6 ms·

This technology would spot a secret chip in seconds

39 points by wolfgke 8y ago

moonbug 8y ago
Or just Secure Boot (on the BMCs).
- asaph 8y ago
  How does this defend against a the type of hardware-based attack discussed in the article?
  - rjst01 8y ago
    The same way secure-boot provides protection against hardware modification / evil maid type attacks in CPUs today: by verifying the integrity of the code that's about to be booted before the CPU boots it. It would significantly raise the cost and difficulty of this sort of attack.
    - wolfgke 8y ago
      > It would significantly raise the cost and difficulty of this sort of attack. In my opinion, modifying the board layout with the additional chip and modifying the production process for the server boards stealthily already has a pretty high cost and difficulty.
      - rjst01 8y ago
        > already has a pretty high cost and difficulty That's true, but properly implemented secure boot could serve to increase it by an order of magnitude.
  - monocasa 8y ago
    The best guess I've heard is that this attack pulls down the BMC's SPI flash lines in order to corrupt its code as it's loaded. A proper chain of trust that starts on the BMC chip could absolutely protect against that. At that point any modification to the boot image would leave the BMC refusing to boot rather giving attacker control.
- subudeepak 8y ago
  Hardware attacks cannot be prevented by secure boot...
  - wolfgke 8y ago
    > Hardware attacks cannot be prevented by secure boot... But by Trusted Computing (at least in some implementations).
  - moonbug 8y ago
    The most plausible hypothesis of how this attack works is by corrupting firmware loaded at power-on time over SPI. Secure boot would absolutely protect from that by rejecting the signature of the modified code. By hey, I get that Newsy groupthink means secure boot bad.
    - subudeepak 8y ago
      Secure boot is in no way bad :-) Ofcourse, it must in fact be the first point on any sane security checklist. And one of the most common attacks aka. malicious firmware is prevented by using secure boot. Many other classes of attacks like forcing the microcontroller to delete all its data, opening up the debug JTAG port of the microcontroller, preventing the log of certain security events etc. can be achieved with the right settings. Though these are just remote possibilities with high levels of complexity, so is changing a production design of a board.
    - asdf2341234 8y ago
      >is by corrupting firmware loaded at power-on time over SPI. >Secure boot would absolutely protect from that by rejecting the signature of the modified code. Why couldn't you also change out the keys so the signature does match?
      - moonbug 8y ago
        Doing so means compromising the TPM on the BMC module which is much harder to do. It's not something that can be done downstream in the supply chain, as this attack is purported to have been.
asaph 8y ago
I find the denials made by the companies involved to be substantive and credible. I'm inclined to believe them. Perhaps Bloomberg's reporters fell for a conspiracy theory this time.
- ElBarto 8y ago
  If true, the attack described by Bloomberg would mean the US fell victim to one of the most spectacular attack, if not the most spectacular attack, in history and at the hand of the Chinese. It's equally credible that they would never want to acknowledge that.
  - tyingq 8y ago
    "would mean the US fell victim to one of the most spectacular attack, if not the most spectacular attack, in history" The general idea doesn't seem new or novel. https://arstechnica.com/tech-policy/2014/05/photos-of-an-nsa-upgrade-factory-show-cisco-router-getting-implant/ https://arstechnica.com/tech-policy/2014/05/photos-of-an-nsa...
    - ElBarto 8y ago
      It's not the idea, which is indeed old and used. It's the execution and success (if true).
      - tyingq 8y ago
        I'm assuming it's been successfully used both by, and against, the US for many years.
  - rasz 8y ago
    or they knew about it from the beginning and used it as a counter intelligence tool, now blown by Bloomberg.
- wolfgke 8y ago
  > Perhaps Bloomberg's reporters fell for a conspiracy theory this time. According to > https://www.theregister.co.uk/2018/10/04/supermicro_bloomberg/?page=3 https://www.theregister.co.uk/2018/10/04/supermicro_bloomber... "Bloomberg reporters receive bonuses based indirectly on how much they shift markets with their reporting. This story undoubtedly did that. The publisher employs roughly 2,000 journalists, who are encouraged to work together and share information through their Bloomberg Terminals, with many layers of editing and fact checking, and it has a zero tolerance on errors: it is inconceivable that it would publish a story this huge that wasn't watertight."
maltalex 8y ago
> The system uses optical scans, microscopy, X-ray tomography, and artificial intelligence to compare a printed circuit board and its chips and components with the intended design. Could it detect a change within a chip? If not, then it makes such an attack harder to execute, but not impossible. Especially for a nation state.
- Cthulhu_ 8y ago
