CWE-1263 covers products designed to restrict access to certain information that do not sufficiently protect against someone with physical access. It is a broad class, relevant to any team that ships hardware an attacker can pick up.
How it happens
Parts of a product that are meant to be off limits can become reachable if the physical protections are too weak. Sometimes this is by accident and sometimes through deliberate effort. How strong the protection must be depends on the kind of product. Picking the right physical protection and enforcing it through both implementation and manufacturing is critical to overall physical security.
MITRE lists confidentiality and integrity as impacts, with access control effects that vary by context.
What an attacker gains
Whatever the restricted area guarded. That could be stored secrets, configuration or the ability to change the device. The record says the effects vary by context.
How to find it
No detection methods are listed. The mitigations suggest the checks: test whether the protection mechanism actually stops unauthorized access, and verify that every mechanism is active on units as they leave manufacturing.
How to fix it
MITRE's mitigations by phase:
- Design. Requirements depend on context, including how much risk of compromise is acceptable. Designers can add anti-tampering measures that protect against tampering or detect it.
- Testing. Establish a method to determine whether the protection is sufficient to prevent unauthorized access.
- Manufacturing. Ensure all protection mechanisms are fully activated at manufacture and distribution.
Quick check
Who decides how strong the protection should be?
It depends on the product and the acceptable level of risk if the protection is compromised, per MITRE.
Why is manufacturing named as a phase?
A protection that is designed but not switched on in shipped units gives no protection, so all mechanisms must be fully activated at manufacture and distribution.
