8 ms·
Supply Chain Security Is the Whole Enchilada, but Who’s Willing to Pay for It?
- CPLX 8y agoThis seems like as good an excuse as any to post a link to the seminal “Reflections on Trusting Trust”: https://www.archive.ece.cmu.edu/~ganger/712.fall02/papers/p761-thompson.pdf https://www.archive.ece.cmu.edu/~ganger/712.fall02/papers/p7... It’s an absolute classic that I’m sure 97% of HN readers are familiar with, but for the 3% that aren’t it’s a really great meditation on just how difficult it is to trust any computing system, without somehow recursively assessing the trustworthiness of everything that has ever happened before.
- nickpsecurity 8y agoThat was a paper reflecting on Paul Kargers compiler-compiler subversion he did in the 1970's evaluation of MULTICS. https://www.acsac.org/2002/papers/classic-multics.pdf https://www.acsac.org/2002/papers/classic-multics.pdf The seminal paper on subversion in the lifecycle was from another high-assurace, security researcher named Philip Myers in 1980: https://csrc.nist.gov/csrc/media/publications/conference-paper/1998/10/08/proceedings-of-the-21st-nissc-1998/documents/early-cs-papers/myer80.pdf https://csrc.nist.gov/csrc/media/publications/conference-pap... The recommendations were carefully specifying what things do, implementing them in a structured way to inspect for backdoors, using safe languages to block regular vulnerabilities, using covert-channel analysis to find leaks, verifying things down to object code or transistors, letting people build from crypto-signed source, and using couriers for the hardware from trusted facilities onshore ("trusted trucks"). People ignored most of that. Even Thompson as he was obsessed with unsafe language vs Wirth whose work let you choose per module. It's coming back to bite everyone.
- nickpsecurity 8y agoOh yeah, if any of you enjoyed Thompson's paper, you might enjoy this write-up that talks about discovering something like that: https://www.teamten.com/lawrence/writings/coding-machines/ https://www.teamten.com/lawrence/writings/coding-machines/ It took me 30min-1hr to read. I can't recall specifically. Worth it. :)
- nickpsecurity 8y agoThe DOD has been paying it through the Trusted Foundry Program. Probably not enough use of that, though. ;) https://www.dmea.osd.mil/trustedic.html https://www.dmea.osd.mil/trustedic.html
- Nasrudith 8y agoIf you mean among themselves fine - but among others along the peripheral I think it is for a good reason. It would be something of them isn't something likely to be piggybacked on for several reasons - even aside from the increased cost from overspeccing and reduced economies of scale the DOD easily have the muscle to extort built in spyware to the specification to be trusted to if they want big contracts. And given history believing such is not paranoid and wise in a sense of 'not being stupid' as opposed to prescience given the past history of exposed similar moves and a lack of transparency. Probably a borderline 'blasphemous' statement like other uncomfortable truths about things not working.
- nickpsecurity 8y agoI had a recommendation for this during Snowden leaks: use hardware from threat model's most capable opponents. As in, assume it's all backdoored by at least one party. Most threatening are specific, nation states. Use their opponents' hardware. If stopping Chinese hackers, use stuff from Trusted Foundry running most secure software you can. If stopping Five Eyes and Israel, use Russian or Chinese hardware running most secure stuff they support. If not trusting anyone, use a computer made before 1997 that's not on a network and usually hidden in a tamper-evident compartment. If paranoid, get rid of all electronic devices except those that detect electronic devices and emissions. Keep it far away from you itself sealed so it's not a point of attack. Periodically get it out to conduct a sweep. Your brain, pencil, paper, and hiding places are what you trust in this model. Even mechanical typewriters have acoustic and active RF weaknesses. So, now you know how to be paranoid. Have at it. ;)
- pmlnr 8y agoWhy 1997?
- dev_dull 8y agoI’m not a protectionist, but we need to start looking USA-based semiconductor supply capacity as a national security imperative. We should never lose our ability to manufacture these critical components, even it means policies that might be viewed as “protectionist”.
- pmlnr 8y agoI feel the same way in europe, and it applies to much simpler things as well: clothing and shoes. It's incredibly hard to find shoes manufactured locally, or at least regionally.
- GordonS 8y agoI don't think these are the kind of items the parent was referring to. Does it really matter if your shoes were manufactured locally?
- raesene9 8y agoIt could in the event of a trade war, which seems increasingly likely for many countries. Lack of local manufacturing isn't really important in a world of global commerce, but when governments start using their manufacturing as a weapon in dimplomatic disputes it becomes important.
- GordonS 8y agoYou could argue that about literally anything though, from clothes to bananas - but it's simply not practical for every country to manufacture and produce everything it needs. Also, clothing and shoes (mentioned in the comment I responded to) are easy to produce without massive capital outlay, and the raw materials are readily available from several countries. I think the local manufacturing argument makes more sense with regard to items that are seen as critical, and which would be impractical to obtain from elsewhere - such as motherboards, processors and the like.
