3 ms·
This is a neat paper. One of the tricky parts of making a malicious circuit is the fact that you want your behavior to only be triggered on some unlikely condit
by moyix 10y ago
This is a neat paper. One of the tricky parts of making a malicious circuit is the fact that you want your behavior to only be triggered on some unlikely condition.
In other words you want:
if (counter == 0x686e686e) { do evil }
else counter++;
But that requires a lot of hardware.
What the authors realized is that essentially a simple capacitor can be used as a counter! Each time you reach the condition it adds a bit of charge to the capacitor, until at the appropriate moment it discharges and changes the state of the chip in some way.
This is a really clever bit of design, getting something general-purpose and malicious out of a single capacitor!
- impdmnt2Prgrss 10y agoThe paper uses two capacitors that share charge to get the same effect as your code. In effect Cunit (the smaller capacitor) is the increment (i.e., counter++), while Cmain (the larger capacitor) acts as the count-holding variable (i.e., counter). Another circuit (Schmitt Trigger) acts as the comparator.
- moyix 10y agoThanks for the clarification! I'm definitely not a hardware expert and was going off of what I remembered from the talk on Monday.