The document discusses risks and vulnerabilities in cyber-physical systems (CPS), especially those used in defense applications. It notes that CPS integrate computation and physical processes to monitor and control systems. In the defense sector, CPS and embedded systems are critical to network-centric warfare approaches. However, these systems are vulnerable to hardware Trojans, which are malicious modifications made during integrated circuit manufacturing that can undermine trust in affected systems. Specifically, hardware Trojans could mislead information sharing between nodes in a network-centric system, degrading situational awareness and decision making with potentially severe consequences for military missions. The document calls for preventive methods at the design, fabrication, and post-fabrication stages to help address these risks

1. Introduction to Hardware
Trojan and Cyber-Physical
Systems Risks and
Vulnerabilities: A Case in
Defense Sector
Sarwono Sutikno, Dr.Eng., CISA, CISSP, CISM, CSXF
Advisor to Corruption Eradication Commission (KPK)
Associate Professor at School of Electrical Engineering and Informatics, Institut Teknologi Bandung (ITB), Bandung, Indonesia
Colonel Dr. Arwin Datumaya Wahyudi Sumari, S.T., M.T.
Policy Analyst for Contingency Plan at Deputy of Political and Strategy, Secretariat General of National Resilience Council
Head of Information Resilience Division at Desk for National Cyberspace, Coordinating Ministry for Political, Law and Security
Senior Researcher, Cognitive Artificial Intelligence Research Group (CAIRG) at School of Electrical Engineering and Informatics,
Institut Teknologi Bandung (ITB), Bandung, Indonesia

2. OUTLINE
• CYBERSPACE
• NETWORK-CENTRIC WARFARE
• CYBER-PHYSICAL SYSTEMS
• INTERNET-OF-THINGS
• RISKS AND VULNERABILITIES: HARDWARE
TROJAN
• PREVENTIVE WAYS
• CONCLUDING REMARKS
Sarwono Sutikno-Arwin Sumari@IIDSS2017 - 13 July 2017
2

3. CYBERSPACE
A global domain within the information
environment consisting of the
interdependent network of information
technology infrastructures, including the
Internet, telecommunications networks,
computer systems, and embedded
processors and controllers
Sarwono Sutikno-Arwin Sumari@IIDSS2017 - 13 July 2017
3

4. CYBERSPACE – It’s a man-made domain
What do you need?
- IT devices
- Comm links (wired/
wireless)
- Data to be exchanged
VERY
EASY
Sarwono Sutikno-Arwin Sumari@IIDSS2017 - 13 July 2017
4

5. CYBERSPACE
Air
Space
SeaLand
Sarwono Sutikno-Arwin Sumari@IIDSS2017 - 13 July 2017
5

6. NETWORK-CENTRIC WARFARE
• A digital battlefield network
• Each warfare element is an information processing
node, some of nodes are autonomous or
intelligent, some are embedded systems
• Information is exchanged amongst nodes
• Shared situational awareness
• Accelerate decision making cycle
• Decision superiority
Sarwono Sutikno-Arwin Sumari@IIDSS2017 - 13 July 2017
6

7. CYBER-PHYSICAL SYSTEMS
• The integration of computation and a physical
process
• Composed of physical process monitored and
controlled by a cyber system, which is a
networked system of distributed sensing,
communication, and computational devices
• Embedded systems can be considered CPSes
Sarwono Sutikno-Arwin Sumari@IIDSS2017 - 13 July 2017
7

8. CYBER-PHYSICAL SYSTEMS
•Characteristics:
•largescale system sizes
•heterogeneity of resources
•uncertain system dynamics
•extensive physical interactions
Sarwono Sutikno-Arwin Sumari@IIDSS2017 - 13 July 2017
8

9. INTERNET-OF-THINGS
• Devices with Internet
Protocol address that use
Internet (network) as the
medium for information
exchanging
• When everything is
connected ....
Sarwono Sutikno-Arwin Sumari@IIDSS2017 - 13 July 2017
9

10. INTERNET-OF-THINGS
Sarwono Sutikno-Arwin Sumari@IIDSS2017 - 13 July 2017
10

11. HARDWARE VULNERABILITIES
• Embedded systems are highly needed for various applications
especially in Internet-of-Things era
• Defense sector uses embedded systems in almost its weapon
equipment especially in NCW era where size is matter
• Small size embedded systems can only be achieved via
Integrated (Circuit) IC technology
• Vulnerabilities of embedded system hardware emerge from
any level of IC manufacturing
Sarwono Sutikno-Arwin Sumari@IIDSS2017 - 13 July 2017
11

12. HARDWARE TROJAN
• A malicious and deliberately
stealthy modification made
to an electronic device such
as the circuitry of an IC or
chip
• It can change the chips
functionality and thereby
undermine trust in the
systems using that chip
Sarwono Sutikno-Arwin Sumari@IIDSS2017 - 13 July 2017
12

