Hardware Attacks and Security Education

This paper aims to develop and evaluate information assurance and security learning materials on hardware/firmware attacks for undergraduate education. Topics include firmware worms, application programming interface, and operating systems. Computing devices are equipped with firmware that performs basic hardware testing and loads operating systems. According to hardware rooted security guidelines, the following fundamental security primitives are required: roots of trust, an application programming interface (API) to the platform, and a policy enforcement engine. We believe it is important to verify these primitives' integrity with hands-on experiments to educate next generation computer experts. The learning material has been implemented and evaluated in an undergraduate Computer Architecture course using Intel's Chipsec to validate PC BIOS in terms of known vulnerabilities.