11 ms·
'Demonically Clever' Backdoor Hides Inside Computer Chip
- matt_the_bass 8y agoThis is not a new threat idea. DOD has been worrying about this for years. Perhaps the implementation of the threat is new but not the idea of the threat.
- DoctorOetker 8y agoyou may be remembering this very same single transistor back-door from 2 years ago?
- matt_the_bass 8y agoI can’t find the link, but I seem to remember either an SBIR, STTR, or BAA topic a few years ago relating to de ting such backdoors.
- IAmLiterallyAB 8y agoYep, the article linked is from 2016. I'm actually friends with one of the authors, the similarity tipped me off
- nickpsecurity 8y agoThey even implemented the Trusted Foundry program to mitigate some risk. https://www.dmea.osd.mil/trustedic.html https://www.dmea.osd.mil/trustedic.html
- PhantomGremlin 8y agoThis is quite clever, since the required addition to the "mask" (actually multiple mask layers) to implement such a function would be quite simple. During chip design, there are tools (DRC and LVS) that very carefully verify that the mask has exactly what the designers intend it to have, not a single transistor more or less. This abstract mask is called GDSII[1] (or perhaps a successor such as OASIS, the principle is the same). Once upon a time the layers of the GDSII could be used directly to build ICs. But now chip design rules are too tricky, so the masks are tweaked post-tapeout, in order to be able to get a decent yield of functioning chips. Still, it is possible to take actual silicon and extract the circuitry from it. This, while quite difficult to do, is routinely done by "reverse engineering" companies. If it's your own chip you already know exactly what to expect, you actually specified every transistor there. So it would be much "easier" (ha ha) to reverse engineer to verify that your actual chip has all the circuitry, no more, no less, that you intended it to have. I wrote a little about this in an HN discussion a few years ago.[2] That's the theory. But in reality, does any company reverse engineer their own chips to check? Highly unlikely. Which means they're implicitly trusting TSMC (or whoever the fab is). Not only that, what's to keep some bad actor at TSMC from inserting this circuitry into your chips perhaps 6 months after initial production. Must you repeatedly keep reverse engineering your own chips to make sure they're still unmodified? But, as I mentioned in my earlier post, there are many IP blocks in current silicon that come from third-party suppliers. Does anyone fully understand the operation of every transistor in every IP block they bought, or they inherited from an earlier design? If I were to backdoor an IC, I'd use the third-party IP method. It would be much easier to sneak something in that way. [1] https://en.wikipedia.org/wiki/GDSII https://en.wikipedia.org/wiki/GDSII [2] https://news.ycombinator.com/item?id=11880935#11891857 https://news.ycombinator.com/item?id=11880935#11891857
- weinzierl 8y agoA few years a ago I attended a talk given by an engineer of one of the largest American semiconductor companies. After the talk someone asked if they were able to verify that the chips they get back from the fabs are made as specified. The answer was that they couldn‘t but that the problem was considered a serious concern and that their company invested resources into a solution.
- kingosticks 8y agoAnd what about all the blackbox IP that get added after you design your functionality. There could be absolutely anything in that test logic added by the vendor, anything in that random 'process measurement' cell added by the fab. I don't see how the verification required is remotely possible.
- FartyMcFarter 8y ago> If I were to backdoor an IC, I'd use the third-party IP method. It would be much easier to sneak something in that way. I'm not a hardware designer, but I imagine that restricting a backdoor to a specific block might make it much harder to cause the rest of the hardware to behave in a specific way?
- Yetanfou 8y agoI'm still waiting for someone - say Raytheon, General Dynamics, Northrop Grumman or Boeing - to find that those SMD capacitors or inductors they used for their hardware ended up being more than just simple passive components. The amount of space available in the package is more than enough to hide some circuitry which can be used for other purposes ranging from bridging air gaps to denial of service. These parts are used in positions where ample power is available for such purposes. The device could be triggered by outside signals, by specifically crafted power profiles, by simple timers or other means. They could be designed to detect the location where they're used in the circuitry and act accordingly.