- 8y ago
- stcredzero 8y agoIs Apple willing to pay for supply chain security? Could they afford it? Writing for this week’s newsletter put out by the SANS Institute, a security training company based in Bethesda, Md., editorial board member William Hugh Murray has a few provocative thoughts: 1. Abandon the password for all but trivial applications. 2. Abandon the flat network. 3. Move traffic monitoring from encouraged to essential. 4. Establish and maintain end-to-end encryption for all applications. 5. Abandon the convenient but dangerously permissive default access control rule of “read/write/execute”
- simplecomplex 8y agoThe supply chain is secure. But that’s not FUD that sells. The gap between mainstream news and tech news is closing.
- maltalex 8y ago> Indeed, noted security expert Bruce Schneier calls supply-chain security “an insurmountably hard problem.” Centrally, yes. But supply chain verification & tracking is one thing blockchains are genuinely good at. There are actual blockchain-based products on the market for that. Imagine a company such as Apple forcing their suppliers to authenticate each production step from raw material to shipped good on a proprietary blockchain. It's certainly doable from a technical standpoint, and Apple's suppliers are probably eager enough not to lose Apple's business to comply.
- _trampeltier 8y agoI know from the car industrie, from each car, they know from each part the whole production history. A factory, for example, is certified to produce part "A". The factory has two machines (machine "B" and "C") who could produce part "A". The factory has to produce samples with machine "B". The samples have to pass several test and get approved by all the companys, who produce bigger and bigger parts with part "A" until you get the full car. So maybe a handfull of companys have to say ok to part "A". This can take like a half year or more. So now is machine "B" certified to produce "A" but not machine "C". This takes all pretty long and I don't think it's done this way in the electronics world, because there are almost no callbacks. So why bother so much with the supply chain. And not to forget, the test is just if the part does pass the tolerances in the factory. It does not test, if a guy in the factory does cheat. Even if the factory checked "everyting" and all the details. Then comes somebody like the NSA and they just grab the package on the transport from the factory to the customer (Cisco).
- GordonS 8y agoI don't see how this would help here. If you have a nefarious party adding skullduggerous chips to motherboards, they are hardly likely to attest to that on a blockchain. My point is, just because someone added a verification message to a blockchain, doesn't mean it actually happened in real life - or indeed preclude additional things from happening.
- presscast 8y agoI don't understand how this solves the problem: - if all links in the supply-chain are properly verifying/tracking components, why can't they send this verif/tracking data to their client's server? - if they're not making a good-faith effort, what does blockchain solve? Blockchain is genuinely good at maintaining an immutable, trust-free ledger. It's NOT good at making sure the data that's written to it is true.
- iambateman 8y agoCan someone explain why a semiconductor production facility would be “punishingly” expensive to operate in the US? Maybe the cost of electricity, but it seems like the labor cost wouldn’t make a huge difference since most of the production work (I presume) is automated.
- axaxs 8y agoI don't see how, either. TI, Intel, GloFo, and a few others have facilities here. Sure China can do it cheaper, but IMO the race to the bottom is over. People want quality, which explains why Apple and Samsung outsell, say, BLU.
- hobofan 8y agoI guess it's could also be a) A missing local supply chain for the raw resources, making them more expensive b) Additional shipping cost, since every chip will still be assembled into the product in Asia anyway
- nyolfen 8y agoi would imagine at least part of it is supply chain centralization around eg shenzhen. it would have to be much more than just the fabs to be competitive
- gnopgnip 8y agoSafety, and environment costs. Many of the former semiconductor sites in the US are now superfund sites. Doing work exactly the same way it is done overseas would be illegal in the US, and doing it legally is expensive.
- Animats 8y agoThis is going to be a huge problem. If that backdoor exists, someone will find it and use it. Not necessarily the people who put it there.
- teddyh 8y ago“If it’s a core business function — do it yourself, no matter what.” — Joel Spolsky, talking about Not-Invented-Here programming https://www.joelonsoftware.com/2001/10/14/in-defense-of-not-invented-here-syndrome/ https://www.joelonsoftware.com/2001/10/14/in-defense-of-not-...
- QML 8y agoIs security considered a “core business function”? I wouldn’t believe so.
- teddyh 8y agoJoel also writes “If you have customers, never outsource customer service.”. I think “security” is in the same category.
- dylan604 8y agoHow does this apply to the types of programming like encryption where it is oft advised to not roll-your-own?
- swagasaurus-rex 8y agoEncrypt multiple times with multiple encryption methods? Including an in-house built cipher (task assigned to intern).
- closeparen 8y agoIf there's reason to believe your team is better at cryptography implementation than the people behind the libraries you'd otherwise use, maybe. (This probably applies to the US national security establishment, not some random internet product).
- curuinor 8y agoIf encryption is a core business function, you need as a prerequisite to having a business at all a couple of folks who know encryption well enough to roll their own.
- rkagerer 8y agoOnce upon a time computers came with a full schematic diagram and enthusiasts could actually verify what they received. My point isn't so much the diagram as it is the culture of [showing/]knowing what's inside your black box.
- yc-kraln 8y agoThis is the kind of attack that the trustless.ai guys are fighting. They've secured their supply chain down to the silicon vendor at a fab in Italy. Really cool project.