5 ms·

Hardware Implants

36 points by okket 8y ago

deleted 8y ago
[deleted]
doitLP 8y ago
I love follow-ups like this from experts like Joe. However, he seems quick to dismiss a couple things as improbable due to cost. I don’t know, but I wouldn’t be so sure considering we’re talking a nation-state actor here.
sephamorr 8y ago
A pencil point is a tapering edge, so I'm assuming the author is considering <1mm for "fully capable computer the size of a pencil point" being unreasonable. Microcontrollers are not a huge amount larger than that any more: -Cortex-M4f in 1.6x1.6x0.65mm (MAX32660) -Attiny20UUR in 1.56x1.4mmx0.50mm Bare dies may be a bit smaller than the above.
- kurthr 8y ago
  I would note that thinning and encapsulation of bare die allows typical thicknesses of <200um. Now, if you need an smt package and a (F)PCB then everything blows up to mm total thickness. Note also that typical minimum dicing width is 6-700um and your micros layout could be re-done to be a more toothpick 3x0.66x0.2 size. Still, gotta get power in and signals out, but conformal parylene will cover ACF or wirebonds.
  - baybal2 8y ago
    You can put a lot of tsvs across the border of IC and grind up to them, hoping that the wire will bond to at least one of them. And if you do bonding by hand, you can bond right to the metal if the oxide below is thick enough.
fulafel 8y ago
BMC threats are a sufficient reason to avoid server class hardware for some people. They even contain public remotely exploitable vulns.
bitewhite 8y ago
Coincidentally, Joe Fitzpatrick was also one of the experts cited in the Bloomberg article. It would have been great to see this kind of technical perspective in the Bloomberg article! Joe clearly has value to add to the conversation and it is disappointing that Bloomberg chose to leverage his credentials in the hardware security community to add fluff to their article instead of any real insight. Same with using Joe Grand as well.
dogreborn 8y ago
I've got titanium nails (controlled through magnet remote) in bone which helped me increase my height from 5'8 to 6'2 my dream height. The method is called distraction osteogenesis where bone is cut obliquely and distanced 0.8mm a day. I got both femur and tibia through the procedure in both legs to preserve the biomechanics which have to do with the femur to tibia ratio. That said i don't feel anything. But this change has tremendously helped me gain confidence. So, my atheletism isn't affected in anyway. I always had technical competence but was sidelined because of my lack of confidence due to my below average height. I saw some really tall guys without any degree getting the role which i had experience/qualification for without any issue. Today, I am a CEO of a small company and no longer insecure :)
- AdequateLobster 8y ago
  Are you an INCEL?
- okket 8y ago
  Implant can refer to: https://en.m.wikipedia.org/wiki/Implant https://en.m.wikipedia.org/wiki/Implant This thread is about implanting malicious chips in hardware, specifically motherboards, see the "The Big Hack" story by Bloomberg, all over the place, most recent discussion is currently #1 on the front page here: https://news.ycombinator.com/item?id=18145815 https://news.ycombinator.com/item?id=18145815
- turtlecloud 8y ago
  How much did that cost you???
  - dogreborn 8y ago
    100K
- sparkpeasy 8y ago
  Your comment bot is acting up
  - 8y ago
uncle_d 8y ago
The discoverability of a hardware hack as reported makes the whole thing fail to ring true for me. As Joe alludes to, why do something so discoverable when there are numerous other attack vectors that would preserve plausible deniability? It appears close to a one-time trick, if you’re China. Once the trust is gone, it’s not coming back. Supply chains are already coming back home due to automation and consequently less reliance on cheap manual labour. The case would have to be compelling - something that could not be achieved otherwise. That case is yet to be made.
- drasticmeasures 8y ago
  When you ask "why would they?" you can intuit a seemingly good case either way that they would or wouldn't (maybe they would because they're incompetent.) Instead of relying on intuition, a more to-the-point question is "did they do it?" We have to wait for a definitive answer to this from the authorities.
  - uncle_d 8y ago
    No, we’ll have to wait for some definitive proof.

