Physical Security Attacks and Defenses for Computing Systems - PDF document

Physical Security Attacks and Defenses for Computing Systems Steve Weingart Senior Engineer c1shw@us.ibm.com (561) 392 6100 Secure Systems and Smart Cards IBM T.J. Watson Research Center Hawthorne, NY

Physical Security Attacks & Defenses Outline • Definition • Attacks • Defenses • Standards Steve H. Weingart IBM T. J. Watson Research Center, Hawthorne, NY Page 2 (561) 392-6100 Secure Systems and Smart Cards c1shw@us.ibm.com

Physical Security Attacks & Defenses Definition: Physical Security, A barrier placed around a computing system to deter unauthorized physical access to that computing system. In the event of an attack, there should be a low probability of success; and a high probability of the attack being detected either during the attack, or subsequent to penetration. Steve H. Weingart IBM T. J. Watson Research Center, Hawthorne, NY Page 3 (561) 392-6100 Secure Systems and Smart Cards c1shw@us.ibm.com

Physical Security Attacks & Defenses Attacks • Low Tech • Theft • Mis-use • High Tech • Machining • Mechanical • Water • Laser • Chemical • Shaped Charge • Probes • Passive/Active • Mechanical • Energy • E-beam/Ion Beam • X-Ray • IR Laser • Energy • Imprinting • Temperature • Voltage • Radiation • Disruption • Tempest • EM Emanations • Power/Current Profile Steve H. Weingart IBM T. J. Watson Research Center, Hawthorne, NY Page 4 (561) 392-6100 Secure Systems and Smart Cards c1shw@us.ibm.com

Physical Security Attacks & Defenses Defenses (High & Low Tech) • Tamper Resistance • Guards • Weight, Size, Material • Complexity • Inaccessibility • Chip Coatings • Substrates • Tamper Evidence • Holographic Seals • ‘Bleeding’ Paint • Crazed Materials • Tamper Detection • Membranes • Metallic • Organic • Other • Sensors • Temperature • Radiation • Voltage • Tamper Response • Zeroization Steve H. Weingart IBM T. J. Watson Research Center, Hawthorne, NY Page 5 (561) 392-6100 Secure Systems and Smart Cards c1shw@us.ibm.com

Physical Security Attacks & Defenses The Operating Envelope The range of all conditions that are required for correct operation of all components. Note: For Tamper Responding systems that use erasure as a means of protecting secret data, correct operation includes the ability to guarantee the removal of memory contents when desired. • Voltage • Temperature • Radiation Steve H. Weingart IBM T. J. Watson Research Center, Hawthorne, NY Page 6 (561) 392-6100 Secure Systems and Smart Cards c1shw@us.ibm.com

Physical Security Attacks & Defenses Standards • Not Many! • In commercial sector • FIPS 140-1 • Seems to be the emerging commercial standard • Reasonable, but needs updating now • ANSI 9.66 • Had been different than FIPS 140-1 • Probably will not be in the future • TNO (Delft Holland) • Not really a standard, an Authority • ITSEC • Not Really Focused on Hardware • Common Criteria • Not Really Focused on Hardware Steve H. Weingart IBM T. J. Watson Research Center, Hawthorne, NY Page 7 (561) 392-6100 Secure Systems and Smart Cards c1shw@us.ibm.com

Physical Security Attacks & Defenses An Example of a Physically Secure Coprocessor Metal Shield Tamper Detecting Membrane Crypto Card Inner Cover Potting Shielded Base Card Flexible Data/Power Cable Steve H. Weingart IBM T. J. Watson Research Center, Hawthorne, NY Page 8 (561) 392-6100 Secure Systems and Smart Cards c1shw@us.ibm.com

Physical Security Attacks and Defenses for Computing Systems - PDF document

Physical Security Attacks and Defenses for Computing Systems Steve Weingart Senior Engineer c1shw@us.ibm.com (561) 392 6100 Secure Systems and Smart Cards IBM T.J. Watson Research Center Hawthorne, NY Physical Security Attacks &

FOSAD07 Low-level Software Security: Attacks and Defenses lfar Erlingsson Microsoft

Clickjacking: Attacks and Defenses University of Cyprus Department of ComputerScience Advanced

Attacks and Defenses Dr. Falko Strenzke fstrenzke@cryptosource.de cryptosource Cryptography.

