4 ms·

Sorry, but that's a clickbait headline. I clicked it expecting to see a real attack dissected, not someone's idea on attacking an hypothetical platform. (cute

Sorry, but that's a clickbait headline. I clicked it expecting to see a real attack dissected, not someone's idea on attacking an hypothetical platform. (cute idea though)

imglorp 10y ago
Nope, they built one. > As +Andreas Schou said in his share, "Okay. That's it. I give up. Security is impossible."
jMyles 10y ago
A proof-of-concept is provided. If you are saying that the only way to gauge that an attack is "clever" (an adjective I'm not sure I'd apply here anyway) is to find it in the wild, I don't think that's fair.
- flyinglizard 10y ago
  Proof of concept on your own platform doesn't count. Security wise, it gets interesting when you attack an existing product, not when you set the rules for the "attack" that you'll carry later. Obviously with this attack it's a bit of a problem to provide a PoC - but at this point comes the mislabeling of the post. Should have been called "a clever attack concept".
  - lsb 10y ago
    The attack is carried out on an existing product, an open source chip OR1200 that has its schematics generally available.
    - flyinglizard 10y ago
      Calling it an "attack" is no less of an hyperbole than changing the sources of nginx to introduce a remote exploit. What this team did is to create a compromised version of an open source product. They engineered it to be defective in the first place. This is nothing beyond a thought experiment.
      - ethbro 10y ago
        > They engineered it to be invisibly defective in the first place. That's the difference and the interesting part. Unless most people who aren't me decap their chips and go over them with an electron microscope before use...
      - hexane360 10y ago
        A compromised version that isn't noticeably different from any other version, which could be surreptitiously deployed on a large scale.
      - impdmnt2Prgrss 10y ago
        There is a crucial difference between hardware development and software development that you are missing: hardware has several stages of development/implementation that spans several parties only connected by business contracts. If you want to squeeze the attack into your analogy, it would be as if a compiler writer was malicious an added an attack to any/all nginx binaries without modifying the original source code.
iLoch 10y ago
Just because you clicked it thinking it would be something else doesn't mean it's clickbait.
- bbcbasic 10y ago
  Its hyperbolic though.
  - rosser 10y ago
    Demonstrated attacks with physical PoCs aren't hyperbolic.
    - flyinglizard 10y ago
      The magic of hacking is cleverly exploiting a given situation, not setting the rules by modifying the product to be compromised. The "attack" here would be obtaining access to the ASIC design computers, while what the article discusses is simply a backdoor to be installed by the attacker.
      - deleted 10y ago
        [deleted]
      - jgw 10y ago
        No, I don't think you're seeing the proposed attack here. As I understand it: 1. A company tapes out their chip to be fabbed, as most chips are, off-shore. The design is clean. 2. The backdoor is added after it is out of the company's hands -- say, by the fab. A single register and some wiring are not that difficult to add by hand to the design masks -- effectively, it's just an ECO. Post tape-out tampering is a mounting concern for our clients. [EDIT: I work for an ASIC Design & Verification consultancy]
      - mannykannot 10y ago
        Oh come on! As if security were a sport with rules. Your irrelevant pigeon-holing of the threat surface is just the sort of thinking that the black-hats like to see.
baby 10y ago
I agree with that downvoted comment. This is not an attack. It's a backdoor.
- c_c_c 10y ago
  That's a distinction without a difference imo. "Oh, thank goodness I was compromised by a hardware backdoor not a software flaw. What a relief!"
  - King-Aaron 10y ago
    It's a big difference, especially in a legal sense, and if that attacker is a government player. Walking in a back door which you have a key for, if argued correctly in a court, is a lot different than breaking in through a window.
    - mannykannot 10y ago
      I am not convinced that the legal difference will carry much weight with all the potential exploiters, but if it does, there is always the question of how you acquired the key.
    - c_c_c 10y ago
      No. If your job is to secure systems there is zero difference. If other than primary has key, it's not secure. If you can break in, it's not secure. Legal arguments are irrelevant.
  - flyinglizard 10y ago
    "backdoor" and "attack" refer to entirely distinct concepts: backdoor is, given administrative access to equipment or code, installing an hidden component that will be used later by an adversary. "attack" is the operational word, sometimes using a backdoor but mostly just exploiting a given system to your benefit. Coming to read this article, I'd have no problem if it stated "the most sophisticated backdoor I've ever seen", but it implied that it exposes an unprecedentedly sophisticated attack - I was expecting something operational of the Stuxnet variety, and instead I got a research paper. If this article showed how this backdoor was embedded into a real (commercial and widely used) chip - unbeknownst to the chip maker - and later used by an actual adversary, then that would be an attack.
c_c_c 10y ago
I really hope you're not involved with securing sensitive systems. This is the nightmare right here. Who cares about hardened a OS when the hardware is compromised in a way that is virtually undetectable. Very few have the resources to verify every item on the board and its purpose. The fact that this is even possible is a problem.

