This technology would spot a secret chip in seconds

https://spectrum.ieee.org/riskfactor/computing/hardware/this-tech-would-have-spotted-the-secret-chinese-chip-in-seconds

by wolfgke • 8 years ago

39 52 8 years ago

spectrum.ieee.org

moonbug3• 8 years ago

Or just Secure Boot (on the BMCs).

asaph2• 8 years ago

How does this defend against a the type of hardware-based attack discussed in the article?

rjst012• 8 years ago

The same way secure-boot provides protection against hardware modification / evil maid type attacks in CPUs today: by verifying the integrity of the code that's about to be booted before the CPU boots it.

It would significantly raise the cost and difficulty of this sort of attack.

monocasa2• 8 years ago

The best guess I've heard is that this attack pulls down the BMC's SPI flash lines in order to corrupt its code as it's loaded.

A proper chain of trust that starts on the BMC chip could absolutely protect against that. At that point any modification to the boot image would leave the BMC refusing to boot rather giving attacker control.

subudeepak2• 8 years ago

Hardware attacks cannot be prevented by secure boot...

wolfgke3• 8 years ago

Hardware attacks cannot be prevented by secure boot...

But by Trusted Computing (at least in some implementations).

moonbug3• 8 years ago

The most plausible hypothesis of how this attack works is by corrupting firmware loaded at power-on time over SPI. Secure boot would absolutely protect from that by rejecting the signature of the modified code. By hey, I get that Newsy groupthink means secure boot bad.

asaph2• 8 years ago

I find the denials made by the companies involved to be substantive and credible. I'm inclined to believe them. Perhaps Bloomberg's reporters fell for a conspiracy theory this time.

ElBarto2• 8 years ago

If true, the attack described by Bloomberg would mean the US fell victim to one of the most spectacular attack, if not the most spectacular attack, in history and at the hand of the Chinese.

It's equally credible that they would never want to acknowledge that.

tyingq2• 8 years ago

"would mean the US fell victim to one of the most spectacular attack, if not the most spectacular attack, in history"

The general idea doesn't seem new or novel.

https://arstechnica.com/tech-policy/2014/05/photos-of-an-nsa...

rasz6• 8 years ago

or they knew about it from the beginning and used it as a counter intelligence tool, now blown by Bloomberg.

wolfgke3• 8 years ago

Perhaps Bloomberg's reporters fell for a conspiracy theory this time.

According to

https://www.theregister.co.uk/2018/10/04/supermicro_bloomber...

"Bloomberg reporters receive bonuses based indirectly on how much they shift markets with their reporting. This story undoubtedly did that. The publisher employs roughly 2,000 journalists, who are encouraged to work together and share information through their Bloomberg Terminals, with many layers of editing and fact checking, and it has a zero tolerance on errors: it is inconceivable that it would publish a story this huge that wasn't watertight."

fjsolwmv• 8 years ago

SmellyGeekBoy• 8 years ago

Thanks, I hadn't spotted the other 1500 times this 5-year-old revelation had already been posted on HN this morning.

sigmar• 8 years ago

If it were true that they found backdoored hardware, would you expect all of them to make statements confirming that? I wouldn't. and it is clear Apple is still lying about the events surrounding them dropping Super Micro (their current explanation makes as little sense as their shifting 2017 explanations: https://twitter.com/matthew_d_green/status/10478594450642411...).

alias_neo5• 8 years ago

I'm not sure I see anything substantive or credible in the denials by the various companies. If they haven't been issued gag orders, which is quite likely for something of this scale, perhaps it's just in their best interests to deny this.

There is suggestion that at least one of the companies involved is lying about related goings-on.

maltalex• 8 years ago

The system uses optical scans, microscopy, X-ray tomography, and artificial intelligence to compare a printed circuit board and its chips and components with the intended design.

Could it detect a change within a chip? If not, then it makes such an attack harder to execute, but not impossible. Especially for a nation state.

Cthulhu_• 8 years ago

They could do spot checks where they remove the cap and compare pictures, but it's rather eh.

