Hardware backdoor

Short description: Hardware or firmware of computer chips

A hardware backdoor is a backdoor implemented within the physical components of a computer system, also known as its hardware. They can be created by introducing malicious code to a component's firmware, or even during the manufacturing process of an integrated circuit.[1][2] Often, they are used to undermine security in smartcards and cryptoprocessors, unless investment is made in anti-backdoor design methods.[3] They have also been considered for car hacking.[4]

Backdoors differ from hardware Trojans as backdoors are introduced intentionally by the original designer or during the design process, whereas hardware Trojans are inserted later by an external party.[5]

## Contents

* 1 Background
* 2 History
* 3 Countermeasures
* 4 See also
* 5 References
* 6 Further reading

## Background

The existence of hardware backdoors poses significant security risks for several reasons. They are difficult to detect and are impossible to remove using conventional methods like antivirus software. They can also bypass other security measures, such as disk encryption. Hardware trojans can be introduced during manufacturing where the end-user lacks control over the production chain.[1]

## History

In 2008, the FBI reported the discovery of approximately 3,500 counterfeit Cisco network components in the United States, some of which were introduced in military and government infrastructure.[6] In the same year, the possibility of a backdoor SPARC CPU was demonstrated with an FPGA running Linux that supported various hidden malicious services.[7]

A few years later, in 2011, Jonathan Brossard presented "Rakshasa", a proof-of-concept hardware backdoor. This backdoor could be installed by an individual with physical access to the hardware. It utilized coreboot to re-flash the BIOS with a SeaBIOS and iPXE-based bootkit composed of legitimate, open-source tools, allowing malware to be fetched from the internet during the boot process.[1]

The following year, in 2012, Sergei Skorobogatov and Christopher Woods from the University of Cambridge Computer Laboratory reported the discovery of a backdoor in a military-grade FPGA device, which could be exploited to access and modify sensitive information.[8][9][10] It has been said that this was proven to be a software problem and not a deliberate attempt at sabotage. This still brought to attention that equipment manufacturers should ensure that microchips operate as intended.[11][12] Later that year, two mobile phones developed by the Chinese company ZTE were found to carry a root access backdoor. According to security researcher Dmitri Alperovitch, the exploit used a hard-coded password in its software.[13]

Starting in 2012, the United States stated that Huawei might have backdoors present in their products.[14]

In 2013, researchers at the University of Massachusetts devised a method of breaking a CPU's internal cryptographic mechanisms by introducing specific impurities into the crystalline structure of transistors to change Intel's random-number generator.[15]

Documents revealed from 2013 onwards during the surveillance disclosures initiated by Edward Snowden showed that the Tailored Access Operations (TAO) unit and other NSA employees intercepted servers, routers, and other network gear being shipped to organizations targeted for surveillance to install covert implant firmware onto them before delivery.[16][17] These tools include custom BIOS exploits that survive the reinstallation of operating systems and USB cables with spy hardware and radio transceiver packed inside.[18]

In June 2016 it was reported that University of Michigan Department of Electrical Engineering and Computer Science had built a hardware backdoor that leveraged "analog circuits to create a hardware attack" so that after the capacitors store up enough electricity to be fully charged, it would be switched on, to give an attacker complete access to whatever system or device − such as a PC − that contains the backdoored chip. In the study that won the "best paper" award at the IEEE Symposium on Privacy and Security they also note that microscopic hardware backdoor wouldn't be caught by practically any modern method of hardware security analysis, and could be planted by a single employee of a chip factory.[19][20]

In September 2016 Skorobogatov showed how he had removed a NAND chip from an iPhone 5C \- the main memory storage system used on many Apple devices - and cloned it so that he can try out more incorrect combinations than allowed by the attempt-counter.[21]

In October 2018 Bloomberg reported that an attack by Chinese spies reached almost 30 U.S. companies, including Amazon and Apple, by compromising America's technology supply chain.[22]

## Countermeasures

Skorobogatov has developed a technique capable of detecting malicious insertions into chips.[12]

New York University Tandon School of Engineering researchers have developed a way to corroborate a chip's operation using verifiable computing whereby "manufactured for sale" chips contain an embedded verification module that proves the chip's calculations are correct and an associated external module validates the embedded verification module.[11] Another technique developed by researchers at University College London (UCL) relies on distributing trust between multiple identical chips from disjoint supply chains. Assuming that at least one of those chips remains honest the security of the device is preserved.[23]