- beambot 8y agoThere are a lot of "ideal diode" devices being used now -- they save power by eliminating the voltage drop associated with passive diodes. Would be simple to hide extra circuitry in these already-active devices (they harvest a bit of inline power) -- and they're typically used in high-power control circuits, so the perfect DoS candidate.
- SAI_Peregrinus 8y agoSMD capacitors are microphonic. They change capacitance slightly when flexed. They also act as speakers, which could be used to exfiltrate data across a (small) air gap.
- analog31 8y agoI tried making my own guitar amplifier in the early 90s. It had a really mysterious feedback problem. Trying to find the cause, I accidentally brushed across one of the decoupling caps with my scope probe, and it went "doink." It was a big goober of a ceramic disc cap. Lesson learned.
- hazeii 8y agoNot just SMD; pretty much any tuned circuit will ring when tapped (esp. if multi-layer caps are involved, whether SMD or not).
- 8y ago
- thathappened 8y agoCan't the weight be calculated to see if additional components were added between mock-up and production output? I know weight is how you double check other manufacturing
- Tuna-Fish 8y agoThere is no method of producing a small quantity of silicon chips for cheaper than the mass production method, meaning there are no mock-ups -- there is just a software simulation and then the products made at the foundry. Also, adding a few additional transistors and paths doesn't really add components to the chip in the way you think. They cause no meaningful difference in weight.
- NPMaxwell 8y agoHow much more expensive would it be to build chips in your own country? I would think that early in the lifetime of a new CPU/GPU, the manufacturing cost is a small portion of the cost.
- Tuna-Fish 8y agoThe cost of a top-of-the line fab has nearly doubled every generation, with TSMC now estimating that a single 3nm fab costs ~$20B to build. The manufacturing costs of a single CPU are small once you already have a working fab, but the fabs are now the most expensive factories ever built.
- cabalamat 8y ago> a single 3nm fab costs ~$20B to build Then counties -- or groups of countries -- that can't or won't fork out $20bn are going to effectively lose their independence.
- WJW 8y agoIt could be argued that true independence on a nation-state level has been impossible for most countries ever since a small group of larger countries started building nuclear weapons and ICBMs.
- tempodox 8y agoStill, I'd expect the scales to be vastly different. Computer chips are getting ever more pervasive, while not every household / office / factory has nuclear weapons and ICBMs.
- cryptonector 8y agoNukes have nothing to do with the independence of nuke-free countries. It's not like either any of the nuclear club countries can threaten, say, Chile, with nuclear attack if they don't do whatever it is they want. Limited-scale nuclear war would still be a disaster in many ways (political, ecological, economic, cultural, risk of becoming a wider nuclear war, ...), so it can't happen. Small countries lose independence mainly by having to participate in the larger trade and global economy: others, especially bigger countries, have enormous leverage. Pick a small country, any small country outside the nuclear club. It will be a lot easier to force that country to do something it'd rather not using economic threats, or at most the threat of conventional warfare, than threatening nuclear attack.
- cheez 8y agoIf each modification to the design is approved using a multi-key process (this is practical, I've done this in financial trading environments), I don't see how this would go through.
- daveFNbuck 8y agoWith a financial trading environment, it should be easy to tell whether the approved plan is what got executed. How would you audit the chip manufacturer to ensure that they're using the design you approved?
- signa11 8y ago> How would you audit the chip manufacturer to ensure that they're using the design you approved? would pki be of some help here ? where final tapeout is signed with your and their keys as well for example.
- na85 8y agoHow do you know the chip as fabbed conforms to the final tape out?
- signa11 8y agoumm, i am unaware if it is possible for manufacturing companies to make changes like these to a design handed out. can you please explain how ?
- pjc50 8y agoThe design as presented to the fab is usually "GDSII" format, which is a huge list of polygons on various layers. Manufacturing companies usually have to run this through preprocessing in order to make the interference lithography work properly. In the end, they produce a bunch of IC masks, and it's always possible to ""manually"" (with expensive tools) cut another hole in the mask.
- calebh 8y agoI interviewed at a company called Chip Scan which is a startup that aims to detect backdoors in chip designs. I didn't end up accepting, but it did sound like an interesting job.
- mattkevan 8y agoA friend of a friend designed chips in the 80s. One of his chips became a high-end audio component if hooked up in the right way, unbeknownst to his employer. Apparently he had a very good home hifi system.
