5 ms·
$100 billion is not unrealistic for typical defense budgets. Modern warfare is transitioning from lead to silicon. It takes 6 lines of VHDL to backdoor a CPU.
by Cieplak 11y ago
$100 billion is not unrealistic for typical defense budgets. Modern warfare is transitioning from lead to silicon. It takes 6 lines of VHDL to backdoor a CPU. Modern chips have billions of transistors. It would be irresponsible of any modern superpower not to ensure their nation's machines are secure. I am a US citizen, but if I were a Chinese national, I might be worried about things like Intel Active Management Technology. Maybe mutual defense is a good thing if it prevents escalation. I'm still outraged that members of my Congress proposed violent conflict with China as an appropriate reaction to a data breech, as if their own organization had never accessed Chinese systems without authorization. It's probably just theatrics of elected officials from states with large military presence, but how evil is it to propose killing people for sneaking into your computers which you failed to secure properly?
- nraynaud 11y agoI was curious about how a CPU backdoor would work: http://es.slideshare.net/ortegaalfredo/deep-submicronbackdoorsortegasyscan2014slides http://es.slideshare.net/ortegaalfredo/deep-submicronbackdoo... This example is a memory inspector and poker. On a side note, I think using a LEON MCU would be smart for this kind of demonstration, the code is free and it's synthetisable in a lot of targets.
- stock_toaster 11y agoAnother example[1] (actual paper[2]) of potential for cpu backdoors. [1]: https://ece.umass.edu/news/paper-stealthy-trojans-attracting-international-attention https://ece.umass.edu/news/paper-stealthy-trojans-attracting... [2]: http://sharps.org/wp-content/uploads/BECKER-CHES.pdf http://sharps.org/wp-content/uploads/BECKER-CHES.pdf
- Cieplak 11y agoAt minute 39:30, the lecturer demonstrates a snippet of HDL which will transition the CPU to ring 0 if a very specific instruction is passed to the processor core: https://www.youtube.com/watch?v=fwyh3Vychj8 https://www.youtube.com/watch?v=fwyh3Vychj8
- thesz 11y agoBTW, this kind of backdoor would be very visible in Bluespec. Bluespec is very concerned about resource use and you will have to make extra effort to bring (really unneeded) resources to be accessible during interesting stages of CPU pipeline.
- Cieplak 11y agoAbsolutely true, if you have the source code, which is trade secret. Correct me if I'm wrong, but Bluespec is like Haskell that compiles to Verilog? Seems pretty neat. Any such thing as circuit decompilers? In my imagination, they look like as huge boxes with tunneling electron microscopes inside, where you input a chip and it outputs source code.
- joshvm 11y agoThe closest I've seen to that are the guys that reverse engineered a 6502 at the transistor level and built a "perfect" emulator for it. http://www.visual6502.org/ http://www.visual6502.org/ I think even with modern computer vision techniques, it would be very very difficult to do this kind of thing automatically. If you were a big state with cheap labour, you could probably hire a load of people to do nothing but map traces all day.
- Cieplak 11y ago@joshvm looks like we ran out of thread depth.. That's super cool. I wanted to show you this too if you hadn't seen it already: http://zeptobars.ru/en/read/KR580VM80A-intel-i8080-verilog-reverse-engineering http://zeptobars.ru/en/read/KR580VM80A-intel-i8080-verilog-r...
- CamperBob2 11y agoThat is extremely neat. I wouldn't have thought you could build an 8080 in less than 1K lines of Verilog.
- imglorp 11y agoNetwork controllers with DMA would also be prime targets that could even be tailored for a specific victim's network. They can sit passively and monitor for interesting network traffic as well as sift through memory unimpeded. And when something needs exfiltrating, it can send out packets undetectable by the cpu. Edit- oh, and dropping code into memory for the CPU to run is not unpossible either.
- Gustomaximus 11y ago> I'm still outraged that members of my Congress proposed violent conflict with China as an appropriate reaction to a data breech, as if their own organization had never accessed Chinese systems without authorization This +1. We are supposed to be intelligent adults but this behaviour is more like schoolyard bullies that behave one way and then cry foul when another does the same.
- beambot 11y agoPsychology, naming & shaming, PR, politicking, and propaganda are important parts of any conflict. Just look at the cold war. It's not hypocritical; it's part of the game.
- amelius 11y ago> It takes 6 lines of VHDL to backdoor a CPU Are they still using VHDL? I wonder what hardware languages are being used by Intel and ARM.
- typon 11y agoA lot of companies still use VHDL to write IPs. Systemverilog is the de facto standard in verification, but VHDL with its strong typing remains a favorite for writing synthesizable code.
- oflordal 11y agoARMs customer facing code is 100% verilog and this reflects most of the industry.
- trsohmers 11y agoThey do provide VHDL models for at least some components I have seen, but Verilog is what they do seem to prefer)
- trsohmers 11y agoVHDL is used primarily in Europe (and in some academic classes in the US), while Verilog is used by the vast majority of businesses in the US, and most of the top schools for VLSI. I know that the vast majority of chip designers I know (which are 90% US based) much prefer Verilog. As for Intel and ARM, both are primarily Verilog shops, but I know ARM provides both Verilog and VHDL models for the licensed components.
- dogma1138 11y agoWhile defense is surely an important by product of an indigenous semiconductor industry the simply truth is that China is now on the edge of collapsing back on it self. China became an economic superpower because it had a huge labor force to offer cheaply and provided an environment in which international corporations could exploit (not necessarily with a negative confutation but rather the direct dictionary definition of the word) it easily. They are coming to the point in which they need to import a very large amount of the components which is ending up in the electronics which are being made in China even basic stuff (e.g. high quality capacitors are still primary made in Japan, same goes for thin film resistors and other high precision electronics). With electronics becoming nothing more than system on chip China needs to be able to compete locally if nothing than at least to offer cheaper local alternatives (A Chinese MediaTek for example), if they'll fail they risk at severely cutting the profitability and hence the income from Chinese manufacturing and risking quite a bit of it being actually shipped overseas especially when your production can be highly automated and scaled up without the need for a large and cheap labor force. Another lucrative aspect that China has been offering is it's "design and manufacturing engineering" expertise you could go with a rough idea and a sketch to China and get 50 engineers all of who are experts in various fields of manufacturing from injection molding to electronic assembly and get your product out of the way. To maintain this capability China needs to be able to design bespoke silicon just as easily as they can design a bespoke plastic shell which will be injection molded and then ultrasonically welded.
- deleted 11y ago[deleted]
- samstave 11y ago>Modern warfare is transitioning from lead to silicon For some reason - this really made it sink in... The cold war WRT electronics in the next few years is going to be very interesting. The dystopian cyberpunk landscape we read about in the 80s was utopian vs the reality of what we will see in the future.