6 ms·
The reason that the information about hardware was vauge is probably because it was (is) most likely classified. IMHO Bloomberg is trying to break this story w
by K0balt 6y ago
The reason that the information about hardware was vauge is probably because it was (is) most likely classified.
IMHO Bloomberg is trying to break this story without giving malicious actors useful information.
As a proof of concept experiment, I hacked together an Mcu, a few caps, resistors, diodes, and a small power transistor to see what could be done on a "single component" attack. I was able to receive data and inject malicious messaging into the data from a serial eeprom using a "filter capacitor" made up of my device (only 2 wires, 1 to signal, 1 to ground)
Obviously, not having access to a fab or able to integrate microscale circuits, my device would have been trivially detected (about 1 cubic centimeter) but with access to a fab and a bespoke lab, I have no doubt it could be manufactured down to the size of a standard filter capacitor (~3mm3).
I do not know if this is what malicious actors would do or not, but if I can build a 2 wire device to compromise the data loaded from serial flash, then any state actor can. If you compromise this data on the control firmware for a PC, you own the board.
All of the claims that the hardware attack is fanciful are clearly naieve, based on my experiment.
It is worth mentioning that the attack that I experimentally replicated is the hard version. The easy one is to substitute a modified device for the serial eeprom itself... Also invisible, and orders of magnitude more potent. A compromised eeprom could include advanced features including large amounts of storage and built in rf communication capabilities.
The naysayers in this case saying that the attack would be technically infeasible or excessively difficult to implement undetected are simply wrong from a technical point of view.
Compromised devices could be mass manufactured for < 10usd each, and if you can get a reel of them into a manufacturers supply chain, you can permenantly compromise thousands of devices with a single attack. The required tech is within reach of any state actor with access to a fab.
- Daho0n 6y ago>The reason that the information about hardware was vauge is probably because it was (is) most likely classified. This is irelevant to the article though. The article was clearly written by someone who didn't even know what an Ethernet cable looks like and someone who provided fake photos for the article. It makes no difference if it could have happened to the clearly fakenews article. There's a discussion to be had about the implecications of something like this happening but baseing it on a fluff piece is not the way to get anything useful.
- nitrogen 6y agoThere are entire MCUs that fit into the volume of an Ethernet connector's shielding. So there would be no visual way to tell if one were present on a board, unless the shielding or connector design was different.
- exikyut 6y agoIndustrial X-Ray capability is trivially accessible and is frequently used for relatively simple tasks like ensuring an assembly is put together properly or that the correct part was ordered etc.
- encom 6y agoJournalists don't have to prove whether the attack is possible or not. They have to prove that it actually happened. Which they didn't.
- gpm 6y agoThat's not how this works. Journalists frequently don't provide public proof, because that is frequently impossible. They convince themselves an article is true (often by using sources they cannot reveal) and then publish whether or not they are able to find proof that they can reveal.
- zepto 6y ago> without giving malicious actors useful information What kind of useful information?
- swirepe 6y agoNice try
- zepto 6y agoNot helpful. It should be possible to answer what classes of useful information are being hidden without revealing the actual information itself.
- swirepe 6y agoIf you were sneaking chips into boards and wanted to know if you were caught, what classes of information would you find useful? What classes of information wouldn't be immediately useful, but would be useful in aggregate?
- zepto 6y agoNot helpful. If your premise is that the article might tip off attackers to the idea that they have been caught, these points are moot. Either they have been caught, or the article is actually bullshit.
- swirepe 6y agoNot helpful. But that's okay, I'm going to hold your hand for a bit. Pretend the article said "three hidden microphones were found to be added to this board." That tells the attacker which board is being tested, that they are testing for microphones, and how many of their microphones have been found. If your job is to hide microphones every day, do you see how this information could help you moving forward? Do you see why this is more than a binary caught/not caught?
- snypher 6y agoIt's been know for years about implant capability, my usual example is COTTONMOUTH but there's a list on Wikipedia; https://en.wikipedia.org/wiki/NSA_ANT_catalog https://en.wikipedia.org/wiki/NSA_ANT_catalog There's pricing from 2008 so you can be sure it's 10x smaller now.