4 ms·

What you're proposing isn't really possible. Sure you could hide a microcontroller in a capacitor or diode packagebbut those components are rudimentary with ve

What you're proposing isn't really possible. Sure you could hide a microcontroller in a capacitor or diode packagebbut those components are rudimentary with very simple functions. A diode is like a check valve in pluming, it allows electricity to flow in a single direction. Capacitors are slightly more complicated but still a two pin component. Imagine you're a pipefitting installed in something, based on the water flowing through you would you be able to distinguish if you were in a house, fire engine, office complex, or high-rise? Would you be able to ascertain what function you served in the system?

evv 9y ago
The parent comment referenced two use-cases for such nefarious components. Both of which seem quite possible: 1. Bridging an air gap. This would basically be a radio repeater that lets you reach other compromised components. It just needs power, and could certainly fit within one of these component packages. 2. Denial of service. The component may be a simple diode, but if it stops working, you could potentially disable a weapon, or maybe even cause it to self-destruct. That said, I'm sure that defense contractors are very careful about where they source components. They likely have spies placed within their suppliers, and perform regular audits and teardowns of components.
- godelmachine 9y ago
  Food for thought? https://www.military.com/defensetech/2012/05/30/smoking-gun-proof-that-military-chips-from-china-are-infected https://www.military.com/defensetech/2012/05/30/smoking-gun-...
- areynx 9y ago
  >That said, I'm sure that defense contractors are very careful about where they source components. Not as careful as you might expect. "Fake" IC components were found in a military 737 [1]. Trusted ICs are a hot topic and the big players in the defense industry are working towards solutions. It's an interesting topic if you have time to read their academic papers. [1] https://military.com/defensetech/2011/11/08/counterfeit-parts-found-on-new-p-8-posiedons https://military.com/defensetech/2011/11/08/counterfeit-part...
- taneq 9y ago
  > I'm sure that defense contractors are very careful about where they source components. I thought that's why military hardware is so expensive. You're not just paying for a radio or whatever, you're paying for an entire hardened supply chain with everything sourced from trusted manufacturers. I guess maybe that's not the case any more...
- manicdee 9y ago
  Bridging an air gap could also be possible by simply producing a device that looks to x-ray to be a capacitor but is crafted of materials specifically selected for their ability to physically change in some dimension that the attacker is able to measure remotely. Change physical size when charged/discharged, measure sound pressure via lasers on windows or microwaves sensing cavities in concrete walls. The victim doesn’t even need to be specifically targeted if they use commodity components whose design is known. Just arrange for the company producing parts to select a specific recipe.
slededit 9y ago
> distinguish if you were in a house, fire engine, office complex If water is used primarily between 9-5 in large quantities: office building If water is used during breakfast and dinner: home Fire engines also have very distinct water usage patterns and pressures. I bet you could easily get to >90% accuracy quickly.
- martyvis 9y ago
  This reminds of only learning about the existing of light level geolocation that uses only an accurate clock recording ambient light level to determine longitude and latitude of migratory birds - https://en.wikipedia.org/wiki/Light_level_geolocator https://en.wikipedia.org/wiki/Light_level_geolocator
pjc50 9y ago
Decoupling capacitors are in a unique position: practically every bit-flip in a chip turns into a glitch signal on the power lines. Normally the capacitor is there to supress those signals by shorting them to ground, but it's also ideally positioned to analyse them.
mikeash 9y ago
The component itself doesn’t have to distinguish anything. Imagine if the component just covertly transmitted the water flow. Most would be useless, but the one installed in the CEO’s toilet could give you some useful info.
- gh02t 9y ago
  Such a device would be severely restricted in what it could exfiltrate just based on bandwidth limitations. I'm not super knowledgeable on RF, but I believe that something the size of a SMD resistor or capacitor would be too small to conceal any sort of radio with significant bandwidth (not to mention having to evade RF emissions compliance testing, but maybe some kind of exotic backscatter radio could work). Another possibility would be to modulate the power line signal, but again not enough bandwidth to transmit much that isn't already being leaked. Perhaps information on power consumption by the CPU, which has been used to recover encryption keys in some attacks, but that's already being leaked in most cases. The most likely scenario as I see it would be parts that deliberately amplified unintentionally leaked information (like high-resolution power usage information) more than normal, but it seems to me that normal compliance testing would detect a lot of that. I can imagine a bug or something being hidden in a large power supply capacitor, which can have volumes of several milliliters. Maybe capacitors with a hidden transmitter mislabeled as higher values to explain the extra size.
  - mikeash 9y ago
    Maybe you could combine those two ideas. Have a really tiny bug in the logic electronics somewhere that transmits at extremely low power, then have a bigger thing in a power capacitor that receives those and retransmits the data at higher power. IANAEE, though, so I could be talking nonsense. As far as the size goes, is there any tradeoff between size and price? If there’s a more expensive design that occupies less volume, an attacker could use that design, use the extra space for the bug, then sell the whole thing as if it were the cheaper version. You probably couldn’t do this for all of your capacitors, since it would cost a lot. Maybe 1% would be enough to have a good chance of getting a bug somewhere interesting.
hazeii 9y ago
I'll bite; the MCU in the cap (let's assume a tricky case, like a decoupling cap) could transmit by briefly shorting the PSU (one bit at a time).

