Cpu trojans activated by high-level code executed in browsers
Exploiting Software-level Abstractions To Support Practical Hardware Trojan Attacks
Cryptography and Security
Summary
Most hardware trojan attacks assume the attacker can run any code on a device, which is hard to do in real-world users’ phones or laptops. The authors show a new kind of CPU trojan (called SURF) that can activate just by running certain high-level language instructions, like JavaScript code in a browser. They tested this on a RISC-V CPU and used JavaScript memory operations to trigger the trojan without needing full control over the device’s software. This means malicious hardware trojans could remain hidden and active across many browser versions, posing risks to everyday devices.
What this means in practice
- •For hardware security engineers: Detect and mitigate trojans triggered by high-level code patterns in CPUs used in client devices.
- •For web browser developers: Evaluate browser JavaScript engines for subtle microarchitectural side effects that could activate hidden hardware trojans.
Authors
Athanasios Moschos, Kevin Valakuzhy, Georgios Kokolakis, Fabian Monrose, Angelos D. Keromytis
Abstract
Hardware trojan (HT) attacks against CPUs typically assume threat scenarios where an attacker targeting a system with a trojanized CPU is able to execute arbitrary code (i.e. machine-level instructions) to reliably interact with the implanted trojan. On end-user devices (i.e., mobiles, laptops), achieving arbitrary code execution in practice requires software exploits tailored to each specific target. Such strong adversarial premises reduce the generality of existing threat models casting doubt on CPU trojan attacks as a pragmatic threat vector. To push the envelope on HT attacks against client devices, we introduce the SURF class of CPU-trojans that can be activated without arbitrary code execution. Our key insight is that integer operations expressed in a high-level language can be mapped to microarchitectural side-effects distinguishable by a SURF trigger circuit. This observation unlocks HT activation via runtime engines, constrained environments executing untrusted high-level code. We demonstrate a SURF trojan inside a RISC-V processor and exploit JavaScript-level memory indexing operations inside Google's V8 engine to perform a code injection attack. Importantly, we show that SURF trojans remain effective across multiple JavaScript engine versions, enabling long-term compromise of endpoint devices. To facilitate research, we opensource SURF's design and supporting software.