- Scramblejams 8y agoChip! Pinout! Deets!
- bsder 8y agoIIRC, lots of things in the old days (1970's-ish? Popular Electronics, for example) talked about using a 4009 or 4049 as an audio amplifier. You put a feedback resistor in place from input to output to bias it and then capacitively couple the input and output. Metal-gate CMOS was particularly good for this as it had an operating voltage from <3V to about 18V.
- tripletao 8y agoCD4009 is a buffer. If you connect its input to its output, then you get a bit of SRAM, not an amplifier. CD4049 is an inverter. If you do the trick above then you indeed get an amplifier, nonlinear and with poorly-controlled gain but an amplifier nonetheless. This isn't some kind of Easter egg; an inverter is just a high-gain amplifier that's usually allowed to saturate, so it fundamentally just does that. Such amplifiers are not very good, but they're fast-ish and cheap. They're often used for crystal oscillators. The preferred logic series these days is 74HCU. That's "unbuffered" logic, where your inverter really is just one CMOS inverter, and not a string of three like usual. That makes the gain more stable, since the three inverters wouldn't match perfectly, and would each end up biased somewhere different.
- bsder 8y agoHuh? Is my memory faulty and I got it wrong? I thought that the 4009/4049 were the hex inverters and that the 4010/4050 were the hex buffers.
- xtiansimon 8y agoI feel the same way about this as I do about, say, NSA hacking. It will never effect most computer users--until the day it does.
- monocasa 8y agoI've heard rumors of an even more insidious backdoor. Screwing with the dopants slightly in order to bias the HRNG slightly one way. Wouldn't show up even under a full visual inspection.
- cryptonector 8y agoYou can get around this. A biased HRNG is still an RNG, and there are other sources of entropy on a system anyways, so a decent OS can make exploiting a bias in an RNG infeasible.
- monocasa 8y agoDo the RNGs for fixed hardware devices like hardware security modules typically mix entropy from several sources?
- dfox 8y agoI assume that HSM as discrete hardware devices certainly use their hardware RNG only as one input to some /dev/random like CSPRNG. On the other hand I would also assume that single-chip "HSMs" (smartcards...) do not although I vaguely remember that for TPM (which is hardware-wise a smartcard with weird host interface) the RNG output is somehow dependent on state of attestation registers.
- cryptonector 8y agoSure, many HSMs/smartcards/tokens lack sophisticated RNGs. And NIST's SP800-90 has proven weak on this.
- dfox 8y agoI'm probably biased because I spend good part of quarter by designing reasonably secure CSPRNG for smartcard chip without hardware RNG (and ended up exploiting essentially any cross-clockdomain communication as entropy source) and thus I assume that typical smardcard vendors don't care about that (too much work) while HSM vendors simply leverage infrastructure of whatever (RT)OS they use and probably harden that somewhat.
- bitL 8y agoWith SGX any script kiddie will be able to write undetectable malware once a SPOF is found (I believe some Spectre-variant was in the news recently).
- chatmasta 8y agoSGX = Software Guard Instructions [0] SPOF = Single Point of Failure [0] https://software.intel.com/en-us/sgx https://software.intel.com/en-us/sgx
- carapace 8y agoEveryone here knows about "Trusting Trust", right? And that nanotechnology will be done with software that is effectively compilers, right?
- TeMPOraL 8y agoAlso living things. I sometimes wonder just how much of the information that determine an organism is stored not in DNA, but hidden in the "runtime" state of the replication mechanism. After all, when a new cell is made, the parent replication mechanism also builds the child's replication mechanism. Related - Hofstadter's GEB, where he discusses the observation that information is not stored on a storage medium - it's a function of the medium and the mechanism reading that medium.
- carapace 8y agoI once went to a hypno-therapist who did a germ-line regression (as contrasted with a "past-life" regression) where I was lead back in time through my familial linage to talk one of my ancestors. YMMV > Epigenetics is the study of heritable changes in gene function that do not involve changes in the DNA sequence. https://en.wikipedia.org/wiki/Epigenetics https://en.wikipedia.org/wiki/Epigenetics > After all, when a new cell is made, the parent replication mechanism also builds the child's replication mechanism. The whole organism splits in two so the daughter cells' entire mechanism is half of the parent cell's mechanism. One of the thoughts that trips me out is that each Amoeba (for example) is billions of years old.
