Report: Hackers could access US weapons systems through vulnerable chip

A pair of cybersecurity researchers say an encrypted chip used by the military and nuclear power plants has a secret 'backdoor' that can be hacked. It could be a wakeup call for the industry. 

A secret nanoscale "backdoor" etched into the silicon of a supposedly secure programmable chip could give cyberattackers access to classified US weapons systems, including guidance, flight control, networking, and communications systems, according to a new report by cybersecurity researchers in Britain.

The Cambridge University study is apparently the first public documentation that such a serious vulnerability has been deliberately built into a class of microchips used across the military and in key industrial applications such as power grids, the researchers say.

The discovery underscores the Pentagon's growing concerns over the vulnerability of the "supply chain" for computer chips it relies on. The new research illustrates how spying or even destructive functions, such as a "kill switch" that could make a plane fall out of the sky like a brick, could be added unnoticed to microchips while they are being designed and manufactured either at home or overseas, hardware-security experts say.

The chip in question – one of the ProASIC3 (PA3) line – is designed by a California company but manufactured in China. It is not know how or why the backdoor was installed on the chip, but experts say it is highly unlikely that it was inserted nefariously during the manufacturing process in China. More likely, it might be merely an overlooked feature left over from a period of early development, some say.

Yet how the backdoor got there is, in many ways, less important than the fact that it is there at all, the experts add. It suggests that even the PA3 chip, purchased by a variety of critical industries and touted as having "one of the highest levels of design security in the industry," could have exploitable vulnerabilities that users don't even know about. 

"The major concern here is: If there are backdoors built into other chips, how easy will it be to find them?" says Sergei Skorobogatov, the researcher who led the Cambridge University study, in an interview. "It doesn't really matter much if it's a backdoor or a special test function embedded by the original chip designer. All a hacker wants is access to the chip.... If the attacker can find it and use it, he gets what he wants."

What the chip does

The PA3 A3P250 chip is a field programmable gate array, meaning it is basically a blank slate ready to be programmed to perform myriad functions. Experts agree that the chips are used widely by the US military in various settings, some likely to be critical, others likely to be much less so. 

Strong encryption protects the chip from further changes. But the Cambridge report, titled "Breakthrough silicon scanning discovers backdoor in military chip," claims to have found an internal passcode and other vital keys needed to make big changes can be filched through the hidden backdoor.

Once inside the chip's backdoor, the potential for mischief is significant. The chip can be reprogrammed to do anything the attacker wants it to do, including erase itself or divulge information like classified algorithms for targeting, flight control, and other systems, the researchers say. Moreover, successful attackers would have access to proprietary secrets behind the chip's design.   

"This means the device is wide open to intellectual property theft, fraud, re-programming as well as reverse engineering of the design which allows the introduction of a new backdoor or Trojan," writes Mr. Skorobogatov and fellow Cambridge researcher Christopher Woods in their paper.

Concern about kill switches

These are some of the concerns that have led the Pentagon and intelligence agencies to accelerate the development of tools that can scrutinize chips for signs of intentionally built-in microscopic vulnerabilities. A kill-switch, for example, could allow an adversary to send a command that could cause a critical failure on a computer controlled weapon system like a jet fighter, these experts say.

"There's a lot of concern within the US military and intelligence agencies that people, other governments, could be putting into these chips not just backdoors, but kill switches that are extremely difficult to detect," says David Adler, president of DLA Instruments Corp. of San Jose, Calif., which is assisting the Pentagon in its efforts to detect microscopic tampering.

The concern spreads beyond the military. The chips are also used widely in nuclear power plants, power distribution, aerospace, aviation, public transport, and automotive products, and the discovery could pave the way for cyberattacks on vital infrastructure.

"This permits a new and disturbing possibility of a large scale Stuxnet-type attack via a network or the Internet on the silicon itself," the Cambridge researchers write, referring to a now notorious cybersabotage attack on centrifuge systems inside Iran's nuclear fuel-enrichment facility – an attack recently identified as the handiwork of the US and Israel.

"To our knowledge, this is the first documented case of finding a deliberately inserted backdoor in a real world chip," the researchers state.

Chipmaker's response

The chip's maker, Actel, now a subsidiary of Irvine, Calif.-based Microsemi Corp., disputes the researchers' claim, saying there is no backdoor at all, while also noting that future designs will be even more secure.

"Microsemi can confirm that there is no designed feature that would enable the circumvention of the user security," the company said in a statement. "The researchers assertion is that with the discovery of a security key, a hacker can gain access to a privileged internal test facility reserved for initial factory testing and failure analysis. Microsemi verified that the internal test facility is disabled in all shipped devices."

The report arrives on the heels of another recent backdoor revelation. In April, a cybersecurity researcher in San Francisco went public with evidence that a technology firm with ties to the military, Canada-based RuggedCom, also had a backdoor built into the firmware of an industrial control system router that it touted as secure. 

In that case, RuggedCom was able to issue a patch to eliminate the vulnerability. But backdoors left in chips cannot be patched. 

Moreover, backdoors are extraordinarily difficult to find. Finding a backdoor is roughly equivalent to comparing every street address from a satellite image of North America to a map of North America just to be sure they match and that no fake addresses have been added, DLA's Mr. Adler says.

That suggests many more backdoors may be out there waiting to be found by friend or foe.

"It's hard to say about this discovery, but it could be a canary-in-the-coal-mine-type incident that indicates a big problem," says Olin Sibert, an expert in hardware systems security and founder of Boston-based Oxford Systems Inc. "It would not be surprising if similar vulnerabilities were found elsewhere in widely used components."

This shows how important it is that security awareness be pervasive throughout a manufacturing organization, he says.

A China role?

In this case, he agrees, there doesn't yet appear to be any sign of malicious intent from China or anyone else.

"There's lots of chips manufactured in China," Mr. Sibert says. "It's theoretically possible, but it would be very difficult for them to install this sophisticated backdoor."

One factor that mitigates against the vulnerability being used to install a kill switch is that physical access would be needed to most of the chips that have been deployed, Skorobogatov says. Even so, at least some of the chips have been "wired to the network" to enable reprogramming – and therefore they and their backdoors are reachable over the Internet, he says.

Even if the chips are just inside telephones, the idea of being able to modify them "is a critical concern," Adler says. "If you are using encryption in a call and someone can disable that and eavesdrop on the call – that's a big concern."

Regardless of the origin of the backdoor, more are likely to be found as researchers become more adept at searching and new tools become available.

"What the researchers have found is ... the strongest suggestion to date that those who claimed complete security for their systems are at best mistaken," says Andrew Righter, a researcher at the University of Pennsylvania. "What the researcher has done is said – in the middle of the parade – 'The emperor has no clothes' to the manufacturing industry that says all our toys are secure."

"We are going to see a lot more chips fall to these attacks and a lot of companies backpedaling, trying to explain why these backdoors exist," Mr. Righter says.