5 ms·

Very interesting from a theoretical perspective. Luckily most of the devices we use have software on them that we know is compromised (written in memory unsafe

• monocasa 5y ago
  Because it's much less likely to be found. One rumor I've heard for a while is that messing with the doping at the right time can bias HWRNGs in a way that you wouldn't be able to notice even with physical inspection with an electron microscope.
  • dtx1 5y ago
    We literally KNOW about the Intel ME and AMD PSP and we KNOW about all the windows telemetry yet most of the worlds IT runs on systems with these backdoors. There's no need to hide it in the first place
    • jaywalk 5y ago
      I think biasing a HWRNG is in an entirely different league than the stuff you mentioned.
    • avianes 4y ago
      And because we KNOW about the Intel ME many security researchers have been looking for backdoors and vulnerabilities in it, several vulnerabilities have been found but no backdoor. If Intel wants to put a backdoor ME would probably be a bad choice because it's a too obvious and monitored location
    • uxp100 5y ago
      This could be more about a rogue actor in a fab leaking Xbox private keys, for example. And Microsoft cares about that a lot, I think mainly because they worry non-legitimate copies of real games could be inserted into the supply chain at some point (though digital download sort of makes this irrelevant)
      • dtx1 5y ago
        I hadn't considered that the victim might not necessarily be the end consumer. Interesting point
        • ncmncm 5y ago
          The end consumer may be the least likely target. More likely, a customer of the end consumer, or OEMs loading what they had hoped was protected code onto a microcontroller.
    • monocasa 5y ago
      I mean, the Russian Elbrus chips boot Windows (and a version of Windows built from source by Russians), all without Intel ME or AMD PSP. But modern Elbrus is fabbed by TSMC. And security agencies have proved that they take a layered, multipronged approach to SIGINT, even against companies that are directly working with them. Google working with the NSA didn't stop the NSA from also tapping Google's inter-datacenter traffic without telling Google.
      • heavyset_go 5y ago
        Do you have more information about the second version of Windows that was compiled? I never looked at the leaked source code, but was under the impression that it wouldn't compile into a usable system.
        • duskwuff 5y ago
          There have been multiple leaks of Windows source code. At least one of them included almost everything required to build Windows XP: https://www.zdnet.com/article/windows-xp-leak-confirmed-after-user-compiles-the-leaked-code-into-a-working-os/ https://www.zdnet.com/article/windows-xp-leak-confirmed-afte... The only missing component was winlogin.exe, probably because of its involvement with the activation process.
          • monocasa 5y ago
            And I can tell you having put winlogon under ghidra (and before that, IDA) that there's really not all that much in there.
        • monocasa 5y ago
          Microsoft just gives large state actors full source access to alleviate their fears of precompiled software, including Russia. https://www.zdnet.com/article/microsoft-turns-over-all-win7-and-server-source-code-to-russias-new-kgb/ https://www.zdnet.com/article/microsoft-turns-over-all-win7-... That being said, some of the leaks also simply provide enough code to compile a more or less complete system. https://fossbytes.com/youtuber-compiles-windows-xp-leaked-source-code/ https://fossbytes.com/youtuber-compiles-windows-xp-leaked-so...
• uxp100 5y ago
  On a similar note, this attack introduces an artificial power consumption based side channel. It might require more inside information for the attacker, but it seems like an ECO that disables the crypto side channel mitigations that exist could be an interesting approach too. I’m not sure what the advantages and disadvantages would be.
  • ncmncm 5y ago
    Yes, deleting things from a layout would be much easier than adding them. And, who's checking?
    • uxp100 5y ago
      Well, you probably actually are checking with the hardware. Running tests to make sure side channel mitigations worked. But would you recognize this as sabotage, and not just slightly worse performance of some technique that should have helped eliminate particular attacks?