5 ms·
This is not small issue. Up to 10% of FPGA's in the market can be affected. RAID-, SATA-, NIC- controllers, Industrial control systems, mobile base stations
by Nokinside 6y ago
This is not small issue. Up to 10% of FPGA's in the market can be affected.
RAID-, SATA-, NIC- controllers,
Industrial control systems, mobile base stations, data centers, devices like encrypted USB sticks and HDD's. In some cases it's possible to carry the attack remotely.
- REPLicated2 6y agoDepending on your viewpoint, this may actually be a boon for reverse engineering efforts to counter planned obsolescence.
- segfaultbuserr 6y agoYes. Unfortunately, it's a double-edged sword. The same technology is needed for the FOSS community to create secure hardware.
- snvzz 6y agoSecurity through obscurity? Nah.
- loeg 6y agoThis was security through a cryptographic design. It was just a broken design. If you consider confidential symmetric or privkeys "obscurity," sure, all crypto is obscurity.
- snvzz 6y agoThere's no need to encrypt the keys as you hardcode them into the FPGA, if you control the hardware as you do this. I certainly don't see how anything FOSS would be affected, and would appreciate concrete examples.
- johncolanduoni 6y agoThis mechanism also included an HMAC, responsible for authenticating the bitstream. That's useful even if the bitstream is public knowledge.
- baybal2 6y agoOnly ones who need to keep firmwares secret will be affected. There are few companies I knew who transitioned from MCUs to FPGAs solely for their obsession of keeping their "IP" from leaking, hoping that FPGA will provide more obscuration than simple encrypted MCU firmware.
- Nokinside 6y agoIf the FPGA can be updated, attacker can take over the hardware and reprogram it. If attacker gets access to the bitstream, the has complete control over the FPGA.
- firmnoodle 6y agoIt's more like access to replace the bitsteam. It's a complicated and expensive new attack vector.
- DarkmSparks 6y agoyeah, with a cheap and easy attack vector like this especially with a remote option this is one of the worst hardware compromises Ive seen in a while.
- alexdowad 6y agoBut if an attacker is already "inside" your system and is able to access the interface for configuring the FPGA, I think you have already lost...
- DarkmSparks 6y agoHe bought the FPGA, modified it, and sold you a compromised one.
- Nokinside 6y agoAttacker needs physical access to just one device in the whole product line that uses the same encryption key. After that, all you need is to get the device to update using the bitstream you made.
- stragies 6y agoCan your post be read as "In the near future, we might have the possibility of inspecting/re-programming a bunch of DMA--capable devices commonly found in systems"? That would be great. I shudder to think what horrors may await us in USB-/Wifi-/Network-controller bit-streams/firmwares. But the sooner these things get opened, the better.