4 ms·

So the chip shown in the article looks like a typical SMD balun, it is a type of transformer used to adapt impedance between two transmission line. It’s designe

So the chip shown in the article looks like a typical SMD balun, it is a type of transformer used to adapt impedance between two transmission line. It’s designed to replace a series a lumped element (capacitor, inductors, resistors) normally used for impedance adaptation (in a T or Pi network). The most common used for the device is directly between an antenna an a RF front-end to serve as an antenna tuner. Technically you could embed and power an RF front-end inside a “flavored” balun to intercept or alter any communication passing through that front-end or even use the antenna to communicate during the down time. So this literally would hack Wifi / Bluetooth at low level and inject code and at the same time create a mesh network of malicious devices to relay information. Welcome to IoT Cyberwarfare. But this clever hack is probably not limited to RF and is likely to also be embedded in transformers used for isolating Ethernet lines. Common mode chokes (some SMD chokes also look like the chip they are showing) or even some integrated ESD protection solution would be an ideal target as they are inserted in series of the signal.

FridgeSeal 8y ago
Wow that’s pretty neat. Terrifying and neat; thanks for the explanation! How easy is it for us (or rather the companies making the hardware) to detect and mitigate this?
07d046 8y ago
I don't know enough about this, but isn't the article saying that the appearance is deceptive: The chips on Elemental servers were designed to be as inconspicuous as possible, according to one person who saw a detailed report prepared for Amazon by its third-party security contractor, as well as a second person who saw digital photos and X-ray images of the chips incorporated into a later report prepared by Amazon’s security team. Gray or off-white in color, they looked more like signal conditioning couplers, another common motherboard component, than microchips, and so they were unlikely to be detectable without specialized equipment.
- rasz 8y ago
  If the photo in the article is real you wouldnt be able to identify this component as compromised "just" by visual (even xray augmented) inspection. TVS Diode Array looks the same from the outside, whats more its build in same way with silicon die embedded in tis structure. Other than signal analysis it would take decapping every single component of a motherboard to find this implant.
- C1sc0cat 8y ago
  How specialised? ohmmeters inductance capacitance meters are not exactly exotic.
denyslb 8y ago
The chip shown in the article most likely just something journalists found in photo stock by keywords.
rasz 8y ago
Yes, TVS Diode Array (image google to see they look just like in the article) for ESD protection is the obvious candidate, inserted on serial communication lines - perfect spot for signal interception/injection.
squarefoot 8y ago
"But this clever hack is probably not limited to RF and is likely to also be embedded in transformers used for isolating Ethernet lines." I was thinking along the same lines: a balun could harvest energy and use it for other purposes, but it should either store it for later use using maybe a tiny supercapacitor inside, or inject it into the data stream on the fly not unlike RFID dongles do. Or maybe just have enough power and memory to store a few hundred bytes and alter a few fields here and there, so that for example a network frame coming from a compromised machine can have its source field rewritten as it came from a trusted source. In theory small pull up resistors also could be swapped with lookalike malicious parts capable of tampering with i2c traffic between boards peripherals so that devices can be activated/deactivated no matter what the CPU tells them. We're going straight to the point when there won't be a single device in the world, from toasters to supercomputers through top brand network gear, that can claim and guarantee to be secure; inserting malicious hardware and firmware is getting just too easy for those with the necessary knowledge and resources. A technically interesting and scary scenario.
pmorici 8y ago
The article specifically says that the attack goes after the Baseboard Management Controller (BMC). In Supermicro equipment this takes the form of a separate SOC made by ASPEED that runs it's own operating system entirely separate from the main CPU but with access into the main system through various mechanisms. Facebook uses the same ASPEED chips in their open hardware projects.
bitewhite 8y ago
It seems to me that embedding an RF front-end, back-end, and signal manipulation logic in a chip of the size shown in the article would be extraordinarily difficult. Assuming that feat was achievable, it would likely result in serious performance hits on that transmission line right? Signal latency would probably be a dead giveaway for something like EEPROM reads being manipulated.
jiveturkey 8y ago
you would be extremely hard pressed to fit that amount of logic (and code) into that small of a package. and to operate intelligently, as you suggest, it needs a CPU clock, not available to it from where it would sit. And it would need to do signal analysis in real time, with no power and no clock. it's not possible.
- abecedarius 8y ago
  Clockless CPUs exist.
  - jiveturkey 8y ago
    grain-sized? and they still need power.
    - abecedarius 8y ago
      Honestly, I'm too ignorant to judge the rest, I just think you weren't accounting for (1) you don't need a clock signal for fancy logic and (2) you can fit a lot of logic in a cubic mm. The other points may rule this out, I don't know. Note that the async CPUs I've read about tend to be lower power than clocked ones.
  - bitewhite 8y ago
    Clockless CPUs with RF transceiver and signal manipulation logic, however, do not exist.
bravo22 8y ago
It does look like a balun which is clever but based on the pinout I think it is meant to intercept SPI flash and patch it as needed.
- bravo22 8y ago
  Looks like I was correct. This image from Bloomberg article seems to indicate SPI flash (https://twitter.com/jamesdotcuff/status/1048221163607007233 https://twitter.com/jamesdotcuff/status/1048221163607007233)