  They could do spot checks where they remove the cap and compare pictures, but it's rather eh. Maybe testing could work? Hook it up to a testing device and have it run through a suite of tests not known by the manufacturer, as well as fuzzing tests. They might find additional bugs in their own design as well that way.
- TickleSteve 8y ago
  I would have thought it would actually easier to subvert the supply chain than physically mount a new device on a board. Simply supply 'alternate' devices for normal manufacture.
- kop316 8y ago
  The issue is that X-rays can only scan down to a certain feature size (its minimum resolution is directly related to its wavelength). There is research going into it, this article would interest you: https://www.nature.com/articles/nature21698 https://www.nature.com/articles/nature21698 Its the only article I know if that nondestructively can imagine a chip.
- rasz 8y ago
  No, none of those will detect a change in silicon. Only options are signal analysis on working system and/or decapping, scanning and comparing all the masks.
TickleSteve 8y ago
This would still not pick up malicious surface-mount devices. Imagine a subverted NOR FLASH device with malicious firmware booting your board-management device. Its still a SPI FLASH with the same (apparent) device id. The contents would just be different.
- alias_neo 8y ago
  The technology shown here is working at a different level; is looking at the PCB, trace by trace and identifying components and connections, layer by layer and verifying it against the design. It's purpose is to ensure that designs aren't modified in manufacture. What you're talking about is a software problem, and should be carried out in addition to this. The first idea that comes to mind is that I would sign the contents of the flash devices and have them verified once the board layout has been verified. Essentially, you'd have your board schematic, and then a signature "schematic" of firmware to verify against. Of course, you'd also need a way of signing the schematic/signature list to verify those once they're updated.
  - rasz 8y ago
    Yes, in other words technology shown here is useless.
    - alias_neo 8y ago
      I'm not sure what gives you that impression. In this case, the technology would have identified this additional component added out-of-spec. Once you've identified that a component that doesn't belong has been added you don't need to bother identifying any software attacks, it's already compromised.
      - rasz 8y ago
        What makes you think this component (if it existed) was visually different from component it replaced on the pcb?
  - 8y ago
frgewut 8y ago
Slightly offtopic, but most easiest way for detecting tampering with hardware is weighing stuff.
- JdeBP 8y ago
  Now read https://news.ycombinator.com/item?id=18138699 https://news.ycombinator.com/item?id=18138699 .
  - alxlaz 8y ago
    I see comments like that every once in a while, and I always come back to something that one of my professors told me a long time ago. If it took you like five minutes of thinking about it to come up with it, it's a safe bet that a) folks who are paid to work on this stuff full-time have already thought about it and b) that someone already figured out how to work around it.
- cMax347 8y ago
  Reminded me of this tweet I found earlier today: https://twitter.com/arbedout/status/1047822585009004545 https://twitter.com/arbedout/status/1047822585009004545 They actually shifted from weighing stuff to measuring angular momentum!
  - rasz 8y ago
    this "tweet" is an embedded screen capture from HN :)
- alias_neo 8y ago
  That's great if you're looking for whole extra boards in a device with grams or tens of grams of additional mass. These surface mount components are so small that the variation in the volume of solder on the joints alone would render your technique moot. Add to that, the fact that manufacturers often use multiple suppliers for parts, they could have different materials, densities and casing designs, this particular problem is beyond weighing.
monocasa 8y ago
I don't but that some machine learning algorithm from 2014 actually works and isn't just snake oil.
baybal2 8y ago
That will not help you with sand grain sized plants, if they actually are such
vectorEQ 8y ago
x-rays are useful to identify parts which don't belong in the original design, though it doesnt say anything about these parts. It can be manufacturing errors / design iterations not well documented or any number of things besides a malicious implant. more manual analysis will always be needed. But if you have tons of PCBs to go through it can give a quick overview what chips might be good initial targets. some people noted that some 'hardware' attacks can't be seen because they use original parts. -> that's a silly statement, as that would make it a firmware attack, not a hardware attack (even though physical access might be needed to flash the chip, it's the firmware which is malicious, not the chip itsefl. i.e. other type of threat / use-case). i think the problem with x-rays, apart from them being hazardous in themselves, the cost and availibility of equipment is not practical for reverse engineers and researchers apart from some highest tier companies doing this. A question to NH about this which might be more interesting: do you think you can get similar results using ultrasound? Because ultrasound devices are fairly cheap and can be made at home fairly easily compared to x-ray technology. It's also much less hazardous to the researchers....
