In this work we show that logical network isolation based on host and guest networks can be overcome by the use of cross-router covert channels. These two logical networks, commonly called the host network and the guest network, use the same router hardware, which is designed to isolate the two networks in software. Many organizations protect secure networked devices from non-secure networked devices by assigning each class of devices to a different logical network. Altogether, the paper shows the insufficient security of the XOM concept as well as several implementations. Our research also reveals implementation flaws in some of the analyzed devices which enables an adversary to bypass the read-out restrictions.

We successfully performed experiments on devices from different manufacturers to confirm the practicability of our attack. We demonstrate our method via an automatic recovery of protected firmware.

We present a method to infer instructions from observed state transitions in shared hardware.

Our security analysis shows that this concept is insufficient for firmware protection due to the use of shared resources such as the CPU and SRAM. The concept allows execution of code but disallows any read access to it. For this reason, microcontroller manufacturers integrate eXecute-Only Memory (XOM) which shall prevent an unauthorized read-out of third-party firmware during development. In such a scenario, the Intellectual Property (IP) is not protected against adversarial developers which have unrestricted access to the firmware binary. The development process of microcontroller firmware often involves multiple parties.

Download woot art