2034
Consider a device that comes with various security measures, such as secure boot. The secureboot
process performs firmware-integrity verification at boot time, and this code is stored in a
separate SPI-flash device. However, this code contains undocumented "special access features"
intended to be used only for performing failure analysis and intended to only be unlocked by the
device designer.
Example Language: Other (Bad)
Attackers dump the code from the device and then perform reverse engineering to analyze the code. The undocumented,
special-access features are identified, and attackers can activate them by sending specific commands via UART before
secure-boot phase completes. Using these hidden features, attackers can perform reads and writes to memory via the
UART interface. At runtime, the attackers can also execute arbitrary code and dump the entire memory contents.
Remove all chicken bits and hidden features that are exposed to attackers. Add authorization
schemes that rely on cryptographic primitives to access any features that the manufacturer does
not want to expose. Clearly document all interfaces.
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 1198 Privilege Separation and Access Control Issues 1194 2470
MemberOf 1371 ICS Supply Chain: Poorly Documented or
Undocumented Features
1358 2508
MemberOf 1396 Comprehensive Categorization: Access Control 1400 2519
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
ISA/IEC 62443 Part 4-1 Req SD-4
ISA/IEC 62443 Part 4-1 Req SVV-3
ISA/IEC 62443 Part 4-2 Req CR 2.12
Related Attack Patterns
CAPEC-ID Attack Pattern Name
36 Using Unpublished Interfaces or Functionality
212 Functionality Misuse
References
[REF-1071]Ali Abbasi, Tobias Scharnowski and Thorsten Holz. "Doors of Durin: The Veiled Gate to
Siemens S7 Silicon". < https://i.blackhat.com/eu-19/Wednesday/eu-19-Abbasi-Doors-Of-Durin-The-
Veiled-Gate-To-Siemens-S7-Silicon.pdf >.
[REF-1072]Sergei Skorobogatov and Christopher Woods. "Breakthrough Silicon Scanning
Discovers Backdoor in Military Chip". < https://www.cl.cam.ac.uk/~sps32/Silicon_scan_draft.pdf >.
[REF-1073]Chris Domas. "God Mode Unlocked: Hardware Backdoors in x86 CPUs". < https://
i.blackhat.com/us-18/Thu-August-9/us-18-Domas-God-Mode-Unlocked-Hardware-Backdoors-Inx86-
CPUs.pdf >.
[REF-1074]Jonathan Brossard. "Hardware Backdooring is Practical". < https://media.blackhat.com/
bh-us-12/Briefings/Brossard/BH_US_12_Brossard_Backdoor_Hacking_Slides.pdf >.
[REF-1075]Sergei Skorabogatov. "Security, Reliability, and Backdoors". < https://
www.cl.cam.ac.uk/~sps32/SG_talk_SRB.pdf >.
CWE Version 4.14
CWE-1243: Sensitive Non-Volatile Information Not Protected During Debug
CWE-1243: Sensitive Non-Volatile Information Not Protected During Debug