- ChrisLomont 8y ago
  >that's a silly statement, as that would make it a firmware attack, not a hardware attack Original parts can also have attacks not in firmware, without changing the transistor layouts, via dopant attacks [1, paper at 2]. [1] https://www.researchgate.net/publication/262211582_Stealthy_Dopant-Level_Hardware_Trojans https://www.researchgate.net/publication/262211582_Stealthy_... [2] https://sharps.org/wp-content/uploads/BECKER-CHES.pdf https://sharps.org/wp-content/uploads/BECKER-CHES.pdf
- rasz 8y ago
  >some people noted that some 'hardware' attacks can't be seen because they use original parts. You can have original looking part. Imagine a 8Mbit SOIC SPI NOR flash chip. Looks the part, belongs in its spot, you decap it and it sure does look like a flash Die with its normal Flash controller. Now consider this: http://travisgoodspeed.blogspot.com/2012/07/emulating-usb-devices-with-python.html http://travisgoodspeed.blogspot.com/2012/07/emulating-usb-de... I cant find it right now, but Afair Travis (or maybe it was hak5 RubberDucky folks) noticed early on that its pretty trivial to detect what is happening on the Host side of the interface - what operating system am I plugged into and at what phase of the operation are we on (bios query, OS loading drivers). Imagine a Flash chip that is able to tell (power sequencing, timing and order of commands) if its booting a particular controller on the board, or if its being read in a flash programmer. Flash chips have processors running their own firmware nowadays, turtles all the way own.
deleted 8y ago
[deleted]
amelius 8y ago
The problem is that the bad guys also have access to this technology. So they can just tweak their designs until the scanner says it's ok.
trycrmr 8y ago
The overarching theme is why isn't everyone using this tool. A few issues: 1) They might be, and it's being fooled. But... 2) ...they're likely not using it. Consider the following: > "So why isn’t this system in widespread use? After all, much of it has been available since 2014." With the compromised servers being purchased in 2015 it's assuming the ubiquitous implementation of the described system a year after "much of it" was available. Big companies don't move that fast to begin with (budgets, politics, entrenchment of current processes, etc.). Also, the article doesn't site anywhere this tech has been proven in the wild. Do you want to make that case to your boss that your job can be replaced (and maybe theirs) with this, probably expensive to purchase and implement, unproven tech? That's even if you've heard or thought of this system coming together in 2014 to prevent an attack that would've infiltrated your network by 2015. The only defense they give for why it hasn't been used was they were waiting for a huge attack to help justify company's spend. That would help, but FICS would be better off taking on the initial capital costs and charging these big companies on a per server basis to use FICS's system (or spinning of a company to do so, idk how FICS could make this happen). It's like saying a day after SpaceX's flight around the moon that if your company wants to get to the moon have your company purchase a BFR and send their own people up. Cool. Take a hike.
alsadi 8y ago
> .. would spot .. the article describe how to spot a supposed spying chip when it happens, but why they single China? Just replace it with Israel and the article would still valid.
otto_ortega 8y ago
This article is shameless self-promotion... "to compare a printed circuit board and its chips and components with the intended design..." So every company now has to design its own servers, routers and every other piece of hardware from the scratch to avoid "spy chips" ? Yeah... Sounds like a good idea...
exoesquitur 8y ago
The thing missing from this analysis is that on data bus lines like SPI, I2c and others there are "passive" components like resistors and capacitors used for signal conditioning and line bias. If one of these components were replaced with a highly integrated IC, it would be possible to mimic the function of the passive component most of the time, but sometimes hijack existing data streams as a MITM. This can be used to insert alternative boot code, firmware, microcode, or even FPGA structures. Note that the component would not have to generate its own signal source, because by merely inserting a lower than normal resistance or capacitance it could alter an existing bitstream to reflect the desired payload. It would require a high degree of integration and power management finesse, but is certainly doable to replace an existing SMT resistor or Capacitor with such a device. .
- exoesquitur 8y ago
  ..... Such a device would not be detectable by xray (micrographic xray maybe?) , ultrasound, visual inspection, circuit analysis, or signal analysis until it was activated by a particular bitstream, possibly as part of a firmware update released by the manufacturer.

