Designing and implementing malicious hardware

Our memory access mechanism provides hardware sup- port for unprivileged malicious software by allowing ac- cess to privileged memory regions. Malicious software triggers the attack by forcing a sequence of bytes on the data bus to enable the memory access circuits. This se- quence can be arbitrarily long to avoid false positives and the particular sequence must be agreed upon be- fore deployment. Once the sequence is observed, the MMU in the data cache ignores CPU privilege levels for memory accesses, thus granting unprivileged soft- ware access to all memory, including privileged mem- ory regions like the operating system’s internal mem- ory. In other words, loading a magic value on the data bus...