New to CAPEC? Start Here
Home > CAPEC List > CAPEC-681: Exploitation of Improperly Controlled Hardware Security Identifiers (Version 3.6)  

CAPEC-681: Exploitation of Improperly Controlled Hardware Security Identifiers

Attack Pattern ID: 681
Abstraction: Detailed
Status: Draft
Presentation Filter:
+ Description

An adversary takes advantage of missing or incorrectly configured security identifiers (e.g., tokens), which are used for access control within a System-on-Chip (SoC), to read/write data or execute a given action.

+ Extended Description

A System-on-Chip (SoC) often implements a security identifier mechanism to differentiate what actions are allowed or disallowed when a transaction originates from an entity. However, these mechanisms may be exploitable due to any number of the following:

  • The security identifiers are missing
  • The security identifiers are incorrectly implemented or generated
  • The security identifiers are generated with an obsolete encoding
  • The security identifiers are generated and implemented correctly, but are improperly protected

If the security identifiers leveraged by the SoC are missing or misconfigured, an adversary may be able to take advantage of this shortcoming to circumvent the intended access controls. This could result in the adversary gaining unintended access, performing a Denial of Service (DoS), escalating privileges, or spoofing actions from a trusted agent.

+ Likelihood Of Attack

Medium

+ Typical Severity

Very High

+ Relationships
Section HelpThis table shows the other attack patterns and high level categories that are related to this attack pattern. These relationships are defined as ChildOf and ParentOf, and give insight to similar items that may exist at higher and lower levels of abstraction. In addition, relationships such as CanFollow, PeerOf, and CanAlsoBe are defined to show similar attack patterns that the user may want to explore.
NatureTypeIDName
ChildOfStandard Attack PatternStandard Attack Pattern - A standard level attack pattern in CAPEC is focused on a specific methodology or technique used in an attack. It is often seen as a singular piece of a fully executed attack. A standard attack pattern is meant to provide sufficient details to understand the specific technique and how it attempts to accomplish a desired goal. A standard level attack pattern is a specific type of a more abstract meta level attack pattern.1Accessing Functionality Not Properly Constrained by ACLs
ChildOfStandard Attack PatternStandard Attack Pattern - A standard level attack pattern in CAPEC is focused on a specific methodology or technique used in an attack. It is often seen as a singular piece of a fully executed attack. A standard attack pattern is meant to provide sufficient details to understand the specific technique and how it attempts to accomplish a desired goal. A standard level attack pattern is a specific type of a more abstract meta level attack pattern.180Exploiting Incorrectly Configured Access Control Security Levels
Section HelpThis table shows the views that this attack pattern belongs to and top level categories within that view.
+ Prerequisites
Awareness of the hardware being leveraged.
Access to the hardware being leveraged.
+ Skills Required
[Level: Medium]
Ability to execute actions within the SoC.
[Level: High]
Intricate knowledge of the identifiers being utilized.
+ Consequences
Section HelpThis table specifies different individual consequences associated with the attack pattern. The Scope identifies the security property that is violated, while the Impact describes the negative technical impact that arises if an adversary succeeds in their attack. The Likelihood provides information about how likely the specific consequence is expected to be seen relative to the other consequences in the list. For example, there may be high likelihood that a pattern will be used to achieve a certain impact, but a low likelihood that it will be exploited to achieve a different impact.
ScopeImpactLikelihood
Integrity
Modify Data
Confidentiality
Read Data
Confidentiality
Access Control
Authorization
Gain Privileges
+ Mitigations
Review generation of security identifiers for design inconsistencies and common weaknesses.
Review security identifier decoders for design inconsistencies and common weaknesses.
Test security identifier definition, access, and programming flow in both pre-silicon and post-silicon environments.
+ Example Instances

A system contains a register (divided into four 32-bit registers) that is used to store a 128-bit AES key for encryption/decryption, in addition to an access-policy register. The access-policy register determines which agents may access the AES-key registers, based on a corresponding security identifier. It is assumed the system has two agents: a Main-controller and an Aux-controller, with respective security identifiers "1" and "2". The Main-controller (ID "1") is meant to have access to the AES-key registers, while the Aux-controller (ID "2") has access to the access-policy register. If a SoC incorrectly generates security identifier "1" for both agents, then both agents will have access to the AES-key registers. This could further result in a Denial-of-Service (DoS) or the execution of an action that in turn could result in privilege escalation or unintended access.

+ References
[REF-694] "PCIe Device Measurement Requirements". Intel Corporation. 2018-09. <https://www.intel.com/content/dam/www/public/us/en/documents/reference-guides/pcie-device-security-enhancements.pdf>. URL validated: 2021-10-21.
[REF-695] John Butterworth, Cory Kallenberg and Xeno Kovah. "BIOS Chronomancy: Fixing the Core Root of Trust for Measurement". 2013-07-31. <https://media.blackhat.com/us-13/US-13-Butterworth-BIOS-Security-Slides.pdf>. URL validated: 2021-10-21.
+ Content History
Submissions
Submission DateSubmitterOrganization
2021-10-21CAPEC Content TeamThe MITRE Corporation
More information is available — Please select a different filter.
Page Last Updated or Reviewed: October 21, 2021