39 points by wolfgke 8y ago

moonbug 8y ago

Or just Secure Boot (on the BMCs).

asaph 8y ago
How does this defend against a the type of hardware-based attack discussed in the article?
- rjst01 8y ago
  The same way secure-boot provides protection against hardware modification / evil maid type attacks in CPUs today: by verifying the integrity of the code that's about to be booted before the CPU boots it. It would significantly raise the cost and difficulty of this sort of attack.
  - wolfgke 8y ago
    > It would significantly raise the cost and difficulty of this sort of attack. In my opinion, modifying the board layout with the additional chip and modifying the production process for the server boards stealthily already has a pretty high cost and difficulty.
    - rjst01 8y ago
      > already has a pretty high cost and difficulty That's true, but properly implemented secure boot could serve to increase it by an order of magnitude.
- monocasa 8y ago
  The best guess I've heard is that this attack pulls down the BMC's SPI flash lines in order to corrupt its code as it's loaded. A proper chain of trust that starts on the BMC chip could absolutely protect against that. At that point any modification to the boot image would leave the BMC refusing to boot rather giving attacker control.
subudeepak 8y ago
Hardware attacks cannot be prevented by secure boot...
- wolfgke 8y ago
  > Hardware attacks cannot be prevented by secure boot... But by Trusted Computing (at least in some implementations).
- moonbug 8y ago
  The most plausible hypothesis of how this attack works is by corrupting firmware loaded at power-on time over SPI. Secure boot would absolutely protect from that by rejecting the signature of the modified code. By hey, I get that Newsy groupthink means secure boot bad.
  - subudeepak 8y ago
    Secure boot is in no way bad :-) Ofcourse, it must in fact be the first point on any sane security checklist. And one of the most common attacks aka. malicious firmware is prevented by using secure boot. Many other classes of attacks like forcing the microcontroller to delete all its data, opening up the debug JTAG port of the microcontroller, preventing the log of certain security events etc. can be achieved with the right settings. Though these are just remote possibilities with high levels of complexity, so is changing a production design of a board.
  - asdf2341234 8y ago
    >is by corrupting firmware loaded at power-on time over SPI. >Secure boot would absolutely protect from that by rejecting the signature of the modified code. Why couldn't you also change out the keys so the signature does match?
    - moonbug 8y ago
      Doing so means compromising the TPM on the BMC module which is much harder to do. It's not something that can be done downstream in the supply chain, as this attack is purported to have been.

asaph 8y ago

I find the denials made by the companies involved to be substantive and credible. I'm inclined to believe them. Perhaps Bloomberg's reporters fell for a conspiracy theory this time.

ElBarto 8y ago
If true, the attack described by Bloomberg would mean the US fell victim to one of the most spectacular attack, if not the most spectacular attack, in history and at the hand of the Chinese. It's equally credible that they would never want to acknowledge that.
- tyingq 8y ago
  "would mean the US fell victim to one of the most spectacular attack, if not the most spectacular attack, in history" The general idea doesn't seem new or novel. https://arstechnica.com/tech-policy/2014/05/photos-of-an-nsa-upgrade-factory-show-cisco-router-getting-implant/ https://arstechnica.com/tech-policy/2014/05/photos-of-an-nsa...
  - ElBarto 8y ago
    It's not the idea, which is indeed old and used. It's the execution and success (if true).
    - tyingq 8y ago
      I'm assuming it's been successfully used both by, and against, the US for many years.
- rasz 8y ago
  or they knew about it from the beginning and used it as a counter intelligence tool, now blown by Bloomberg.
wolfgke 8y ago
> Perhaps Bloomberg's reporters fell for a conspiracy theory this time. According to > https://www.theregister.co.uk/2018/10/04/supermicro_bloomberg/?page=3 https://www.theregister.co.uk/2018/10/04/supermicro_bloomber... "Bloomberg reporters receive bonuses based indirectly on how much they shift markets with their reporting. This story undoubtedly did that. The publisher employs roughly 2,000 journalists, who are encouraged to work together and share information through their Bloomberg Terminals, with many layers of editing and fact checking, and it has a zero tolerance on errors: it is inconceivable that it would publish a story this huge that wasn't watertight."

maltalex 8y ago

> The system uses optical scans, microscopy, X-ray tomography, and artificial intelligence to compare a printed circuit board and its chips and components with the intended design. Could it detect a change within a chip? If not, then it makes such an attack harder to execute, but not impossible. Especially for a nation state.

