4 ms·

> One country in particular has an advantage executing this kind of attack: China, which by some estimates makes 75 percent of the world’s mobile phones and 90

> One country in particular has an advantage executing this kind of attack: China, which by some estimates makes 75 percent of the world’s mobile phones and 90 percent of its PCs. Intel and AMD are both USA based companies. Is it conceivable their processors contain backdoors in a similar vein?

squaredpants 8y ago
I'm pretty certain they do. AMD's PSP and Intel's ME are really shady and are still enabled in every CPU sold today (and full of disclosed and undisclosed flaws for that matter).
- jake_the_third 8y ago
  Not to mention that these back doors can be easily disabled, e.g intels high assurance mode, but normal "owners" are specifically not allowed to disable them. The whole thing is a fucking mess.
chx 8y ago
No, it is totally inconceivable AMD and Intel CPUs are backdoored this way. Inserting a microcontroller somewhere on the Ethernet traces and then using IPMI is not as sophisticated as this article wants to describe. Sophistication is necessary from the payload to be stealthy but not the hardware. There are at least two problems with China messing with CPUs: a) they are not made there. TSMC is Taiwan, the Asian parts of Global Foundries are in Singapore, Intel is manufacturing CPUs mostly in the USA with some in Ireland and Israel, only 3DNAND / 3DXPoint ICs are made in China. b) the hardware knowledge to change here, well, think of it, the microcontroller on the motherboard is on the few millimetres scale, the parts here are on the few ten nanometres scale so as a rough but not unjust quantifications would say it's 100 000 times harder. Whether the platforms are hackable / hacked, that's harder to say thanks Intel ME and such but the CPUs aren't.
- simias 8y ago
  I don't think the parent was talking about this specific type of attacks but other types of hardware backdoors. I think the answer to that is very obviously yes, and given what we know about intelligence agencies I'm even willing to go as far as saying that it is likely (or at least, if you have reasons to be worried about Uncle Sam getting to your stuff you should consider it a very real possibility). Modern ASICs are so complex that I'm sure that sneaking a tiny backdoor into the behemoth that's a modern CPU or embedded SoC would be almost trivial. They'd also have great plausible deniability in case they're found, if something like SPECTRE was an intentional backdoor how would you ever prove it for instance?
  - wepple 8y ago
    > Modern ASICs are so complex that I'm sure that sneaking a tiny backdoor into the behemoth that's a modern CPU or embedded SoC would be almost trivial. I suspect putting in a backdoor would be difficult because they are complex. Wouldn’t it be far too easy for the backdoor to inadvertently cause reliability or performance issues? And the bug would have to be useful enough to warrant potentially destroying the semiconductor business of a nation, not just some difficult to trigger side channel.
    - whatpad 8y ago
      Nobody cares about your wild, uneducated speculation.
      - wepple 8y ago
        Welcome to HN. You’ll find that kind of negative comment which doesn’t really add to the discussion isn’t valued here. It wasn’t wild nor uneducated; I have some experience with FPGAs and the challenges of complex circuit design - regardless, I was posing a question rather than stating fact. Do you disagree with what I suggested? Educate me, correct my speculation.
      - dang 8y ago
        Please be civil here. https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html
baq 8y ago
can you be sure that fabs haven't been infiltrated and masks changed between design and production in any factory, be it tsmc, samsung, glofo or intel?
- TheSpiceIsLife 8y ago
  Presumably the organisations responsible for hard coding backdoors in chip designs know how to test to confirm their presence. Presumably some adversarial nation-states have moles inside these organisations > know how to remove them prior to fab. Presumably these adversaries export genuine chips to their adversaries, thereby tricking them in to thinking the backdoors made it through the fab process, and only use chips that have the backdoors removed in their own critical infrastructure. Presumably. I’ve always had this fantasy of being a hextuple agent involved in this type of deep espionage.
- paulie_a 8y ago
  The US did that in the late 70's or early 80's to the USSR and it resulted in one of the largest non nuclear explosions in history.
  - aaaaaaaaaab 8y ago
    * allegedly https://en.m.wikipedia.org/wiki/At_the_Abyss https://en.m.wikipedia.org/wiki/At_the_Abyss
hoppelhase 8y ago
And how about the software that runs on these things?
JohnHaugeland 8y ago
they're up front and open that they do also, they're not that hard to dig out https://www.youtube.com/watch?v=_eSAF_qT_FY https://www.youtube.com/watch?v=_eSAF_qT_FY

squaredpants 8y ago

I'm pretty certain they do. AMD's PSP and Intel's ME are really shady and are still enabled in every CPU sold today (and full of disclosed and undisclosed flaws for that matter).