Sorry, but that's a clickbait headline. I clicked it expecting to see a real attack dissected, not someone's idea on attacking an hypothetical platform. (cute idea though)

imglorp 10y ago

Nope, they built one. > As +Andreas Schou said in his share, "Okay. That's it. I give up. Security is impossible."

jMyles 10y ago

A proof-of-concept is provided. If you are saying that the only way to gauge that an attack is "clever" (an adjective I'm not sure I'd apply here anyway) is to find it in the wild, I don't think that's fair.

flyinglizard 10y ago
Proof of concept on your own platform doesn't count. Security wise, it gets interesting when you attack an existing product, not when you set the rules for the "attack" that you'll carry later. Obviously with this attack it's a bit of a problem to provide a PoC - but at this point comes the mislabeling of the post. Should have been called "a clever attack concept".
- lsb 10y ago
  The attack is carried out on an existing product, an open source chip OR1200 that has its schematics generally available.
  - flyinglizard 10y ago
    Calling it an "attack" is no less of an hyperbole than changing the sources of nginx to introduce a remote exploit. What this team did is to create a compromised version of an open source product. They engineered it to be defective in the first place. This is nothing beyond a thought experiment.
    - ethbro 10y ago
      > They engineered it to be invisibly defective in the first place. That's the difference and the interesting part. Unless most people who aren't me decap their chips and go over them with an electron microscope before use...
    - hexane360 10y ago
      A compromised version that isn't noticeably different from any other version, which could be surreptitiously deployed on a large scale.
    - impdmnt2Prgrss 10y ago
      There is a crucial difference between hardware development and software development that you are missing: hardware has several stages of development/implementation that spans several parties only connected by business contracts. If you want to squeeze the attack into your analogy, it would be as if a compiler writer was malicious an added an attack to any/all nginx binaries without modifying the original source code.

iLoch 10y ago

Just because you clicked it thinking it would be something else doesn't mean it's clickbait.

bbcbasic 10y ago
Its hyperbolic though.
- rosser 10y ago
  Demonstrated attacks with physical PoCs aren't hyperbolic.
  - flyinglizard 10y ago
    The magic of hacking is cleverly exploiting a given situation, not setting the rules by modifying the product to be compromised. The "attack" here would be obtaining access to the ASIC design computers, while what the article discusses is simply a backdoor to be installed by the attacker.
    - deleted 10y ago
      [deleted]
    - jgw 10y ago
      No, I don't think you're seeing the proposed attack here. As I understand it: 1. A company tapes out their chip to be fabbed, as most chips are, off-shore. The design is clean. 2. The backdoor is added after it is out of the company's hands -- say, by the fab. A single register and some wiring are not that difficult to add by hand to the design masks -- effectively, it's just an ECO. Post tape-out tampering is a mounting concern for our clients. [EDIT: I work for an ASIC Design & Verification consultancy]
    - mannykannot 10y ago
      Oh come on! As if security were a sport with rules. Your irrelevant pigeon-holing of the threat surface is just the sort of thinking that the black-hats like to see.

baby 10y ago

I agree with that downvoted comment. This is not an attack. It's a backdoor.

c_c_c 10y ago
That's a distinction without a difference imo. "Oh, thank goodness I was compromised by a hardware backdoor not a software flaw. What a relief!"
- King-Aaron 10y ago
  It's a big difference, especially in a legal sense, and if that attacker is a government player. Walking in a back door which you have a key for, if argued correctly in a court, is a lot different than breaking in through a window.
  - mannykannot 10y ago
    I am not convinced that the legal difference will carry much weight with all the potential exploiters, but if it does, there is always the question of how you acquired the key.
  - c_c_c 10y ago
    No. If your job is to secure systems there is zero difference. If other than primary has key, it's not secure. If you can break in, it's not secure. Legal arguments are irrelevant.
- flyinglizard 10y ago
  "backdoor" and "attack" refer to entirely distinct concepts: backdoor is, given administrative access to equipment or code, installing an hidden component that will be used later by an adversary. "attack" is the operational word, sometimes using a backdoor but mostly just exploiting a given system to your benefit. Coming to read this article, I'd have no problem if it stated "the most sophisticated backdoor I've ever seen", but it implied that it exposes an unprecedentedly sophisticated attack - I was expecting something operational of the Stuxnet variety, and instead I got a research paper. If this article showed how this backdoor was embedded into a real (commercial and widely used) chip - unbeknownst to the chip maker - and later used by an actual adversary, then that would be an attack.

c_c_c 10y ago

I really hope you're not involved with securing sensitive systems. This is the nightmare right here. Who cares about hardened a OS when the hardware is compromised in a way that is virtually undetectable. Very few have the resources to verify every item on the board and its purpose. The fact that this is even possible is a problem.