  The hardware security community has made significant advances in detecting
Hardware Trojan vulnerabilities using software fuzzing-inspired automated
analysis. However, the Electronic Design Automation (EDA) code base itself
remains under-examined by the same techniques. Our experiments in fuzzing EDA
tools demonstrate that, indeed, they are prone to software bugs. As a
consequence, this paper unveils HeisenTrojan attacks, a new hardware attack
that does not generate harmful hardware, but rather, exploits software
vulnerabilities in the EDA tools themselves. A key feature of HeisenTrojan
attacks is that they are capable of deploying a malicious payload on the system
hosting the EDA tools without triggering verification tools because
HeisenTrojan attacks do not rely on superfluous or malicious hardware that
would otherwise be noticeable. The aim of a HeisenTrojan attack is to execute
arbitrary code on the system on which the vulnerable EDA tool is hosted,
thereby establishing a permanent presence and providing a beachhead for
intrusion into that system. Our analysis reveals 83% of the EDA tools analyzed
have exploitable bugs. In what follows, we demonstrate an end- to-end attack
and provide analysis on the existing capabilities of fuzzers to find
HeisenTrojan attacks in order to emphasize their practicality and the need to
secure EDA tools against them.

Cryptography and Security