evv 9y ago

The parent comment referenced two use-cases for such nefarious components. Both of which seem quite possible: 1. Bridging an air gap. This would basically be a radio repeater that lets you reach other compromised components. It just needs power, and could certainly fit within one of these component packages. 2. Denial of service. The component may be a simple diode, but if it stops working, you could potentially disable a weapon, or maybe even cause it to self-destruct. That said, I'm sure that defense contractors are very careful about where they source components. They likely have spies placed within their suppliers, and perform regular audits and teardowns of components.

godelmachine 9y ago
Food for thought? https://www.military.com/defensetech/2012/05/30/smoking-gun-proof-that-military-chips-from-china-are-infected https://www.military.com/defensetech/2012/05/30/smoking-gun-...
areynx 9y ago
>That said, I'm sure that defense contractors are very careful about where they source components. Not as careful as you might expect. "Fake" IC components were found in a military 737 [1]. Trusted ICs are a hot topic and the big players in the defense industry are working towards solutions. It's an interesting topic if you have time to read their academic papers. [1] https://military.com/defensetech/2011/11/08/counterfeit-parts-found-on-new-p-8-posiedons https://military.com/defensetech/2011/11/08/counterfeit-part...
taneq 9y ago
> I'm sure that defense contractors are very careful about where they source components. I thought that's why military hardware is so expensive. You're not just paying for a radio or whatever, you're paying for an entire hardened supply chain with everything sourced from trusted manufacturers. I guess maybe that's not the case any more...
manicdee 9y ago
Bridging an air gap could also be possible by simply producing a device that looks to x-ray to be a capacitor but is crafted of materials specifically selected for their ability to physically change in some dimension that the attacker is able to measure remotely. Change physical size when charged/discharged, measure sound pressure via lasers on windows or microwaves sensing cavities in concrete walls. The victim doesn’t even need to be specifically targeted if they use commodity components whose design is known. Just arrange for the company producing parts to select a specific recipe.

slededit 9y ago

> distinguish if you were in a house, fire engine, office complex If water is used primarily between 9-5 in large quantities: office building If water is used during breakfast and dinner: home Fire engines also have very distinct water usage patterns and pressures. I bet you could easily get to >90% accuracy quickly.

martyvis 9y ago
This reminds of only learning about the existing of light level geolocation that uses only an accurate clock recording ambient light level to determine longitude and latitude of migratory birds - https://en.wikipedia.org/wiki/Light_level_geolocator https://en.wikipedia.org/wiki/Light_level_geolocator

pjc50 9y ago

Decoupling capacitors are in a unique position: practically every bit-flip in a chip turns into a glitch signal on the power lines. Normally the capacitor is there to supress those signals by shorting them to ground, but it's also ideally positioned to analyse them.

mikeash 9y ago

The component itself doesn’t have to distinguish anything. Imagine if the component just covertly transmitted the water flow. Most would be useless, but the one installed in the CEO’s toilet could give you some useful info.

gh02t 9y ago
Such a device would be severely restricted in what it could exfiltrate just based on bandwidth limitations. I'm not super knowledgeable on RF, but I believe that something the size of a SMD resistor or capacitor would be too small to conceal any sort of radio with significant bandwidth (not to mention having to evade RF emissions compliance testing, but maybe some kind of exotic backscatter radio could work). Another possibility would be to modulate the power line signal, but again not enough bandwidth to transmit much that isn't already being leaked. Perhaps information on power consumption by the CPU, which has been used to recover encryption keys in some attacks, but that's already being leaked in most cases. The most likely scenario as I see it would be parts that deliberately amplified unintentionally leaked information (like high-resolution power usage information) more than normal, but it seems to me that normal compliance testing would detect a lot of that. I can imagine a bug or something being hidden in a large power supply capacitor, which can have volumes of several milliliters. Maybe capacitors with a hidden transmitter mislabeled as higher values to explain the extra size.
- mikeash 9y ago
  Maybe you could combine those two ideas. Have a really tiny bug in the logic electronics somewhere that transmits at extremely low power, then have a bigger thing in a power capacitor that receives those and retransmits the data at higher power. IANAEE, though, so I could be talking nonsense. As far as the size goes, is there any tradeoff between size and price? If there’s a more expensive design that occupies less volume, an attacker could use that design, use the extra space for the bug, then sell the whole thing as if it were the cheaper version. You probably couldn’t do this for all of your capacitors, since it would cost a lot. Maybe 1% would be enough to have a good chance of getting a bug somewhere interesting.

hazeii 9y ago

I'll bite; the MCU in the cap (let's assume a tricky case, like a decoupling cap) could transmit by briefly shorting the PSU (one bit at a time).