Hardware trojans against virtual keyboards on e-banking platforms - A proof of concept

In the last years there has been a considerable growth on the number of users id on-line banking (Szopinski, 2016). Banks must implement strong security solutions and users have to feel safe about the security offered. To securize the users' access, virtual keyboards are commonly used. Unlikely, virtual keyboards are vulnerable to shoulder surfing and malicious software-based attacks such as malware and Trojans (Nadkarni et al., 2011; Sapra et al., 2013). In this article we propose a Hardware Trojan (HT), which targets a VGA display and is able to reveal the private information clicked by the user on a virtual keyboard. This HT is very harmful since it defeats the countermeasures (e.g., keyboard mutation or obfuscation) generally used to combat malicious pieces of software (Nayak et al., 2014; Parekh et al., 2011; Rajarajan et al., 2014).This work was supported by the MINECO – Spain grant: TIN2013-46469-R (SPINY: Security and Privacy in the Internet of You) and the CAM – Comunidad Autónoma de Madrid grant S2013/ICE-3095 (CIBERDINE: Cybersecurity, Data, and Risks)

A Survey on Integrated Circuit Trojans

Traditionally, computer security has been associated with the software security, or the information-data security. Surprisingly, the hardware on which the software executes or the information stored-processed-transmitted has been assumed to be a trusted base of security. The main building blocks of any electronic device are Integrated circuits (ICs) which form the fabric of a computer system. Lately, the use of ICs has expanded from handheld calculators and personal computers (PCs) to smartphones, servers, and Internet-of-Things (IoT) devices. However, this significant growth in the IC market created intense competition among IC vendors, leading to new trends in IC manufacturing. System-on-chip (SoC) design based on intellectual property (IP), a globally spread supply chain of production and distribution of ICs are the foremost of these trends. The emerging trends have resulted in many security and trust weaknesses and vulnerabilities, in computer systems. This includes Hardware Trojans attacks, side-channel attacks, Reverse-engineering, IP piracy, IC counterfeiting, micro probing, physical tampering, and acquisition of private or valuable assets by debugging and testing. IC security and trust vulnerabilities may cause loss of private information, modified/altered functions, which may cause a great economical hazard and big damage to society. Thus, it is crucial to examine the security and trust threats existing in the IC lifecycle and build defense mechanisms against IC Trojan threats. In this article, we examine the IC supply chain and define the possible IC Trojan threats for the parties involved. Then we survey the latest progress of research in the area of countermeasures against the IC Trojan attacks and discuss the challenges and expectations in this area. Keywords: IC supply chain, IC security, IP privacy, hardware trojans, IC trojans DOI: 10.7176/CEIS/12-2-01 Publication date: April 30th 202

Assessing Hardware Security Threats Posed by Hardware Trojans in Power Electronics

This study investigates the threat of hardware Trojans (HTs) in power electronics applications, a rising concern due to the growing demand for cost-effective embedded solutions in power systems. With the supply chain for electronic hardware devices expanding globally, particularly to low-cost foundries in foreign locations, there is an increasing risk of HT attacks. While there has been extensive research on HTs in computer applications, little consideration has been given to their threat in power electronics. This study demonstrates the effectiveness of a power electronics HT by implementing a novel HT design into a gate drive circuit. Additionally, the research proposes several HT designs that exploit factors unique to power circuits, such as high power delivery and analog circuitry in order to illustrate the distinct attack space. The research highlights the need for enhanced detection, protection, and prevention methods in power electronics applications and offers a roadmap for future studies to develop more effective countermeasures and algorithms to mitigate the risks of HT attacks in power electronics

A Systematic Review on Social Robots in Public Spaces: Threat Landscape and Attack Surface

There is a growing interest in using social robots in public spaces for indoor and outdoor applications. The threat landscape is an important research area being investigated and debated by various stakeholders. Objectives: This study aims to identify and synthesize empirical research on the complete threat landscape of social robots in public spaces. Specifically, this paper identifies the potential threat actors, their motives for attacks, vulnerabilities, attack vectors, potential impacts of attacks, possible attack scenarios, and mitigations to these threats. Methods: This systematic literature review follows the guidelines by Kitchenham and Charters. The search was conducted in five digital databases, and 1469 studies were retrieved. This study analyzed 21 studies that satisfied the selection criteria. Results: Main findings reveal four threat categories: cybersecurity, social, physical, and public space. Conclusion: This study completely grasped the complexity of the transdisciplinary problem of social robot security and privacy while accommodating the diversity of stakeholders’ perspectives. Findings give researchers and other stakeholders a comprehensive view by highlighting current developments and new research directions in this field. This study also proposed a taxonomy for threat actors and the threat landscape of social robots in public spaces.publishedVersio

Built-In Return-Oriented Programs in Embedded Systems and Deep Learning for Hardware Trojan Detection

Microcontrollers and integrated circuits in general have become ubiquitous in the world today. All aspects of our lives depend on them from driving to work, to calling our friends, to checking our bank account balance. People who would do harm to individuals, corporations and nation states are aware of this and for that reason they seek to find or create and exploit vulnerabilities in integrated circuits. This dissertation contains three papers dealing with these types of vulnerabilities. The first paper talks about a vulnerability that was found on a microcontroller, which is a type of integrated circuit. The final two papers deal with hardware trojans. Hardware trojans are purposely added to the design of an integrated circuit in secret so that the manufacturer doesn’t know about it. They are used to damage the integrated circuit, leak confidential information, or in other ways alter the circuit. Hardware trojans are a major concern for anyone using integrated circuits because an attacker can alter a circuit in almost any way if they are successful in inserting one. A known method to prevent hardware trojan insertion is discussed and a type of circuit for which this method does not work is revealed. The discussion of hardware trojans is concluded with a new way to detect them before the integrated circuit is manufactured. Modern deep learning models are used to detect the portions of the hardware trojan called triggers that activate them