3 ms·

"Obviously such attacks are possible, but are they likely? I can see how the cat-and-mouse game of IP protection would lead to all kinds of dirty tricks, but wh

"Obviously such attacks are possible, but are they likely? I can see how the cat-and-mouse game of IP protection would lead to all kinds of dirty tricks, but what would be the profit in introducing a backdoor that could be leveraged to break crypto or an RNG?" You get paid directly by the parties wanting it. That's what Crypto AG did for NSA a long time ago. They weren't making enough money so they risked whole business on a large sum of money to cripple machines sent to specific parties. The Snowden leaks quite clearly say this is going on domestically and with foreign companies although not clear on what (i.e. hardware) they're sabotaging to break the crypto: https://theintercept.com/document/2014/10/10/national-initiative-protection-program-sentry-eagle/ https://theintercept.com/document/2014/10/10/national-initia... For the locals, they paid between $30-80 million in one time fees to "SIGINT-enable" them per other leaks. Foreign nation-states, esp China, stay doing this sort of thing but usually with human assets working for the company to plant stuff. Now back to hardware. You're probably having a hard time imagining how it would look or even make sense commercially outside a shady deal with No Such Agency. The first example was a wireless communications in non-online device. The embedded system just needed a cheap SOC. The engineers decided on an integrated one that was used in budget mobiles and data collection since they were already getting them dirt cheap for the phones. The RTOS was of course an insecure one common in embedded. Totally justified by the fact it was an offline device. The device could be hit with a software flaw that would enable remote access or location tracking via that silicon users had no knowledge of. In this case, though, they were just doing it to save development time & maybe quarters to dollars on each device. Hardware guy said this stuff wasn't unusual due to three trends in ASIC development: 1. Need to add features to increase competitiveness. 2. Need to reduce number of new designs or components to keep costs down (esp mask costs). 3. Need to offer multiple tiers of capabilities and pricing on products ideally not paying for each individual one. Hiding existing functionality they already bought or built in others is the natural solution to this. It's why 3G chips might be in CPU's or MCU's (eg Intel's ARC) might be in chips you didn't know had them. The hard disk companies are one of few that got caught doing it in that it's cheaper to mass-produce (for example) 1TB platters for all HD's of given model than many different platters. They just had a firmware or hardware setting in the chip to make it pretend to be lower space that they charged less for. AMD's triple-cores were another that was more open & reasonable where they were quad-cores with one defective core. They just turned it off then sold them as cheaper triple-cores. On mobile side, Shenzhen takes the cake with them cloning, modifying, and reselling anything you can think of. Their fake iPhone hit the Chinese market before the iPhone did officially at a fraction of the price. I'll let you wonder of security implications of high-ranking laypersons in business using an iPhone without any of its protection mechanisms built-in to CPU & OS. This doesn't even count all the counterfeit Chinese chips in U.S. products and military gear DOD reported on. The weaknesses are already there. They're there for commercial rather than surveillance reasons. Many benefit the surveillance state with those parties bribing or coercing the companies to enable them for SIGINT. In some cases, like with RSA, they introduce backdoors directly for money that had no plausible explanation of benefit. Intel's chip-level backdoor, AMT, is sold as great for management & runs even when CPU is "off." Probably nothing to worry about. ;) Hardware business is shady, dude. I can't tell you who is attacking, how much, and so on. Whole industry is full of NDA's from all the shit they pull. It's a black box outside the things above that leaked out.

