5 ms·

Gotta disagree. When you know enough about hardware engineering you'll understand that there are very talented folks around the world and if you released a vuln

Gotta disagree. When you know enough about hardware engineering you'll understand that there are very talented folks around the world and if you released a vulnerable piece of hardware, SOMEONE SOMEWHERE will notice. You could argue that Spectre, etc. are part of that, but I don't think that is the case. This is just retaliation because of all the Taiwan crap, but more importantly, it does not matter as much as many folks think.

s4mw1se 3y ago
It happens a ton, and the hardware and software supply chains are more fragile than people realize. One book I was reading “Secrets of a Cybersecurity architect” by Brook S.E Shoenfield stated that security starts at the physical port and all hardware must go through integrity checks before it can be used. If my memory servers me right he was one of NSAs first cyber warfare and security architects. I also have retired family that was SVP of Engineering at a major telecom and he said this is a practice they had to implement as well because backbone routers would go missing for three days during shipping and just show up with no excuses for the delay. The book is worth a glance, i never finished but it’s pretty insightful. Additionally, on podcast i will never remember, China circumvents the banned entities list by stealthy acquiring approved chip manufactures and not rebranding, and new ownership adds backdoor into the chips.
brokenmachine 3y ago
>if you released a vulnerable piece of hardware, SOMEONE SOMEWHERE will notice But is that someone somewhere only part of the NSA or its Chinese equivalent? It makes me think of the TriangleDB iPhone exploit. I don't think anyone could have realistically known that those MMIO opcodes were there, without being part of the actual CPU design team. https://securelist.com/operation-triangulation-the-last-hardware-mystery/111669/ https://securelist.com/operation-triangulation-the-last-hard... >The exploit targets Apple A12–A16 Bionic SoCs, targeting unknown MMIO blocks of registers that are located at the following addresses: 0x206040000, 0x206140000, and 0x206150000. >The prompted me to try something. I checked different device tree files for different devices and different firmware files: no luck. I checked publicly available source code: no luck. I checked the kernel images, kernel extensions, iboot, and coprocessor firmware in search of a direct reference to these addresses: nothing. >How could it be that that the exploit used MMIOs that were not used by the firmware? How did the attackers find out about them? What peripheral device(s) do these MMIO addresses belong to I believe it's very easy nowadays to release undetectably vulnerable devices.

s4mw1se 3y ago

It happens a ton, and the hardware and software supply chains are more fragile than people realize. One book I was reading “Secrets of a Cybersecurity architect” by Brook S.E Shoenfield stated that security starts at the physical port and all hardware must go through integrity checks before it can be used. If my memory servers me right he was one of NSAs first cyber warfare and security architects. I also have retired family that was SVP of Engineering at a major telecom and he said this is a practice they had to implement as well because backbone routers would go missing for three days during shipping and just show up with no excuses for the delay. The book is worth a glance, i never finished but it’s pretty insightful. Additionally, on podcast i will never remember, China circumvents the banned entities list by stealthy acquiring approved chip manufactures and not rebranding, and new ownership adds backdoor into the chips.

brokenmachine 3y ago

>if you released a vulnerable piece of hardware, SOMEONE SOMEWHERE will notice But is that someone somewhere only part of the NSA or its Chinese equivalent? It makes me think of the TriangleDB iPhone exploit. I don't think anyone could have realistically known that those MMIO opcodes were there, without being part of the actual CPU design team. https://securelist.com/operation-triangulation-the-last-hardware-mystery/111669/ https://securelist.com/operation-triangulation-the-last-hard... >The exploit targets Apple A12–A16 Bionic SoCs, targeting unknown MMIO blocks of registers that are located at the following addresses: 0x206040000, 0x206140000, and 0x206150000. >The prompted me to try something. I checked different device tree files for different devices and different firmware files: no luck. I checked publicly available source code: no luck. I checked the kernel images, kernel extensions, iboot, and coprocessor firmware in search of a direct reference to these addresses: nothing. >How could it be that that the exploit used MMIOs that were not used by the firmware? How did the attackers find out about them? What peripheral device(s) do these MMIO addresses belong to I believe it's very easy nowadays to release undetectably vulnerable devices.