Researchers at the University of Southern California Ming Hsieh Department of Electrical and Computer Engineering and the Photonic Science Division at the Paul Scherrer Institute have developed a new technique called Ptychographic X-ray laminography.[24] This technique is the only current method that allows for verification of the chips blueprint and design without destroying or cutting the chip. It also does so in significantly less time than other current methods. Anthony F. J. Levi Professor of electrical and computer engineering at University of Southern California explains “It’s the only approach to non-destructive reverse engineering of electronic chips—[and] not just reverse engineering but assurance that chips are manufactured according to design. You can identify the foundry, aspects of the design, who did the design. It’s like a fingerprint.”[24] This method currently is able to scan chips in 3D and zoom in on sections and can accommodate chips up to 12 millimeters by 12 millimeters easily accommodating an Apple A12 chip but not yet able to scan a full Nvidia Volta GPU.[24] "Future versions of the laminography technique could reach a resolution of just 2 nanometers or reduce the time for a low-resolution inspection of that 300-by-300-micrometer segment to less than an hour, the researchers say."[24]

## See also

* Clipper chip
* FBI–Apple encryption dispute
* Hardware security
* Hardware security bug
* Hardware Trojan
* Intel Active Management Technology § Security
* Zombie Zero
* Open hardware
* Code signing
* Intel Management Engine
* AMD Platform Security Processor

## References

1. ↑ 1.0 1.1 1.2 "Rakshasa: The hardware backdoor that China could embed in every computer - ExtremeTech". ExtremeTech. 1 August 2012. https://www.extremetech.com/computing/133773-rakshasa-the-hardware-backdoor-that-china-could-embed-in-every-computer.
2. ↑ "Adding Backdoors at the Chip Level" (in en-US). 2018-03-26. https://www.schneier.com/blog/archives/2018/03/adding_backdoor.html.
3. ↑ Waksman, Adam (2010), "Tamper Evident Microprocessors", Proceedings of the IEEE Symposium on Security and Privacy (Oakland, California), https://www.cs.columbia.edu/~waksman/PDFs/Oakland_2010.pdf, retrieved 2019-08-27
4. ↑ Smith, Craig (2016-03-24) (in en). The Car Hacker's Handbook: A Guide for the Penetration Tester. No Starch Press. ISBN 9781593277031. https://books.google.com/books?id=Ao_QCwAAQBAJ&pg=PA95. Retrieved 22 January 2017.
5. ↑ Becker, Steffen; Paar, Christof (2025), Jajodia, Sushil; Samarati, Pierangela; Yung, Moti, eds., "Hardware Trojan" (in en), Encyclopedia of Cryptography, Security and Privacy (Cham: Springer Nature Switzerland): pp. 1081–1083, doi:10.1007/978-3-030-71522-9_1703, ISBN 978-3-030-71522-9, https://link.springer.com/referenceworkentry/10.1007/978-3-030-71522-9_1703, retrieved 2025-05-13
6. ↑ Wagner, David (2008-07-30) (in en). Advances in Cryptology - CRYPTO 2008: 28th Annual International Cryptology Conference, Santa Barbara, CA, USA, August 17-21, 2008, Proceedings. Springer Science & Business Media. ISBN 9783540851738. https://books.google.com/books?id=RiJ2qE8svEoC&pg=PA222. Retrieved 22 January 2017.
7. ↑ King, Samuel T; Tucek, Joseph A; Cozzie, Anthony; Grier, Chris; Jiang, Weihang; Zhou, Yuanyuan (2008-04-13). "Designing and Implementing Malicious Hardware". FIRST USENIX WORKSHOP ON LARGE-SCALE EXPLOITS AND EMERGENT THREATS (LEET). San Francisco: Usenix. https://www.usenix.org/legacy/event/leet08/tech/full_papers/king/king.pdf. Retrieved 2025-07-31.
8. ↑ Mishra, Prabhat; Bhunia, Swarup; Tehranipoor, Mark (2017-01-02) (in en). Hardware IP Security and Trust. Springer. ISBN 9783319490250. https://books.google.com/books?id=vd3TDQAAQBAJ&pg=PA227. Retrieved 22 January 2017.
9. ↑ "Hardware-Hack: Backdoor in China-Chips entdeckt?" (in de). CHIP Online. http://www.chip.de/news/Hardware-Hack-Backdoor-in-China-Chips-entdeckt_56047005.html.
10. ↑ "Hackers Could Access US Weapons Systems Through Chip". CNBC. 8 June 2012. https://www.cnbc.com/id/47700647.
11. ↑ 11.0 11.1 "Self-checking chips could eliminate hardware security issues - TechRepublic" (in en). Tech Republic. 31 August 2016. http://www.techrepublic.com/article/self-checking-chips-could-eliminate-hardware-security-issues/.
12. ↑ 12.0 12.1 "Cambridge Scientist Defends Claim That US Military Chips Made In China Have 'Backdoors'" (in en). Business Insider. http://www.businessinsider.com/sergei-skorobogatov-defends-backdoor-claims-2012-5?IR=T.
13. ↑ Lee, Michael. "Researchers find backdoor on ZTE Android phones" (in en). ZDNet. https://www.zdnet.com/article/researchers-find-backdoor-on-zte-android-phones/.
14. ↑ Schoen, Douglas E.; Kaylan, Melik (9 September 2014). The Russia-China Axis: The New Cold War and America's Crisis of Leadership. Encounter Books (published 2014). ISBN 9781594037573. https://books.google.com/books?id=q2ToBAAAQBAJ. Retrieved 2020-05-16. "Hardware-encoded backdoors are more threatening than software-encoded ones [...] In October 2012, the U.S. House Permanent Select Committee on Intelligence recommended that U.S. companies avoid hardware made by Chinese telecom giants Huawei and ZTE, saying that its use constitutes a risk to national security. Huawei and ZTE manufacture network hardware for telecommunications systems."
15. ↑ "Researchers find new, ultra-low-level method of hacking CPUs - and there's no way to detect it - ExtremeTech". ExtremeTech. 16 September 2013. https://www.extremetech.com/extreme/166580-researchers-find-new-ultra-low-level-method-of-hacking-cpus-and-theres-no-way-to-detect-it.
16. ↑ "Photos of an NSA "upgrade" factory show Cisco router getting implant" (in en-us). Ars Technica. 2014-05-14. https://arstechnica.com/tech-policy/2014/05/photos-of-an-nsa-upgrade-factory-show-cisco-router-getting-implant/.
17. ↑ "NSA's Secret Toolbox: Unit Offers Spy Gadgets for Every Need". Der Spiegel (SPIEGEL ONLINE). 30 December 2013. http://www.spiegel.de/international/world/nsa-secret-toolbox-ant-unit-offers-spy-gadgets-for-every-need-a-941006.html.
18. ↑ "Your USB cable, the spy: Inside the NSA's catalog of surveillance magic" (in en-us). Ars Technica. 2013-12-31. https://arstechnica.com/information-technology/2013/12/inside-the-nsas-leaked-catalog-of-surveillance-magic/.
19. ↑ Greenberg, Andy (June 2016). "This 'Demonically Clever' Backdoor Hides In a Tiny Slice of a Computer Chip". WIRED. https://www.wired.com/2016/06/demonically-clever-backdoor-hides-inside-computer-chip/. Retrieved 22 January 2017.
20. ↑ Storm, Darlene (2016-06-06). "Researchers built devious, undetectable hardware-level backdoor in computer chips" (in en). Computerworld. http://www.computerworld.com/article/3079417/security/researchers-built-devious-undetectable-hardware-level-backdoor-in-computer-chips.html.
21. ↑ "Hardware hack defeats iPhone passcode security". BBC News. 19 September 2016. https://www.bbc.com/news/technology-37407047.
22. ↑ Robertson, Jordan; Riley, Michael (4 October 2018). "The Big Hack: How China Used a Tiny Chip to Infiltrate U.S. Companies". https://www.bloomberg.com/news/features/2018-10-04/the-big-hack-how-china-used-a-tiny-chip-to-infiltrate-america-s-top-companies.
23. ↑ Vasilios Mavroudis. "A Touch of Evil: High-Assurance Cryptographic Hardware from Untrusted Components" (in en). Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security. https://acmccs.github.io/papers/p1583-mavroudisA.pdf.
24. ↑ 24.0 24.1 24.2 24.3 Moore, Samuel (2019-10-07). "X-Ray Tech Lays Chip Secrets Bare" (in en). https://spectrum.ieee.org/xray-tech-lays-chip-secrets-bare.

## Further reading

* Krieg, Christian; Dabrowski, Adrian; Hobel, Heidelinde; Krombholz, Katharina; Weippl, Edgar (2013). Hardware malware. [S.l.]: Morgan & Claypool. ISBN 9781627052528.

This article is part of a series on

Information security
Related security categories

* Internet security
* Automotive security
* Cyberwarfare
* Computer security
* Mobile security
* Network security

Threats

* Advanced persistent threat
* Computer crime
* Vulnerabilities
* Eavesdropping
* Malware
* Spyware
* Ransomware
* Trojans
* Viruses
* Worms
* Rootkits
* Bootkits
* Keyloggers
* Screen scrapers
* Exploits
* Backdoors
* Logic bombs
* Payloads
* Denial of service
* Web shells
* Web application security
* Phishing

Defenses

* Computer access control
* Application security
* Antivirus software
* Secure coding
* Secure by default
* Secure by design
* Secure operating systems
* Authentication
* Multi-factor authentication
* Authorization
* Data-centric security
* Encryption
* Firewall
* Intrusion detection system
* Mobile secure gateway
* Runtime application self-protection (RASP)

* v
* t
* e

0.00

(0 votes)

Original source: https://en.wikipedia.org/wiki/Hardware backdoor. Read more

|

Retrieved from "https://handwiki.org/wiki/index.php?title=Hardware_backdoor&oldid=4003788"
*[v]: View this template
*[t]: Discuss this template
*[e]: Edit this template