Unlocking Hardware Security: Red Team, Blue Team, and Trojan Tales (37c3)

Ensuring the integrity of Integrated Circuits (ICs) against malicious hardware Trojans is paramount for secure electronic devices. One approach involves imaging the manufactured chips to compare them with their original design files. While such techniques for detecting Trojans are relatively well-known in the industry, there is a notable absence of comprehensive, publicly available case studies. To bridge this gap, we unveil a Red Team vs. Blue Team case study on hardware Trojan detection across four digital ICs in various modern feature sizes. We share our findings, algorithms, and image datasets, shedding light on the efficiency of these techniques, and offer insights into the impact of technology scaling on detection performance. We love to put microcontrollers, systems-on-a-chip and many other Integrated Circuits (ICs) into all sorts of devices. As hardware backdoors can undermine software security, the integrity of these chips is becoming increasingly important. However, most of these microchips are manufactured in a complex global supply chain where not all parties can necessarily be trusted. Who guarantees that the chip we order is the chip we get delivered? While the European Union wants to ensure digital sovereignty through massive long-term investment in domestic IC production, we need a way to verify the integrity of microchips *today*. In this talk, we will first briefly cover the basics of the IC design and production process. We will outline common attacks that enable the insertion of subtle malicious manipulations or backdoors, often called hardware Trojans. You don't need to have a hardware background to follow along! We then introduce some techniques we can use to detect hardware manipulations by comparing the circuit within a microchip to its original design files by reverse engineering the chip using open-source image processing. While imaging an IC requires advanced laboratory equipment, commodity hardware is sufficient to analyze the captured images. In the main part of our talk, we will present a case study on Trojan detection based on four different digital ICs using a Red Team vs. Blue Team approach, and give a live demonstration. We will share what manipulations of our Red Team we are already able to find reliably, and where some work is still needed -- and we're calling on you to play with our algorithms and have a go at uncovering the Trojans that are still well-hidden. Of course, we have made our source code and entire image datasets available under a free and open license. We'll conclude with an insight into the working process of our Blue Team -- what we learned, and how we failed -- and give an outlook on how we can lower the entry barrier into IC reverse engineering, unlocking the hardware security field for all. about this event: https://events.ccc.de/congress/2023/hub/event/unlocking_hardware_security_red_team_blue_team_and_trojan_tales/