{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,8,27]],"date-time":"2026-08-27T15:16:55Z","timestamp":1787843815640,"version":"build-2784847793"},"reference-count":21,"publisher":"Association for Computing Machinery (ACM)","issue":"9","license":[{"start":{"date-parts":[[2017,8,23]],"date-time":"2017-08-23T00:00:00Z","timestamp":1503446400000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"funder":[{"DOI":"10.13039\/100007245","name":"MARCO","doi-asserted-by":"crossref","id":[{"id":"10.13039\/100007245","id-type":"DOI","asserted-by":"crossref"}]},{"name":"C-FAR"},{"DOI":"10.13039\/100000185","name":"DARPA","doi-asserted-by":"crossref","id":[{"id":"10.13039\/100000185","id-type":"DOI","asserted-by":"crossref"}]},{"DOI":"10.13039\/100000001","name":"National Science Foundation","doi-asserted-by":"publisher","id":[{"id":"10.13039\/100000001","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":["Commun. ACM"],"published-print":{"date-parts":[[2017,8,23]]},"abstract":"<jats:p>While the move to smaller transistors has been a boon for performance it has dramatically increased the cost to fabricate chips using those smaller transistors. This forces the vast majority of chip design companies to trust a third party---often overseas---to fabricate their design. To guard against shipping chips with errors (intentional or otherwise) chip design companies rely on post-fabrication testing. Unfortunately, this type of testing leaves the door open to malicious modifications since attackers can craft attack triggers requiring a sequence of unlikely events, which will never be encountered by even the most diligent tester. In this paper, we show how a fabrication-time attacker can leverage analog circuits to create a hardware attack that is small (i.e., requires as little as one gate) and stealthy (i.e., requires an unlikely trigger sequence before affecting a chip's functionality). In the open spaces of an already placed and routed design, we construct a circuit that uses capacitors to siphon charge from nearby wires as they transit between digital values. When the capacitors are fully charged, they deploy an attack that forces a victim flip-flop to a desired value. We weaponize this attack into a remotely controllable privilege escalation by attaching the capacitor to a controllable wire and by selecting a victim flip-flop that holds the privilege bit for our processor. We implement this attack in an OR1200 processor and fabricate a chip. Experimental results show that the purposed attack works. It eludes activation by a diverse set of benchmarks and evades known defenses.<\/jats:p>","DOI":"10.1145\/3068776","type":"journal-article","created":{"date-parts":[[2017,8,24]],"date-time":"2017-08-24T11:49:04Z","timestamp":1503575344000},"page":"83-91","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":12,"title":["Exploiting the analog properties of digital circuits for malicious hardware"],"prefix":"10.1145","volume":"60","author":[{"given":"Kaiyuan","family":"Yang","sequence":"first","affiliation":[{"name":"Rice University, Houston, TX and University of Michigan, Ann Arbor"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Matthew","family":"Hicks","sequence":"additional","affiliation":[{"name":"Virginia Tech, Blacksburg, VA and University of Michigan, Ann Arbor"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Qing","family":"Dong","sequence":"additional","affiliation":[{"name":"University of Michigan, Ann Arbor, MI"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Todd","family":"Austin","sequence":"additional","affiliation":[{"name":"University of Michigan, Ann Arbor, MI"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Dennis","family":"Sylvester","sequence":"additional","affiliation":[{"name":"University of Michigan, Ann Arbor, MI"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"320","published-online":{"date-parts":[[2017,8,23]]},"reference":[{"key":"e_1_2_1_1_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2007.36"},{"key":"e_1_2_1_2_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-40349-1_12"},{"key":"e_1_2_1_3_1","volume-title":"International Conference on Computer-Aided Design (ICCAD","author":"Forte D.","year":"2013"},{"key":"e_1_2_1_4_1","doi-asserted-by":"publisher","DOI":"10.5555\/1128020.1128563"},{"key":"e_1_2_1_5_1","doi-asserted-by":"crossref","unstructured":"Hicks M. Finnicum M. King S.T. Martin M.M.K. Smith J.M. Overcoming an untrusted computing base: Detecting and removing malicious hardware automatically. USENIX;login 35 6 (Dec. 2010) 31--41.  Hicks M. Finnicum M. King S.T. Martin M.M.K. Smith J.M. Overcoming an untrusted computing base: Detecting and removing malicious hardware automatically. USENIX;login 35 6 (Dec. 2010) 31--41.","DOI":"10.1109\/SP.2010.18"},{"key":"e_1_2_1_6_1","doi-asserted-by":"publisher","DOI":"10.1145\/2694344.2694366"},{"key":"e_1_2_1_7_1","doi-asserted-by":"publisher","DOI":"10.1109\/HST.2008.4559049"},{"key":"e_1_2_1_8_1","doi-asserted-by":"publisher","DOI":"10.1007\/s10836-015-5504-x"},{"key":"e_1_2_1_9_1","volume-title":"Workshop on Large-Scale Exploits and Emergent Threats","volume":"1","author":"King S.T.","year":"2008"},{"key":"e_1_2_1_10_1","doi-asserted-by":"publisher","DOI":"10.1109\/FDTC.2014.12"},{"key":"e_1_2_1_11_1","doi-asserted-by":"publisher","DOI":"10.1109\/HST.2008.4559038"},{"key":"e_1_2_1_12_1","doi-asserted-by":"publisher","DOI":"10.1145\/1346281.1346315"},{"key":"e_1_2_1_13_1","volume-title":"Hardware-Oriented Security and Trust (HOST","author":"Narasimhan S.","year":"2011"},{"key":"e_1_2_1_14_1","unstructured":"OpenCores.org. OpenRISC OR1200 processor.  OpenCores.org. OpenRISC OR1200 processor."},{"key":"e_1_2_1_15_1","doi-asserted-by":"publisher","DOI":"10.1145\/1629911.1630091"},{"key":"e_1_2_1_16_1","volume-title":"Proceedings of the International Conference on Computer-Aided Design (ICCAD","author":"Rostami M.","year":"2013"},{"key":"e_1_2_1_17_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-662-44709-3_7"},{"key":"e_1_2_1_18_1","unstructured":"S.S. Technology. Why node shrinks are no longer offsetting equipment costs (online webpage Oct. 2012).  S.S. Technology. Why node shrinks are no longer offsetting equipment costs (online webpage Oct. 2012)."},{"key":"e_1_2_1_19_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2011.27"},{"key":"e_1_2_1_20_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICCD.2011.6081413"},{"key":"e_1_2_1_21_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2016.10"}],"container-title":["Communications of the ACM"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3068776","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3068776","content-type":"application\/pdf","content-version":"vor","intended-application":"syndication"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3068776","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,18]],"date-time":"2025-06-18T03:03:44Z","timestamp":1750215824000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3068776"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2017,8,23]]},"references-count":21,"journal-issue":{"issue":"9","published-print":{"date-parts":[[2017,8,23]]}},"alternative-id":["10.1145\/3068776"],"URL":"https:\/\/doi.org\/10.1145\/3068776","relation":{},"ISSN":["0001-0782","1557-7317"],"issn-type":[{"value":"0001-0782","type":"print"},{"value":"1557-7317","type":"electronic"}],"subject":[],"published":{"date-parts":[[2017,8,23]]},"assertion":[{"value":"2017-08-23","order":2,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}