6 ms·

Hey, I updated my comment with a footnote on exactly that. Not sure if you saw it. I agree it may be possible to develop an attack against the secure enclave wi

by abalone 11y ago

Hey, I updated my comment with a footnote on exactly that. Not sure if you saw it. I agree it may be possible to develop an attack against the secure enclave with a big enough budget and access to lots of sample chips to practice on. But keep in mind secure enclaves are designed to self-destruct under these circumstances, so I almost think it may entail pushing the frontier of electron microscopy and/or techniques for exposing it that are more delicate that grinding down the chip. In other words yes, I'd bet money there's a "secure enclaves" team at the NSA with a few million bucks to play with. Or teams.

cromwellian 11y ago
Another possibility is a tailored-access type attack further upstream the supply chain. For example, Apple relies on Samsung or TSMC to fab chips. It's possible the chips could be modified before manufacture, or after, to contain a flaw. I've read about such attacks demonstrated in principle already. There was a worry about the Chinese government executing such attacks for example. One of the downsides of the way global manufacturing works today that there's so many stages in which components can be intercepted. You don't know that the device you bought actually consists of unmodified versions of the components that were part of the original design. Could the NSA partner with the Korean government and Samsung to put a backdoor into components? I wouldn't rule it out.
- dogma1138 11y ago
  It would be considerably cheaper to just replicate the ASIC you want to attack in your own silicon. The secure enclave isn't so magic it's just a secondary processor that handles cryptography it has it's own memory to store variable such as failed attempts. Attacking the SOC might be more complex and expensive but eventually it's exactly the same as attacking the NAND or any other integrated circuit. For all we know the NSA could (and most likely does) develop their own in circuit debuggers for common ASIC/SOC's and just dumps what ever unique values the target SOC stores and takes a crack at it. This also isn't out of the realm of possibilities for companies that specialize in in-circuit emulation, hardware design, and forensics to create as a turn key solution.
  - abalone 11y ago
    > it's exactly the same as attacking the NAND or any other integrated circuit Not really. Secure enclaves have added defenses that NAND does not. They don't have an API that lets you read their embedded secrets, for instance. You can't just hook up a debugger. You'd have to try to get at the state of its transistors with an SEM or something. But additionally some have physical defenses against delayering that will self-destruct their contents in the event of a physical compromise. So while I ultimately agree that a nation-state could potentially craft an attack against a specific design, you're understating the difficulty.
    - dogma1138 11y ago
      Hence why I said it was more complex and expensive if you are going to quote some one please do so in full. Additionally NAND doesn't have an "API", NAND mirroring works by desoldering the memory hooking it up to a device and mirroring it to another chip by flagging the mirroring bit. There are other ways to attack hardware, you do not need to get a SEM(or AFM for that matter). Devices that probe transistors on a microscopic level exist in the industry (e.g. http://www.tek.com/sites/tek.com/files/media/document/resources/Probing%20Transistors%20App%20Note.pdf http://www.tek.com/sites/tek.com/files/media/document/resour...), hence the more complex and expensive part.