- Jach 8y agoWhat everyone seems to forget is that "trusting trust" has a counter: https://www.dwheeler.com/trusting-trust/ https://www.dwheeler.com/trusting-trust/
- carapace 8y agoYes, but... You have to have at least two independent compiler stack development processes occurring in separate light-cones. If one happens far enough within the cone of the other you cannot trust it. (Not actually speed-of-light-cone of course. You have the lead-time required to develop general "nanites" and then their travel time to reach the opposite side of the Earth (assuming no one is working on this off-planet. The first thing a paranoid nanotech-haver would does is detect and suborn all other nanotech labs. I call this the "Matter-Lock".)
- analog31 8y agoI wonder, does open source software help at all here? I mean, if you don't know what instructions will actually be executed, because the user's compiler is deciding how the code will run, can these hardware back doors even work?
- cptskippy 8y agoMaybe? The reality is that most OSS is run from downloaded binaries and not precompiled. Even if it were, most people would be using the exact same compiler. From the description of the attack though, the function charging the capacitor wouldn't have to be all that obscure. The attack could cause a privilege escalation but if the running process that accidentally triggered it isn't asking for escalated privileges then having them won't cause harm. The circuitry could have a discharge resistor across the capacitor causing it to drain quickly. This would require the trigger to be executed and then subsequent attack in a very short window of time.
- CivilEngineer 8y agoThe solution is, of course, Blockchain.
- mikeash 8y agoYou can target the most popular compilers. And there’s always inline asm.
- greggarious 8y agoThis sounds like it would be a very powerful targeted attack, but would it be possible at scale? Or would such a modification going into all chips coming out of a factory be noticed?
- eloff 8y agoThey edit the mask used to produce the chip, not the chip. It would affect all chips produced.
- greggarious 8y agoThanks for the clarification!
- yarrel 8y ago"...and here's why that's a great thing for your security!" https://www.wired.com/story/crypto-war-clear-encryption/ https://www.wired.com/story/crypto-war-clear-encryption/
- gazarsgo 8y agoso like port knocking but at an electrical level, nice.
- slededit 8y agoThat trigger circuit looks pretty big. It would be very hard to find a spot for it in an existing layout without moving things around. Moving things around would invalidate their timing which would be noticeable to the chip designers. A fab would most likely not be able to do this unless it was an extremely valuable target. But it would be pretty easy if the design team wanted it in the first place.
- dfox 8y agoI think that this glosses over one quite important detail: while the "RC-integrator out of digital logic" is quite small an inconspicuous, the logic required to activate it would be significantly more complex and almost by definition very suspicious.
- Animats 8y agoMaybe I shouldn't have suggested this on HN in 2016.[1] [1] https://news.ycombinator.com/item?id=11768980 https://news.ycombinator.com/item?id=11768980
- godelmachine 8y agoBelieve me, I slogged hard for 3 months to understand the paper in 2016, when it was made public. I was excited to learn more about how controlling the number of electrons can change JavaScript functionality. Had the opportunity to learn everything from dopant level to the browser level. Gave up when I reached page 10, coz other priorities took over me. Had I know about this HN post, maybe I would had finished the entire paper.
- a1369209993 8y agoI suggested something similar for transistors in 2014[1], and I'm sure I wasn't the first, so you're probably blameless. [1] https://news.ycombinator.com/item?id=8759749 https://news.ycombinator.com/item?id=8759749
- mirimir 8y agoI work only in VMs. So I wonder if websites accessed in VMs could charge such capacitors in CPU cores. By default, virtual CPUs aren't mapped to particular cores. But then, I do tend to use hardware virtualization. Maybe it'd be more secure to avoid that?
- dredmorbius 8y agoNB: 2016
- joewee 8y agoIt’s should be noted this is from 2016.
- samstave 8y agoSomeone said that while working at western digital, there were hw backdoors in the hdd controllers. Such that they didn’t even need access to the OS to read all your data.