Hardware Security Class Extra Reading List

Introductions

• Introduction to Security for Computer Architecture Students
• USENIX OSDI ’21 Keynote - It's Time for Operating Systems to Rediscover Hardware
• Introduction to HW Security & Trust Tehranipoor’s Slides

Cryptography

• Introduction to Cryptography Tehranipoor’s Slides
• Public Key Cryptography: RSA Encryption
• Introduction to Modern Cryptography
• APPLIED CRYPTOGRAPHY AND DATA SECURITY

Supply Chain

• Hackable Intel and Lenovo hardware that went undetected for 5 years won’t ever be fixed
• Hardware Security With an Emphasis on Supply Chain Attacks & Verifiability Andrew “bunnie” Huang
  • YouTube Video
• Protecting supply chains with CHERI CHERITech 2024
• Hardware Trojan Tehranipoor’s Slides

Physical Attacks

• I, For One, Welcome Our New Power Analysis Overlords
• PLATYPUS: Software-based Power Side-Channel Attacks on x86
• FPGA-Based Remote Power Side-Channel Attacks
• Andrew “bunnie” Huang. Hacking the Xbox
• How Practical Are Fault Injection Attacks, Really?
• See “Colin O’Flynn Resources” below
• MINDSHARE: HARDWARE REVERSING WITH THE TP-LINK TL-WR841N ROUTER
• SRAM Has No Chill: Exploiting Power Domain Separation to Steal On-Chip Secrets
• Fault Injection Attacks Tehranipoor’s Slides
• Physical Attacks and Tamper Resistance Tehranipoor’s Slides

Side-Channel/Microarchitecture/Transient Execution Attacks

• Meltdown: Reading Kernel Memory from User Space
• Spectre Attacks: Exploiting Speculative Execution
• CACHE MISSING FOR FUN AND PROFIT
• EntryBleed: Breaking KASLR under KPTI with Prefetch
• On the Spectre and Meltdown Processor Security Vulnerabilities
• PACMAN Attacking ARM Pointer Authentication with Speculative Execution
• TIKTAG: Breaking ARM’s Memory Tagging Extension with Speculative Execution
• Speculative Probing: Hacking Blind in the Spectre Era
• Hertzbleed: Turning Power Side-Channel Attacks into Remote Timing Attacks on x86
• Last-Level Cache Side-Channel Attacks are Practical
• Flush+Reload: A High Resolution, Low Noise, L3 Cache Side-Channel Attack
• Port Contention for Fun and Profit
• Opening Pandora’s Box: A Systematic Study of New Ways Microarchitecture Can Leak Private Data
• An Analysis of Speculative Type Confusion Vulnerabilities in the Wild
• DAWG: A Defense Against Cache Timing Attacks in Speculative Execution Processors
• Speculative Load Hardening
• MDS: Microarchitectural Data Sampling
• A Survey of Microarchitectural Timing Attacks and Countermeasures on Contemporary Hardware
• Synesthesia: Detecting Screen Content via Remote Acoustic Side Channels
• Swivel: Hardening WebAssembly against Spectre
• A Systematic Evaluation of Transient Execution Attacks and Defenses
• Complete information flow tracking from the gates up
• MIRAGE: Mitigating Conflict-Based Cache Attacks with a Practical Fully-Associative Design
• Speculative Taint Tracking (STT): A Comprehensive Protection for Speculatively Accessed Data

Software/Hardware Contract

• BearSSL - Why Constant-Time Crypto?
• Hardware-Software Contracts for Secure Speculation
• Data Operand Independent Timing Instruction Set Architecture (ISA) Guidance
• FaCT: A DSL for Timing-Sensitive Computation
• Secure, Precise, and Fast Floating-Point Operations on x86 Processors
• Revizor: Testing Black-Box CPUs against Speculation Contracts

