CWE

Common Weakness Enumeration

A Community-Developed List of Software & Hardware Weakness Types

CWE Top 25 Most Dangerous Software Errors
Home > CWE List > CWE- Individual Dictionary Definition (4.1)  
ID

CWE-1191: Exposed Chip Debug and or Test Interface With Insufficient Access Control

Weakness ID: 1191
Abstraction: Base
Structure: Simple
Status: Draft
Presentation Filter:
+ Description
The chip does not implement or does not correctly enforce access control on the debug/test interface, thus allowing an attacker to exercise the debug/test interface to access a portion of the chip internal registers that typically would not be exposed.
+ Extended Description

Integrated circuits can expose the chip internals through a scan chain interconnected through internal registers etc., through scan flip-flops. A Joint Test Action Group (JTAG) compatible test access port usually provides access to this scan chain for debugging the chip. Since almost every asset in the chip can be accessed over this debug interface, chip manufacturers typically insert some form of password-based or challenge-response based access control mechanisms to prevent misuse. This mechanism is implemented in addition to on-chip protections that are already present. If this debug access control is not implemented or the access control check is not implemented properly, or if the hardware does not clear secret keys, etc., when debug more is entered, an attacker may be able to bypass on-chip access control mechanisms through debug features/interfaces.

+ Relationships

The table(s) below shows the weaknesses and high level categories that are related to this weakness. These relationships are defined as ChildOf, ParentOf, MemberOf and give insight to similar items that may exist at higher and lower levels of abstraction. In addition, relationships such as PeerOf and CanAlsoBe are defined to show similar weaknesses that the user may want to explore.

+ Relevant to the view "Research Concepts" (CWE-1000)
NatureTypeIDName
ChildOfPillarPillar - a weakness that is the most abstract type of weakness and represents a theme for all class/base/variant weaknesses related to it. A Pillar is different from a Category as a Pillar is still technically a type of weakness that describes a mistake, while a Category represents a common characteristic used to group related things.284Improper Access Control
PeerOfClassClass - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource.1263Insufficient Physical Protection Mechanism
+ Relevant to the view "Hardware Design" (CWE-1194)
NatureTypeIDName
MemberOfCategoryCategory - a CWE entry that contains a set of other entries that share a common characteristic.1207Debug and Test Problems
+ Modes Of Introduction

The different Modes of Introduction provide information about how and when this weakness may be introduced. The Phase identifies a point in the life cycle at which introduction may occur, while the Note provides a typical scenario related to introduction during the given phase.

PhaseNote
Architecture and Design
Implementation
+ Applicable Platforms
The listings below show possible areas for which the given weakness could appear. These may be for specific named Languages, Operating Systems, Architectures, Paradigms, Technologies, or a class of such platforms. The platform is listed along with how frequently the given weakness appears for that instance.

Languages

Class: Language-Independent (Undetermined Prevalence)

Operating Systems

Class: OS-Independent (Undetermined Prevalence)

Architectures

Class: Architecture-Independent (Undetermined Prevalence)

Technologies

Class: System on Chip (Undetermined Prevalence)

Class: Technology-Independent (Undetermined Prevalence)

+ Common Consequences

The table below specifies different individual consequences associated with the weakness. The Scope identifies the application security area that is violated, while the Impact describes the negative technical impact that arises if an adversary succeeds in exploiting this weakness. The Likelihood provides information about how likely the specific consequence is expected to be seen relative to the other consequences in the list. For example, there may be high likelihood that a weakness will be exploited to achieve a certain impact, but a low likelihood that it will be exploited to achieve a different impact.

ScopeImpactLikelihood
Confidentiality

Technical Impact: Read Application Data

High
Confidentiality

Technical Impact: Read Memory

High
Authorization

Technical Impact: Execute Unauthorized Code or Commands

High
Integrity

Technical Impact: Modify Memory

High
Integrity

Technical Impact: Modify Application Data

High
Access Control

Technical Impact: Bypass Protection Mechanism

High
+ Demonstrative Examples

Example 1

A home, WiFi-router device implements a standard, login prompt, which prevents an attacker from issuing any commands on the device until appropriate credentials are provided. The credentials are secret, and they are not from the well-known list of poor credentials.

(bad code)
Example Language: Other 

If JTAG interface on this device is not hidden by the manufacturer, it can be identified using tools such as JTAGulator. If it is hidden but not disabled, it can be exposed by using a soldering engine.

By issuing a halt command before the OS starts, the attacker pauses the watchdog timer and prevents the router from restarting (once the watchdog timer expires). Having paused the router, attacker sets breakpoints and is capable of stepping through operations and inspecting/injecting data in the device’s memory. Through analysis of the extracted firmware from the device, attacker identifies the exact pattern to inject to the device memory. After injecting this pattern, attacker successfully launches a shell on the device.

JTAG is useful to chip manufacturers during design, testing, and production and is included in nearly every product. However, it also serves as a huge, potential, attack vector if it is exposed to an attacker. Appropriate measures need to be taken to prevent misuse of this powerful interface.

(good code)
Example Language: Other 
In order to prevent exposing debug interface, manufacturers might try to obfuscate JTAG interface or deliberately blow fuses in the JTAG interface. Sometimes, they are hidden in inner layers of the board. If interface has to be exposed, adding access-control protection to this interface would also prevent misuse.
+ Observed Examples
ReferenceDescription
chain: JTAG interface is not disabled (CWE-1191) during ROM code execution, introducing a race condition (CWE-362) to extract encryption keys
+ Potential Mitigations

Phase: Architecture and Design

Strategy: Separation of Privilege

Implement an access control mechanism to exercise the debug interface in order to control and observe security-sensitive chip internals.

Password checking logic should be resistant to timing attacks. Security-sensitive data stored in registers, such as keys, etc. should be cleared when entering debug mode.

+ References
[REF-1037] Kurt Rosenfeld and Ramesh Karri. "Attacks and Defenses for JTAG". 2010-02. <https://ieeexplore.ieee.org/stamp/stamp.jsp?tp=&arnumber=5406671>.
[REF-1043] Gopal Vishwakarma and Wonjun Lee. "Exploiting JTAG and Its Mitigation in IOT: A Survey". 2018-12-03. <https://www.mdpi.com/1999-5903/10/12/121/pdf>.
[REF-1084] Gopal Vishwakarma and Wonjun Lee. "JTAG Explained (finally!): Why “IoT”, Software Security Engineers, and Manufacturers Should Care". <https://www.mdpi.com/1999-5903/10/12/121/pdf >.
[REF-1085] Bob Molyneaux, Mark McDermott and Anil Sabbavarapu. "Design for Testability & Design for Debug". <http://users.ece.utexas.edu/~mcdermot/vlsi-2/Lecture_17.pdf>.
+ Content History
+ Submissions
Submission DateSubmitterOrganization
2019-10-15Arun Kanuparthi, Hareesh Khattri, Parbati Kumar Manna, Narasimha Kumar V MangipudiIntel Corporation
+ Modifications
Modification DateModifierOrganization
2020-06-25CWE Content TeamMITRE
updated Applicable_Platforms, Common_Consequences, Demonstrative_Examples, Description, Name, References, Relationships
+ Previous Entry Names
Change DatePrevious Entry Name
2020-02-26Exposed Chip Debug Interface With Insufficient Access Control
More information is available — Please select a different filter.
Page Last Updated: June 25, 2020