the risks of cyberattacks have significantly increased, as has the damage that such breaches can do to a person’s life or business.
Approximately 20% of Canadian businesses will experience a cyberattack or other cybersecurity breach each year, with small and medium-sized businesses at particular risk. With recent studies suggesting that global business losses to cybercrime could exceed $5 trillion dollars (US) by 2024, the need to ensure security from the outset of a project is clear.
So why are such protections routinely neglected? Instead, cybersecurity needs to be addressed from the design to ensure devices are protected from the outset—this is known as “security by design.”
Security needs to be implemented at different levels: hardware, firmware, software. To provide you with insights at each level, we will be releasing a series of three articles to explore best practices for each discipline. As with the product development process, we start with hardware and hardware security.
Common Hardware Attacks
While the average consumer is aware that computer software can be hacked, fewer will be aware that hardware, too, can suffer security breaches. Many such attacks will target systems that few people ever interact with directly, including network appliances, industrial control systems, and elements of communication infrastructure.
Here are some of the most common kinds of hardware attacks to be aware of:
• Manufacturing backdoors: just as software can have backdoors, hardware can be vulnerable to them, as well. A backdoor can allow unauthorized users to circumvent normal security measures and gain root access to the hardware. They can then install malware or other malicious code. Backdoors can also affect embedded radio-frequency identification (RFID) chips and memory
• Eavesdropping: malicious actors gain access to protected memory without opening other hardware
• Inducing faults: these kinds of attacks disrupt the normal behavior of a device and can have knock-on effects as other hardware and software relying on the normal operation of the infected hardware then fail to function properly
• Hardware modification: modifications aimed at invasively tampering with a device’s normal functioning and overriding restrictions on its operation
• Backdoor creation: hidden methods for bypassing normal computer authentication systems. These can be installed by manufacturers or even state-level actors.
• Counterfeiting product assets: this kind of attack can produce extraordinary operations and allow malicious access to systems
A backdoor can allow unauthorized users to circumvent normal security measures and gain root access to the hardware.
Best Practices to Design a Hardware-Secure Device
With these threats in mind what are the best ways to minimize hardware attacks? Here are some best practices to keep in mind.
1. Minimize potential attack vectors
As the first step to securing your hardware, disable any hardware you’re not using that could present an avenue of attack. This includes disabling any UARTs that aren’t used in the final design (e.g. debug ports), unused Ethernet ports (or enforce MAC address restrictions), unused wireless interfaces, and programming and debugging interfaces (e.g. JTAG ports).
2. Use encryption wherever possible
Be sure to use encryption wherever possible (e.g. external flash storage, DRAM interfaces). Most modern processors have embedded hardware to facilitate encryption/decryption with little overhead on the CPU, so take advantage.
3. Use multiple layers of security
Use multiple layers of security, both physical and electronic.
Physical solutions include anti-tamper or tamper-evident housing designs that make the device difficult to open (remember to balance the need for serviceability and cost) and potting or encapsulating the electronics to make them physically difficult to access them without damaging.
Electronic layers of security include using a secure element (for example, the Microchip ATECC608A) to store a master key, which can then be used to encrypt/decrypt other keys and data as necessary. Secure elements provide strong protection against both tampering and key extraction, but another technology, like ARM TrustZone for example, can be a good option if a hardware SE is not feasible for the design.
Another strong choice is the use of secure authenticator devices (like the A1006 Secure Authenticator Solution from NXP or the STSAFE-A100 solution from ST Micro) to authenticate accessories and other “mating” devices. Secure authenticators use strong cryptography to mutually authenticate each other and prevent counterfeit devices from spoofing a real device.
And a final technique to keep in mind is the use of tamper switches and environmental monitoring. For devices that are at a high risk of tampering (e.g. mobile point-of-sale terminals) the master key can be loaded into battery-backed SRAM, which is wiped if the unit is opened and the tamper switches are triggered. Additional triggers—such as the detection of light on the interior of the unit—can also be used.
Security Can’t be an Afterthought
A sure bet in cybersecurity is that hackers and other malicious actors will never stop innovating to get around both software and hardware protections, which is why you can’t stop innovating either. One way you can take a new approach to your device security is to adopt genuine security by design thinking, and implement best practices at the beginning of the design rather than as an afterthought. With this new approach, your company can be a leader in technological change and innovate with confidence.
Keep an eye out for follow up pieces in this series that will cover designing secure devices from the perspectives of firmware and software. Together these three articles will give you a comprehensive view of what you need to consider to ensure your next device is secure.
All Blogs