Ask HN: How can there be backdoors in memory chips?

https://news.ycombinator.com/item?id=35879149

1 2 3 years ago

news.ycombinator.com

Been catching up with the news lately, stumbled upon allegations against Micron [0] (does anyone remember Bloomberg's SuperMicro scoop?).

How does one put backdoors in DIMMs? Flash memory? What is the threat model? Assuming airgapped computers, will a memory backdoor simply xmit secrets in an RF side channel?

[0] https://www.theregister.com/2023/04/01/china_micron_probe/

wmf• 3 years ago

This could be side channels such as rowhammer, not necessarily backdoors. It could also be a technical pretense for political posturing.

schoen• 3 years ago

I'm not sure this would be very straightforward at all as an engineering matter, but you could embed a microcontroller that looks for a certain pattern and then performs modifications indicated by that pattern.

An example could be a password, followed by something like a search and replace buffer. In Python pseudocode, something like

  for i, v in enumerate(ram):
      if v == b'\x9eP"\xcb\xde\x8fP\xcf':
          for i2, v2 in enumerate(ram):
              if v2 == ram[i+8]:
                  ram[i2] = ram[i+16]
          break

Then if you could get the machine to internally store a string containing that password followed by a substitution, it could perform the specified substitution automatically elsewhere (in a database? in a kernel data structure?), having some desired side effect.

Of course, the microcontroller wouldn't actually need to be able to interpret Python code, and could be a very tiny, slow, and small one. (And it would have to be powered by the bus that the RAM device itself was plugged into!!)

Another similar thing would be, instead of a search-and-replace, giving patterns and saying "copy from after whatever matches this, to whatever matches that", so that you could get a data leak across users, compartments, VMs, etc., where the attacking unprivileged one would set up a buffer containing the "receive" string and then wait for that buffer to get filled with a copy of the location in RAM containing the "transmit" string.

Ask HN: How can there be backdoors in memory chips?

Related Stories