Maybe testing could work? Hook it up to a testing device and have it run through a suite of tests not known by the manufacturer, as well as fuzzing tests. They might find additional bugs in their own design as well that way.

TickleSteve2• 8 years ago

I would have thought it would actually easier to subvert the supply chain than physically mount a new device on a board.

Simply supply 'alternate' devices for normal manufacture.

kop316• 8 years ago

The issue is that X-rays can only scan down to a certain feature size (its minimum resolution is directly related to its wavelength).

There is research going into it, this article would interest you:

https://www.nature.com/articles/nature21698

Its the only article I know if that nondestructively can imagine a chip.

rasz6• 8 years ago

No, none of those will detect a change in silicon. Only options are signal analysis on working system and/or decapping, scanning and comparing all the masks.

TickleSteve2• 8 years ago

This would still not pick up malicious surface-mount devices.

Imagine a subverted NOR FLASH device with malicious firmware booting your board-management device. Its still a SPI FLASH with the same (apparent) device id. The contents would just be different.

alias_neo5• 8 years ago

The technology shown here is working at a different level; is looking at the PCB, trace by trace and identifying components and connections, layer by layer and verifying it against the design.

It's purpose is to ensure that designs aren't modified in manufacture.

What you're talking about is a software problem, and should be carried out in addition to this.

The first idea that comes to mind is that I would sign the contents of the flash devices and have them verified once the board layout has been verified.

Essentially, you'd have your board schematic, and then a signature "schematic" of firmware to verify against. Of course, you'd also need a way of signing the schematic/signature list to verify those once they're updated.

rasz6• 8 years ago

Yes, in other words technology shown here is useless.

exoesquitur3• 8 years ago

Passive components like a line conditioning resistor or cap could be changed out with an identical looking malicious component. Such a chip could perform effective MITM attacks against anything that talks on a serial line such as I2C, SPI, etc. This is pretty much a universal zero day for on board controllers, FPGA's, and anything that loads its boot code unencrypted.

frgewut• 8 years ago

Slightly offtopic, but most easiest way for detecting tampering with hardware is weighing stuff.

JdeBP• 8 years ago

Now read https://news.ycombinator.com/item?id=18138699 .

alxlaz• 8 years ago

I see comments like that every once in a while, and I always come back to something that one of my professors told me a long time ago. If it took you like five minutes of thinking about it to come up with it, it's a safe bet that a) folks who are paid to work on this stuff full-time have already thought about it and b) that someone already figured out how to work around it.

cMax347• 8 years ago

Reminded me of this tweet I found earlier today: https://twitter.com/arbedout/status/1047822585009004545 They actually shifted from weighing stuff to measuring angular momentum!

rasz6• 8 years ago

this "tweet" is an embedded screen capture from HN :)

alias_neo5• 8 years ago

That's great if you're looking for whole extra boards in a device with grams or tens of grams of additional mass.

These surface mount components are so small that the variation in the volume of solder on the joints alone would render your technique moot.

Add to that, the fact that manufacturers often use multiple suppliers for parts, they could have different materials, densities and casing designs, this particular problem is beyond weighing.

monocasa2• 8 years ago

I don't but that some machine learning algorithm from 2014 actually works and isn't just snake oil.

baybal2• 8 years ago

That will not help you with sand grain sized plants, if they actually are such

vectorEQ• 8 years ago

x-rays are useful to identify parts which don't belong in the original design, though it doesnt say anything about these parts. It can be manufacturing errors / design iterations not well documented or any number of things besides a malicious implant. more manual analysis will always be needed. But if you have tons of PCBs to go through it can give a quick overview what chips might be good initial targets.

some people noted that some 'hardware' attacks can't be seen because they use original parts. -> that's a silly statement, as that would make it a firmware attack, not a hardware attack (even though physical access might be needed to flash the chip, it's the firmware which is malicious, not the chip itsefl. i.e. other type of threat / use-case).

i think the problem with x-rays, apart from them being hazardous in themselves, the cost and availibility of equipment is not practical for reverse engineers and researchers apart from some highest tier companies doing this.