FridgeSeal 8y ago

Wow that’s pretty neat. Terrifying and neat; thanks for the explanation! How easy is it for us (or rather the companies making the hardware) to detect and mitigate this?

07d046 8y ago

I don't know enough about this, but isn't the article saying that the appearance is deceptive: The chips on Elemental servers were designed to be as inconspicuous as possible, according to one person who saw a detailed report prepared for Amazon by its third-party security contractor, as well as a second person who saw digital photos and X-ray images of the chips incorporated into a later report prepared by Amazon’s security team. Gray or off-white in color, they looked more like signal conditioning couplers, another common motherboard component, than microchips, and so they were unlikely to be detectable without specialized equipment.

rasz 8y ago
If the photo in the article is real you wouldnt be able to identify this component as compromised "just" by visual (even xray augmented) inspection. TVS Diode Array looks the same from the outside, whats more its build in same way with silicon die embedded in tis structure. Other than signal analysis it would take decapping every single component of a motherboard to find this implant.
C1sc0cat 8y ago
How specialised? ohmmeters inductance capacitance meters are not exactly exotic.

denyslb 8y ago

The chip shown in the article most likely just something journalists found in photo stock by keywords.

rasz 8y ago

Yes, TVS Diode Array (image google to see they look just like in the article) for ESD protection is the obvious candidate, inserted on serial communication lines - perfect spot for signal interception/injection.

squarefoot 8y ago

"But this clever hack is probably not limited to RF and is likely to also be embedded in transformers used for isolating Ethernet lines." I was thinking along the same lines: a balun could harvest energy and use it for other purposes, but it should either store it for later use using maybe a tiny supercapacitor inside, or inject it into the data stream on the fly not unlike RFID dongles do. Or maybe just have enough power and memory to store a few hundred bytes and alter a few fields here and there, so that for example a network frame coming from a compromised machine can have its source field rewritten as it came from a trusted source. In theory small pull up resistors also could be swapped with lookalike malicious parts capable of tampering with i2c traffic between boards peripherals so that devices can be activated/deactivated no matter what the CPU tells them. We're going straight to the point when there won't be a single device in the world, from toasters to supercomputers through top brand network gear, that can claim and guarantee to be secure; inserting malicious hardware and firmware is getting just too easy for those with the necessary knowledge and resources. A technically interesting and scary scenario.

pmorici 8y ago

The article specifically says that the attack goes after the Baseboard Management Controller (BMC). In Supermicro equipment this takes the form of a separate SOC made by ASPEED that runs it's own operating system entirely separate from the main CPU but with access into the main system through various mechanisms. Facebook uses the same ASPEED chips in their open hardware projects.

bitewhite 8y ago

It seems to me that embedding an RF front-end, back-end, and signal manipulation logic in a chip of the size shown in the article would be extraordinarily difficult. Assuming that feat was achievable, it would likely result in serious performance hits on that transmission line right? Signal latency would probably be a dead giveaway for something like EEPROM reads being manipulated.

jiveturkey 8y ago

you would be extremely hard pressed to fit that amount of logic (and code) into that small of a package. and to operate intelligently, as you suggest, it needs a CPU clock, not available to it from where it would sit. And it would need to do signal analysis in real time, with no power and no clock. it's not possible.

abecedarius 8y ago
Clockless CPUs exist.
- jiveturkey 8y ago
  grain-sized? and they still need power.
  - abecedarius 8y ago
    Honestly, I'm too ignorant to judge the rest, I just think you weren't accounting for (1) you don't need a clock signal for fancy logic and (2) you can fit a lot of logic in a cubic mm. The other points may rule this out, I don't know. Note that the async CPUs I've read about tend to be lower power than clocked ones.
- bitewhite 8y ago
  Clockless CPUs with RF transceiver and signal manipulation logic, however, do not exist.

bravo22 8y ago

It does look like a balun which is clever but based on the pinout I think it is meant to intercept SPI flash and patch it as needed.

bravo22 8y ago
Looks like I was correct. This image from Bloomberg article seems to indicate SPI flash (https://twitter.com/jamesdotcuff/status/1048221163607007233 https://twitter.com/jamesdotcuff/status/1048221163607007233)