3 ms·

QSPI has 4 data lines, a clock and a chip-select line. In order to intercept a QSPI bus, you would therefore need 4+1+1+2xpower lines = 8 pins. This is not su

QSPI has 4 data lines, a clock and a chip-select line. In order to intercept a QSPI bus, you would therefore need 4+1+1+2xpower lines = 8 pins. This is not sufficient for QSPI. Single SPI on the other hand requires Clock, Data, ChipSelect, Ground & Power = 5 lines, so that would be plausible. (Yes, I know you can potentially get rid of the CS line, but that depends on what else is on the bus).

mindslight 8y ago
You need two lines - data/ground, or data/Vdd. Probably whichever gives you voltage when idle. You harvest power when data is idle. CS is irrelevant. The rough clock speed is fixed, and you can match the precise timing from the data line. QSPI actually gets you access to data in both directions with the tradeoff of only getting one quarter of the bits. Logically, you likely only need to recognize a few patterns that are each say 30 bits long. If you could shrink this down, it would look exactly like a boring pullup.
- TickleSteve 8y ago
  CS isn't irrelevant if there are multiple devices on the bus, we havent seen a schematic.
  - mindslight 8y ago
    Yes it is - a tap doesn't need to be 100% sure that a given chip is selected like how we think when designing a circuit - it just needs to key off patterns that look like memory reads of interest. If you've got ambiguity you don't need to pull in more parallel bits, just record a longer serial history. In fact I would think the most stealthy and robust way of bugging code would be to just ignore addresses and look for a context-free stream of instructions that does some security-sensitive initialization (either of the platform or of the application code). Turn off some flag that's supposed to be on, causing the code to continue running as normal but silently skipping certain checks. Now that you mention other devices on the bus - those in fact would be a great chip to subvert with such a backdoor. Why bother fitting everything into a two terminal hack package when you could just have a malicious temperature sensor sourced from the "lowest bidder" that does the attack and jumps to its own ROM? (I think those are usually I2C but you get the point). Bonus points for only being triggered through some sidechannel - recruit a low level employee at the target, while they retain plausible deniability.
bsder 8y ago
Most QSPI flash chips start up in an SPI mode for interrogation of parameters and then are commanded to switch to QSPI once the correct parameters are established. If your flash chip simply doesn't return the correct responses to switch to QSPI, most systems will happily continue communicating with SPI.

mindslight 8y ago

You need two lines - data/ground, or data/Vdd. Probably whichever gives you voltage when idle. You harvest power when data is idle. CS is irrelevant. The rough clock speed is fixed, and you can match the precise timing from the data line. QSPI actually gets you access to data in both directions with the tradeoff of only getting one quarter of the bits. Logically, you likely only need to recognize a few patterns that are each say 30 bits long. If you could shrink this down, it would look exactly like a boring pullup.

TickleSteve 8y ago
CS isn't irrelevant if there are multiple devices on the bus, we havent seen a schematic.
- mindslight 8y ago
  Yes it is - a tap doesn't need to be 100% sure that a given chip is selected like how we think when designing a circuit - it just needs to key off patterns that look like memory reads of interest. If you've got ambiguity you don't need to pull in more parallel bits, just record a longer serial history. In fact I would think the most stealthy and robust way of bugging code would be to just ignore addresses and look for a context-free stream of instructions that does some security-sensitive initialization (either of the platform or of the application code). Turn off some flag that's supposed to be on, causing the code to continue running as normal but silently skipping certain checks. Now that you mention other devices on the bus - those in fact would be a great chip to subvert with such a backdoor. Why bother fitting everything into a two terminal hack package when you could just have a malicious temperature sensor sourced from the "lowest bidder" that does the attack and jumps to its own ROM? (I think those are usually I2C but you get the point). Bonus points for only being triggered through some sidechannel - recruit a low level employee at the target, while they retain plausible deniability.

bsder 8y ago

Most QSPI flash chips start up in an SPI mode for interrogation of parameters and then are commanded to switch to QSPI once the correct parameters are established. If your flash chip simply doesn't return the correct responses to switch to QSPI, most systems will happily continue communicating with SPI.