Analysis of Attack Surfaces and Practical Attack Examples in Open Source FPGA CAD Tools

FPGAs gain increasing utilization in system prototyping, low-volume products, and obsolete component replacement. Driven by high profits, FPGA deployment is suffering from various attacks, such as reverse engineering bitstream, functionality tampering via hardware Trojans, information leaking through covert channels, and denial-of-service attacks. Typically, the investigation of security threats on FPGA deployment is tied with a specific FPGA chip and its design suite version, either the discovered attacks or the developed countermeasures are not easy to migrate to other FPGAs. Thus, the utilization of open source FPGA CAD tools becomes increasingly attractive. This work analyzes the new attack surfaces on two open source FPGA CAD tools: VTR and Symbiflow. The case studies in this work indicate that practical attacks in open source FPGA computeraided-design (CAD) tools can be implemented with minor changes on the intermediate files generated by the CAD toolchain.

I. Introduction

FPGAs are prevalent in system prototyping, hardware implementation for low-volume products, and the replacement of obsolete components in legacy systems [1], [2]. As highlighted in the work [3], FPGA security gains increasing attention [4]. There are extensive research efforts on the secure operations conducted by FPGA devices and safe bitstream delivery. Driven by the large market profit, attackers are motivated to degrade the performance of FPGA based systems by using counterfeit FPGA chips [5], pirate the hardware description of FPGA configuration by reverse engineering the bitstream [6], or tamper with the FPGA configuration via malicious FPGA ComputerAided-Design (CAD) tools.