Szczegóły CWE-1384

The product does not properly handle unexpected physical or environmental conditions that occur naturally or are artificially induced.

Sposoby wprowadzenia

Architecture and Design : The product's design might not consider checking and handling extreme conditions.
Manufacturing : For hardware manufacturing, sub-par components might be chosen that are not able to handle the expected environmental conditions.

Odpowiednie platformy

Technologie

Class: System on Chip (Undetermined)
Class: ICS/OT (Undetermined)

Typowe konsekwencje

Zaobserwowane przykłady

Potencjalne środki zaradcze

Phases : Requirements
In requirements, be specific about expectations for how the product will perform when it exceeds physical and environmental boundary conditions, e.g., by shutting down.
Phases : Architecture and Design // Implementation
Where possible, include independent components that can detect excess environmental conditions and have the capability to shut down the product.
Phases : Architecture and Design // Implementation
Where possible, use shielding or other materials that can increase the adversary's workload and reduce the likelihood of being able to successfully trigger a security-related failure.

Uwagi dotyczące mapowania podatności

Uzasadnienie : This CWE entry is a Class and might have Base-level children that would be more appropriate
Komentarz : Examine children of this entry to see if there is a better fit

Odniesienia

REF-1248

Categories of Security Vulnerabilities in ICS
Securing Energy Infrastructure Executive Task Force (SEI ETF).
https://secureenergy.inl.gov/content/uploads/27/2024/12/SEI-ETF-NCSV-TPT-Categories-of-Security-Vulnerabilities-ICS-v1_03-09-22.pdf

REF-1255

Semi-invasive attacks - A new approach to hardware security analysis
Sergei P. Skorobogatov.
https://www.cl.cam.ac.uk/techreports/UCAM-CL-TR-630.pdf

REF-1285

Physical Security Attacks Against Silicon Devices
Texas Instruments.
https://www.ti.com/lit/an/swra739/swra739.pdf?ts=1644234570420

REF-1286

On The Susceptibility of Texas Instruments SimpleLink Platform Microcontrollers to Non-Invasive Physical Attacks
Lennert Wouters, Benedikt Gierlichs, Bart Preneel.
https://eprint.iacr.org/2022/328.pdf

REF-1101

The Hard-coded Key to my Heart - Hacking a Pacemaker Programmer
Anders B. Wilhelmsen, Eivind S. Kristiansen, Marie Moe.
https://anderbw.github.io/2019-08-10-DC27-Biohacking-pacemaker-programmer.pdf

Zgłoszenie

Modyfikacje