{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,4,1]],"date-time":"2026-04-01T18:46:51Z","timestamp":1775069211702,"version":"3.50.1"},"reference-count":37,"publisher":"MDPI AG","issue":"12","license":[{"start":{"date-parts":[[2018,12,3]],"date-time":"2018-12-03T00:00:00Z","timestamp":1543795200000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Future Internet"],"abstract":"<jats:p>Nowadays, companies are heavily investing in the development of \u201cInternet of Things(IoT)\u201d products. These companies usually and obviously hunt for lucrative business models. Currently, each person owns at least 3\u20134 devices (such as mobiles, personal computers, Google Assistant, Alexa, etc.) that are connected to the Internet 24\/7. However, in the future, there might be hundreds of devices that will be constantly online behind each person, keeping track of body health, banking transactions, status of personal devices, etc. to make one\u2019s life more efficient and streamlined. Thus, it is very crucial that each device should be highly secure since one\u2019s life will become dependent on these devices. However, the current security of IoT devices is mainly focused on resiliency of device. In addition, less complex node devices are easily accessible to the public resulting in higher vulnerability. JTAG is an IEEE standard that has been defined to test proper mounting of components on PCBs (printed circuit boards) and has been extensively used by PCB manufacturers to date. This JTAG interface can be used as a backdoor entry to access and exploit devices, also defined as a physical attack. This attack can be used to make products malfunction, modify data, or, in the worst case, stop working. This paper reviews previous successful JTAG exploitations of well-known devices operating online and also reviews some proposed possible solutions to see how they can affect IoT products in a broader sense.<\/jats:p>","DOI":"10.3390\/fi10120121","type":"journal-article","created":{"date-parts":[[2018,12,3]],"date-time":"2018-12-03T06:02:09Z","timestamp":1543816929000},"page":"121","update-policy":"https:\/\/doi.org\/10.3390\/mdpi_crossmark_policy","source":"Crossref","is-referenced-by-count":26,"title":["Exploiting JTAG and Its Mitigation in IOT: A Survey"],"prefix":"10.3390","volume":"10","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-5440-9149","authenticated-orcid":false,"given":"Gopal","family":"Vishwakarma","sequence":"first","affiliation":[{"name":"Department of Electrical and Computer Engineering, University of Texas at San Antonio, San Antonio, TX 78249, USA"}]},{"given":"Wonjun","family":"Lee","sequence":"additional","affiliation":[{"name":"Department of Electrical and Computer Engineering, University of Texas at San Antonio, San Antonio, TX 78249, USA"}]}],"member":"1968","published-online":{"date-parts":[[2018,12,3]]},"reference":[{"key":"ref_1","unstructured":"BI Intelligence (2018, December 02). Here\u2019s How the Internet of Things Will Explode by 2020. Available online: http:\/\/www.businessinsider.com\/iot-ecosystem-Internet-of-things-forecasts-and-business-opportunities-2016-2."},{"key":"ref_2","unstructured":"Egham, U.K. (2018, December 02). Gartner Says 8.4 Billion Connected \u201cThings\u201d Will Be in Use in 2017, Up 31 Percent from 2016. Available online: https:\/\/www.gartner.com\/newsroom\/id\/3598917."},{"key":"ref_3","doi-asserted-by":"crossref","unstructured":"Tehranipoor, M., Sergei, S., and Wang, C. (2011). Introduction to Hardware Security and Trust, Springer Publishing Company, Incorporated.","DOI":"10.1007\/978-1-4419-8080-9"},{"key":"ref_4","unstructured":"IEEE (2001). 1149.1-2001 IEEE Standard Test Access Port and Boundary-Scan Architecture 2001, IEEE Computer Society. Tech. Rep."},{"key":"ref_5","doi-asserted-by":"crossref","first-page":"36","DOI":"10.1109\/MDT.2010.9","article-title":"Attacks and Defenses for JTAG","volume":"27","author":"Rosenfeld","year":"2010","journal-title":"IEEE Des. Test Comput."},{"key":"ref_6","unstructured":"Drake, J.J., Lanier, Z., Mulliner, C., Fora, P.O., Ridley, S.A., and Wicherski, G. (2014). Android Hacker\u2019s Handbook, Wiley Publishing. [1st ed.]