4 ms·

So it is possible to get malicious code execution on the fabs that build the next generation of processors for our devices. What are the chances that a sophisti

by 0x0 8y ago

So it is possible to get malicious code execution on the fabs that build the next generation of processors for our devices. What are the chances that a sophisticaled stuxnet-like attack inserting backdoors in the CPU design will follow?

ttul 8y ago
I would say it’s more likely that back doors have been injected via gold old traditional espionage, which could be aided by sophisticated malware (say, to gain access to source code repositories).
kingosticks 8y ago
It would be much easier to do this at an earlier stage - before the design is handed off to the foundry. Modifying masks for even trivial changes is very difficult and that's assuming knowledge of the circuit (which your malicious code probably won't have). Plus I imagine the verification tools would spot the difference, flagging it as an imperfection which would then attract scrutiny. I think this is extremely unlikely.
- 0x0 8y ago
  Well, stuxnet was written with knowledge of a very specific SCADA setup. Not so farfetched to think a targeted trojan would be written with knowledge of the circuit.
  - toast0 8y ago
    Editing circuits is hard enough with complete information. If the intent is to add an exciting extra feature, that seems rather difficult to do via malware. If you're trying to just sabotage a bit, that's more likely -- maybe expose for slightly less time and things are less reliable, etc. Like others said though, it's probably easier to mess with the designs before they go to the Fab.
    - phendrenad2 8y ago
      What if they do have complete information? If you had spies working at all levels, you could create your own parallel version of the end result all the way down to the silicon level. Then, you would actually do the modification at the silicon level, to make the backdoor hardest to find.
      - delfinom 8y ago
        At that point you just insert a spook into the foundry as an employee and have them swap the files. No need to waste time or uncertainty.
- MertsA 8y ago
  Some backdoors can be almost impossible to detect with any kind of traditional wafer inspection tools. E.g., it might be possible to transparently cripple something like Intel's RdRand instruction by changing only the doping on some of the gates inside the hardware RNG circuit. It would look completely identical under the best microscope and looking at the output wouldn't give you a good indication of whether or not you had a broken RNG or a good one. The design of Intel's RNG involved passing the output of the RNG through some whitening and IIRC AES so it might look completely random and pass every statistical test but the hardware entropy source might only realistically have 10 bits per second of real entropy. I still think it's unlikely that someone would go through the effort to insert a super secret backdoor by surreptitiously modifying the masks but there are some interesting techniques that can make finding a backdoor almost impossible if you don't already know about it.
  - kingosticks 8y ago
    Sounds like the really cool "Stealthy Dopant-Level Hardware Trojans" paper from a few years ago. I'd forgotten about that, well worth a read for those interested. However, you must remember that as well as precise knowledge of the circuit, anyone other than an insider has close to zero chance of getting a doping change correct. Even an insider's chances are very low. And then your high-level testing is in place too. It's not common to have circuits where BIST can't give you full confidence but it happens; for things like the RNG here, also due to test tool limitations etc. So you must be doing both both general and highly targeted post-manufacturing testing also. The extent of that testing may depend on your market.
paulie_a 8y ago
It's apparently not hard, the US did it to the USSR in the 70s that resulted in one of the largest non nuclear explosions in the history of mankind.
- muricula 8y ago
  Wait what? Do you have a link with more info?
  - 32535634 8y ago
    https://www.cia.gov/library/center-for-the-study-of-intelligence/csi-publications/csi-studies/studies/96unclass/farewell.htm https://www.cia.gov/library/center-for-the-study-of-intellig... https://www.washingtonpost.com/archive/politics/2004/02/27/reagan-approved-plan-to-sabotage-soviets/a9184eff-47fd-402e-beb2-63970851e130/ https://www.washingtonpost.com/archive/politics/2004/02/27/r...
- kingosticks 8y ago
  Are you referring to the trans-siberian pipeline explosion in 1982? The claim is that it was caused by the CIA sabotaging the software used for controlling pipeline pressure. If this is true (seems to be partly rumour/leaks) then that's the work of a nation state, so I'm not convinced it qualifies as "not hard". https://www.telegraph.co.uk/news/worldnews/northamerica/usa/1455559/CIA-plot-led-to-huge-blast-in-Siberian-gas-pipeline.html https://www.telegraph.co.uk/news/worldnews/northamerica/usa/...
  - paulie_a 8y ago
    From the technical side it wasn't exactly a difficult feat. Sure getting it done was mostly logistical.
avs733 8y ago
Sabotage? probably highly likely. Even a power blip can scrap millions of dollars in product. You don't even have to hack a FAB, hack the local substation...hell hack the local airport or port and you can put them in discomfort. Actual backdoor? almost impossible. A backdoor would have to change the interconnections within the chips. That isn't a function performed by the FAB software. The design of the chip circuitry is designed much earlier. Once validated and released it is then laser / ion beam etched into a series of 'masks.' The mask represent the different layers of the chip that make up the interconnections. They are used in photolithography and are typically made elsewhere and then used thousands of times. Like a photo. To put a backdoor in the chip you would have to, undetected, hack the design side of a chip company. And do it early enough that without being noticed the backdoor is created into the masks which then get built into all of the chips and still remain unnoticed. It would be much easier to bribe a couple employees. Edit: a simple analogy - lets say you hack my oven. You can burn my cake and undercook it and give me food poisoning. But you can't swap the salt for sugar in the pan unless you actually had physical access.

by 0x0 8y ago

ttul 8y ago

I would say it’s more likely that back doors have been injected via gold old traditional espionage, which could be aided by sophisticated malware (say, to gain access to source code repositories).

kingosticks 8y ago

It would be much easier to do this at an earlier stage - before the design is handed off to the foundry. Modifying masks for even trivial changes is very difficult and that's assuming knowledge of the circuit (which your malicious code probably won't have). Plus I imagine the verification tools would spot the difference, flagging it as an imperfection which would then attract scrutiny. I think this is extremely unlikely.