lisper 10y ago
I don't really want to say this on Christmas but: Holy shit. (Actually, I'm in Australia at the moment where it is already December 26 so I guess that makes it OK.)
- nickpsecurity 10y ago
  Well, Im glad the shocking reality of it hit you. Ive done my part. Wait till you dig into the fab problem. It wasn't a can of worms: more like an underwater warehouse of electric eels. Current stance is we're stuck with 350nm and up for verifiability by eye. Shell games otherwise.
  - lisper 10y ago
    I'm having to rethink my entire world view. I was operating under the assumption that lower-profile manufacturers like STM were (probably) trustworthy because they don't sell into the consumer market and so there would be more to be lost than gained for them to compromise their chips. I was hoping that the company would reckon that professional customers would have less tolerance for bullshit than consumers, and so if a compromise were discovered that could damage the company's reputation enough to put them out of business, so they would not take the risk. But if what you say is true (and it sounds plausible to me) then you really can't trust anything any more. Even at 350nm, how do you know that the part you just bought conforms to the spec? You'd have to verify every single individual part. And given that someone has already demonstrated a hardware compromise using a single transistor, even a visual verification will not necessarily catch that.
    - nickpsecurity 10y ago
      One of my protoges and I have been discussing groups like STM specifically. We're very torn about it given their strengths on verification & tamper-resistance but increased odds of subversion. I mean, if tamper-resistant market is just a few players, then it would make sense for every major agency to focus on them more using all available techniques. Many also own a fab on older technology that they might be consolidating on for cost reduction given how price-sensitive their chips are. Extra risk. It's still unknown to us far as those companies go. "then you really can't trust anything any more" Yep. My recommendation was security through diversity and obscurity at least on the hardware end. Plus developing open hardware and safe methods for making it. "Even at 350nm, how do you know that the part you just bought conforms to the spec? " 250nm was the point where we stopped being able to see the components visually in a microscope. The 350nm or higher can be verified visually against an expected image/layout. You'd order a pile then verify a random percentage like other things. I also thought that image recognition tech could be trained to do it for you after enough samples come in from a given fab. At least, capture all the common stuff that should be there showing it to you. Leaves the rest to be inspected manually to see if it's a defect of the process or something malicious. Additionally, I was going to use it as the TCB for superior, modern chips that do heavy lifting on untrusted computation but get mediated by TCB chip. For advanced stuff, there's companies like ChipWorks that tear them down for what's probably a fortune. There's also possibility of using your own eBeam workstation or whatever to print them plus obscuring whose using it. The printing and packaging systems probably cost millions even for 65-90nm. If you can do 65nm, then we're good as my Core Duo 2 was printed on that... not even best one can do... with it lasting 8 years of application bloat still performing well. So, 65nm is where we can stop if we find a way to produce that in a trustworthy way. Note: Verification side works this way as you might keep the CPU or whatever small enough to verify samples from a fab with those workstations that can handle it. Similarly obfuscated, open software, whatever. Seems easier to control & create the chips instead of just verifying them. Last idea was to get money together to do a FPGA architecture, regular and antifuse, on most cutting-edge node possible. Alternatively, raise money by interested parties to buy Achronix that has 1.4GHz (or similar) FPGA's with 1+ million slices, 10Gbps networking, etc. Idea being the FPGA is open, it's sold at cost by nonprofit, it's periodically verified by various parties, open tooling based on eg Qflow targets it, and it turns into whatever design we need. Gotta verify one, big-ass thing that is mostly same, symmetrical shapes all over with a few custom things (eg I/O). My hardware guy partly inspired this by saying go for the most cutting-edge node because PhD's can barely get them to work much less do clever, stealthy subversions on black boxes. Note: Similar plan to boost open hardware by buying eASIC and their single-layer programmability. FPGA idea can be done that way, too, where the masks are verified by various parties and then monitored by them. So, there's some ideas for this. I'm defaulting on 350-700nm option as (a) verifiable by eye, (b) cheapest to make masks for with MOSIS et al, and (c) gotta start somewhere with at least one thing I can trust. Probably make a Forth- or JOP-like processor to keep number of gates down much as possible. Earlier fabs also had fewer components available to print in terms of their categories. Less stuff to train eyes or computer vision on.

lisper 10y ago

I don't really want to say this on Christmas but: Holy shit. (Actually, I'm in Australia at the moment where it is already December 26 so I guess that makes it OK.)