13. HARDWARE TROJAN – TAXONOMY
Sarwono Sutikno-Arwin Sumari@IIDSS2017 - 13 July 2017
13

14. VULNERABILITIES AND RISKS
Sarwono Sutikno-Arwin Sumari@IIDSS2017 - 13 July 2017
14

15. HARDWARE TROJAN – Attack of Doping
• Doping is a process for
modifying the electrical
properties of silicon by
introducing tiny impurities like
phosphorous, boron and gallium,
into the crystal.
• By switching the doping on a few
transistors, parts of the
integrated circuit no longer work
as they should. Because the
changes happen at the atomic
level, the stuff is hard to detect.
Sarwono Sutikno-Arwin Sumari@IIDSS2017 - 13 July 2017
15

16. HARDWARE TROJAN – Attack with Payload
• Combinationally triggered Trojan –
subclass of digitally triggered
• Occurrence of condition A = 0, B = 0
at the trigger nodes A, B causes
payload node C to have an incorrect
value at Cmodified
• Attacker chooses a rare activation
condition from low-controllable
inputs making trojan unlikely to
trigger during manufacturing test
Sarwono Sutikno-Arwin Sumari@IIDSS2017 - 13 July 2017
16

17. PREVENTIVE WAYS
• At Design Level
• The ability to create trusted circuits using untrusted EDA tools
• At Fabrication Level
• Provide both hardware specifications and a list of “security-related properties.”
There must be an agreement among Customers and manufactures on the
requirements of the specified hardware to be fabricated
• At Post-Fabrication Level
• Reconfigurable logic could be placed between the output of some ICs and the
input of other ICs to cut attacker access at the Register Transfer Level
Sarwono Sutikno-Arwin Sumari@IIDSS2017 - 13 July 2017
17

18. Internet-of-
Things
Cyber-Physical
Systems
Critical
Infrastructures
Embedded
Systems
Networked
System
High
Vulnerability
and Very
Risky
Spy Satellite
Spy Satellite
Operation Field
UAV
Example on NCW for
Military Operation
Sarwono Sutikno-Arwin Sumari@IIDSS2017 - 13 July 2017
18

19. Risks on NCW
• Satellite may send mislead information to other nodes (F-16, UAV,
AEW/C, MPA, Radar). The same occurs to other nodes
• Avionics system may not work properly and may risk the aircrafts
(accident, friendly fire etc.)
• Reconnaissance system may be degraded
• Radar system may detect erroneous targets
• Information exchange may be delayed
• Field Operation may be mapped wrongly
• Shared situational awareness may not be achieved
• Decision made may unprecise and risk the units
• Decision superiority may not be achieved
• Victory may not be achieved, too and probably loose
Sarwono Sutikno-Arwin Sumari@IIDSS2017 - 13 July 2017
19

20. CONCLUDING REMARKS
• Real examples of CPS are embedded systems which have been parts
of various application especially in Defense sector
• CPSes give full support to military mission moreover now is NCW era
• CPSes hardware is vulnerable to hardware attack i.e. Hardware
Trojan, and is almost impossible to be detected
• Trojan attack to military equipment during military mission may
cause severe looses not only to the equipment themselves but also to
the objective of the mission itself
Sarwono Sutikno-Arwin Sumari@IIDSS2017 - 13 July 2017
20

21. REFERENCES
• A.D.W. Sumari, Letnan Kolonel Lek, Dr., S.T., M.T., (2011), Optimalisasi Sistem K4IPP guna Meningkatkan Efektivitas
Pengambilan Keputusan dalam rangka Mendukung Tugas-Tugas TNI AU, Taskap Terbaik Peraih Penghargaan
“Sastratama”, Seskoau A-48, Bandung
• A.D.W. Sumari, Dr., S.T., M.T., Kolonel Lek (2015), Kedaulatan Cyber Indonesia dari Perspektif Militer, Simposium
Nasional CyberSecurity (SNCS) 2015, Kemenkopolhukam, 3-4 Juni 2015
• A. Iqbal (2013), “Security Threats in Integrated Circuits”, https://sdm.mit.edu/security-threats-in-integrated-
circuits/#note-xiii
• A. Tiwari (2015), “Hardware Trojans”, https://www.slideshare.net/OWASPdelhi/hardware-trojans-by-anupam-tiwari
• P. Paganini (2013), “Integrated circuits can be compromised using Undetectable hardware Trojans”,
http://thehackernews.com/2013/09/Undetectable-hardware-Trojans.html
• Ramesh Karri, Kurt Rosenfeld, Jeyavijayan Rajendran, Mohammad Tehranipoor, "Trustworthy Hardware: Identifying
and Classifying Hardware Trojans", Computer, vol. 43, no. , pp. 39-46, October 2010
• X. Cao (2015), “Hardware Trojan vulnerability “,
http://lib.dr.iastate.edu/cgi/viewcontent.cgi?article=5654&context=etd
• Hardware attacks, backdoors and electronic component qualification,
http://resources.infosecinstitute.com/hardware-attacks-backdoors-and-electronic-component-qualification/
• http://gauss.ececs.uc.edu/Courses/c6056/pdf/hardware.pdf
Sarwono Sutikno-Arwin Sumari@IIDSS2017 - 13 July 2017
21