Hardware Attacks: a defensive hardware security course

Hardware Attacks is a defensive hardware security course about protecting physical devices, from smart locks and payment terminals to the microcontrollers inside everyday gadgets. Across 25 short sections it explains the main ways hardware can be attacked, conceptually, and spends as much time on the defences engineers use: constant-time code, protection against faults, locking down debug access, secure boot, supply chain checks, tamper resistance and defence in depth.

Software security assumes the hardware underneath can be trusted. This course explains why that assumption needs defending, and how good device design defends it.

What the course covers

The main ideas, and how devices are defended

Attack surface

A device's attack surface is every way in: its network connections and apps, but also its physical connectors, chips and circuit board. Anyone who can hold a device has more options than a remote attacker, so physical access has to be part of the threat model.

Side channels

A side channel is information that leaks from how a device works rather than from what it outputs, such as how long an operation takes or how much power it draws. If a password check takes longer when more characters are right, the timing itself gives information away. The defences are code that takes the same time whatever the input, known as constant-time code, and hardware and software designed so power use does not depend on secret values.

Faults

Fault injection means disturbing a device, for example with an unstable power supply, so that it makes a mistake at a critical moment, such as skipping a security check. Devices defend against this with sensors that detect abnormal conditions, by repeating important checks, and by failing safely when something looks wrong.

Debug ports and firmware

Circuit boards often keep the debug connections used during manufacturing. Left open in a finished product, they can give deep access to a device and its firmware. Good practice is to disable or lock debug access before shipping, enable the chip's readout protection, and encrypt firmware stored on separate chips. The course shows the difference between a real fix and simply hiding a connector.

Secure boot, supply chains and tamper resistance

Secure boot checks a digital signature on each piece of software before running it, starting from code fixed in the chip, so only trusted firmware can start. This is the chain of trust. Supply chain defences check that components and firmware have not been altered before they reach you. Tamper resistance and tamper detection make physical interference hard and noticeable, and defence in depth combines all of these so that no single failure is enough.

Try a question from the course

In secure boot, each stage checks the signature of the next before handing over. If every signature is valid, the device starts. If someone has changed the firmware, its signature no longer matches the manufacturer's key, so the check fails and a well-designed device refuses to run it.

Now decide whether a device will boot in a new situation, then press Mark to check your answer in the course.

The law and ethics

Interfering with a device or computer system you do not own, without permission, can be a criminal offence, under the Computer Misuse Act 1990 in the UK and the Computer Fraud and Abuse Act in the US. Hardware security work is done on your own devices, or with the written permission of the owner, often as part of a certification or a vendor's security programme.

Who this course is for

• Embedded and IoT developers who want to ship devices that resist physical attacks.
• Electronics and computing students interested in how security extends below software.
• Product managers and buyers who need to ask the right security questions about connected devices.

What you need to know first

The course page lists Micro Controllers first: you should know what a microcontroller, firmware and a circuit board are. The Cryptocurrencies course covers digital signatures, which secure boot relies on.

How long it takes

There are 25 sections and most take a few minutes. Learners without a plan can open two sections of a course a day, in order, so the whole course takes 13 days. A plan removes the daily limit and lets you go straight to any topic, such as secure boot.

Read next

Computer Science · CoursesEthical hacking course: web security for beginnersAn ethical hacking course on web security: the law and ethics, how common website weaknesses work, and how developers defend against them, in 26 sections.