\HeadingLevelB{Physical Attacks}
\label{sec:physical_attacks}

Physical attacks are generally classified according to their cost, which factors in the equipment needed to carry out the attack and the attack's complexity.
Joe Grand's DefCon presentation~\citep{grand2004physicalattacks} provides a good overview with a large number of intuition-building figures and photos.

The simplest type of physical attack is a denial of service attack performed by disconnecting the victim computer's power supply or network cable.
The threat models of most secure architectures exclude this attack from consideration, because denial of service can also be achieved by software attacks that compromise system software such as the hypervisor.


\HeadingLevelC{I/O Port Attacks}
\label{sec:physical_port_attacks}

Slightly more involved attacks rely on connecting a device to an existing port on the victim computer's case or motherboard~(\S~\ref{sec:motherboard}).
A simple example is a \textit{cold boot attack}, where the attacker plugs in a USB flash drive into the victim's case and causes the computer to boot from the flash drive loaded with malicious system software, which receives unrestricted access to the computer's peripherals.

More costly physical attacks that still require relatively little effort target the debug ports of various peripherals.
The cost of these attacks is generally dominated by the expense of acquiring the development kits needed to connect to the debug ports.
For example, recent Intel processors include the Generic Debug eXternal Connection~(GDXC)~\citep{yuffe2011sandybridge, intel2011gdxc}, which collects, filters, and exposes the data transferred by the uncore's ring network (\S~\ref{sec:cache_coherence}), and reports it to an external debugger.

The threat models of secure architectures generally ignore debug port attacks, under the assumption that devices sold for general consumption have their debug ports irreversibly disabled.
In practice, manufacturers have strong incentives to preserve debugging ports in production hardware, as this facilitates the diagnosis and repair of defective units.
Due to insufficient documentation on this topic, we do not survey GDXC-based attacks in this work.


\HeadingLevelC{Bus Tapping Attacks}
\label{sec:physical_bus_attacks}

More complex physical attacks consist of installing a device that taps a bus on the computer's motherboard (\S~\ref{sec:motherboard}).
\textit{Passive attacks} are limited to monitoring the bus traffic, whereas \textit{active attacks} can modify the traffic, or even place new commands on the bus.
\textit{Replay attacks} are a notoriously challenging class of active attacks, where the attacker first records the bus traffic, and then selectively replays a subset of the traffic.
Replay attacks bypass systems that rely on static signatures or HMACs, and generally aim to double-spend a limited resource.

The cost of bus tapping attacks is generally dominated by the cost of the equipment used to tap the bus, which increases with bus speed and complexity.
For example, the flash module storing the computer's firmware is connected to the PCH via an SPI bus (\S~\ref{sec:motherboard}), which is simpler and much slower than the DDR bus connecting DRAM to the CPU.
Consequently, tapping the SPI bus is much cheaper than tapping the DDR bus.
For this reason, systems whose security relies on a cryptographic hash of the firmware will first copy the firmware into DRAM, hash the DRAM copy of the firmware, and then execute the firmware from DRAM.

Although the speed of the DDR DRAM link makes tapping very difficult, there are well-publicized records of successful attempts.
The original Xbox console's boot process was reverse-engineered via a passive tap on the DRAM bus~\citep{huang2003xbox}, which showed that the firmware used to boot the console was partially stored in its southbridge.
The protection mechanisms of the PlayStation 3 hypervisor were subverted by an active tap on its memory bus~\citep{hotz2010ps3} that targeted the hypervisor's page tables.

The Ascend secure processor~(\S~\ref{sec:sgx_related_ascend}) demonstrated that concealing the DRAM addresses accessed by a program is orders of magnitude more expensive than protecting the data in memory.
Therefore, we are chiefly interested in analyzing attacks that tap the DRAM bus and collect information on the address lines.
These attacks use the same equipment as normal DRAM bus tapping attacks, but require a significantly more involved analysis to learn useful information from the gathered data.
One of the difficulties of such attacks stems from the fact that the memory addresses observed on the DRAM bus are generally very different from the application's memory access patterns due to the behavior of cache hierarchies and multiprogramming in modern processors (\S~\ref{sec:caching}). At the time of this writing, we are not aware of any successful attack based on tapping the address lines of a DRAM bus and analyzing the sequence of memory addresses.


\HeadingLevelC{Attacks on the Processor Package or Die}
\label{sec:physical_chip_attacks}

The most equipment-intensive physical attacks involve removing a chip's packaging and directly interacting with its electrical circuits.
These attacks generally take advantage of equipment and techniques that were originally developed to diagnose design and manufacturing defects in integrated circuits.
\citep{beck1998integrated} covers these techniques in depth.

