6 ms·
EE here, looking at the size of the chip, the weight and power difference is going to be too small to measure. Latency will probably not be affected when the ch
by LeonM 8y ago
EE here, looking at the size of the chip, the weight and power difference is going to be too small to measure. Latency will probably not be affected when the chip is dormant
- scld 8y agoIf it replaced a DNP part, it could have been found at a flying probe test. Half the expected impedance on a few of those pins? Also AOI might have picked up a difference.
- dboreham 8y agoFlying probe testing is unlikely to be used for this type of product.
- pixl97 8y agoSounds like a randomized sample of boards needs tested against a reference then.
- nvusuvu 8y agoAOI would miss the chip if it were buried between layers or look exactly like a part it was replaced for.
- lovelearning 8y agoI wonder how the auditing team detected it. X-rays?
- bri3d 8y agoThey might have noted an anomaly in the SMC given the acknowledged SMC firmware exploits (maybe a beta test run?) and investigated the SPI lines to the SMC as a response.
- mediocrejoker 8y agoAre you basing this off the photo in the Bloomberg article that shows a small (0402?) SMT package with three terminals? I wonder if that's an actual photo of the chip in question.
- codetrotter 8y agoFTA: https://assets.bwbx.io/images/users/iqjWHBFdfxIU/iWRg56pmx508/v0/-1x-1.jpg https://assets.bwbx.io/images/users/iqjWHBFdfxIU/iWRg56pmx50... > [...] a picture of the alleged implant. This shows a 6-pin silicon chip inside a roughly 1mm x 2mm ceramic package – as often used for capacitors and other so-called ‘passive’ components, which are typically overlooked.
- dboreham 8y agoIt might be possible to mount an attack from a board location occupied by a legitimate passive component (or a single SOT-23 transistor, something like that). In that case the attacker would only need to replace a reel of legit passives in the PnP machine. Visually they'd be identical.
- nerfhammer 8y agoSOT-23 only has three pins, seems like it would be challenging only having one data pin. The alleged component in question had six pins, if it were passive it must have been a bank or array of passives since individual passives generally only have two pins each.
- jnbiche 8y agoBased on the captions in the original story, I think it's just a photo of a random signal conditioning coupler, which the chip in question was said to strongly resemble. But I'm not sure.
- wyldfire 8y agoOne of the bloomberg articles claimed that in some cases it was "thin enough that they’d been embedded between the layers of fiberglass" -- like as if it were a passive in a blind/buried via? This seems like a very sophisticated attack.
- baybal2 8y agoNot a sophisticated attack, but a standard industry practice for high value, high density boards. I first saw a buried passive 5 years ago.
- wyldfire 8y agoSorry, I didn't mean to suggest that the attack was with a passive. Clearly, this package is shown to have logic. But it was meant to look as if it were a passive. In some cases surface mount, but in truly devious ones it's much better hidden.
- baybal2 8y agoWell my own idea was along the lines - if they can burry passives, burying a small IC should also be possible
- femto 8y agoSD cards have the raw IC die buried in the PCB. If you crack open a cheap SanDisk card, you will see that it is a marvel of engineering. Instinctively one thinks of advanced manufacturing as being reserved for high end goods, but in reality it is used widely in cheap mass produced things to bring the cost down.
- nerfhammer 8y agoPassives don't have enough pins to do much of anything, unless it's an array of passives in a single package that happens to be on power, gnd and data lines at once. But, I'm not sure but it seems like a bit of a red herring. Reading the article the chip in question doesn't sound passive at all: "The Supermicro board here appears to have a QSPI chip, but also a space for an SPI chip as a manufacturing-time option. The alleged implant is mounted in part of the space where the SPI chip would go." edit: so maybe it was an array of passives that were meant to go across every pin of this protocol in a single package.