Covert Channel Chronicles: Remotely Activated Hardware Trojans

The Covert Channel Chronicles is a periodical focused on covert or side-channels that can be used to bypass security measures. Free reader link here.

“Every module is characterized by its knowledge of a design decision which it hides from all others. Its interface or definition was chosen to reveal as little as possible about its inner workings.” — David Parnas, a Canadian early pioneer of software engineering, who developed the concept of information hiding in modular programming

When we discuss cybersecurity controls that are implemented to protect computer systems, most often they refer to either administrative, technical, or physical security controls. The technical security controls deal with logical aspects of computer systems, such as software applications or operating system configuration settings that can be hardened against various known attacks or at least help reduce potential attack surfaces. For instance, we might implement Discretionary Access Control (DAC) on a file system to prevent unauthorized access to folders and files that are not granted access to those folders and files.

It is usually the technical security controls that get talked about most, with the physical security controls relegated to the “not my department” category within the context of cybersecurity engineering. That line of thinking is flawed, however, as physical security controls can eclipse software-based security controls involving the physical computer hardware devices that run the software applications and store the data we use daily. That’s why limiting physical access to computer hardware is so important.

What is the point of securing software but not hardware? One-dimensional security by obscurity.

Securing the OS and software Apps on a system, but not hardening the device itself, is a form of one-dimensional security by obscurity that’s ineffective and also defeats the purpose. It’s a half-assed lazy effort, in other words. Cybersecurity is not one or two-dimensional (2D); it is multi-dimensional. There are aspects of software, hardware, and firmware that can be exploited, some in combination or possibly at the same time. It’s not necessarily the software or the fact that something is connected to the internet that makes it vulnerable to attack. It can also be the hardware itself.

Interestingly, with both software and hardware, side-channel attacks are possible. A successful side-channel attack can lead to the establishment of covert channels that attackers can use to further compromise and/or exfiltrate data from a target system. Looking back through decades of computer history, there are many examples of times in which computer hardware was rife with security vulnerabilities straight from the Original Equipment Manufacturer (OEM).

The National Institute of Standards and Technology (NIST) glossary defines a covert channel as, “An unintended or unauthorized intra-system channel that enables two cooperating entities to transfer information in a way that violates the system’s security policy but does not exceed the entities’ access authorizations” (NIST, n.d.).

Vulnerabilities that make this IT equipment susceptible to proximity-based covert channel vulnerabilities that can be exploited to exfiltrate data or completely bypass software security controls altogether. That’s why we say in the security community that when an attacker gains physical access to computer hardware, it’s usually game over. That’s because there are a multitude of methods and techniques that can be used to break into or manipulate computer hardware devices.

When these types of covert channel exploits are exposed publicly, it’s usually considered big news in the cybersecurity community and can have devastating effects on the victim's computer system. Why does this happen, though? Don’t manufacturers care about cybersecurity? Sure, they do, ok? Ok, well maybe some of them do then… Fine, most don’t care, but just keep telling yourself that they do so that you can sleep at night. “Everything’s going to turn out all right.” Breathe…

I’m sure the benevolent white hat hackers of the world, like myself, will discover them all before the black hats do, and we’ll inform the manufacturers, who’ll promptly issue firmware patches and/or change their entire device design; recall the millions of devices they already shipped and sold when a critical vulnerability is discovered in their product. Alright, go splash some cold water on your face, friends. Unfortunately, that’s not the reality we live in.

When it becomes about shareholder profits and Agile development processes that enable Continuous Integration and Continuous Delivery (CI/CD) not only in software but also in hardware development, hardware security never stood a chance, to begin with. If you thought security was lacking in software, just wait until you see hardware! That’s why Internet of Things (IoT) product security is a literal dumpster fire (more on that in the article linked below).

[embed]Stop Connecting Junk to the Internet *Note: This article was originally published by the author on May 20, 2019. It is re-posted here by the author for…medium.com

Security is hard. It requires time, money, and skilled engineers to implement even default, minimal security in hardware devices, let alone hardening products for unknown or rarely seen types of attacks that add cost and schedule to OEMs. That doesn’t mean hardware security should be completely neglected, though. It doesn’t mean manufacturers should use default logon credentials like “Admin/Admin”. Naturally, hardware security is often the first thing to get chopped in the design process, assuming it ever was in the original design to begin with (Hint: it’s usually not). Check out this video on hardware security by Semiconductor Engineering to get some further context.

[embed]Rambus’ Ben Levine talks with Semiconductor Engineering about how to minimize the risk attacks on chip hardware, why design for security is becoming more critical for connected devices, and strategies for making devices less vulnerable.

Fault Attacks

When attackers aren’t able to directly attack cryptographic algorithms, they may try to look for other ways to bypass software security and use a side-channel attack. One type of side-channel attack is a fault attack.

