5 ms·

Very cool. I wonder why companies still leave the UART pins accessible. Fine they're on the chip, but just remove the trace and slow down attack evolution is w

by rob_c 4y ago

Very cool. I wonder why companies still leave the UART pins accessible. Fine they're on the chip, but just remove the trace and slow down attack evolution is worth the cost of a board revision surely...

nickzana 4y ago
Isn't it better to leave them exposed and make it easier for security researchers who genuinely want to test the chip? Someone interested in and capable of developing and using/selling an exploit won't be deterred by needing a special cable to get a UART console, whereas a security researcher might appreciate the simpler access. So long as it doesn't weaken the actual security model, companies should make their products as easy to analyze as possible imo.
- rob_c 4y ago
  Then sell a dev unit surely, not a consumer grade device...
dmitrygr 4y ago
If THAT is your idea of security, i hope you do not work on any hardware whose security matters. First thing anyone would do is find the pins and connect to them. It buys you nothing, and if anything tells me that i should go look for them. Visible and labeled UART pins tell me that you've (hopefully) thought through the consequences of me having access to them. Hidden UART tells me that most likely nobody ever gave that half a thought.
- rob_c 4y ago
  Do you have __any idea__ how difficult removing the chip and re-surface mounting it for an attack... Removing the trace means an extra step which is the whole point. Ffs
  - dmitrygr 4y ago
    Yes i do. done it. at home. for fun. Which means anyone motivated to do it can easily get it done too..
    - rob_c 4y ago
      With data intact after etching a custom PCB for a custom chip? I'd be impressed if that skillset overlaps with someone hacking bytecode
      - thrtythreeforty 4y ago
        I bet that skillet overlaps more than you think. Especially once you consider motivated teams of two or three.
        rob_c 4y ago
        Again this additional step slows down an attack which discourages people from attacking the product. If it achieves this it's a valid step as part of a security strategy. No single solution/step is 100% secure, if you think that, throw your devices away now because they're probably already compromised. Stop with the ego pedaling security stuff and live/work in the real world where small changes have real positive impacts. It's the same with DRM. It doesn't have to be uncrackable, as long as it keeps the sales for the first x-months it's worked. (Not that I think DRM is acceptable but that's another discussion).
        dmitrygr 4y ago
        Sometimes, idiotic moves like that DRAW people to your product who'd otherwise pass it by. The only reason cypress got publicly embarrassed by their secure rom being completely broken [1] was because the way they talked about it annoyed me. [1] http://dmitry.gr/?r=05.Projects&proj=23.%20PSoC4 http://dmitry.gr/?r=05.Projects&proj=23.%20PSoC4
        4y ago

by rob_c 4y ago

nickzana 4y ago

Isn't it better to leave them exposed and make it easier for security researchers who genuinely want to test the chip? Someone interested in and capable of developing and using/selling an exploit won't be deterred by needing a special cable to get a UART console, whereas a security researcher might appreciate the simpler access. So long as it doesn't weaken the actual security model, companies should make their products as easy to analyze as possible imo.

rob_c 4y ago
Then sell a dev unit surely, not a consumer grade device...

dmitrygr 4y ago

If THAT is your idea of security, i hope you do not work on any hardware whose security matters. First thing anyone would do is find the pins and connect to them. It buys you nothing, and if anything tells me that i should go look for them. Visible and labeled UART pins tell me that you've (hopefully) thought through the consequences of me having access to them. Hidden UART tells me that most likely nobody ever gave that half a thought.

rob_c 4y ago
Do you have __any idea__ how difficult removing the chip and re-surface mounting it for an attack... Removing the trace means an extra step which is the whole point. Ffs
- dmitrygr 4y ago
  Yes i do. done it. at home. for fun. Which means anyone motivated to do it can easily get it done too..
  - rob_c 4y ago
    With data intact after etching a custom PCB for a custom chip? I'd be impressed if that skillset overlaps with someone hacking bytecode
    - thrtythreeforty 4y ago
      I bet that skillet overlaps more than you think. Especially once you consider motivated teams of two or three.
      - rob_c 4y ago
        Again this additional step slows down an attack which discourages people from attacking the product. If it achieves this it's a valid step as part of a security strategy. No single solution/step is 100% secure, if you think that, throw your devices away now because they're probably already compromised. Stop with the ego pedaling security stuff and live/work in the real world where small changes have real positive impacts. It's the same with DRM. It doesn't have to be uncrackable, as long as it keeps the sales for the first x-months it's worked. (Not that I think DRM is acceptable but that's another discussion).
        dmitrygr 4y ago
        Sometimes, idiotic moves like that DRAW people to your product who'd otherwise pass it by. The only reason cypress got publicly embarrassed by their secure rom being completely broken [1] was because the way they talked about it annoyed me. [1] http://dmitry.gr/?r=05.Projects&proj=23.%20PSoC4 http://dmitry.gr/?r=05.Projects&proj=23.%20PSoC4
        4y ago