."},{"key":"ref_7","unstructured":"(2018, December 02). JTAGulator by Grand Idea Studio. Available online: http:\/\/www.grandideastudio.com\/jtagulator\/."},{"key":"ref_8","unstructured":"(2018, December 02). JTAGulator Official Documentation. Available online: https:\/\/www.parallax.com\/sites\/default\/files\/downloads\/32115-JTAGulator-Product-Brief-1.1.pdf."},{"key":"ref_9","unstructured":"Hartung, C., Balasalle, J., and Han, R. (2005). Node Compromise in Sensor Networks: The Need for Secure Systems, University of Colorado at Boulder."},{"key":"ref_10","doi-asserted-by":"crossref","first-page":"80","DOI":"10.1109\/MC.2017.201","article-title":"DDoS in the IoT: Mirai and other botnets","volume":"50","author":"Kolias","year":"2017","journal-title":"Computer"},{"key":"ref_11","unstructured":"(2018, December 02). Chinese Firm Recalls Camera Products Linked to Massive DDOS Attack. Available online: https:\/\/www.pcworld.com\/article\/3133962\/chinese-firm-recalls-camera-products-linked-to-massive-ddos-attack.html."},{"key":"ref_12","doi-asserted-by":"crossref","unstructured":"Tan, S.J., Bratus, S., and Goodspeed, T. (2014, January 8\u201312). Interrupt-oriented bugdoor programming: A minimalist approach to bugdooring embedded systems firmware. Proceedings of the 30th Annual Computer Security Applications Conference (ACSAC \u201c14), New Orleans, LA, USA.","DOI":"10.1145\/2664243.2664268"},{"key":"ref_13","unstructured":"(2018, December 02). IDA Pro TechnicAl Documentation. Available online: https:\/\/www.hex-rays.com\/products\/ida\/debugger\/index.shtml."},{"key":"ref_14","unstructured":"(2018, December 02). IDA Python Docs. Available online: https:\/\/www.hex-rays.com\/products\/ida\/support\/idapython_docs\/."},{"key":"ref_15","unstructured":"Texas Instruments (2012). SLAU144I: MSP430x2xx Family: User\u2019s Guide, Texas Instruments Inc."},{"key":"ref_16","unstructured":"DeBusschere, E., and McCambridge, M. (2012). Modern Game Console Exploitation, Department of Computer Science University of Arizona. Technical Report."},{"key":"ref_17","unstructured":"Anonymous Hacker (2018, December 02). Xbox 360 Hypervisor Privilege Escalation Vulnerability. Available online: http:\/\/securityvulns.com\/Qdocument211.html."},{"key":"ref_18","unstructured":"Weinmann, R.-P. (2012, January 7\u20138). Baseband attacks: Remote exploitation of memory corruptions in cellular protocol stacks. Proceedings of the 6th USENIX Conference on Offensive Technologies, Berkeley, CA, USA."},{"key":"ref_19","doi-asserted-by":"crossref","first-page":"61","DOI":"10.1016\/j.ijcip.2014.01.004","article-title":"An evaluation of modification attacks on programmable logic controllers","volume":"7","author":"Schuett","year":"2014","journal-title":"Int. J. Crit. Infrastruct. Prot."},{"key":"ref_20","unstructured":"Santamarta, R. (2012). Project Basecamp\u2014Attacking Controllogix, Project Basecamp Report, Digital Bond."},{"key":"ref_21","doi-asserted-by":"crossref","first-page":"76","DOI":"10.1016\/j.ijcip.2013.04.004","article-title":"Firmware modification attacks on programmable logic controllers","volume":"6","author":"Basnight","year":"2013","journal-title":"Int. J. Crit. Infrastruct. Prot."},{"key":"ref_22","unstructured":"Gonzalvo, B., Bourbao, E., Maj\u00e9ric, F., and Bossue, L. (2016, January 21\u201323). JTAG combined attacks. Proceedings of the 2016 8th IEEE IFIP International Conference on New Technologies, Mobility and Security (NTMS), Larnaca, Cyprus."},{"key":"ref_23","doi-asserted-by":"crossref","first-page":"65","DOI":"10.1109\/LES.2017.2771206","article-title":"JTAG Fault Injection Attack","volume":"10","author":"Majeric","year":"2018","journal-title":"IEEE Embed. Syst. Lett."},{"key":"ref_24","doi-asserted-by":"crossref","unstructured":"Suh, G.E., and Devadas, S. (2007, January 4\u20138). Physical unclonable functions for device authentication and secret key generation. Proceedings of the 44th ACM\/IEEE Design Automation Conference (DAC\u201907), San Diego, CA, USA.","DOI":"10.1145\/1278480.1278484"},{"key":"ref_25","unstructured":"Anderson, R., and Kuhn, M. (1996, January 18\u201321). Tamper resistance\u2014A cautionary note. Proceedings of the 2nd USENIX Workshop on Electronic Commerce, Oakland, CA, USA."