Such faults may include heat, over/under voltage, clock shifts, EM fields, or radiation, for example. Dr. Axel York Poschmann, head of the Vulnerability Analysis Innovation Center Crypto & Security Business Unit Security & Connectivity at NXP Semiconductors notes, “A successful fault attack can result in a disturbed program flow. That may result in, say, a skipped PIN verification step. It may also be possible to dump the entire content of the memory, including the secret key, for example.’(Semiconductor Engineering, 2025)

An attacker can use a fault attack to cause the system to behave abnormally and possibly cause a system to spill secret information. This has been demonstrated in numerous ways, such as with the RowHammer attack, whereby an attacker repeatedly accesses a row of Dynamic Random-Access Memory (DRAM). Do this enough times, and it will cause disturbance errors in other DRAM rows, otherwise known as bit-flipping. DRAM cells lose their state over time and need to be refreshed periodically.

Hardware Trojan Remote Activation Via Covert Temperature Channel

This Utah State University academic journal article describes how attackers could overwhelm a server or similar IT hardware with numerous packet requests to increase the temperature of the hardware and trigger a covert channel, “…and they are of particular concern to military, financial and industrial sectors as they can lead to functionality errors, performance reduction, denial-of-service, or information leakage” (Dash, et al., 2015).

Such a “trigger” could be either a digital or an analog piece of equipment within IT hardware. Maybe a computer fan designed to cool the motherboard is remotely turned off, causing the motherboard to overheat, and the computer shuts down. Or, perhaps malware that causes a motor within a centrifugal pump to speed up to the point where it damages or “bricks” the machine (e.g., Stuxnet). It could just as easily be a water pump in a water system designed to regulate water pressure to a municipality region that is remotely managed, but doesn’t have any built-in engineering safeguards to prevent it from being shut down or maxed out to full pressure by attackers, causing damage and flooding.

[embed]

Supply Chain Risk Management

The academic journal article also highlights the importance of supply chain risk management (SCRM). The U.S. has invested heavily in and relies heavily on Taiwanese semiconductor chip foundries to produce the most high-tech chips on the planet. Of course, China claims ownership of Taiwan, which considers itself an independent nation, and thus, we have the nexus of a potential WWIII situation. The U.S. does not recognize China’s claim that Taiwan belongs to China and has stated publicly that it will defend Taiwan from a Chinese invasion. Why is that?

In short, if China seized control of Taiwan, where would that leave the U.S. in terms of the high-tech chips it relies on for all types of technology products used by the U.S.? The U.S. does not currently possess the chip foundries to produce at scale the same amount of high-tech chips as Taiwan produces. Not to mention the sheer cost of labor in Taiwan is much cheaper for chip manufacturers, and U.S. Tech companies like Google, Apple, Meta, Amazon, and Microsoft have agreements with Taiwanese chip manufacturers to produce the chips they need for their smartphones, tablets, laptops, and similar computing devices.

High-ranking Chinese officials have stated publicly that China will take Taiwan by 2027 (Brown, 2025). It’s halfway through 2025, buckle up, folks. The world instability is about to get even bumpier… Let’s hope that doesn’t happen.

Hey, you! Thanks for reading my stuff. If you enjoyed the read, don’t be shy and feel free to give it a few claps. Your support makes my writing possible. You can sign up for emails when I publish on Medium, or join Medium to directly support me and gain full access to all Medium stories.

Similar Posts From the Author

[embed]Covert Channel Chronicles: The RAMBO Attack At this time in modernity, in the technologically advanced year 2025 of the twenty-first century, Wi-Fi signals are…medium.com

[embed]Covert Channel Chronicles: Astaroth’s ADS Forking Techniques *Note: This article was originally published by the author on April 6, 2020. It is republished here by the author for…medium.com

References

Brown, K. (2025, July 29). How China Could Take Taiwan, Without Firing a Shot. Retrieved from How China Could Take Taiwan, Without Firing a Shot | TIME

“covert channel”. (n.d.). NIST: Computer Security Resource Center Glossary. Retrieved from covert channel — Glossary | CSRC

Dash, P., Perkins, C., Gerdes, R.M. (2015). Remote Activation of Hardware Trojans via a Covert Temperature Channel. Institute for Computer Sciences, Social Informatics and Telecommunications Engineering 2015 B. Thuraisingham et al. (Eds.): SecureComm 2015, LNICST 164, pp. 294–310, 2015. DOI: 10.1007/978–3–319–28865–9 16. Retrieved from https://eudl.eu/pdf/10.1007/978-3-319-28865-9_16

Semiconductor Engineering. (2025, July 8). Side channel attacks: A class of attacks on a device and its contents by analyzing information using different access methods. Retrieved from Side Channel Attacks — Semiconductor Engineering