Advanced Man-at-the-end Attacks and Defenses Bjorn De Sutter ISSISP 2018 Canberra 1

Hash-flooding DoS reloaded: Hash flooding begins? attacks and defenses July 1998 article

CSCI 8260 S16 Computer Network Attacks and Defenses Overview of research topics in computer

CS 134: Operating Systems Security (continued) 1 / 23 Overview CS34 Overview 2012-12-10

Summary Introduction & Cryptographic Background Hardware Support for Physical Security

Vulnerability Analysis Of Optimal Power Flow Problem Under Cyber-Physical Security Attacks

NETWORKING ATTACKS NETWORKING ATTACKS NOTICES Lab #2 extended to Feb. 17 @ 23:59 HW #3

Clickjacking Credit: paper (Clickjacking: Attacks and Defenses Huang et al.) and most slide

15-780 Graduate Artificial Intelligence: Adversarial attacks and provable defenses J. Zico

Practical Known-Plaintext Attacks against Physical Layer Security in Wireless MIMO Systems

Website Fingerprinting Attacks and Defenses in the Tor Onion Space Marc Juarez imec-COSIC KU

Buffer Overflow Attacks & Defenses Slides are borrowed from Franziska Roesner @UW and Dawn

Side-Channel Attacks and Defenses for SGX and SEV Yinqian Zhang Associate Professor Computer

Towards Robust LiDAR-based Perception in Autonomous Driving: General Black-box Adversarial Sensor

Identifying an accurate metric for football efficiency Tim Chou Football Coach Introduction:

READ AND REACT OFFENSE WHAT ITS NOT Not motion offense Motion offense is good if you

CSCI 1650: Software Security and Exploitation Introduction Vasileios (Vasilis) Kemerlis

Sicherheitslcken in der knstlichen Intelligenz Konrad Rieck, TU Braunschweig Keynote

QP and Dissertation Dont Freak Out, Just Be Prepared What is the QP? It is your Research

HESTIA: High-level and Extensible System for Training and Infrastructure risk Assessment Ananth

A Map for Security Science Fred B. Schneider* Department of Computer Science Cornell University

Physical Security Attacks and Defenses for Computing Systems - PDF document

Physical Security Attacks and Defenses for Computing Systems Steve Weingart Senior Engineer c1shw@us.ibm.com (561) 392 6100 Secure Systems and Smart Cards IBM T.J. Watson Research Center Hawthorne, NY Physical Security Attacks &

FOSAD07 Low-level Software Security: Attacks and Defenses lfar Erlingsson Microsoft

Clickjacking: Attacks and Defenses University of Cyprus Department of ComputerScience Advanced

Attacks and Defenses Dr. Falko Strenzke fstrenzke@cryptosource.de cryptosource Cryptography.

Advanced Man-at-the-end Attacks and Defenses Bjorn De Sutter ISSISP 2018 Canberra 1

Hash-flooding DoS reloaded: Hash flooding begins? attacks and defenses July 1998 article

CSCI 8260 S16 Computer Network Attacks and Defenses Overview of research topics in computer

CS 134: Operating Systems Security (continued) 1 / 23 Overview CS34 Overview 2012-12-10

Summary Introduction &amp; Cryptographic Background Hardware Support for Physical Security

Vulnerability Analysis Of Optimal Power Flow Problem Under Cyber-Physical Security Attacks

NETWORKING ATTACKS NETWORKING ATTACKS NOTICES Lab #2 extended to Feb. 17 @ 23:59 HW #3

Clickjacking Credit: paper (Clickjacking: Attacks and Defenses Huang et al.) and most slide

15-780 Graduate Artificial Intelligence: Adversarial attacks and provable defenses J. Zico

Practical Known-Plaintext Attacks against Physical Layer Security in Wireless MIMO Systems

Website Fingerprinting Attacks and Defenses in the Tor Onion Space Marc Juarez imec-COSIC KU

Buffer Overflow Attacks &amp; Defenses Slides are borrowed from Franziska Roesner @UW and Dawn

Side-Channel Attacks and Defenses for SGX and SEV Yinqian Zhang Associate Professor Computer

Towards Robust LiDAR-based Perception in Autonomous Driving: General Black-box Adversarial Sensor

Identifying an accurate metric for football efficiency Tim Chou Football Coach Introduction:

READ AND REACT OFFENSE WHAT ITS NOT Not motion offense Motion offense is good if you

CSCI 1650: Software Security and Exploitation Introduction Vasileios (Vasilis) Kemerlis

Sicherheitslcken in der knstlichen Intelligenz Konrad Rieck, TU Braunschweig Keynote

QP and Dissertation Dont Freak Out, Just Be Prepared What is the QP? It is your Research

HESTIA: High-level and Extensible System for Training and Infrastructure risk Assessment Ananth

A Map for Security Science Fred B. Schneider* Department of Computer Science Cornell University

Summary Introduction & Cryptographic Background Hardware Support for Physical Security

Buffer Overflow Attacks & Defenses Slides are borrowed from Franziska Roesner @UW and Dawn