3 ms·

I was curious about how a CPU backdoor would work: http://es.slideshare.net/ortegaalfredo/deep-submicronbackdoorsortegasyscan2014slides http://es.slideshare.ne

I was curious about how a CPU backdoor would work: http://es.slideshare.net/ortegaalfredo/deep-submicronbackdoorsortegasyscan2014slides http://es.slideshare.net/ortegaalfredo/deep-submicronbackdoo... This example is a memory inspector and poker. On a side note, I think using a LEON MCU would be smart for this kind of demonstration, the code is free and it's synthetisable in a lot of targets.

stock_toaster 11y ago
Another example[1] (actual paper[2]) of potential for cpu backdoors. [1]: https://ece.umass.edu/news/paper-stealthy-trojans-attracting-international-attention https://ece.umass.edu/news/paper-stealthy-trojans-attracting... [2]: http://sharps.org/wp-content/uploads/BECKER-CHES.pdf http://sharps.org/wp-content/uploads/BECKER-CHES.pdf
Cieplak 11y ago
At minute 39:30, the lecturer demonstrates a snippet of HDL which will transition the CPU to ring 0 if a very specific instruction is passed to the processor core: https://www.youtube.com/watch?v=fwyh3Vychj8 https://www.youtube.com/watch?v=fwyh3Vychj8
- thesz 11y ago
  BTW, this kind of backdoor would be very visible in Bluespec. Bluespec is very concerned about resource use and you will have to make extra effort to bring (really unneeded) resources to be accessible during interesting stages of CPU pipeline.
  - Cieplak 11y ago
    Absolutely true, if you have the source code, which is trade secret. Correct me if I'm wrong, but Bluespec is like Haskell that compiles to Verilog? Seems pretty neat. Any such thing as circuit decompilers? In my imagination, they look like as huge boxes with tunneling electron microscopes inside, where you input a chip and it outputs source code.
    - joshvm 11y ago
      The closest I've seen to that are the guys that reverse engineered a 6502 at the transistor level and built a "perfect" emulator for it. http://www.visual6502.org/ http://www.visual6502.org/ I think even with modern computer vision techniques, it would be very very difficult to do this kind of thing automatically. If you were a big state with cheap labour, you could probably hire a load of people to do nothing but map traces all day.
    - Cieplak 11y ago
      @joshvm looks like we ran out of thread depth.. That's super cool. I wanted to show you this too if you hadn't seen it already: http://zeptobars.ru/en/read/KR580VM80A-intel-i8080-verilog-reverse-engineering http://zeptobars.ru/en/read/KR580VM80A-intel-i8080-verilog-r...
      - CamperBob2 11y ago
        That is extremely neat. I wouldn't have thought you could build an 8080 in less than 1K lines of Verilog.
imglorp 11y ago
Network controllers with DMA would also be prime targets that could even be tailored for a specific victim's network. They can sit passively and monitor for interesting network traffic as well as sift through memory unimpeded. And when something needs exfiltrating, it can send out packets undetectable by the cpu. Edit- oh, and dropping code into memory for the CPU to run is not unpossible either.

stock_toaster 11y ago

Another example[1] (actual paper[2]) of potential for cpu backdoors. [1]: https://ece.umass.edu/news/paper-stealthy-trojans-attracting-international-attention https://ece.umass.edu/news/paper-stealthy-trojans-attracting... [2]: http://sharps.org/wp-content/uploads/BECKER-CHES.pdf http://sharps.org/wp-content/uploads/BECKER-CHES.pdf

Cieplak 11y ago

At minute 39:30, the lecturer demonstrates a snippet of HDL which will transition the CPU to ring 0 if a very specific instruction is passed to the processor core: https://www.youtube.com/watch?v=fwyh3Vychj8 https://www.youtube.com/watch?v=fwyh3Vychj8

thesz 11y ago
BTW, this kind of backdoor would be very visible in Bluespec. Bluespec is very concerned about resource use and you will have to make extra effort to bring (really unneeded) resources to be accessible during interesting stages of CPU pipeline.
- Cieplak 11y ago
  Absolutely true, if you have the source code, which is trade secret. Correct me if I'm wrong, but Bluespec is like Haskell that compiles to Verilog? Seems pretty neat. Any such thing as circuit decompilers? In my imagination, they look like as huge boxes with tunneling electron microscopes inside, where you input a chip and it outputs source code.
  - joshvm 11y ago
    The closest I've seen to that are the guys that reverse engineered a 6502 at the transistor level and built a "perfect" emulator for it. http://www.visual6502.org/ http://www.visual6502.org/ I think even with modern computer vision techniques, it would be very very difficult to do this kind of thing automatically. If you were a big state with cheap labour, you could probably hire a load of people to do nothing but map traces all day.
  - Cieplak 11y ago
    @joshvm looks like we ran out of thread depth.. That's super cool. I wanted to show you this too if you hadn't seen it already: http://zeptobars.ru/en/read/KR580VM80A-intel-i8080-verilog-reverse-engineering http://zeptobars.ru/en/read/KR580VM80A-intel-i8080-verilog-r...
    - CamperBob2 11y ago
      That is extremely neat. I wouldn't have thought you could build an 8080 in less than 1K lines of Verilog.

imglorp 11y ago

Network controllers with DMA would also be prime targets that could even be tailored for a specific victim's network. They can sit passively and monitor for interesting network traffic as well as sift through memory unimpeded. And when something needs exfiltrating, it can send out packets undetectable by the cpu. Edit- oh, and dropping code into memory for the CPU to run is not unpossible either.