Designing and implementing a Malicious 8051 processor

We report our experiences in designing and implementing several hardware Trojans within the framework of the Malicious Processor Design Challenge competition. It was held as part of the Cyber Security Awareness Week (CSAW) at the Polytechnic Institute of New York University in November 2011. A malicious processor provides an attacker the ability to bypass traditional defensive techniques as they occupy a layer below the entire software stack. To show that, we present several attack techniques employing hardware Trojans to compromise the security of an 8051 processor performing RC-5 encryption algorithm implemented on a Digilent ATLYS Spartan-6 FPGA development board. We show three powerful attacks using extra hardware: a back door Trojan allows an attacker dump the whole or partial memory region, a bomb counter Trojan disables/enables special/extra functions, and a power sink Trojan exposes the state of the carry flag by changing the power profile of the system.