Hardware Hacking with FPGAs

Remote hardware is available for this course if you cannot obtain the optional hardware. Please contact our chat at least 72 hours before the beginning of the course to reserve your remote hardware.

This course is ideally suited for both hardware engineers who wish to better understand potential security issues that may exist in hardware implementations and software security engineers who may lack experience in analyzing hardware and embedded systems. The training teaches participants a unique hybrid hardware/software workflow that is extremely effective for identifying security issues in hardware, embedded devices, automotive and IoT (Internet of Things). Students will be familiarized with the concepts of hardware analysis and have a first-hand chance to build and instrument the analysis of hardware targets using FPGAs.

Students will implement complex algorithms in a modern high-level scripting language (python) while implementing all low-level timing critical components in hardware (Verilog HDL). This training will also cover how these techniques can be utilized for applications ranging from black box reverse-engineering of undocumented protocols to validating an overall hardware design. This training also offers a unique opportunity for students to work with real-world test and measurement equipment. Additionally, the training covers the minimal amount of electrical engineering required for instrumenting targets in practice.

As such there are no specific prerequisites for this course beyond a basic programming background. Students will be provided sufficient background and templates for the python scripting language to successfully complete the assignments. All the aspects of hardware design (FPGA development, RTL design, Verilog HDL as well as simulation and functional verification) will be covered in the course. Each day will feature one CTF (capture the flag) style assignment that will take approximately the entire day for students to solve. Each assignment will cover one common flaw that can be found in real-world hardware implementations.

Students should bring a notebook capable of running VMware Fusion, VMware Workstation or the free VMware Player.

Topics

• Common hardware vulnerabilities
• embedded device security
• IoT security
• test and measurement equipment (oscilloscopes, logic analyzers)
• JTAG, FPGA implementations
• HDL development
• core generation
• debugging
• soft cores
• glitching
• fuzzing
• Man-in-The-Middle (MITM) of protocols
• protocol injection
• hardware acceleration
• cloud FPGA platforms

Theory and Introduction

1. Theory/Basics

   • Recommended literature
   • Machine-To-Machine Communication
   • Logic 101

2. Combinatorics

   • Sequential & combinatorial logic
   • Finite State machines (FSM)
   • Logical functions & arithmetic computation
   • Logic optimization

3. Verilog 101

   • UART FSM
   • HDL equivalent for FSM
   • Testing and verification of RX/TX

4. Hardware Logic Implementation

   • Electronics 101
   • ASICs, TTL-Logic
   • FPGAs, CPLDs
   • Hard vs. Soft Macros
   • I/O, Tristates

5. FPGA/ASIC Development Workflow

   • Behavioral simulation
   • Synthesis
   • Place and Route
   • Timing simulation

6. Gotchas

   • Design constraints
   • Optimization
   • Best practices
   • Safety and electronics

After the introduction to FPGAs, the design workflow and the tooling, students will get the opportunity to solve practical CTF style assignmnets. Each assignment takes approximately 4-6 hours to complete.

Assignment 1: FPGA Bring-Up

At the end of Day 1 students will have an opportunity to program create a design that utilizes the state machines written throughout the day. Subsequently students will load their bitstreams onto an FGPA and verify that they work. This assignment ensures that students have fully the process of simulation, synthesis and have fully understood the workflow with the FPGA tools.

Assignment 2: Basic Glitching

The goal of this assignment is to teach students that the security of the target platform can be compromised by manipulating the operating state of the target. The target is realized as a system requiring that a valid pin be entered on a pin pad for access. Students will have to identify ways in which the operating state of the device can be determined and change it accordingly.

Identify and analyze the communications protocol. Design a hardware implementation capable of brute forcing the system PIN. Identify valid triggers for the operating state of the system. Modify the hardware implementation to be able to cope with a penalty for 3 consecutive invalid PIN entries. Cope with a penalty flag hardware flag being set in Non Volatile Memory (NVM)

Assignment 3: Timing Analysis

The goal of this assignment is to familiarize students with the advantages of utilizing programmable logic platforms for their predictable timing behavior. Students must implement a hardware implementation capable of sending the target platform a password and measuring the response time.

Identify and analyze the communications protocol. Design a hardware implementation capable of sending a password and measuring the response time. Perform adaptive timing analysis against the target platform. Perform adaptive timing analysis against an optimized implementation.

Assignment 4: Bootloader Security Bypass

As seen on the blog (Part 1, Part 2, Part 3).

This assignment is designed to familiarize students with the workflow necessary for analyzing hardware targets in practice. Students will need to extract the bootloader from the device, analyze its contents, identify vulnerable instructions and glitch these instructions bypassing the protection mechanisms of the platform.

Extract the bootloader from a standard ARM microcontroller. Analyze the bootloader and identify vulnerabilities. Implement a programmable logic design capable of glitching a protected target. Glitch a protected target and extract the firmware.

Class Requirements

Participants should have some familiarity with scripting languages, i.e. Python. This course is suitable for people that are new to hardware security and electronics. All the theory and concepts related to electronics, HDL and debugging will be explained during course.

Optional Hardware Requirements

These hardware requirements are entirely optional. You can either purchase the hardware and run it locally or request remote hardware access and the hardware will be provided to you remotely. You can request a remote development environment as well if you are unable to run virtual machines.

• You will need a Digilent Arty Z7 FPGA development board.

  • Stock of board is limited due to the ongoing chip shortage, use Octopart to search multiple resellers. The board is sometimes also available on Amazon, Ebay and Aliexpress.

• A working laptop capable of running virtual machines.

  • 4GB RAM required, at a minimum.
  • Approximately 60 GB free space for the Virtual Machine