The cost of chip attacks is dominated by the required equipment, although the reverse-engineering involved is also non-trivial.
This cost grows very rapidly as the circuit components shrink with advances in fabrication technology.
At the time of this writing, the latest widely available state of-the-art processor systems have a 14nm feature size, which requires ion beam microscopy for such analysis.
% (TODO: look up the details for all this).

The least expensive classes of chip attacks are destructive, and only require imaging the chip's circuitry.
These attacks rely on a microscope capable of capturing the necessary details in each layer, and equipment for mechanically removing each layer and exposing the layer below it to the microscope.

Imaging attacks generally target global secrets shared by all devices in a family, such as ROM masks that store global encryption keys or secret boot code.
They are also used to reverse-engineer undocumented functionality, such as debugging backdoors.
E-fuses and polyfuses are particularly vulnerable to imaging attacks, because of their relatively large sizes.

Non-destructive passive chip attacks include measuring the voltages across a module at specific times while the chip is active.
These attacks are orders of magnitude more expensive than destructive imaging attacks because the attacker must take care to maintain the integrity of the chip's circuitry, and therefore cannot de-layer the chip and has limited visibility and access.

The simplest active attacks on a chip create or destroy an electric connection between two components.
For example, the debugging functionality in many devices is disabled by ``blowing'' an e-fuse.
Once this e-fuse is located, an attacker can reconnect its two ends, effectively undoing the ``blowing'' operation.
More expensive attacks involve changing voltages across a component as the chip is operating, and are typically used to reverse-engineer complex circuits.

Surprisingly, active attacks are not significantly more expensive to carry out than passive non-destructive attacks.
This is because the tools used to measure the voltage across specific components are not very different from the tools that can tamper with the chip's electric circuits.
Therefore, once an attacker develops a process for accessing a module without destroying the chip's circuitry, the attacker can use the same process for both passive and active attacks.

At the architectural level, we cannot address physical attacks against the CPU's chip package.
Active attacks on the CPU change the computer's execution semantics, leaving us without any hardware that can be trusted to make security decisions.
Passive attacks can read the private data that the CPU is processing.
Therefore, many secure computing architectures assume that the processor chip package is invulnerable to physical attacks.

Thankfully, physical attacks can be deterred by reducing the value that an attacker obtains by compromising an individual chip.
As long as this value is below the cost of carrying out the physical attack, a system's designer can hope that the processor's chip package will not be targeted by the physical attacks.

Architects can reduce the value of compromising an individual system by avoiding shared secrets, such as global encryption keys.
Chip designers can increase the cost of a physical attack by not storing a platform's secrets in hardware that is vulnerable to destructive attacks, such as e-fuses.


\HeadingLevelC{Power Analysis Attacks}
\label{sec:power_analysis_attacks}

An entirely different approach to physical attacks consists of indirectly measuring the power consumption of a computer system or its components.
The attacker takes advantage of a known correlation between power consumption and the computed data, and learns some property of the data from the observed power consumption.

The earliest power analysis attacks have directly measured the processor chip's power consumption.
For example, \citep{kocher1999dpa} describes a simple power analysis (SPA) attack that exploits the correlation between the power consumed by a smart card chip's CPU and the type of instruction it executed, and learned a DSA key that the smart card was supposed to safeguard.

While direct power analysis attacks necessitate some equipment, their costs are dominated by the complexity of the analysis required to learn the desired information from the observed power trace which, in turn, is determined by the complexity of the processor's circuitry.
Today's smart cards contain special circuitry~\citep{tiri2002dcmos} and use hardened algorithms~\citep{herbst2006aes} designed to frustrate power analysis attacks.

Recent work demonstrated successful power analysis attacks against a system as complex as a full-blown out-of-order Intel processor using inexpensive off-the-shelf sensor equipment.
\citep{genkin2014rsa} extracts an RSA key from GnuPG running on a laptop using a microphone that measures its acoustic emissions.
\citep{genkin2014fullpa} and \citep{genkin2015radiopa} extract RSA keys from power analysis-resistant implementations using a voltage meter and a radio.
All of these attacks can be performed quite easily by a disgruntled data center employee.

Unfortunately, power analysis attacks can be extended to displays and human input devices, which cannot be secured in any reasonable manner.
For example, \citep{van1985monitorpa} documented a very early attack that measures the radiation emitted by a CRT display's ion beam to reconstitute the image on a computer screen in a different room.
\citep{kuhn2005lcdpa} extended the attack to modern LCD displays.
\citep{zhuang2009keyboard} used a directional microphone to measure the sound emitted by a keyboard and learn the password that its operator typed.
\citep{owusu2012accessory} applied similar techniques to learn a user's input on a smartphone's on-screen keyboard, based on data from the device's accelerometer.

In general, power attacks cannot be addressed at the architectural level, as they rely on implementation details that are decided during the manufacturing process.
Therefore, it is unsurprising that the secure computing architectures described in \S~\ref{sec:sgx_related} do not protect against power analysis attacks.
