This news is classified in: Defense Cyber Defense / IT
Jun 8, 2020
Electronic systems – from the processors powering smartphones to the embedded devices keeping the Internet of Things humming – have become a critical part of daily life. The security of these systems is of paramount importance to the Department of Defense (DoD), commercial industry, and beyond. To help protect these systems from common means of exploitation, DARPA launched the System Security Integration Through Hardware and Firmware (SSITH) program in 2017. Instead of relying on patches to ensure the safety of our software applications, SSITH seeks to address the underlying hardware vulnerabilities at the source. Research teams are developing hardware security architectures and tools that protect electronic systems against common classes of hardware vulnerabilities exploited through software.
To help harden the SSITH hardware security protections in development, DARPA today announced its first ever bug bounty program called, the Finding Exploits to Thwart Tampering (FETT) Bug Bounty. FETT aims to utilize hundreds of ethical researchers, analysts, and reverse engineers to deep dive into the hardware architectures in development and uncover potential vulnerabilities or flaws that could weaken their defenses. DARPA is partnering with the DoD’s Defense Digital Service (DDS) and Synack, a trusted crowdsourced security company on this effort. In particular, FETT will utilize Synack’s existing community of vetted, ethical researchers as well as artificial intelligence (AI) and machine learning (ML) enabled technology along with their established vulnerability disclosure process to execute the crowdsourced security engagement.
Bug bounty programs are commonly used to assess and verify the security of a given technology, leveraging monetary rewards to encourage hackers to report potential weaknesses, flaws, or bugs in the technology. This form of public Red Teaming allows organizations or individual developers to address the disclosed issues, potentially before they become significant security challenges.
Forecasts by Deployment Mode (Cloud-based, On-premise), by Component (Hardware, Software, Services), by End-user (Army, Navy, Air Force, Cyber Commands), by Security Type (Network Security, Endpoint Security, Application Security, Cloud-based Security, Data Security), by Solutions (Threat Intelligence and Response Management, Identity and Access Management (IAM), Intrusion Detection and Prevention Systems (IDPS), Security Information and Event Management (SIEM), Firewall, Other) AND Regional and Leading National Market Analysis PLUS Analysis of Leading Companies AND COVID-19 Impact and Recovery Pattern Analysis
Download free sample pages“The FETT Bug Bounty is a unique take on DARPA’s more traditional program evaluation efforts,” said Keith Rebello, the DARPA program manager leading SSITH and FETT. “FETT will open SSITH’s hardware security protections to a global community of ethical researchers with expertise in hardware reserve engineering to detect potential vulnerabilities, strengthen the technologies, and provide a clear path to disclosure.”
While most bug bounty programs focus on software evaluation, FETT is unique in making hardware instances available for Red Teaming. Security researchers will be given access to emulated systems running in the Amazon Web Services (AWS) EC2 F1 cloud. Each emulated system is FPGA-based and includes a RISC-V processor core, modified to include the hardware security protections developed under SSITH. The software stack on each emulated system is expected to contain known vulnerabilities, with the SSITH hardware security protections intended to prevent exploitation of these vulnerabilities. These vulnerabilities will be based on common classes of security weaknesses as identified by the MITRE Common Weakness Enumeration Specification (CWE) and NIST, including buffer errors, information leakage, resource management, numeric errors, etc. Security researchers will be tasked with devising novel exploit mechanisms to bypass the hardware security protections and sharing their findings through the established disclosure process.
“There is a lot of complexity associated with hardware architectures, which is why we wanted to provide ample time for interested researchers to understand, explore, and evaluate the SSITH protections,” noted Rebello. While most of Synack’s crowdsourced security engagements run for two weeks or continuous year round, FETT is expected to run from July to September 2020 to allow for extensive analysis and testing of the hardware.
SSITH hardware security protections developed by researchers at SRI International and the University of Cambridge, the Massachusetts Institute of Technology (MIT), University of Michigan, and Lockheed Martin will be available for evaluation. Over the past two years, these research teams have explored a number of different design approaches and their techniques generally involve providing the hardware with more information about what the software is trying to do. With this insight, the hardware can become a more active participant in defense and guard against accidental or malicious transgressions. The research teams are working closely with Galois, a computer science research and development company, to transition the emulated systems to the cloud and support ongoing evaluation efforts.
To help demonstrate the pervasiveness of electronic systems and criticality of their security, researchers will see SSITH defenses used within a number of electronic system application frameworks. This will include a medical records database system, a password authentication system for personal computers, and several additional computer software programs that are utilizing SSITH’s protections.
“Among the vulnerable applications found in FETT is a web-based voter registration system. Successful integration of the SSITH hardware protection technologies aims to ultimately protect the underlying voter information from manipulation or disclosure, even in the presence of vulnerabilities in the system's software. The goal with this demonstrator, as well as the other application systems, is to show how SSITH technologies could help protect critical infrastructure, and potentially prevent the erosion of trust in things like our election process or healthcare systems,” said Rebello.
Prior to the start of FETT, Synack is running a Capture-the-Flag (CTF) qualifier for any hacker, reverse engineer, or cybersecurity enthusiast interested in gaining access to the SSITH defenses. Security researchers that are not currently Synack Red Team (SRT) members will be provided an opportunity to earn a Technical Assessment ‘Fast Pass’ to join SRT (legal verification steps still required) through the CTF event. Current SRT members that meet the skills criteria will be granted access to the program throughout the life of the engagement. The CTF event is expected to run from June 15-29, 2020. Additional information is available at https://go.synack.com/darpa-ctf-registration-page.html.
The FETT Bug Bounty will be open to Technical Assessment ‘Fast Pass’ holders as well as verified SRT members in July 2020. Additional information is available at FETT.darpa.mil.