A question to NH about this which might be more interesting: do you think you can get similar results using ultrasound? Because ultrasound devices are fairly cheap and can be made at home fairly easily compared to x-ray technology. It's also much less hazardous to the researchers....

ChrisLomont• 8 years ago

that's a silly statement, as that would make it a firmware attack, not a hardware attack

Original parts can also have attacks not in firmware, without changing the transistor layouts, via dopant attacks [1, paper at 2].

[1] https://www.researchgate.net/publication/262211582_Stealthy_... [2] https://sharps.org/wp-content/uploads/BECKER-CHES.pdf

rasz6• 8 years ago

some people noted that some 'hardware' attacks can't be seen because they use original parts.

You can have original looking part. Imagine a 8Mbit SOIC SPI NOR flash chip. Looks the part, belongs in its spot, you decap it and it sure does look like a flash Die with its normal Flash controller. Now consider this: http://travisgoodspeed.blogspot.com/2012/07/emulating-usb-de... I cant find it right now, but Afair Travis (or maybe it was hak5 RubberDucky folks) noticed early on that its pretty trivial to detect what is happening on the Host side of the interface - what operating system am I plugged into and at what phase of the operation are we on (bios query, OS loading drivers).

Imagine a Flash chip that is able to tell (power sequencing, timing and order of commands) if its booting a particular controller on the board, or if its being read in a flash programmer. Flash chips have processors running their own firmware nowadays, turtles all the way own.

amelius• 8 years ago

The problem is that the bad guys also have access to this technology. So they can just tweak their designs until the scanner says it's ok.

trycrmr• 8 years ago

The overarching theme is why isn't everyone using this tool. A few issues:

1) They might be, and it's being fooled. But...

2) ...they're likely not using it. Consider the following:

"So why isn’t this system in widespread use? After all, much of it has been available since 2014."

With the compromised servers being purchased in 2015 it's assuming the ubiquitous implementation of the described system a year after "much of it" was available. Big companies don't move that fast to begin with (budgets, politics, entrenchment of current processes, etc.). Also, the article doesn't site anywhere this tech has been proven in the wild. Do you want to make that case to your boss that your job can be replaced (and maybe theirs) with this, probably expensive to purchase and implement, unproven tech? That's even if you've heard or thought of this system coming together in 2014 to prevent an attack that would've infiltrated your network by 2015.

The only defense they give for why it hasn't been used was they were waiting for a huge attack to help justify company's spend. That would help, but FICS would be better off taking on the initial capital costs and charging these big companies on a per server basis to use FICS's system (or spinning of a company to do so, idk how FICS could make this happen).

It's like saying a day after SpaceX's flight around the moon that if your company wants to get to the moon have your company purchase a BFR and send their own people up. Cool. Take a hike.

alsadi• 8 years ago

.. would spot ..

the article describe how to spot a supposed spying chip when it happens, but why they single China? Just replace it with Israel and the article would still valid.

otto_ortega• 8 years ago

This article is shameless self-promotion... "to compare a printed circuit board and its chips and components with the intended design..." So every company now has to design its own servers, routers and every other piece of hardware from the scratch to avoid "spy chips" ? Yeah... Sounds like a good idea...

exoesquitur3• 8 years ago

The thing missing from this analysis is that on data bus lines like SPI, I2c and others there are "passive" components like resistors and capacitors used for signal conditioning and line bias. If one of these components were replaced with a highly integrated IC, it would be possible to mimic the function of the passive component most of the time, but sometimes hijack existing data streams as a MITM.

This can be used to insert alternative boot code, firmware, microcode, or even FPGA structures.

Note that the component would not have to generate its own signal source, because by merely inserting a lower than normal resistance or capacitance it could alter an existing bitstream to reflect the desired payload.

It would require a high degree of integration and power management finesse, but is certainly doable to replace an existing SMT resistor or Capacitor with such a device. .

exoesquitur3• 8 years ago

..... Such a device would not be detectable by xray (micrographic xray maybe?) , ultrasound, visual inspection, circuit analysis, or signal analysis until it was activated by a particular bitstream, possibly as part of a firmware update released by the manufacturer.

This technology would spot a secret chip in seconds

Related Stories