Inclusion of Undocumented Features or Chicken Bits

Opis

The device includes chicken bits or undocumented features that can create entry points for unauthorized actors.

A common design practice is to use undocumented bits on a device that can be used to disable certain functional security features. These bits are commonly referred to as "chicken bits". They can facilitate quick identification and isolation of faulty components, features that negatively affect performance, or features that do not provide the required controllability for debug and test. Another way to achieve this is through implementation of undocumented features.

Skutki

• Confidentiality, Integrity, Availability, Access Control

  Modify Memory; Read Memory; Execute Unauthorized Code or Commands; Gain Privileges or Assume Identity; Bypass Protection Mechanism

  An attacker might exploit these interfaces for unauthorized access.

Zapobieganie

• Architecture and Design, Implementation

  The implementation of chicken bits in a released product is highly discouraged. If implemented at all, ensure that they are disabled in production devices. All interfaces to a device should be documented.

  Skuteczność: High

Słabość nadrzędna

• CWE-912 Hidden Functionality

Kiedy powstaje

• Architecture and Design
• Implementation
• Documentation

Dotyczy

Not Language-Specific, Not OS-Specific, Not Architecture-Specific, Not Technology-Specific, ICS/OT

Źródła

1. Doors of Durin: The Veiled Gate to Siemens S7 Silicon — Ali Abbasi, Tobias Scharnowski, Thorsten Holz
2. Breakthrough Silicon Scanning Discovers Backdoor in Military Chip — Sergei Skorobogatov, Christopher Woods
3. God Mode Unlocked: Hardware Backdoors in x86 CPUs — Chris Domas
4. Hardware Backdooring is Practical — Jonathan Brossard
5. Security, Reliability, and Backdoors — Sergei Skorabogatov