1981
Scope Impact Likelihood
Confidentiality Read Application Data High
Confidentiality Read Memory High
Authorization Execute Unauthorized Code or Commands High
Integrity Modify Memory High
Integrity Modify Application Data High
Access Control Bypass Protection Mechanism High
Detection Methods
Dynamic Analysis with Manual Results Interpretation
Authentication and authorization of debug and test interfaces should be part of the architecture
and design review process. Withholding of private register documentation from the debug and
test interface public specification ("Security by obscurity") should not be considered as sufficient
security.
Dynamic Analysis with Manual Results Interpretation
Dynamic tests should be done in the pre-silicon and post-silicon stages to verify that the debug
and test interfaces are not open by default.
Fuzzing
Tests that fuzz Debug and Test Interfaces should ensure that no access without appropriate
authentication and authorization is possible.
Effectiveness = Moderate
Potential Mitigations
Phase: Architecture and Design
Strategy = Separation of Privilege
If feasible, the manufacturer should disable the JTAG interface or implement authentication and
authorization for the JTAG interface. If authentication logic is added, it should be resistant to
timing attacks. Security-sensitive data stored in registers, such as keys, etc. should be cleared
when entering debug mode.
Effectiveness = High
Demonstrative Examples
Example 1:
A home, WiFi-router device implements a login prompt which prevents an unauthorized user from
issuing any commands on the device until appropriate credentials are provided. The credentials are
protected on the device and are checked for strength against attack.
Example Language: Other (Bad)
If the JTAG interface on this device is not hidden by the manufacturer, the interface may be identified using tools such as
JTAGulator. If it is hidden but not disabled, it can be exposed by physically wiring to the board.
By issuing a "halt" command before the OS starts, the unauthorized user pauses the watchdog timer and prevents the router
from restarting (once the watchdog timer would have expired). Having paused the router, an unauthorized user is able to
execute code and inspect and modify data in the device, even extracting all of the router's firmware. This allows the user to
examine the router and potentially exploit it.
CWE Version 4.14
CWE-1191: On-Chip Debug and Test Interface With Improper Access Control
CWE-1191: On-Chip Debug and Test Interface With Improper Access Control