Rowhammer Attacks

• The Story of Rowhammer
• Exploiting the DRAM rowhammer bug to gain kernel privileges
• Flipping Bits in Memory Without Accessing Them: An Experimental Study of DRAM Disturbance Errors
• Flip Feng Shui: Hammering a Needle in the Software Stack
• CLKSCREW: Exposing the Perils of Security-Oblivious Energy Management
• Hertzbleed: Turning Power Side-Channel Attacks Into Remote Timing Attacks on x86
• RowHammer: A Retrospective
• Revisiting RowHammer: An Experimental Analysis of Modern DRAM Devices and Mitigation Techniques
• PThammer: Cross-User-Kernel-Boundary Rowhammer through Implicit Accesses
• RAMBleed: Reading Bits in Memory Without Accessing Them
• SPOILER: Speculative Load Hazards Boost Rowhammer and Cache Attacks
• Graphene: Strong yet Lightweight Row Hammer Protection
• Exploiting Correcting Codes: On the Effectiveness of ECC Memory Against Rowhammer Attacks

Memory Safety

• Smashing The Stack For Fun And Profit
• SoK: Eternal War in Memory
• Control-Flow Integrity - Principles, Implementations, and Applications
• Pointer Authentication on ARMv8.3
• Memory protection keys
• Armv8.5-A Memory Tagging Extension
• Intel Control-flow Enforcement Technology Specification
• Intel MPX Explained: A Cross-layer Analysis of the Intel MPX System Stack*
• CHERI
  • An Introduction to CHERI
  • CHERI: A Hybrid Capability-System Architecture for Scalable Software Compartmentalization
  • The CHERI capability model: revisiting RISC in an age of risk
  • Efficient Tagged Memory
  • Cornucopia: Temporal Safety for CHERI Heaps
  • Cornucopia Reloaded: Load Barriers for CHERI Heap Temporal Safety
  • The Arm Morello Board
  • CHERITech'24
  • Case Study: Securing MMU-less Linux Using CHERI
• CHERIoT
  • CHERIoT: Complete Memory Safety for Embedded Devices , IEEE/ACM Micro 2023
  • CheriRTOS: A Capability Model for Embedded Devices
  • CHERIoT RTOS architecture
  • What’s the smallest variety of CHERI? Blog posting
  • CHERIoT WebSite
  • CHERIoT: Rethinking security for low-cost embedded systems Microsoft Technical Report MSR-TR-2023-6
  • CHERIoT Architecture Specification (version 0.6)

Hardware Security Modules/Enclaves

• Intel SGX Explained
• Apple Platform Security (Pages 5-96)
• Building the IBM 4758 Secure Coprocessor
• Keystone: An Open Framework for Architecting Trusted Execution Environments
• Arm Confidential Compute Architecture
• Intel® Trust Domain Extensions
• AMD Secure Encrypted Virtualization (SEV)
• A Bad Dream: Subverting Trusted Platform Module While You Are Sleeping
• Attacking Intel TXT® via SINIT code execution hijacking
• Leaky Cauldron on the Dark Land: Understanding Memory Side-Channel Hazards in SGX
• MI6: Secure Enclaves in a Speculative Out-of-Order Processor
• Sanctorum: A lightweight security monitor for secure enclave

Hardware Fuzzing and Verification

• Computational Aspects of the Pentium Affair
  • Pentium Glitch
• Fuzzing Hardware Like Software
• Bug Attacks
• SPECS: A Lightweight Runtime Mechanism for Protecting Software from Security-Critical Processor Bugs
• Breaking the x86 Instruction Set
• Riding the Fuzzing Hype Train
• HardFails: Insights into Software-Exploitable Hardware Bugs
• The Art, Science, and Engineering of Fuzzing: A Survey
• Branch History Injection: On the Effectiveness of Hardware Mitigations Against Cross-Privilege Spectre-v2 Attacks
• Uncovering Hidden Instructions in Armv8-A Implementations

Blogs, YouTube Channels, Books, Online Classes, etc

• Todd Austin’s Hardware Security Tutorial (UMich)
  • Part #1: Building Secure Hardware and Software
  • Part #2: Security Basic
  • Part #3: Software and Hardware Security Exploits
  • Part #4: Side-Channel Attacks
  • Part #5: Software and Hardware Security Defenses
  • Part #6: Emerging Security Protections
• Colin O’Flynn Resources
  • “The Hardware Hacking Handbook” Book
  • Colin O'Flynn Embedded Security, Electronics & More! Blog
  • Colin O'Flynn Huge Nerd YouTube Channel
• Side Channel Security Channel
• Principles of Secure Processor Architecture Design
• MIT 6.858 Computer Systems Security, Fall 2014 MIT OpenCourseWare
• Open Security Training 2

Apple

• Behind the scenes of iOS and Mac Security
• Apple Platform Security