5 ms·

I wonder why they even bothered with such a high end processor like the MT6261. Get a bare die micro like the MSP430, and a bare die GSM chipset, and you're set

by Hasz 9y ago

I wonder why they even bothered with such a high end processor like the MT6261. Get a bare die micro like the MSP430, and a bare die GSM chipset, and you're set. You'd have to dissolve your SIM card in acid and wire bond it to the PCB, but wire bonding machinery is pretty cheap. Realistically, this is stupid easy for a state-level actor. A good hardware hacker worth their salt could probably set up a bug no bigger than 10mmx10mm in a couple of months for a few hundred, less if they already have a wire bonding machine and microscope. For a state level actor, you can roll your own ASIC and just dump RF and microcontroller on one die. Package it up inside a USB flash drive controller IC, mark it with someone else's logo, and you've got a bug that you would only find by dissolving the chip in acid and looking at the die very carefully. It'll cost you a few million, but it's just not that much money when your R&D budget is 150M/y. The weak part of all these systems is the constant GSM heartbeat, but even that is beatable.

amenod 9y ago
> The weak part of all these systems is the constant GSM heartbeat, but even that is beatable. Curious: how do you beat that? Do you listen to other signals and try to transmit at the same time (if you must)?
- Hasz 9y ago
  You can broadcast on a timer, you can switch to a low frequency, low bandwidth transmitter, you can store locally and pick up the device later, etc. It all depends on the environment.
  - jjoonathan 9y ago
    Or burst mode. That's been the speculated reasoning I've heard behind the USA's onerous POI restrictions on exported RTSAs.
    - Hasz 9y ago
      That's probably the better option. I found an article about the export restrictions here. https://signalhound.com/news/how-we-implemexport-controls/ https://signalhound.com/news/how-we-implemexport-controls/ seems like it has to do with the fact it's guaranteed to intercept a signal all the way down to 1.2 uS
revelation 9y ago
They would never design their own. That's why it says COTS (commercial off the shelf) all over the Snowden catalogs. The deniability from a consumer hardware part is very important for something you expect an adversary to find and dismantle.
jlouis 9y ago
I feel part of the reason is that processors such as MT6261 are getting cheaper and cheaper. The marginal benefit of producing a simpler and smaller design is likely going to go away quickly. It is the end-game for hardware. Software has already been gobbled up by language designs which are less and less hardware-near for the very same reason.
- Hasz 9y ago
  I was thinking purely from a power consumption / die size / support stand point. Not sure what the MT6261 quiescent current is, but I'd expect it to be in the 100s of uA. An MSP430 can get down to 0.1uA, which is much more difficult to detect. If I had to guess, the MSP430 die is probably about 1/4 the size of the MT6261 die. Most importantly, I can't find a MT6261 datasheet anywhere except for taobao. This just makes development harder.
  - deleted 9y ago
    [deleted]
  - bhouston 9y ago
    Datasheet here: http://mediatek-club.ru/datasheet-mediatek-mt6261a http://mediatek-club.ru/datasheet-mediatek-mt6261a
jjoonathan 9y ago
> in a couple of months for a few hundred, less if they already have a wire bonding machine and microscope. How do I get my hands on a wirebond machine for a few hundred? The bottom end of "old and crusty but not actually broken" seems to start at a couple thousand on eBay. If my budget were a few hundred I'd probably spend a month just machining and grinding replacement microscope parts. I suppose you could be referring to the marginal cost of an hour on a wirebond machine at the nearest NNIN facility, but last time I priced out training options the overhead to get started would have been $500-$1k.
- Hasz 9y ago
  Yeah, it's kinda tricky -- costs could be much higher. Wire bonders aren't exactly hot ticket items; very few people are using manual machines. A cheap Chinese made one from Taobao/Alibaba costs around $250, but add in shipping, and you're close to $500 already. Something made in the USA from eBay will be of similar price, just two decades older. If you're lucky enough to already be in China, I can't imagine it would be to difficult to get a small run made for a much lower cost, although I've never done so. Lots of factories making high volume, low end products use wire bonders to attach bare die to a PCB -- think calculators, gift cards, etc. The simple fact is there's no comparable level of electronics manufacturing in the US, making it hard to get the parts and machinery necessary.

by Hasz 9y ago

amenod 9y ago

> The weak part of all these systems is the constant GSM heartbeat, but even that is beatable. Curious: how do you beat that? Do you listen to other signals and try to transmit at the same time (if you must)?

Hasz 9y ago
You can broadcast on a timer, you can switch to a low frequency, low bandwidth transmitter, you can store locally and pick up the device later, etc. It all depends on the environment.
- jjoonathan 9y ago
  Or burst mode. That's been the speculated reasoning I've heard behind the USA's onerous POI restrictions on exported RTSAs.
  - Hasz 9y ago
    That's probably the better option. I found an article about the export restrictions here. https://signalhound.com/news/how-we-implemexport-controls/ https://signalhound.com/news/how-we-implemexport-controls/ seems like it has to do with the fact it's guaranteed to intercept a signal all the way down to 1.2 uS

revelation 9y ago

They would never design their own. That's why it says COTS (commercial off the shelf) all over the Snowden catalogs. The deniability from a consumer hardware part is very important for something you expect an adversary to find and dismantle.

jlouis 9y ago

I feel part of the reason is that processors such as MT6261 are getting cheaper and cheaper. The marginal benefit of producing a simpler and smaller design is likely going to go away quickly. It is the end-game for hardware. Software has already been gobbled up by language designs which are less and less hardware-near for the very same reason.

Hasz 9y ago
I was thinking purely from a power consumption / die size / support stand point. Not sure what the MT6261 quiescent current is, but I'd expect it to be in the 100s of uA. An MSP430 can get down to 0.1uA, which is much more difficult to detect. If I had to guess, the MSP430 die is probably about 1/4 the size of the MT6261 die. Most importantly, I can't find a MT6261 datasheet anywhere except for taobao. This just makes development harder.
- deleted 9y ago
  [deleted]
- bhouston 9y ago
  Datasheet here: http://mediatek-club.ru/datasheet-mediatek-mt6261a http://mediatek-club.ru/datasheet-mediatek-mt6261a

jjoonathan 9y ago

> in a couple of months for a few hundred, less if they already have a wire bonding machine and microscope. How do I get my hands on a wirebond machine for a few hundred? The bottom end of "old and crusty but not actually broken" seems to start at a couple thousand on eBay. If my budget were a few hundred I'd probably spend a month just machining and grinding replacement microscope parts. I suppose you could be referring to the marginal cost of an hour on a wirebond machine at the nearest NNIN facility, but last time I priced out training options the overhead to get started would have been $500-$1k.

Hasz 9y ago
Yeah, it's kinda tricky -- costs could be much higher. Wire bonders aren't exactly hot ticket items; very few people are using manual machines. A cheap Chinese made one from Taobao/Alibaba costs around $250, but add in shipping, and you're close to $500 already. Something made in the USA from eBay will be of similar price, just two decades older. If you're lucky enough to already be in China, I can't imagine it would be to difficult to get a small run made for a much lower cost, although I've never done so. Lots of factories making high volume, low end products use wire bonders to attach bare die to a PCB -- think calculators, gift cards, etc. The simple fact is there's no comparable level of electronics manufacturing in the US, making it hard to get the parts and machinery necessary.