      - abalone 11y ago
        The tool you linked to actually requires an SEM. Also, you cannot "desolder" the secure enclave and hook it up to a "mirroring" device. That attack requires the NAND to be encapsulated in a desolder-able memory chip that supports reading out state. Not the case with a secure enclave.
        makomk 11y ago
        The NAND is encapsulated in a desolderable memory chip that supports reading out state. There's an anti-replay counter, but supposedly that's just stored in another external NOR flash chip with the Secure Element having no onboard flash storage at all - the process Apple builds their chips on doesn't support on-chip flash memory even if they wanted it.
- gherkin0 11y ago
  > It's possible the chips could be modified before manufacture, or after, to contain a flaw. Wouldn't Apple be able to detect such an attack, if they were looking (e.g. decap sample chips, image at high magnification, and compare to the original design files)? I don't think such an attack would work very well as a tailored access sort of thing. If the backdoored chips got into the supply chain, the general public would be affected. If the NSA wanted to only target certain people, they'd have to have a huge amount of control over Apple's supply chain, which would surely be noticed.
  - wlesieutre 11y ago
    Depends on how you buy it. If the phone is mail ordered, it would be possible to swap with a compromised device during shipping. NSA's Tailored Access Operations group is known to perform this sort of attack [1]. If you want to ensure you get a phone from the standard supply chain, buy it in-person at a store where you can see someone take it off the shelf. http://arstechnica.com/tech-policy/2014/05/photos-of-an-nsa-upgrade-factory-show-cisco-router-getting-implant/ http://arstechnica.com/tech-policy/2014/05/photos-of-an-nsa-...
  - lololomg 11y ago
    Apple noticed: http://arstechnica.com/information-technology/2016/03/report-apple-designing-its-own-servers-to-avoid-snooping/ http://arstechnica.com/information-technology/2016/03/report...
- mmmBacon 11y ago
  This is a legitimate concern I think. The US government has designated secure foundries in the US to ensure the security of government silicon. See[pdf]: http://www.ndia.org/Divisions/Divisions/SystemsEngineering/Documents/Past%20Meetings/06-20-12%20Division%20Meeting/04%20-%20Trusted%20Foundry%20Program,%20Ortiz,%20NDIA%20SE%20Talk%2020120620%20cjo2.pdf http://www.ndia.org/Divisions/Divisions/SystemsEngineering/D...
- lololomg 11y ago
  http://arstechnica.com/information-technology/2016/03/report-apple-designing-its-own-servers-to-avoid-snooping/ http://arstechnica.com/information-technology/2016/03/report... Apple already suspects that this is happening
  - colejohnson66 11y ago
    The article contains two links to previous stories where this actually happened. [0]: http://arstechnica.com/information-technology/2013/12/inside-the-nsas-leaked-catalog-of-surveillance-magic/ http://arstechnica.com/information-technology/2013/12/inside... [1]: http://arstechnica.com/tech-policy/2014/05/photos-of-an-nsa-upgrade-factory-show-cisco-router-getting-implant/ http://arstechnica.com/tech-policy/2014/05/photos-of-an-nsa-...
hackuser 11y ago
> I agree it may be possible to develop an attack against the secure enclave with a big enough budget You are assuming it's perfect in conception, design and implementation. That is a very unlikely assumption for any system.
zamalek 11y ago
> self-destruct Is this burnt silicon, or just new configuration (genuinely curious)? I'd assume that anything but a smouldering chip is in the realm of circumvention.

