CAPEC-681

Detailed Abstraction Level
Meta — Very abstract, high-level category
Standard — Specific enough to understand
Detailed — Tied to specific technique Draft MITRE CAPEC Status
Stable — Fully reviewed and complete
Draft — Under development
Incomplete — Partially defined
Deprecated — No longer recommended
Obsolete — Replaced by another CAPEC Likelihood: Medium Severity: Very High
Exploitation of Improperly Controlled Hardware Security Identifiers

Description

An adversary takes advantage of missing or incorrectly configured security identifiers (e.g., tokens), which are used for access control within a System-on-Chip (SoC), to read/write data or execute a given action.

Prerequisites

Awareness of the hardware being leveraged.

Access to the hardware being leveraged.

Mitigations

Review generation of security identifiers for design inconsistencies and common weaknesses.

Review security identifier decoders for design inconsistencies and common weaknesses.

Test security identifier definition, access, and programming flow in both pre-silicon and post-silicon environments.

Skills Required

[Medium] Ability to execute actions within the SoC.

[High] Intricate knowledge of the identifiers being utilized.