4 ms·

Not sure if I understand correctly, but are you saying secrets kept in hardware like console encryption keys (PS4 etc.) can be trivially extracted with the righ

Not sure if I understand correctly, but are you saying secrets kept in hardware like console encryption keys (PS4 etc.) can be trivially extracted with the right tool?

baybal2 7y ago
Yes, but signing can't be defeated unless you modify the IC itself.
- AnimalMuppet 7y ago
  If you can get the key, can't you sign whatever you want, in a way that the IC will validate it? It will still check that it's correctly signed, but doesn't that defeat the usefulness of it?
  - drewbug 7y ago
    the private key isn't on the chip, only the public key is
Taniwha 7y ago
not really trivially, you need to drill tiny (sub micron sized) holes with lasers down to the appropriate wires then insert probes (either using FIBs or directly) to pick up signals (we do this to debug bugs in chips) Smart designers will put wires with useful information under many other layers which if broken will disable them. So yes it's doable, you'll likely damage the chip in the process, it's certainly neither easy nor trivial
- Symmetry 7y ago
  Sounds like the sort of resources that most governments could command but few criminals? But of course with criminals there's always just trying to bribe Intel employees.
  - gentleman11 7y ago
    It’s bonkers that the DMCA has people labeling hardware crackers as criminals. What about the farmers and their tractors?
    - macintux 7y ago
      Not the parent commenter, but I suspect it’s less the act than the motivation. Criminals who anticipate finding a way to profit on the information would be far more likely to go through the trouble of bribing someone or investing in the resources to snag it.
    - SolarNet 7y ago
      I think the parent comment was more likely referring to using these devices for personal privacy. For example can a criminal steal my personal information in my phone vs. can the government spy on me. Where the government might spend a million dollars to do this process to read the phone of a terrorist, but a criminal probably wouldn't to steal my personal information off of a phone or USB drive.
    - Symmetry 7y ago
      Those people are fine. I'm looking at this from the perspective of the malware that can survive across OS re-installs because Intel put this enclave in your CPU that you can't touch. I'd assume the NSA is using that to spy on people right now but the question is how many other groups.
  - pdkl95 7y ago
    Bribing Intel employees is probably expensive and might have legal risks. Instead, just hire one of the many skilled technicians in Shenzhen. For a good discussion of this topic, I recommend Andrew "bunnie" Huang's talk about supply chain security: https://www.youtube.com/watch?v=RqQhWitJ1As https://www.youtube.com/watch?v=RqQhWitJ1As
  - Taniwha 7y ago
    Yes - but if you could extract (for example) some HDMI-like master keys (so you can pirate first run movies for resale), or eventual access to someone's billion dollar bitcoin stash, it might be worth the trouble. It's not something you'd do to get cheap netflix/etc It is something a government might do to get someone's crypto keys or iPhone, or to hack into foreign network infrastructure (Huawei/etc) (after all in the past they've built special purpose submarines to do such things)
- avsteele 7y ago
  Correct. My company (zeroK NanoTech) has developed and is now selling advanced focused ion beam (FIB) systems with enhanced resolution and machining capability that are well suited to these operations. We did circuit-edits on 10 nm node chips with Intel and they have given talks about it at several conferences (e.g. ISTFA)
  - baybal2 7y ago
    Never expected to see a man like you here :) Surname Steele ringed in my head as something lab equipment related, and, yes, indeed you are

Not sure if I understand correctly, but are you saying secrets kept in hardware like console encryption keys (PS4 etc.) can be trivially extracted with the right tool?

baybal2 7y ago

Yes, but signing can't be defeated unless you modify the IC itself.

AnimalMuppet 7y ago
If you can get the key, can't you sign whatever you want, in a way that the IC will validate it? It will still check that it's correctly signed, but doesn't that defeat the usefulness of it?
- drewbug 7y ago
  the private key isn't on the chip, only the public key is

Taniwha 7y ago

not really trivially, you need to drill tiny (sub micron sized) holes with lasers down to the appropriate wires then insert probes (either using FIBs or directly) to pick up signals (we do this to debug bugs in chips) Smart designers will put wires with useful information under many other layers which if broken will disable them. So yes it's doable, you'll likely damage the chip in the process, it's certainly neither easy nor trivial

Symmetry 7y ago
Sounds like the sort of resources that most governments could command but few criminals? But of course with criminals there's always just trying to bribe Intel employees.
- gentleman11 7y ago
  It’s bonkers that the DMCA has people labeling hardware crackers as criminals. What about the farmers and their tractors?
  - macintux 7y ago
    Not the parent commenter, but I suspect it’s less the act than the motivation. Criminals who anticipate finding a way to profit on the information would be far more likely to go through the trouble of bribing someone or investing in the resources to snag it.
  - SolarNet 7y ago
    I think the parent comment was more likely referring to using these devices for personal privacy. For example can a criminal steal my personal information in my phone vs. can the government spy on me. Where the government might spend a million dollars to do this process to read the phone of a terrorist, but a criminal probably wouldn't to steal my personal information off of a phone or USB drive.
  - Symmetry 7y ago
    Those people are fine. I'm looking at this from the perspective of the malware that can survive across OS re-installs because Intel put this enclave in your CPU that you can't touch. I'd assume the NSA is using that to spy on people right now but the question is how many other groups.
- pdkl95 7y ago
  Bribing Intel employees is probably expensive and might have legal risks. Instead, just hire one of the many skilled technicians in Shenzhen. For a good discussion of this topic, I recommend Andrew "bunnie" Huang's talk about supply chain security: https://www.youtube.com/watch?v=RqQhWitJ1As https://www.youtube.com/watch?v=RqQhWitJ1As
- Taniwha 7y ago
  Yes - but if you could extract (for example) some HDMI-like master keys (so you can pirate first run movies for resale), or eventual access to someone's billion dollar bitcoin stash, it might be worth the trouble. It's not something you'd do to get cheap netflix/etc It is something a government might do to get someone's crypto keys or iPhone, or to hack into foreign network infrastructure (Huawei/etc) (after all in the past they've built special purpose submarines to do such things)
avsteele 7y ago
Correct. My company (zeroK NanoTech) has developed and is now selling advanced focused ion beam (FIB) systems with enhanced resolution and machining capability that are well suited to these operations. We did circuit-edits on 10 nm node chips with Intel and they have given talks about it at several conferences (e.g. ISTFA)
- baybal2 7y ago
  Never expected to see a man like you here :) Surname Steele ringed in my head as something lab equipment related, and, yes, indeed you are