Cthulhu_ 8y ago
They could do spot checks where they remove the cap and compare pictures, but it's rather eh. Maybe testing could work? Hook it up to a testing device and have it run through a suite of tests not known by the manufacturer, as well as fuzzing tests. They might find additional bugs in their own design as well that way.
TickleSteve 8y ago
I would have thought it would actually easier to subvert the supply chain than physically mount a new device on a board. Simply supply 'alternate' devices for normal manufacture.
kop316 8y ago
The issue is that X-rays can only scan down to a certain feature size (its minimum resolution is directly related to its wavelength). There is research going into it, this article would interest you: https://www.nature.com/articles/nature21698 https://www.nature.com/articles/nature21698 Its the only article I know if that nondestructively can imagine a chip.
rasz 8y ago
No, none of those will detect a change in silicon. Only options are signal analysis on working system and/or decapping, scanning and comparing all the masks.

TickleSteve 8y ago

This would still not pick up malicious surface-mount devices. Imagine a subverted NOR FLASH device with malicious firmware booting your board-management device. Its still a SPI FLASH with the same (apparent) device id. The contents would just be different.

alias_neo 8y ago
The technology shown here is working at a different level; is looking at the PCB, trace by trace and identifying components and connections, layer by layer and verifying it against the design. It's purpose is to ensure that designs aren't modified in manufacture. What you're talking about is a software problem, and should be carried out in addition to this. The first idea that comes to mind is that I would sign the contents of the flash devices and have them verified once the board layout has been verified. Essentially, you'd have your board schematic, and then a signature "schematic" of firmware to verify against. Of course, you'd also need a way of signing the schematic/signature list to verify those once they're updated.
- rasz 8y ago
  Yes, in other words technology shown here is useless.
  - alias_neo 8y ago
    I'm not sure what gives you that impression. In this case, the technology would have identified this additional component added out-of-spec. Once you've identified that a component that doesn't belong has been added you don't need to bother identifying any software attacks, it's already compromised.
    - rasz 8y ago
      What makes you think this component (if it existed) was visually different from component it replaced on the pcb?
- 8y ago

frgewut 8y ago

Slightly offtopic, but most easiest way for detecting tampering with hardware is weighing stuff.

JdeBP 8y ago
Now read https://news.ycombinator.com/item?id=18138699 https://news.ycombinator.com/item?id=18138699 .
- alxlaz 8y ago
  I see comments like that every once in a while, and I always come back to something that one of my professors told me a long time ago. If it took you like five minutes of thinking about it to come up with it, it's a safe bet that a) folks who are paid to work on this stuff full-time have already thought about it and b) that someone already figured out how to work around it.
cMax347 8y ago
Reminded me of this tweet I found earlier today: https://twitter.com/arbedout/status/1047822585009004545 https://twitter.com/arbedout/status/1047822585009004545 They actually shifted from weighing stuff to measuring angular momentum!
- rasz 8y ago
  this "tweet" is an embedded screen capture from HN :)
alias_neo 8y ago
That's great if you're looking for whole extra boards in a device with grams or tens of grams of additional mass. These surface mount components are so small that the variation in the volume of solder on the joints alone would render your technique moot. Add to that, the fact that manufacturers often use multiple suppliers for parts, they could have different materials, densities and casing designs, this particular problem is beyond weighing.

monocasa 8y ago

I don't but that some machine learning algorithm from 2014 actually works and isn't just snake oil.

baybal2 8y ago

That will not help you with sand grain sized plants, if they actually are such

vectorEQ 8y ago

x-rays are useful to identify parts which don't belong in the original design, though it doesnt say anything about these parts. It can be manufacturing errors / design iterations not well documented or any number of things besides a malicious implant. more manual analysis will always be needed. But if you have tons of PCBs to go through it can give a quick overview what chips might be good initial targets. some people noted that some 'hardware' attacks can't be seen because they use original parts. -> that's a silly statement, as that would make it a firmware attack, not a hardware attack (even though physical access might be needed to flash the chip, it's the firmware which is malicious, not the chip itsefl. i.e. other type of threat / use-case). i think the problem with x-rays, apart from them being hazardous in themselves, the cost and availibility of equipment is not practical for reverse engineers and researchers apart from some highest tier companies doing this. A question to NH about this which might be more interesting: do you think you can get similar results using ultrasound? Because ultrasound devices are fairly cheap and can be made at home fairly easily compared to x-ray technology. It's also much less hazardous to the researchers....

