Towards Practical Fabrication Stage Attacks Using Interrupt-Resilient Hardware Trojans

We introduce a new type of hardware trojans called interrupt-resilient trojans (IRTs). Our work is motivated by the observation that hardware trojan attacks on CPUs, even under favorable attack scenarios (e.g., an attacker with local system access), are affected by unpredictability due to non-deterministic context switching events. These events can lead to race conditions between trigger signals and the CPU events targeted by the trojan payloads (i.e., a memory access), thus affecting the reliability of the attacks. This work shows that interrupt-resilient trojans can guarantee the reliable implementation of sophisticated trojan attacks through punctual delivery of the triggering signal under diverse context-switching conditions. We successfully utilize IRTs in different attack scenarios against a Linux-capable CPU design and showcase their resilience against context-switching events. More importantly, we show that IRT designs allow for seamless integration during fabrication stage attacks. We evaluate interrupt-resilient designs on a high-speed, tape-out ready RISC-V layout in a 28nm commercial technology process, adding an average overhead delay of only 20 picoseconds, while leaving the sign-off characteristics of the layout intact. In doing so, we challenge the common wisdom regarding the low flexibility of late supply chain stages (e.g., fabrication) for the insertion of powerful trojans. To promote further research on microprocessor trojans, we open-source IRTs and their supporting software logic.