0x0 8y ago
Well, stuxnet was written with knowledge of a very specific SCADA setup. Not so farfetched to think a targeted trojan would be written with knowledge of the circuit.
- toast0 8y ago
  Editing circuits is hard enough with complete information. If the intent is to add an exciting extra feature, that seems rather difficult to do via malware. If you're trying to just sabotage a bit, that's more likely -- maybe expose for slightly less time and things are less reliable, etc. Like others said though, it's probably easier to mess with the designs before they go to the Fab.
  - phendrenad2 8y ago
    What if they do have complete information? If you had spies working at all levels, you could create your own parallel version of the end result all the way down to the silicon level. Then, you would actually do the modification at the silicon level, to make the backdoor hardest to find.
    - delfinom 8y ago
      At that point you just insert a spook into the foundry as an employee and have them swap the files. No need to waste time or uncertainty.
MertsA 8y ago
Some backdoors can be almost impossible to detect with any kind of traditional wafer inspection tools. E.g., it might be possible to transparently cripple something like Intel's RdRand instruction by changing only the doping on some of the gates inside the hardware RNG circuit. It would look completely identical under the best microscope and looking at the output wouldn't give you a good indication of whether or not you had a broken RNG or a good one. The design of Intel's RNG involved passing the output of the RNG through some whitening and IIRC AES so it might look completely random and pass every statistical test but the hardware entropy source might only realistically have 10 bits per second of real entropy. I still think it's unlikely that someone would go through the effort to insert a super secret backdoor by surreptitiously modifying the masks but there are some interesting techniques that can make finding a backdoor almost impossible if you don't already know about it.
- kingosticks 8y ago
  Sounds like the really cool "Stealthy Dopant-Level Hardware Trojans" paper from a few years ago. I'd forgotten about that, well worth a read for those interested. However, you must remember that as well as precise knowledge of the circuit, anyone other than an insider has close to zero chance of getting a doping change correct. Even an insider's chances are very low. And then your high-level testing is in place too. It's not common to have circuits where BIST can't give you full confidence but it happens; for things like the RNG here, also due to test tool limitations etc. So you must be doing both both general and highly targeted post-manufacturing testing also. The extent of that testing may depend on your market.

paulie_a 8y ago

It's apparently not hard, the US did it to the USSR in the 70s that resulted in one of the largest non nuclear explosions in the history of mankind.

muricula 8y ago
Wait what? Do you have a link with more info?
- 32535634 8y ago
  https://www.cia.gov/library/center-for-the-study-of-intelligence/csi-publications/csi-studies/studies/96unclass/farewell.htm https://www.cia.gov/library/center-for-the-study-of-intellig... https://www.washingtonpost.com/archive/politics/2004/02/27/reagan-approved-plan-to-sabotage-soviets/a9184eff-47fd-402e-beb2-63970851e130/ https://www.washingtonpost.com/archive/politics/2004/02/27/r...
kingosticks 8y ago
Are you referring to the trans-siberian pipeline explosion in 1982? The claim is that it was caused by the CIA sabotaging the software used for controlling pipeline pressure. If this is true (seems to be partly rumour/leaks) then that's the work of a nation state, so I'm not convinced it qualifies as "not hard". https://www.telegraph.co.uk/news/worldnews/northamerica/usa/1455559/CIA-plot-led-to-huge-blast-in-Siberian-gas-pipeline.html https://www.telegraph.co.uk/news/worldnews/northamerica/usa/...
- paulie_a 8y ago
  From the technical side it wasn't exactly a difficult feat. Sure getting it done was mostly logistical.

avs733 8y ago

Sabotage? probably highly likely. Even a power blip can scrap millions of dollars in product. You don't even have to hack a FAB, hack the local substation...hell hack the local airport or port and you can put them in discomfort. Actual backdoor? almost impossible. A backdoor would have to change the interconnections within the chips. That isn't a function performed by the FAB software. The design of the chip circuitry is designed much earlier. Once validated and released it is then laser / ion beam etched into a series of 'masks.' The mask represent the different layers of the chip that make up the interconnections. They are used in photolithography and are typically made elsewhere and then used thousands of times. Like a photo. To put a backdoor in the chip you would have to, undetected, hack the design side of a chip company. And do it early enough that without being noticed the backdoor is created into the masks which then get built into all of the chips and still remain unnoticed. It would be much easier to bribe a couple employees. Edit: a simple analogy - lets say you hack my oven. You can burn my cake and undercook it and give me food poisoning. But you can't swap the salt for sugar in the pan unless you actually had physical access.