jake_the_third 8y ago
Not to mention that these back doors can be easily disabled, e.g intels high assurance mode, but normal "owners" are specifically not allowed to disable them. The whole thing is a fucking mess.

chx 8y ago

No, it is totally inconceivable AMD and Intel CPUs are backdoored this way. Inserting a microcontroller somewhere on the Ethernet traces and then using IPMI is not as sophisticated as this article wants to describe. Sophistication is necessary from the payload to be stealthy but not the hardware. There are at least two problems with China messing with CPUs: a) they are not made there. TSMC is Taiwan, the Asian parts of Global Foundries are in Singapore, Intel is manufacturing CPUs mostly in the USA with some in Ireland and Israel, only 3DNAND / 3DXPoint ICs are made in China. b) the hardware knowledge to change here, well, think of it, the microcontroller on the motherboard is on the few millimetres scale, the parts here are on the few ten nanometres scale so as a rough but not unjust quantifications would say it's 100 000 times harder. Whether the platforms are hackable / hacked, that's harder to say thanks Intel ME and such but the CPUs aren't.

simias 8y ago
I don't think the parent was talking about this specific type of attacks but other types of hardware backdoors. I think the answer to that is very obviously yes, and given what we know about intelligence agencies I'm even willing to go as far as saying that it is likely (or at least, if you have reasons to be worried about Uncle Sam getting to your stuff you should consider it a very real possibility). Modern ASICs are so complex that I'm sure that sneaking a tiny backdoor into the behemoth that's a modern CPU or embedded SoC would be almost trivial. They'd also have great plausible deniability in case they're found, if something like SPECTRE was an intentional backdoor how would you ever prove it for instance?
- wepple 8y ago
  > Modern ASICs are so complex that I'm sure that sneaking a tiny backdoor into the behemoth that's a modern CPU or embedded SoC would be almost trivial. I suspect putting in a backdoor would be difficult because they are complex. Wouldn’t it be far too easy for the backdoor to inadvertently cause reliability or performance issues? And the bug would have to be useful enough to warrant potentially destroying the semiconductor business of a nation, not just some difficult to trigger side channel.
  - whatpad 8y ago
    Nobody cares about your wild, uneducated speculation.
    - wepple 8y ago
      Welcome to HN. You’ll find that kind of negative comment which doesn’t really add to the discussion isn’t valued here. It wasn’t wild nor uneducated; I have some experience with FPGAs and the challenges of complex circuit design - regardless, I was posing a question rather than stating fact. Do you disagree with what I suggested? Educate me, correct my speculation.
    - dang 8y ago
      Please be civil here. https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html

baq 8y ago

can you be sure that fabs haven't been infiltrated and masks changed between design and production in any factory, be it tsmc, samsung, glofo or intel?

TheSpiceIsLife 8y ago
Presumably the organisations responsible for hard coding backdoors in chip designs know how to test to confirm their presence. Presumably some adversarial nation-states have moles inside these organisations > know how to remove them prior to fab. Presumably these adversaries export genuine chips to their adversaries, thereby tricking them in to thinking the backdoors made it through the fab process, and only use chips that have the backdoors removed in their own critical infrastructure. Presumably. I’ve always had this fantasy of being a hextuple agent involved in this type of deep espionage.
paulie_a 8y ago
The US did that in the late 70's or early 80's to the USSR and it resulted in one of the largest non nuclear explosions in history.
- aaaaaaaaaab 8y ago
  * allegedly https://en.m.wikipedia.org/wiki/At_the_Abyss https://en.m.wikipedia.org/wiki/At_the_Abyss

hoppelhase 8y ago

And how about the software that runs on these things?

JohnHaugeland 8y ago

they're up front and open that they do also, they're not that hard to dig out https://www.youtube.com/watch?v=_eSAF_qT_FY https://www.youtube.com/watch?v=_eSAF_qT_FY