},{"key":"ref_26","unstructured":"Anderson, R., and Kuhn, M. (1997). Low cost attacks on tamper resistant devices. Lecture Notes in Computer Science, Proceedings of the IWSP: International Workshop on Security Protocols, Paris, France, 7\u20139 April 1997, Springer."},{"key":"ref_27","unstructured":"Skorobogatov, S.P. (2005). Semi-invasive attacks\u2014A new approach to hardware security analysis. Technical Report UCAM-CL-TR-630, University of Cambridge Computer Laboratory."},{"key":"ref_28","doi-asserted-by":"crossref","first-page":"193","DOI":"10.1007\/s10836-013-5369-9","article-title":"Secure JTAG implementation using Schnorr protocol","volume":"29","author":"Ghosh","year":"2013","journal-title":"Electron. Test."},{"key":"ref_29","doi-asserted-by":"crossref","unstructured":"Clark, C.J. (2010, January 13\u201314). Anti-tamper JTAG TAP design enables DRM to JTAG registers and P1687 on-chip instruments. Proceedings of the 2010 IEEE International Symposium on Hardware-Oriented Security and Trust (HOST), Anaheim, CA, USA.","DOI":"10.1109\/HST.2010.5513119"},{"key":"ref_30","unstructured":"Buskey, R.F., and Frosik, B.B. (2006, January 14\u201318). Protected JTAG. Proceedings of the 2006 International Conference on Parallel Processing Workshops IEEE, Columbus, OH, USA."},{"key":"ref_31","doi-asserted-by":"crossref","first-page":"54","DOI":"10.9790\/0661-0115459","article-title":"JTAG Architecture with Multi Level Security","volume":"1","author":"Kumar","year":"2012","journal-title":"IOSR J. Comput. Eng."},{"key":"ref_32","doi-asserted-by":"crossref","first-page":"549","DOI":"10.1007\/s10836-010-5170-y","article-title":"JTAG security system based on credentials","volume":"26","author":"Park","year":"2010","journal-title":"J. Electron. Test."},{"key":"ref_33","doi-asserted-by":"crossref","unstructured":"Ren, X., Tavares, V.G., and Blanton, R.D. (2015, January 9\u201313). Detection of Illegitimate Access to JTAG via Statistical Learning in Chip. Proceedings of the 2015 Design, Automation & Test in Europe Conference & Exhibition (DATE), Grenoble, France.","DOI":"10.7873\/DATE.2015.0558"},{"key":"ref_34","unstructured":"(2018, December 02). ftjrev. Available online: http:\/\/www.alexforencich.com\/wiki\/en\/projects\/ftjrev\/start\/."},{"key":"ref_35","doi-asserted-by":"crossref","unstructured":"Ren, X., Blanton, R.D., and Tavares, V.G. (2016, January 11\u201313). A Learning-based Approach to Secure JTAG against Unseen Scan-based Attacks. Proceedings of the 2016 IEEE Computer Society Annual Symposium on VLSI (ISVLSI), Pittsburgh, PA, USA.","DOI":"10.1109\/ISVLSI.2016.107"},{"key":"ref_36","doi-asserted-by":"crossref","unstructured":"Guri, M., Poliak, Y., Shapira, B., and Elovici, Y. (2015, January 20\u201325). JoKER: Trusted detection of kernel rootkits in Android devices via JTAG interface. Proceedings of the Trustcom\/BigDataSE\/ISPA, Helsinki, Finland.","DOI":"10.1109\/Trustcom.2015.358"},{"key":"ref_37","unstructured":"(2018, December 02). Configuring Secure Jtag for the i.mx 6 Series Family of Applications Processors-Application Note. Available online: http:\/\/www.nxp.com\/files\/32bit\/doc\/app_note\/AN4686.pdf."}],"container-title":["Future Internet"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.mdpi.com\/1999-5903\/10\/12\/121\/pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,10,11]],"date-time":"2025-10-11T15:30:47Z","timestamp":1760196647000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.mdpi.com\/1999-5903\/10\/12\/121"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2018,12,3]]},"references-count":37,"journal-issue":{"issue":"12","published-online":{"date-parts":[[2018,12]]}},"alternative-id":["fi10120121"],"URL":"https:\/\/doi.org\/10.3390\/fi10120121","relation":{},"ISSN":["1999-5903"],"issn-type":[{"value":"1999-5903","type":"electronic"}],"subject":[],"published":{"date-parts":[[2018,12,3]]}}}