36 points by okket 8y ago

deleted 8y ago

[deleted]

I love follow-ups like this from experts like Joe. However, he seems quick to dismiss a couple things as improbable due to cost. I don’t know, but I wouldn’t be so sure considering we’re talking a nation-state actor here.

sephamorr 8y ago

A pencil point is a tapering edge, so I'm assuming the author is considering <1mm for "fully capable computer the size of a pencil point" being unreasonable. Microcontrollers are not a huge amount larger than that any more: -Cortex-M4f in 1.6x1.6x0.65mm (MAX32660) -Attiny20UUR in 1.56x1.4mmx0.50mm Bare dies may be a bit smaller than the above.

kurthr 8y ago
I would note that thinning and encapsulation of bare die allows typical thicknesses of <200um. Now, if you need an smt package and a (F)PCB then everything blows up to mm total thickness. Note also that typical minimum dicing width is 6-700um and your micros layout could be re-done to be a more toothpick 3x0.66x0.2 size. Still, gotta get power in and signals out, but conformal parylene will cover ACF or wirebonds.
- baybal2 8y ago
  You can put a lot of tsvs across the border of IC and grind up to them, hoping that the wire will bond to at least one of them. And if you do bonding by hand, you can bond right to the metal if the oxide below is thick enough.

fulafel 8y ago

BMC threats are a sufficient reason to avoid server class hardware for some people. They even contain public remotely exploitable vulns.

bitewhite 8y ago

Coincidentally, Joe Fitzpatrick was also one of the experts cited in the Bloomberg article. It would have been great to see this kind of technical perspective in the Bloomberg article! Joe clearly has value to add to the conversation and it is disappointing that Bloomberg chose to leverage his credentials in the hardware security community to add fluff to their article instead of any real insight. Same with using Joe Grand as well.

dogreborn 8y ago

I've got titanium nails (controlled through magnet remote) in bone which helped me increase my height from 5'8 to 6'2 my dream height. The method is called distraction osteogenesis where bone is cut obliquely and distanced 0.8mm a day. I got both femur and tibia through the procedure in both legs to preserve the biomechanics which have to do with the femur to tibia ratio. That said i don't feel anything. But this change has tremendously helped me gain confidence. So, my atheletism isn't affected in anyway. I always had technical competence but was sidelined because of my lack of confidence due to my below average height. I saw some really tall guys without any degree getting the role which i had experience/qualification for without any issue. Today, I am a CEO of a small company and no longer insecure :)

AdequateLobster 8y ago
Are you an INCEL?
okket 8y ago
Implant can refer to: https://en.m.wikipedia.org/wiki/Implant https://en.m.wikipedia.org/wiki/Implant This thread is about implanting malicious chips in hardware, specifically motherboards, see the "The Big Hack" story by Bloomberg, all over the place, most recent discussion is currently #1 on the front page here: https://news.ycombinator.com/item?id=18145815 https://news.ycombinator.com/item?id=18145815
turtlecloud 8y ago
How much did that cost you???
- dogreborn 8y ago
  100K
sparkpeasy 8y ago
Your comment bot is acting up
- 8y ago

uncle_d 8y ago

The discoverability of a hardware hack as reported makes the whole thing fail to ring true for me. As Joe alludes to, why do something so discoverable when there are numerous other attack vectors that would preserve plausible deniability? It appears close to a one-time trick, if you’re China. Once the trust is gone, it’s not coming back. Supply chains are already coming back home due to automation and consequently less reliance on cheap manual labour. The case would have to be compelling - something that could not be achieved otherwise. That case is yet to be made.

drasticmeasures 8y ago
When you ask "why would they?" you can intuit a seemingly good case either way that they would or wouldn't (maybe they would because they're incompetent.) Instead of relying on intuition, a more to-the-point question is "did they do it?" We have to wait for a definitive answer to this from the authorities.
- uncle_d 8y ago
  No, we’ll have to wait for some definitive proof.