3 ms·
One of the bloomberg articles claimed that in some cases it was "thin enough that they’d been embedded between the layers of fiberglass" -- like as if it were a
by wyldfire 8y ago
One of the bloomberg articles claimed that in some cases it was "thin enough that they’d been embedded between the layers of fiberglass" -- like as if it were a passive in a blind/buried via?
This seems like a very sophisticated attack.
- baybal2 8y agoNot a sophisticated attack, but a standard industry practice for high value, high density boards. I first saw a buried passive 5 years ago.
- wyldfire 8y agoSorry, I didn't mean to suggest that the attack was with a passive. Clearly, this package is shown to have logic. But it was meant to look as if it were a passive. In some cases surface mount, but in truly devious ones it's much better hidden.
- baybal2 8y agoWell my own idea was along the lines - if they can burry passives, burying a small IC should also be possible
- femto 8y agoSD cards have the raw IC die buried in the PCB. If you crack open a cheap SanDisk card, you will see that it is a marvel of engineering. Instinctively one thinks of advanced manufacturing as being reserved for high end goods, but in reality it is used widely in cheap mass produced things to bring the cost down.
- nerfhammer 8y agoPassives don't have enough pins to do much of anything, unless it's an array of passives in a single package that happens to be on power, gnd and data lines at once. But, I'm not sure but it seems like a bit of a red herring. Reading the article the chip in question doesn't sound passive at all: "The Supermicro board here appears to have a QSPI chip, but also a space for an SPI chip as a manufacturing-time option. The alleged implant is mounted in part of the space where the SPI chip would go." edit: so maybe it was an array of passives that were meant to go across every pin of this protocol in a single package.
- XnoiVeX 8y agoDid you see the comment above that QSPI boots up as SPI and then switches over to QSPI?
- TickleSteve 8y agoIt can't be QSPI, he's forgetting the clock and (potentially) chip-select lines.