CWE-1191: Exposed Chip Debug and or Test Interface With Insufficient Access Control
The chip does not implement or does not correctly enforce access control on the debug/test interface, thus allowing an attacker to exercise the debug/test interface to access a portion of the chip internal registers that typically would not be exposed.
Integrated circuits can expose the chip internals through a scan chain interconnected through internal registers etc., through scan flip-flops. A Joint Test Action Group (JTAG) compatible test access port usually provides access to this scan chain for debugging the chip. Since almost every asset in the chip can be accessed over this debug interface, chip manufacturers typically insert some form of password-based or challenge-response based access control mechanisms to prevent misuse. This mechanism is implemented in addition to on-chip protections that are already present. If this debug access control is not implemented or the access control check is not implemented properly, or if the hardware does not clear secret keys, etc., when debug more is entered, an attacker may be able to bypass on-chip access control mechanisms through debug features/interfaces.
The table(s) below shows the weaknesses and high level categories that are related to this weakness. These relationships are defined as ChildOf, ParentOf, MemberOf and give insight to similar items that may exist at higher and lower levels of abstraction. In addition, relationships such as PeerOf and CanAlsoBe are defined to show similar weaknesses that the user may want to explore.
Relevant to the view "Research Concepts" (CWE-1000)
Relevant to the view "Hardware Design" (CWE-1194)
The different Modes of Introduction provide information about how and when this weakness may be introduced. The Phase identifies a point in the life cycle at which introduction may occur, while the Note provides a typical scenario related to introduction during the given phase.
The listings below show possible areas for which the given weakness could appear. These may be for specific named Languages, Operating Systems, Architectures, Paradigms, Technologies, or a class of such platforms. The platform is listed along with how frequently the given weakness appears for that instance.
Class: Language-Independent (Undetermined Prevalence)
Class: OS-Independent (Undetermined Prevalence)
Class: Architecture-Independent (Undetermined Prevalence)
Class: System on Chip (Undetermined Prevalence)
Class: Technology-Independent (Undetermined Prevalence)
The table below specifies different individual consequences associated with the weakness. The Scope identifies the application security area that is violated, while the Impact describes the negative technical impact that arises if an adversary succeeds in exploiting this weakness. The Likelihood provides information about how likely the specific consequence is expected to be seen relative to the other consequences in the list. For example, there may be high likelihood that a weakness will be exploited to achieve a certain impact, but a low likelihood that it will be exploited to achieve a different impact.
A home, WiFi-router device implements a standard, login prompt, which prevents an attacker from issuing any commands on the device until appropriate credentials are provided. The credentials are secret, and they are not from the well-known list of poor credentials.
Example Language: Other
If JTAG interface on this device is not hidden by the manufacturer, it can be identified using tools such as JTAGulator. If it is hidden but not disabled, it can be exposed by using a soldering engine.
By issuing a halt command before the OS starts, the attacker pauses the watchdog timer and prevents the router from restarting (once the watchdog timer expires). Having paused the router, attacker sets breakpoints and is capable of stepping through operations and inspecting/injecting data in the device’s memory. Through analysis of the extracted firmware from the device, attacker identifies the exact pattern to inject to the device memory. After injecting this pattern, attacker successfully launches a shell on the device.
JTAG is useful to chip manufacturers during design, testing, and production and is included in nearly every product. However, it also serves as a huge, potential, attack vector if it is exposed to an attacker. Appropriate measures need to be taken to prevent misuse of this powerful interface.
Example Language: Other
In order to prevent exposing debug interface, manufacturers might try to obfuscate JTAG interface or deliberately blow fuses in the JTAG interface. Sometimes, they are hidden in inner layers of the board. If interface has to be exposed, adding access-control protection to this interface would also prevent misuse.
More information is available — Please select a different filter.