  Owning a high-end semiconductor foundry is a luxury very few companies can
afford. Thus, fabless design companies outsource integrated circuit fabrication
to third parties. Within foundries, rogue elements may gain access to the
customer's layout and perform malicious acts, including the insertion of a
hardware trojan (HT). Many works focus on the structure/effects of a HT, while
very few have demonstrated the viability of their HTs in silicon. Even fewer
disclose how HTs are inserted or the time required for this activity. Our work
details, for the first time, how effortlessly a HT can be inserted into a
finalized layout by presenting an insertion framework based on the engineering
change order flow. For validation, we have built an ASIC prototype in 65nm CMOS
technology comprising of four trojaned cryptocores. A side-channel HT is
inserted in each core with the intent of leaking the cryptokey over a power
channel. Moreover, we have determined that the entire attack can be mounted in
a little over one hour. We also show that the attack was successful for all
tested samples. Finally, our measurements demonstrate the robustness of our SCT
against skews in the manufacturing process.
