Overview
Silicon Heist examines a pre-mitigation privilege-escalation path in AMD UltraScale+ FPGA instances on AWS F1 and F2. The series maps the provider shell and regional isolation model, then traces how a tenant-reachable ICAP could enable internal JTAG, expose device state, and alter reachable hardware after verification. It separates cloud-demonstrated, locally validated, vendor-confirmed, and scenario-based claims, and closes with control-plane mitigations whose costs include functionality, monitoring independence, irreversibility, and fleet reach. The case is bounded to the evaluated devices and reported disclosure status, not proof of a current universal cloud-FPGA flaw.
Learning outcomes
- The pre-mitigation AWS F1/F2 flow let a regular tenant reach ICAP and activate internal JTAG after deployment.
- ICAP turned a checked workload into a possible source of later configuration commands in a reachable region.
- The eFuse lockout and ransom scenario was validated locally, not destructively executed on AWS.
- AWS and AMD reported mitigations before publication, but the case remains a warning about tenant-caused hardware transitions.
Keywords
Preview every chapter · Unlock full text, audio, and video from chapter 4
PlansFAQ
What did Silicon Heist demonstrate on AWS F1 and F2?
On pre-mitigation AWS F1/F2, the researchers reached ICAP, activated internal JTAG, read security-related state, and changed reachable hardware non-destructively. They did not program eFuses on Amazon hardware.
How can ICAP lead to internal JTAG access?
ICAP lets running FPGA logic submit configuration operations, which can activate a MASTER_JTAG path after deployment. The evaluated flow did not prohibit the extra ICAP in a secondary SLR.
Was the Silicon Heist ransomware scenario carried out against AWS?
No. Cloud work was limited to non-destructive reads and experiments; the irreversible eFuse lockout was validated on local hardware, so the ransom scenario is conditional rather than a reported AWS incident.
Does this finding apply to every cloud FPGA?
No. The evaluation focused on AMD Virtex UltraScale+ devices in AWS F1 and F2, and the Articles state that other vendors and devices may differ.