by abalone 11y ago

cromwellian 11y ago

Another possibility is a tailored-access type attack further upstream the supply chain. For example, Apple relies on Samsung or TSMC to fab chips. It's possible the chips could be modified before manufacture, or after, to contain a flaw. I've read about such attacks demonstrated in principle already. There was a worry about the Chinese government executing such attacks for example. One of the downsides of the way global manufacturing works today that there's so many stages in which components can be intercepted. You don't know that the device you bought actually consists of unmodified versions of the components that were part of the original design. Could the NSA partner with the Korean government and Samsung to put a backdoor into components? I wouldn't rule it out.

dogma1138 11y ago
It would be considerably cheaper to just replicate the ASIC you want to attack in your own silicon. The secure enclave isn't so magic it's just a secondary processor that handles cryptography it has it's own memory to store variable such as failed attempts. Attacking the SOC might be more complex and expensive but eventually it's exactly the same as attacking the NAND or any other integrated circuit. For all we know the NSA could (and most likely does) develop their own in circuit debuggers for common ASIC/SOC's and just dumps what ever unique values the target SOC stores and takes a crack at it. This also isn't out of the realm of possibilities for companies that specialize in in-circuit emulation, hardware design, and forensics to create as a turn key solution.
- abalone 11y ago
  > it's exactly the same as attacking the NAND or any other integrated circuit Not really. Secure enclaves have added defenses that NAND does not. They don't have an API that lets you read their embedded secrets, for instance. You can't just hook up a debugger. You'd have to try to get at the state of its transistors with an SEM or something. But additionally some have physical defenses against delayering that will self-destruct their contents in the event of a physical compromise. So while I ultimately agree that a nation-state could potentially craft an attack against a specific design, you're understating the difficulty.
  - dogma1138 11y ago
    Hence why I said it was more complex and expensive if you are going to quote some one please do so in full. Additionally NAND doesn't have an "API", NAND mirroring works by desoldering the memory hooking it up to a device and mirroring it to another chip by flagging the mirroring bit. There are other ways to attack hardware, you do not need to get a SEM(or AFM for that matter). Devices that probe transistors on a microscopic level exist in the industry (e.g. http://www.tek.com/sites/tek.com/files/media/document/resources/Probing%20Transistors%20App%20Note.pdf http://www.tek.com/sites/tek.com/files/media/document/resour...), hence the more complex and expensive part.
    - abalone 11y ago
      The tool you linked to actually requires an SEM. Also, you cannot "desolder" the secure enclave and hook it up to a "mirroring" device. That attack requires the NAND to be encapsulated in a desolder-able memory chip that supports reading out state. Not the case with a secure enclave.
      - makomk 11y ago
        The NAND is encapsulated in a desolderable memory chip that supports reading out state. There's an anti-replay counter, but supposedly that's just stored in another external NOR flash chip with the Secure Element having no onboard flash storage at all - the process Apple builds their chips on doesn't support on-chip flash memory even if they wanted it.
gherkin0 11y ago
> It's possible the chips could be modified before manufacture, or after, to contain a flaw. Wouldn't Apple be able to detect such an attack, if they were looking (e.g. decap sample chips, image at high magnification, and compare to the original design files)? I don't think such an attack would work very well as a tailored access sort of thing. If the backdoored chips got into the supply chain, the general public would be affected. If the NSA wanted to only target certain people, they'd have to have a huge amount of control over Apple's supply chain, which would surely be noticed.
- wlesieutre 11y ago
  Depends on how you buy it. If the phone is mail ordered, it would be possible to swap with a compromised device during shipping. NSA's Tailored Access Operations group is known to perform this sort of attack [1]. If you want to ensure you get a phone from the standard supply chain, buy it in-person at a store where you can see someone take it off the shelf. http://arstechnica.com/tech-policy/2014/05/photos-of-an-nsa-upgrade-factory-show-cisco-router-getting-implant/ http://arstechnica.com/tech-policy/2014/05/photos-of-an-nsa-...
- lololomg 11y ago
  Apple noticed: http://arstechnica.com/information-technology/2016/03/report-apple-designing-its-own-servers-to-avoid-snooping/ http://arstechnica.com/information-technology/2016/03/report...
mmmBacon 11y ago
This is a legitimate concern I think. The US government has designated secure foundries in the US to ensure the security of government silicon. See[pdf]: http://www.ndia.org/Divisions/Divisions/SystemsEngineering/Documents/Past%20Meetings/06-20-12%20Division%20Meeting/04%20-%20Trusted%20Foundry%20Program,%20Ortiz,%20NDIA%20SE%20Talk%2020120620%20cjo2.pdf http://www.ndia.org/Divisions/Divisions/SystemsEngineering/D...
lololomg 11y ago
http://arstechnica.com/information-technology/2016/03/report-apple-designing-its-own-servers-to-avoid-snooping/ http://arstechnica.com/information-technology/2016/03/report... Apple already suspects that this is happening
- colejohnson66 11y ago
  The article contains two links to previous stories where this actually happened. [0]: http://arstechnica.com/information-technology/2013/12/inside-the-nsas-leaked-catalog-of-surveillance-magic/ http://arstechnica.com/information-technology/2013/12/inside... [1]: http://arstechnica.com/tech-policy/2014/05/photos-of-an-nsa-upgrade-factory-show-cisco-router-getting-implant/ http://arstechnica.com/tech-policy/2014/05/photos-of-an-nsa-...

hackuser 11y ago

> I agree it may be possible to develop an attack against the secure enclave with a big enough budget You are assuming it's perfect in conception, design and implementation. That is a very unlikely assumption for any system.

zamalek 11y ago

> self-destruct Is this burnt silicon, or just new configuration (genuinely curious)? I'd assume that anything but a smouldering chip is in the realm of circumvention.