5 ms·

I'm still waiting for someone - say Raytheon, General Dynamics, Northrop Grumman or Boeing - to find that those SMD capacitors or inductors they used for their

I'm still waiting for someone - say Raytheon, General Dynamics, Northrop Grumman or Boeing - to find that those SMD capacitors or inductors they used for their hardware ended up being more than just simple passive components. The amount of space available in the package is more than enough to hide some circuitry which can be used for other purposes ranging from bridging air gaps to denial of service. These parts are used in positions where ample power is available for such purposes. The device could be triggered by outside signals, by specifically crafted power profiles, by simple timers or other means. They could be designed to detect the location where they're used in the circuitry and act accordingly.

beambot 9y ago
There are a lot of "ideal diode" devices being used now -- they save power by eliminating the voltage drop associated with passive diodes. Would be simple to hide extra circuitry in these already-active devices (they harvest a bit of inline power) -- and they're typically used in high-power control circuits, so the perfect DoS candidate.
SAI_Peregrinus 9y ago
SMD capacitors are microphonic. They change capacitance slightly when flexed. They also act as speakers, which could be used to exfiltrate data across a (small) air gap.
- analog31 9y ago
  I tried making my own guitar amplifier in the early 90s. It had a really mysterious feedback problem. Trying to find the cause, I accidentally brushed across one of the decoupling caps with my scope probe, and it went "doink." It was a big goober of a ceramic disc cap. Lesson learned.
- hazeii 9y ago
  Not just SMD; pretty much any tuned circuit will ring when tapped (esp. if multi-layer caps are involved, whether SMD or not).
cptskippy 9y ago
What you're proposing isn't really possible. Sure you could hide a microcontroller in a capacitor or diode packagebbut those components are rudimentary with very simple functions. A diode is like a check valve in pluming, it allows electricity to flow in a single direction. Capacitors are slightly more complicated but still a two pin component. Imagine you're a pipefitting installed in something, based on the water flowing through you would you be able to distinguish if you were in a house, fire engine, office complex, or high-rise? Would you be able to ascertain what function you served in the system?
- evv 9y ago
  The parent comment referenced two use-cases for such nefarious components. Both of which seem quite possible: 1. Bridging an air gap. This would basically be a radio repeater that lets you reach other compromised components. It just needs power, and could certainly fit within one of these component packages. 2. Denial of service. The component may be a simple diode, but if it stops working, you could potentially disable a weapon, or maybe even cause it to self-destruct. That said, I'm sure that defense contractors are very careful about where they source components. They likely have spies placed within their suppliers, and perform regular audits and teardowns of components.
  - godelmachine 9y ago
    Food for thought? https://www.military.com/defensetech/2012/05/30/smoking-gun-proof-that-military-chips-from-china-are-infected https://www.military.com/defensetech/2012/05/30/smoking-gun-...
  - areynx 9y ago
    >That said, I'm sure that defense contractors are very careful about where they source components. Not as careful as you might expect. "Fake" IC components were found in a military 737 [1]. Trusted ICs are a hot topic and the big players in the defense industry are working towards solutions. It's an interesting topic if you have time to read their academic papers. [1] https://military.com/defensetech/2011/11/08/counterfeit-parts-found-on-new-p-8-posiedons https://military.com/defensetech/2011/11/08/counterfeit-part...
garaetjjte 9y ago
Obviously not at SMD scale, but I have seen fun videos with seemingly simple circuits with LEDs and switches connected in series and they behaved completely differently (eg. each switch connected in series controlled other LED). It turned out that switches and LEDs have been modified with clever frequency generators and filter circuits. edit: https://www.youtube.com/watch?v=RkTvDjhImwo https://www.youtube.com/watch?v=RkTvDjhImwo
- homero 9y ago
  He didn't cheat? That's impossible if they're really switches
  - OrganicMSG 9y ago
    Define cheating - https://www.youtube.com/watch?v=mzDTZuFJYX4 https://www.youtube.com/watch?v=mzDTZuFJYX4
CamperBob2 9y ago
Such shenanigans would be noticed as soon as someone did a routine X-ray inspection at the board house.
- sametmax 9y ago
  "routine" ? Is that a common thing ?
  - rkangel 9y ago
    Things that are not routine in commercial manufacture become more common in Defence manufacture. The volumes are lower and per-unit cost-pressure is less, while reliability requirements are higher.
bb88 9y ago
Raytheon has already been through this [1]: > Many [counterfeits] have been seized, but any that remain in use pose the risk of causing “components to melt, burst, rupture, catch fire or explode, resulting in property damage, personal injury and death,” [1]: https://www.publicintegrity.org/2011/11/07/7323/counterfeit-chips-plague-pentagon-weapons-systems https://www.publicintegrity.org/2011/11/07/7323/counterfeit-... Edited to add: You might think this is different, but controlling the supply chain limits these kinds of attacks. One way to do it is to control the chain of custody so there's a paper trail on who had access to the parts and when. The other way the pentagon is doing it is putting "dielets" into the chips so they can be verified later. https://www.scientificamerican.com/article/the-pentagon-rsquo-s-seek-and-destroy-mission-for-counterfeit-electronics/ https://www.scientificamerican.com/article/the-pentagon-rsqu... In the end it all comes down to controlling the supply chain.
- jstarfish 9y ago
  > In the end it all comes down to controlling the supply chain. And yet people got all up in arms about that guy who got convictted for counterfeiting freely downloadable Windows restoration disks by outsourcing the job to some random shop in China and making them look like official disks. If anything, he got off easy. The world does not need more factory-backdoored OS installations.
rkangel 9y ago
It is for this reason that DoD is very careful about the source of all the components in things that it purchases. It ensures that as much as feasibly possible, the individual components are built in the US.

beambot 9y ago

There are a lot of "ideal diode" devices being used now -- they save power by eliminating the voltage drop associated with passive diodes. Would be simple to hide extra circuitry in these already-active devices (they harvest a bit of inline power) -- and they're typically used in high-power control circuits, so the perfect DoS candidate.

