Expert Discusses Hardware Security Challenges and Hack@DAC Competition

In this video, Arun, an offensive security expert at Intel, discusses the lessons learned from organizing "Hack@DAC," the world's largest hardware hacking competition. He is joined by his colleagues Harish and Jason, as well as two prominent professors, JV Rajendran from Texas A&M University and Ahmed Sadek from TU Darmstadt in Germany. The team also collaborates with PhD students and industry partners like Synopsys. Arun begins by explaining the main challenges in hardware security: low awareness of hardware weakness types, lack of security tools for hardware, and the high cost of fixing hardware bugs. He emphasizes the importance of detecting and fixing bugs during the RTL (Register Transfer Level) design phase, which is essentially the hardware's source code. To illustrate these challenges, Arun presents a hypothetical System on Chip (SoC) example, showing how security features are implemented in hardware. He provides concrete examples of hardware vulnerabilities, such as flaws in cryptographic key management, and explains how these flaws can be exploited by attackers. He highlights the need to create more security-aware automated design tools to detect these flaws. The video then details the organization of the Hack@DAC competition. The competition is structured in two phases: an offline phase where participants analyze a buggy chip design, and a live phase where finalists use advanced cloud-based tools to detect additional bugs. Participants must identify security flaws, propose mitigations, and evaluate the impact of these flaws, mimicking the work of a full-time security researcher. Arun highlights the benefits of the competition for participants, who gain practical experience in hardware security and develop a hacker mindset. The competition has also created a benchmark for testing hardware security tools, which was previously non-existent. In conclusion, Arun summarizes the key takeaways: raising awareness about hardware security, creating secure automated design tools, and adopting a "shift left" mentality to detect and fix bugs during the design phase. He also mentions the collaboration with MITRE to integrate hardware weaknesses into the Common Weakness Enumeration (CWE), and the positive impacts of the competition on the industry and academia. For more details, watch the full video: https://www.youtube.com/watch?v=IC-BB7HEor8