Cybersecurity Policy Report, Hardware Underestimated as Cyber Attack Vector, NIST Says, (Nov 13, 2024)
Semiconductors and other computer hardware are more vulnerable to cyber attacks than is generally understood, the National Institute of Standards and Technology said in a report published today.
“Historically held notions that hardware is invulnerable have been shown to be incorrect,” according to the report titled “Hardware Security Failure Scenarios.”
The report describes 98 ways that hackers could gain access to protected systems through hardware flaws, including by manipulating the temperature of hardware “to vary hardware behavior to compromise deployed security” or by “introducing voltage and clock glitches.”
“Almost all of these scenarios represent significant security concerns,” it says. But while official lists of cyber attack vectors include nearly 250,000 “common vulnerabilities and exposures” (CVEs), only 131 CVEs related to hardware (HW) have been identified, the report notes.
“This can be partially explained by HW developers finding and removing HW vulnerabilities during the design process, meaning that they are never exploited and added to the CVE,” it says.
“The number of HW CVEs may also be artificially low because HW developers are reticent to acknowledge vulnerabilities in shipped products due to the inability to resolve or mitigate them,” it speculates.
“It is also possible that the restricted programming languages used for HW design limit the options for introducing vulnerabilities compared to more general software programming languages. Another factor could be that HW security has only recently received significantly heightened attention from the security community,” the report adds.
“Hardware is a new focal point in the unending conflict between computer security hackers and defenders,” the report concludes. “Vulnerabilities can have serious consequences because of the largely deployed base of chips and the inability to fix vulnerabilities on those chips. There are many ways in which HW can fail from a security perspective, and there is ample justification for securing the HW infrastructure. HW is the foundation of computing and must be trustworthy.”
News: FederalLegislation DataSecurity