SAI_Peregrinus 9y ago

SMD capacitors are microphonic. They change capacitance slightly when flexed. They also act as speakers, which could be used to exfiltrate data across a (small) air gap.

analog31 9y ago
I tried making my own guitar amplifier in the early 90s. It had a really mysterious feedback problem. Trying to find the cause, I accidentally brushed across one of the decoupling caps with my scope probe, and it went "doink." It was a big goober of a ceramic disc cap. Lesson learned.
hazeii 9y ago
Not just SMD; pretty much any tuned circuit will ring when tapped (esp. if multi-layer caps are involved, whether SMD or not).

cptskippy 9y ago

What you're proposing isn't really possible. Sure you could hide a microcontroller in a capacitor or diode packagebbut those components are rudimentary with very simple functions. A diode is like a check valve in pluming, it allows electricity to flow in a single direction. Capacitors are slightly more complicated but still a two pin component. Imagine you're a pipefitting installed in something, based on the water flowing through you would you be able to distinguish if you were in a house, fire engine, office complex, or high-rise? Would you be able to ascertain what function you served in the system?

evv 9y ago
The parent comment referenced two use-cases for such nefarious components. Both of which seem quite possible: 1. Bridging an air gap. This would basically be a radio repeater that lets you reach other compromised components. It just needs power, and could certainly fit within one of these component packages. 2. Denial of service. The component may be a simple diode, but if it stops working, you could potentially disable a weapon, or maybe even cause it to self-destruct. That said, I'm sure that defense contractors are very careful about where they source components. They likely have spies placed within their suppliers, and perform regular audits and teardowns of components.
- godelmachine 9y ago
  Food for thought? https://www.military.com/defensetech/2012/05/30/smoking-gun-proof-that-military-chips-from-china-are-infected https://www.military.com/defensetech/2012/05/30/smoking-gun-...
- areynx 9y ago
  >That said, I'm sure that defense contractors are very careful about where they source components. Not as careful as you might expect. "Fake" IC components were found in a military 737 [1]. Trusted ICs are a hot topic and the big players in the defense industry are working towards solutions. It's an interesting topic if you have time to read their academic papers. [1] https://military.com/defensetech/2011/11/08/counterfeit-parts-found-on-new-p-8-posiedons https://military.com/defensetech/2011/11/08/counterfeit-part...

garaetjjte 9y ago

Obviously not at SMD scale, but I have seen fun videos with seemingly simple circuits with LEDs and switches connected in series and they behaved completely differently (eg. each switch connected in series controlled other LED). It turned out that switches and LEDs have been modified with clever frequency generators and filter circuits. edit: https://www.youtube.com/watch?v=RkTvDjhImwo https://www.youtube.com/watch?v=RkTvDjhImwo

homero 9y ago
He didn't cheat? That's impossible if they're really switches
- OrganicMSG 9y ago
  Define cheating - https://www.youtube.com/watch?v=mzDTZuFJYX4 https://www.youtube.com/watch?v=mzDTZuFJYX4

CamperBob2 9y ago

Such shenanigans would be noticed as soon as someone did a routine X-ray inspection at the board house.

sametmax 9y ago
"routine" ? Is that a common thing ?
- rkangel 9y ago
  Things that are not routine in commercial manufacture become more common in Defence manufacture. The volumes are lower and per-unit cost-pressure is less, while reliability requirements are higher.

bb88 9y ago

Raytheon has already been through this [1]: > Many [counterfeits] have been seized, but any that remain in use pose the risk of causing “components to melt, burst, rupture, catch fire or explode, resulting in property damage, personal injury and death,” [1]: https://www.publicintegrity.org/2011/11/07/7323/counterfeit-chips-plague-pentagon-weapons-systems https://www.publicintegrity.org/2011/11/07/7323/counterfeit-... Edited to add: You might think this is different, but controlling the supply chain limits these kinds of attacks. One way to do it is to control the chain of custody so there's a paper trail on who had access to the parts and when. The other way the pentagon is doing it is putting "dielets" into the chips so they can be verified later. https://www.scientificamerican.com/article/the-pentagon-rsquo-s-seek-and-destroy-mission-for-counterfeit-electronics/ https://www.scientificamerican.com/article/the-pentagon-rsqu... In the end it all comes down to controlling the supply chain.

jstarfish 9y ago
> In the end it all comes down to controlling the supply chain. And yet people got all up in arms about that guy who got convictted for counterfeiting freely downloadable Windows restoration disks by outsourcing the job to some random shop in China and making them look like official disks. If anything, he got off easy. The world does not need more factory-backdoored OS installations.

rkangel 9y ago

It is for this reason that DoD is very careful about the source of all the components in things that it purchases. It ensures that as much as feasibly possible, the individual components are built in the US.