Disable Crypto Hardware (T1600.002) is a sub-technique of Weaken Encryption, in the Defense Impairment tactic, for the Network Devices platform.
How attackers use it
MITRE explains that many routers, switches and firewalls encrypt traffic, and often have dedicated encryption hardware. That hardware greatly increases the speed of encryption and helps prevent malicious tampering.
When an adversary controls such a device, they may disable that hardware, for example through Modify System Image, which forces encryption to run in software on general processors. That is typically used together with attacks that weaken cipher strength in software, such as Reduce Key Space. The purpose, per MITRE, is to take advantage of weaknesses in software encryption and reduce the effort needed to collect, manipulate and exfiltrate transmitted data.
How to detect it
MITRE's detection strategy lists these signs:
- Unusual CLI commands that change hardware acceleration settings.
- Unexpected firmware or configuration updates.
- Logs that show a fallback from hardware to software encryption.
- Degraded encryption performance, such as a sudden drop in throughput.
- Changes in cipher negotiation behavior consistent with missing hardware acceleration.
If a device that handled a certain tunnel throughput suddenly slows down at the same moment a configuration change appears in the logs, treat it as worth a look.
How to reduce the risk
MITRE lists no separate mitigations here. Disabling hardware typically relies on a modified image, so apply controls for Modify System Image: multi-factor authentication for administrators, signed images, boot integrity checks, and a small set of administrators.
Record normal throughput and CPU load on crypto-heavy devices so a change stands out.
Quick check
Why might throughput drop when crypto hardware is disabled?
Encryption falls back to general processors, which is slower than dedicated hardware.