nickpsecurity 10y ago
Well, Im glad the shocking reality of it hit you. Ive done my part. Wait till you dig into the fab problem. It wasn't a can of worms: more like an underwater warehouse of electric eels. Current stance is we're stuck with 350nm and up for verifiability by eye. Shell games otherwise.
- lisper 10y ago
  I'm having to rethink my entire world view. I was operating under the assumption that lower-profile manufacturers like STM were (probably) trustworthy because they don't sell into the consumer market and so there would be more to be lost than gained for them to compromise their chips. I was hoping that the company would reckon that professional customers would have less tolerance for bullshit than consumers, and so if a compromise were discovered that could damage the company's reputation enough to put them out of business, so they would not take the risk. But if what you say is true (and it sounds plausible to me) then you really can't trust anything any more. Even at 350nm, how do you know that the part you just bought conforms to the spec? You'd have to verify every single individual part. And given that someone has already demonstrated a hardware compromise using a single transistor, even a visual verification will not necessarily catch that.
  - nickpsecurity 10y ago
    One of my protoges and I have been discussing groups like STM specifically. We're very torn about it given their strengths on verification & tamper-resistance but increased odds of subversion. I mean, if tamper-resistant market is just a few players, then it would make sense for every major agency to focus on them more using all available techniques. Many also own a fab on older technology that they might be consolidating on for cost reduction given how price-sensitive their chips are. Extra risk. It's still unknown to us far as those companies go. "then you really can't trust anything any more" Yep. My recommendation was security through diversity and obscurity at least on the hardware end. Plus developing open hardware and safe methods for making it. "Even at 350nm, how do you know that the part you just bought conforms to the spec? " 250nm was the point where we stopped being able to see the components visually in a microscope. The 350nm or higher can be verified visually against an expected image/layout. You'd order a pile then verify a random percentage like other things. I also thought that image recognition tech could be trained to do it for you after enough samples come in from a given fab. At least, capture all the common stuff that should be there showing it to you. Leaves the rest to be inspected manually to see if it's a defect of the process or something malicious. Additionally, I was going to use it as the TCB for superior, modern chips that do heavy lifting on untrusted computation but get mediated by TCB chip. For advanced stuff, there's companies like ChipWorks that tear them down for what's probably a fortune. There's also possibility of using your own eBeam workstation or whatever to print them plus obscuring whose using it. The printing and packaging systems probably cost millions even for 65-90nm. If you can do 65nm, then we're good as my Core Duo 2 was printed on that... not even best one can do... with it lasting 8 years of application bloat still performing well. So, 65nm is where we can stop if we find a way to produce that in a trustworthy way. Note: Verification side works this way as you might keep the CPU or whatever small enough to verify samples from a fab with those workstations that can handle it. Similarly obfuscated, open software, whatever. Seems easier to control & create the chips instead of just verifying them. Last idea was to get money together to do a FPGA architecture, regular and antifuse, on most cutting-edge node possible. Alternatively, raise money by interested parties to buy Achronix that has 1.4GHz (or similar) FPGA's with 1+ million slices, 10Gbps networking, etc. Idea being the FPGA is open, it's sold at cost by nonprofit, it's periodically verified by various parties, open tooling based on eg Qflow targets it, and it turns into whatever design we need. Gotta verify one, big-ass thing that is mostly same, symmetrical shapes all over with a few custom things (eg I/O). My hardware guy partly inspired this by saying go for the most cutting-edge node because PhD's can barely get them to work much less do clever, stealthy subversions on black boxes. Note: Similar plan to boost open hardware by buying eASIC and their single-layer programmability. FPGA idea can be done that way, too, where the masks are verified by various parties and then monitored by them. So, there's some ideas for this. I'm defaulting on 350-700nm option as (a) verifiable by eye, (b) cheapest to make masks for with MOSIS et al, and (c) gotta start somewhere with at least one thing I can trust. Probably make a Forth- or JOP-like processor to keep number of gates down much as possible. Earlier fabs also had fewer components available to print in terms of their categories. Less stuff to train eyes or computer vision on.