3 ms·

Such a device would be severely restricted in what it could exfiltrate just based on bandwidth limitations. I'm not super knowledgeable on RF, but I believe tha

by gh02t 9y ago

Such a device would be severely restricted in what it could exfiltrate just based on bandwidth limitations. I'm not super knowledgeable on RF, but I believe that something the size of a SMD resistor or capacitor would be too small to conceal any sort of radio with significant bandwidth (not to mention having to evade RF emissions compliance testing, but maybe some kind of exotic backscatter radio could work). Another possibility would be to modulate the power line signal, but again not enough bandwidth to transmit much that isn't already being leaked. Perhaps information on power consumption by the CPU, which has been used to recover encryption keys in some attacks, but that's already being leaked in most cases. The most likely scenario as I see it would be parts that deliberately amplified unintentionally leaked information (like high-resolution power usage information) more than normal, but it seems to me that normal compliance testing would detect a lot of that. I can imagine a bug or something being hidden in a large power supply capacitor, which can have volumes of several milliliters. Maybe capacitors with a hidden transmitter mislabeled as higher values to explain the extra size.

mikeash 9y ago
Maybe you could combine those two ideas. Have a really tiny bug in the logic electronics somewhere that transmits at extremely low power, then have a bigger thing in a power capacitor that receives those and retransmits the data at higher power. IANAEE, though, so I could be talking nonsense. As far as the size goes, is there any tradeoff between size and price? If there’s a more expensive design that occupies less volume, an attacker could use that design, use the extra space for the bug, then sell the whole thing as if it were the cheaper version. You probably couldn’t do this for all of your capacitors, since it would cost a lot. Maybe 1% would be enough to have a good chance of getting a bug somewhere interesting.
- gh02t 9y ago
  Capacitor size is pretty much set by the technology, but where possible smaller equivalent parts are usually cheaper. You can't spam this in all of your products anyway because it makes it too likely that you'd be discovered, plus again there's the issue of making it pass spurious emissions testing. This sort of thing would probably only be used in targeted attacks.

by gh02t 9y ago

mikeash 9y ago

Maybe you could combine those two ideas. Have a really tiny bug in the logic electronics somewhere that transmits at extremely low power, then have a bigger thing in a power capacitor that receives those and retransmits the data at higher power. IANAEE, though, so I could be talking nonsense. As far as the size goes, is there any tradeoff between size and price? If there’s a more expensive design that occupies less volume, an attacker could use that design, use the extra space for the bug, then sell the whole thing as if it were the cheaper version. You probably couldn’t do this for all of your capacitors, since it would cost a lot. Maybe 1% would be enough to have a good chance of getting a bug somewhere interesting.

gh02t 9y ago
Capacitor size is pretty much set by the technology, but where possible smaller equivalent parts are usually cheaper. You can't spam this in all of your products anyway because it makes it too likely that you'd be discovered, plus again there's the issue of making it pass spurious emissions testing. This sort of thing would probably only be used in targeted attacks.