Physical Security Attacks and Defenses for Computing Systems - PDF document

Physical Security Attacks and Defenses for Computing Systems Steve Weingart Senior Engineer c1shw@us.ibm.com (561) 392 6100 Secure Systems and Smart Cards IBM T.J. Watson Research Center Hawthorne, NY

Physical Security Attacks & Defenses Outline • Definition • Attacks • Defenses • Standards Steve H. Weingart IBM T. J. Watson Research Center, Hawthorne, NY Page 2 (561) 392-6100 Secure Systems and Smart Cards c1shw@us.ibm.com

Physical Security Attacks & Defenses Definition: Physical Security, A barrier placed around a computing system to deter unauthorized physical access to that computing system. In the event of an attack, there should be a low probability of success; and a high probability of the attack being detected either during the attack, or subsequent to penetration. Steve H. Weingart IBM T. J. Watson Research Center, Hawthorne, NY Page 3 (561) 392-6100 Secure Systems and Smart Cards c1shw@us.ibm.com

Physical Security Attacks & Defenses Attacks • Low Tech • Theft • Mis-use • High Tech • Machining • Mechanical • Water • Laser • Chemical • Shaped Charge • Probes • Passive/Active • Mechanical • Energy • E-beam/Ion Beam • X-Ray • IR Laser • Energy • Imprinting • Temperature • Voltage • Radiation • Disruption • Tempest • EM Emanations • Power/Current Profile Steve H. Weingart IBM T. J. Watson Research Center, Hawthorne, NY Page 4 (561) 392-6100 Secure Systems and Smart Cards c1shw@us.ibm.com

Physical Security Attacks & Defenses Defenses (High & Low Tech) • Tamper Resistance • Guards • Weight, Size, Material • Complexity • Inaccessibility • Chip Coatings • Substrates • Tamper Evidence • Holographic Seals • ‘Bleeding’ Paint • Crazed Materials • Tamper Detection • Membranes • Metallic • Organic • Other • Sensors • Temperature • Radiation • Voltage • Tamper Response • Zeroization Steve H. Weingart IBM T. J. Watson Research Center, Hawthorne, NY Page 5 (561) 392-6100 Secure Systems and Smart Cards c1shw@us.ibm.com

Physical Security Attacks & Defenses The Operating Envelope The range of all conditions that are required for correct operation of all components. Note: For Tamper Responding systems that use erasure as a means of protecting secret data, correct operation includes the ability to guarantee the removal of memory contents when desired. • Voltage • Temperature • Radiation Steve H. Weingart IBM T. J. Watson Research Center, Hawthorne, NY Page 6 (561) 392-6100 Secure Systems and Smart Cards c1shw@us.ibm.com

Physical Security Attacks & Defenses Standards • Not Many! • In commercial sector • FIPS 140-1 • Seems to be the emerging commercial standard • Reasonable, but needs updating now • ANSI 9.66 • Had been different than FIPS 140-1 • Probably will not be in the future • TNO (Delft Holland) • Not really a standard, an Authority • ITSEC • Not Really Focused on Hardware • Common Criteria • Not Really Focused on Hardware Steve H. Weingart IBM T. J. Watson Research Center, Hawthorne, NY Page 7 (561) 392-6100 Secure Systems and Smart Cards c1shw@us.ibm.com

Physical Security Attacks & Defenses An Example of a Physically Secure Coprocessor Metal Shield Tamper Detecting Membrane Crypto Card Inner Cover Potting Shielded Base Card Flexible Data/Power Cable Steve H. Weingart IBM T. J. Watson Research Center, Hawthorne, NY Page 8 (561) 392-6100 Secure Systems and Smart Cards c1shw@us.ibm.com

Physical Security Attacks and Defenses for Computing Systems - PDF document

Physical Security Attacks and Defenses for Computing Systems Steve Weingart Senior Engineer c1shw@us.ibm.com (561) 392 6100 Secure Systems and Smart Cards IBM T.J. Watson Research Center Hawthorne, NY Physical Security Attacks &

FOSAD07 Low-level Software Security: Attacks and Defenses lfar Erlingsson Microsoft

Clickjacking: Attacks and Defenses University of Cyprus Department of ComputerScience Advanced

Attacks and Defenses Dr. Falko Strenzke fstrenzke@cryptosource.de cryptosource Cryptography.

