CAPEC-702 Exploiting Incorrect Chaining or Granularity of Hardware Debug Components

An adversary exploits incorrect chaining or granularity of hardware debug components in order to gain unauthorized access to debug functionality on a chip. This happens when authorization is not checked on a per function basis and is assumed for a chain or group of debug functionality.

Chip designers often include design elements in a chip for debugging and troubleshooting such as: • Various Test Access Ports (TAPs) which allow boundary scan commands to be executed. • Scan cells that allow the chip to be used as a "stimulus and response" mechanism for scanning the internal components of a chip. • Custom methods to observe the internal components of their chips by placing various tracing hubs within their chip and creating hierarchical or interconnected structures among those hubs. Because devices commonly have multiple chips and debug components, designers will connect debug components and expose them through a single external interface, which is referred to as “chaining”. Logic errors during design or synthesis could misconfigure the chaining of the debug components, which could allow unintended access. TAPs are also commonly referred to as JTAG interfaces.

1. [Explore] [Find and scan debug interface] The adversary must first find and scan a debug interface to determine what they are authorized to use and what devices are chained to that interface. 2. [Experiment] [Connect to debug interface] The adversary next connects a device to the JTAG interface using the properties found in the explore phase so that they can send commands. The adversary sends some test commands to make sure the connection is working. 3. [Exploit] [Move along debug chain] Once the adversary has connected to the main TAP, or JTAG interface, they will move along the TAP chain to see what debug interfaces might be available on that chain.

• Hardware device has an exposed debug interface

• [Medium] Ability to identify physical debug interfaces on a device • [Medium] Ability to operate devices to scan and connect to an exposed debug interface

• Confidentiality: Read Data • Integrity: Modify Data • Access Control, Authorization: Gain Privileges

• Implement: Ensure that debug components are properly chained, and their granularity is maintained at different authorization levels • Perform Post-silicon validation tests at various authorization levels to ensure that debug components are only accessible to authorized users