ChrisLomont 8y ago
>that's a silly statement, as that would make it a firmware attack, not a hardware attack Original parts can also have attacks not in firmware, without changing the transistor layouts, via dopant attacks [1, paper at 2]. [1] https://www.researchgate.net/publication/262211582_Stealthy_Dopant-Level_Hardware_Trojans https://www.researchgate.net/publication/262211582_Stealthy_... [2] https://sharps.org/wp-content/uploads/BECKER-CHES.pdf https://sharps.org/wp-content/uploads/BECKER-CHES.pdf
rasz 8y ago
>some people noted that some 'hardware' attacks can't be seen because they use original parts. You can have original looking part. Imagine a 8Mbit SOIC SPI NOR flash chip. Looks the part, belongs in its spot, you decap it and it sure does look like a flash Die with its normal Flash controller. Now consider this: http://travisgoodspeed.blogspot.com/2012/07/emulating-usb-devices-with-python.html http://travisgoodspeed.blogspot.com/2012/07/emulating-usb-de... I cant find it right now, but Afair Travis (or maybe it was hak5 RubberDucky folks) noticed early on that its pretty trivial to detect what is happening on the Host side of the interface - what operating system am I plugged into and at what phase of the operation are we on (bios query, OS loading drivers). Imagine a Flash chip that is able to tell (power sequencing, timing and order of commands) if its booting a particular controller on the board, or if its being read in a flash programmer. Flash chips have processors running their own firmware nowadays, turtles all the way own.

deleted 8y ago

[deleted]

amelius 8y ago

The problem is that the bad guys also have access to this technology. So they can just tweak their designs until the scanner says it's ok.

trycrmr 8y ago

The overarching theme is why isn't everyone using this tool. A few issues: 1) They might be, and it's being fooled. But... 2) ...they're likely not using it. Consider the following: > "So why isn’t this system in widespread use? After all, much of it has been available since 2014." With the compromised servers being purchased in 2015 it's assuming the ubiquitous implementation of the described system a year after "much of it" was available. Big companies don't move that fast to begin with (budgets, politics, entrenchment of current processes, etc.). Also, the article doesn't site anywhere this tech has been proven in the wild. Do you want to make that case to your boss that your job can be replaced (and maybe theirs) with this, probably expensive to purchase and implement, unproven tech? That's even if you've heard or thought of this system coming together in 2014 to prevent an attack that would've infiltrated your network by 2015. The only defense they give for why it hasn't been used was they were waiting for a huge attack to help justify company's spend. That would help, but FICS would be better off taking on the initial capital costs and charging these big companies on a per server basis to use FICS's system (or spinning of a company to do so, idk how FICS could make this happen). It's like saying a day after SpaceX's flight around the moon that if your company wants to get to the moon have your company purchase a BFR and send their own people up. Cool. Take a hike.

alsadi 8y ago

> .. would spot .. the article describe how to spot a supposed spying chip when it happens, but why they single China? Just replace it with Israel and the article would still valid.

otto_ortega 8y ago

This article is shameless self-promotion... "to compare a printed circuit board and its chips and components with the intended design..." So every company now has to design its own servers, routers and every other piece of hardware from the scratch to avoid "spy chips" ? Yeah... Sounds like a good idea...

exoesquitur 8y ago

The thing missing from this analysis is that on data bus lines like SPI, I2c and others there are "passive" components like resistors and capacitors used for signal conditioning and line bias. If one of these components were replaced with a highly integrated IC, it would be possible to mimic the function of the passive component most of the time, but sometimes hijack existing data streams as a MITM. This can be used to insert alternative boot code, firmware, microcode, or even FPGA structures. Note that the component would not have to generate its own signal source, because by merely inserting a lower than normal resistance or capacitance it could alter an existing bitstream to reflect the desired payload. It would require a high degree of integration and power management finesse, but is certainly doable to replace an existing SMT resistor or Capacitor with such a device. .

exoesquitur 8y ago
..... Such a device would not be detectable by xray (micrographic xray maybe?) , ultrasound, visual inspection, circuit analysis, or signal analysis until it was activated by a particular bitstream, possibly as part of a firmware update released by the manufacturer.