Advanced Man-at-the-end Attacks and Defenses Bjorn De Sutter ISSISP 2018 Canberra 1

Hash-flooding DoS reloaded: Hash flooding begins? attacks and defenses July 1998 article

CSCI 8260 S16 Computer Network Attacks and Defenses Overview of research topics in computer

CS 134: Operating Systems Security (continued) 1 / 23 Overview CS34 Overview 2012-12-10

Summary Introduction & Cryptographic Background Hardware Support for Physical Security

Vulnerability Analysis Of Optimal Power Flow Problem Under Cyber-Physical Security Attacks

NETWORKING ATTACKS NETWORKING ATTACKS NOTICES Lab #2 extended to Feb. 17 @ 23:59 HW #3

Clickjacking Credit: paper (Clickjacking: Attacks and Defenses Huang et al.) and most slide

15-780 Graduate Artificial Intelligence: Adversarial attacks and provable defenses J. Zico

Practical Known-Plaintext Attacks against Physical Layer Security in Wireless MIMO Systems

Website Fingerprinting Attacks and Defenses in the Tor Onion Space Marc Juarez imec-COSIC KU

Buffer Overflow Attacks & Defenses Slides are borrowed from Franziska Roesner @UW and Dawn

Side-Channel Attacks and Defenses for SGX and SEV Yinqian Zhang Associate Professor Computer

An Introduction to Physical Attacks Application to Secret Specifications Algorithms

Software Security: Defenses & Principles CS 161: Computer Security Prof. Vern Paxson TAs:

1 Connection Establishment Data Exchange Clients connect to an SSH server on port Once

On Adaptive Attacks to Adversarial Example Defenses Florian Tramr USENIX ScAINet August 10 th

The Problem Distributed Denial of Service Attacks and Defenses CS 239 Advanced Topics in

Covert and Side Channel Attacks and Defenses Mengjia Yan Fall 2020 Based on slides from

Covert and Side Channel Attacks and Defenses Mengjia Yan Fall 2020 Based on slides from

Website fingerprinting on Tor: attacks and defenses Claudia Diaz KU Leuven Joint work with: Marc

Physical Security Attacks and Defenses for Computing Systems - PDF document

Physical Security Attacks and Defenses for Computing Systems Steve Weingart Senior Engineer c1shw@us.ibm.com (561) 392 6100 Secure Systems and Smart Cards IBM T.J. Watson Research Center Hawthorne, NY Physical Security Attacks &

FOSAD07 Low-level Software Security: Attacks and Defenses lfar Erlingsson Microsoft

Clickjacking: Attacks and Defenses University of Cyprus Department of ComputerScience Advanced

Attacks and Defenses Dr. Falko Strenzke fstrenzke@cryptosource.de cryptosource Cryptography.

Advanced Man-at-the-end Attacks and Defenses Bjorn De Sutter ISSISP 2018 Canberra 1

Hash-flooding DoS reloaded: Hash flooding begins? attacks and defenses July 1998 article

CSCI 8260 S16 Computer Network Attacks and Defenses Overview of research topics in computer

CS 134: Operating Systems Security (continued) 1 / 23 Overview CS34 Overview 2012-12-10

Summary Introduction &amp; Cryptographic Background Hardware Support for Physical Security

Vulnerability Analysis Of Optimal Power Flow Problem Under Cyber-Physical Security Attacks

NETWORKING ATTACKS NETWORKING ATTACKS NOTICES Lab #2 extended to Feb. 17 @ 23:59 HW #3

Clickjacking Credit: paper (Clickjacking: Attacks and Defenses Huang et al.) and most slide

15-780 Graduate Artificial Intelligence: Adversarial attacks and provable defenses J. Zico

Practical Known-Plaintext Attacks against Physical Layer Security in Wireless MIMO Systems

Website Fingerprinting Attacks and Defenses in the Tor Onion Space Marc Juarez imec-COSIC KU

Buffer Overflow Attacks &amp; Defenses Slides are borrowed from Franziska Roesner @UW and Dawn

Side-Channel Attacks and Defenses for SGX and SEV Yinqian Zhang Associate Professor Computer

An Introduction to Physical Attacks Application to Secret Specifications Algorithms

Software Security: Defenses &amp; Principles CS 161: Computer Security Prof. Vern Paxson TAs:

1 Connection Establishment Data Exchange Clients connect to an SSH server on port Once

On Adaptive Attacks to Adversarial Example Defenses Florian Tramr USENIX ScAINet August 10 th

The Problem Distributed Denial of Service Attacks and Defenses CS 239 Advanced Topics in

Covert and Side Channel Attacks and Defenses Mengjia Yan Fall 2020 Based on slides from

Covert and Side Channel Attacks and Defenses Mengjia Yan Fall 2020 Based on slides from

Website fingerprinting on Tor: attacks and defenses Claudia Diaz KU Leuven Joint work with: Marc

Summary Introduction & Cryptographic Background Hardware Support for Physical Security

Buffer Overflow Attacks & Defenses Slides are borrowed from Franziska Roesner @UW and Dawn

Software Security: Defenses & Principles CS 161: Computer Security Prof. Vern Paxson TAs: