Whole new meaning to 'Silicone Bug'. - Page 1
Forum section: electronics / general

author: PeterG
author_rank: Frequent Contributor
timestamp: June 08, 2012, 07:56:03 am
content: This is both interesting and scary. Kind of put a whole new spin on the Silicone Bug meaning.http://www.cnbc.com/id/47700647Has anyone here come across this sort of thing before?Regards

author: AntiProtonBoy
author_rank: Frequent Contributor
timestamp: June 08, 2012, 08:22:26 am
content: Draft of the research paper in question:http://www.cl.cam.ac.uk/~sps32/Silicon_scan_draft.pdfHaven't read it yet, but should be interesting.

author: PeterG
author_rank: Frequent Contributor
timestamp: June 08, 2012, 09:20:39 am
content: Quote from: AntiProtonBoy on June 08, 2012, 08:22:26 amJust skimmed it. It is VERY interesting reading. I never thought such techniques were available.Regards

author: EEVblog
author_rank: Unknown
timestamp: June 08, 2012, 09:28:25 am
content: I don't understand this whole thing.Adding such a "backdoor" in production silicon is highly advanced stuff requiring the utmost in talent, design tools, and proper access during the design and manufacturing stage.All I hear in these stories is they have no idea who did it or why.Are they kidding? Surely it's trivial to find out who did this?Grill the design team at Actel to find out if they put it in their or it's a left-over from testing etc.If it's not them, then grill the people at the foundry and track who had access and who did it.And the the bullshit about someone being able to push a button and bring down a missile, that's just garbage. Does every product that uses the chip have magic access of the hacked backdoor to the internet via wireless connection?What a load of rubbish.Dave.

author: Bored@Work
author_rank: Super Contributor
timestamp: June 08, 2012, 10:27:12 am
content: Quote from: EEVblog on June 08, 2012, 09:28:25 amIt should be within the reach of normal law enforcement agencies to figure out who did it, and it should be a piece of cake for Fatherland Security, with the help of some of their special camps operated by special friends around the world.The part in the article where the "journalist" claims that it isn't so important to figure out how it was done is absolutely stupid.QuoteA bit too much simplification from the "journalist". It would require a rather elaborate sabotage scheme. Lets say the FPGA is in a missile (not all such FPGAs will be in one). It is used to process some radar echo signals or other signals from some sensor (not all FPGAs in a missile will do this). Further assume some output of the FPGA can seriously influence an important system of the missile (not all signal processing FPGAs will have that access), then one could imagine a sabotage scheme that might work. Let the sabotaged FPGA listen for a specific input, e.g. a specifically crafted radar-echo like signal, and when received send wrong data to the connected systems in the missile, crafted to bring it down.Now, there are a lot of ifs in that scenario. And it would require a lot of luck, information and skills to pull it off. But while I think it is unlikely I believe there are a few intelligence services in the world that would try it if they think they could pull it

author: EEVblog
author_rank: Unknown
timestamp: June 08, 2012, 10:43:25 am
content: Quote from: Bored@Work on June 08, 2012, 10:27:12 amIt's trivial. Anonymous people don't work in these companies. You know who they are and what they have access to.And like I said, this takes very serious engineering work at the deepest levels.This could a solved or at least narrowed down in days or weeks, surely.QuoteMadness.QuoteI think you haven't mentioned half of the if's.First of all, the back door is just that, a back door. It's not code that can magically do something. So for the backdoor to do anything in an autonomous system like a missile, it would have to engineered into the code and/or hardware in the first place.The only real threat this back door poses (if it's real, Actel deny it) is the reverse engineering issue mentioned. Dr Evil won't be blowing up the Yankee missiles while in the air etc.If they find a hacked back door that secretly re-targets the missiles to the white house, then there should be medals awarded!International design contest anyone?Dave.

author: Bored@Work
author_rank: Super Contributor
timestamp: June 08, 2012, 11:31:22 am
content: Quote from: EEVblog on June 08, 2012, 10:43:25 amThat would be the sabotage part of the operation. Getting the original code, understanding the whole system, altering it, and planting someone in the manufacturing plant or maintenance shops with the task to use the hardware back door to program the FPGAs with the altered code.Or more modern, hack into the manufacturer's network and alter the master copy of the code.QuoteI think your file at the Fatherland Security department just got a new chapter. Watch the black helicopters coming.

author: metalphreak
author_rank: Frequent Contributor
timestamp: June 08, 2012, 11:34:56 am
content: Dave, when has the news media ever let technical information get in the way of a good fear-mongering story?

author: _Sin
author_rank: Regular Contributor
timestamp: June 08, 2012, 11:43:06 am
content: Media fear-mongering aside, I'm still impressed by the whole Stuxnet thing. I thought the whole "send your enemies a computer virus that specifically cripples/destroys hardware critical to their nuclear programme" was strictly hollywood...

author: mikeselectricstuff
author_rank: Super Contributor
timestamp: June 08, 2012, 11:52:34 am
content: Classic case of ignorant journalistic bullshit. I read the paper the other week.Researchers found that Actel have some undocumented JTAG parts of their protocol , probably part of factory test functionality, which allows a protected bitstream to be read out of the device (this is an FPGA with onboard flash, and sold as highly secure).That's it. Nothing to see here.Just (yet) another broken copy protection scheme, this time on something that happens to be used in military stuff.Those that can, doThose that can't, teachThose that can't teach become journalists.

author: EEVblog
author_rank: Unknown
timestamp: June 08, 2012, 12:19:57 pm
content: Quote from: _Sin on June 08, 2012, 11:43:06 amI think in that case the concept is more clever than the actual code.I mean I presume it wouldn't be that hard to write a virus that only attacks certain hardware, and if the effect is subtle enough, it goes undetected.The trick is knowing what hardware your target uses (siemens motor controllers was it? (for the centrifuges)), how to modify it, how to modify it in such a way that it goes undetected for a long time, and having a process like those centrifuges in which a small variation can cause long term issues.Dave.

author: free_electron
author_rank: Super Contributor
timestamp: June 08, 2012, 02:17:09 pm
content: Quote from: mikeselectricstuff on June 08, 2012, 11:52:34 amBingo. This is just a TAP... Test acces port. Almost any chip has that , you just don't know about it.Accessing the tap requires tying a specific pin , or pins to a condition that is not present during normal operation and then powering up the chip. Once powered you cannot enter that mode. For example : a simple voltage divider followed by a windowcomparator looks for a 12 to 15 volts signal on a pin labeled 'gnd' ...this for a chip that is 5 volts only.There is no way to enter this mode in the end prduct as this pin is tied to gnd on the board , and there is no voltage higher than 5 volts anywhere in the system ...This is done all the time. The windowcomparators can detect several voltages so you can do different things.In fpga's with on board pll's you the TAP is used to trim the master oscillators during final test.On mixed signal chips there may be analog switches that can bring out internal nodes so they can test for example the gbw of an i ternal opamp that is otherwise inaccessible.After final test is done and the part is ok the TAP is sealed. Typically by setting a bit in a eprom cell , or by triggering an antifuse. Since this is actel and military , my bet is antifuse.Remember the old proms ? You send in current and it vaporises a piece of metal.. An antifuse is the opposite. We use a low doped mos channel as resistor.. This heats up the metalissation above it , which melts, and creates a physical short. The aluminum in the chip literally melts in a controlled way to tie an internal node hard to ground.. Game over. TAP disabled.If the chip ever comes back for failure analysis the manufacturer knows where the antifuse sits... One shot with the laser and its 'open sesame' ...I've done this numerous times. Nothing to it. Standard practice in the semiconductor industry.So, while the system is in the field there is no way to reactivate the backdoor because it is buried under a pin with a blown physical antifuse , tied to ground on the board....If you can lay your hands on the chip , desolder it , find the antifuse , disable it , and dump the bitstream you are still nowhere.. The stream is encrypted... Yes it can be done.. And you may learn something ,but you still cant alter it in the field. So security is maintained.Oh, and those 'software protection bits in little controllers like pic and avr ? Don't even bother with those.. If you want those dumped... Onehunglo can do that in 5 minutes...Here is how that works.Buy one empty device, set fuse bit , etch package open with fuming sulphuric acid. Use an ebeam prober to find the one gate with charge on it. Write down coordinates...Take 'golden chip' ( the one that needs copying ) , etch open , use ebeam to inject opposite charge at found coordinates so the bit is cleared. Dump using normal programmer....This is also standard procedure. Lets say a microcontroller comes back from the field with erratic behavior and failure analysis needs to be done... First thing to be checked is software integrity...So we disable the lock with an ebeam ( or a uv laser flash on the normal probe station ). , dump the rom and ask to run a bit by bit compare with a known good one.There is plenty of reverse engineering companies, and they have built over time lists with coordinates of the lock bit for anything out there...It's not rocket surgery ...Rocket surgery is a crossbreed between brain surgery and rocket science. It is used to indicate something that is very hard... Doing brain surgery while in a rocket that is malfunctioning is very hard to do .. Harder than either by themselves.

author: G7PSK
author_rank: Super Contributor
timestamp: June 08, 2012, 02:31:38 pm
content: Is this the same team that found out how to get past the chip and pin on credit and bank cards.

author: digsys
author_rank: Unknown
timestamp: June 08, 2012, 02:39:36 pm
content: A long time ago I worked with a University to study the feasability and effects of a harware virus. The test was so successful,we had to drop the project and destroy all test hardware. Yes, you had to have a library of target chipsets, all segmented andrandomly embedded so signature analysers had a difficult time searching for them. There are many "mechanisms" for at leastONE batch getting out into the real world. Unless you have inside help though, malicious damage is random.I've also worked with military GPS. It's well know that during times of war, the US can dither and "tamper" with the satelliteGPS data. This is so the enemy, IF it uses their system, can be rendered unrelaible. During the gulf war, I often knew when astrike was about to take place, and checked the papers in proceeding days / weeks. This is all common knowledge now.I'm sure, the "bad guys" are well aware of it too. I'd hate to think what they get up to now, to keep the advantage.I'm putting ANY credance in the reporters article, they pump out enough crap as it is. This story MAY just be based on one ofmany "service modes" as suggested. But out there, there is still a sci-fi war going on.

author: Psi
author_rank: Super Contributor
timestamp: June 08, 2012, 02:40:46 pm
content: Might be interesting if the FPGA had a hidden virtual LAN interface that could attach and bridge to any legitimate interface.Then it could try and get access out onto the internet and provide some sort of limited remote control/monitoring.It would be damn easy to spot though. "Hey why is my FPGA chip getting two IPs from the DHCP server?" heh

author: bruce273
author_rank: Contributor
timestamp: June 08, 2012, 04:21:42 pm
content: As Dave said the production for these chips relies on netlists generated by EDA synthesis. So if a modification created there it would be as trivial to find who did it as who made a modification to C code. The only other possible place that is theoretically feasible to modify a device in this way would be during the production of the lithography mask when the design netlist is received.The modifications could be potentially easy to hide as the testing for these parts is limited to specific configurations as there are too many combinations of inputs, imagine trying to check all inputs to a 64 x 64 bit multiplier there just wouldn't be time. This could meen that a specific combination of inputs could gain entry but more likely what the artical would meen is that the protection securing the bytecode stored on the FPGA could be overidden allowing the code to be extracted or modified by someone next to the chip.

author: A-sic Enginerd
author_rank: Regular Contributor
timestamp: June 08, 2012, 04:43:41 pm
content: skimmed article, skimmed the thread.I'm still just confused on how, in any way shape or form one can even mix the terms FPGA and "secure" in the same sentence.To keep it "secure", they need to treat it the same as they would any piece of software. By its very nature, it will be inherently riddled with holes. When you can't plug those holes with some "physical" means, you cover it with process.And for the record, pretty much every chip I've ever worked on would have "backdoors" by their lameass, ignorant definition. It comes with the territory when doing chip design. You provide hooks to aid debug. Yes, it's theoretically possible to then remove that logic once the design has been ironed out, but two things about that:1) You've now changed the design, hence have put it at risk.2) cost. Want to cough up a million bucks for a new mask set just to take out your debug logic?Not likely.

author: free_electron
author_rank: Super Contributor
timestamp: June 08, 2012, 05:46:10 pm
content: Quote from: A-sic Enginerd on June 08, 2012, 04:43:41 pmExactly. when you go into final test you need the 'hooks' ( the TAP ) to get to internal nodes. Nobody removes that logic. it is designed in such a way that it cannot activate during normal operaion of the device and/or is disabled permanently. ( permanently meaning : you cannot re-enable it from outside the package .. you need to get a hold of the actual chip , desolder it , decapsulate it and take invasive action te re-enable it )

author: mikeselectricstuff
author_rank: Super Contributor
timestamp: June 08, 2012, 06:20:26 pm
content: QuoteApologies to the minority of competent journalists out there but pretty much every time I've had any direct or indirect contact with them, or read something in the press I have direct knowledge of, either in technical, or more general fields, I've found minimal interest or effort being made to get facts right, and for a profession whose job is supposedly reporting and interpreting factual information, the avarage standard IME is woefully poor.Of course there are exceptions, more so towards the technical end of the field, but in terms of avarage level of competence in the job they are supposed to be being paid for, the standard is low. Also YMMV considerably by country.I doubt I'm the only person to have not been at all surprised at the recent phone-hacking escapades?

author: baljemmett
author_rank: Unknown
timestamp: June 08, 2012, 06:54:28 pm
content: Quote from: mikeselectricstuff on June 08, 2012, 06:20:26 pm"Hack (v): to try the default mailbox PIN and see if it works."

author: Simon
author_rank: Unknown
timestamp: June 08, 2012, 07:26:10 pm
content: sounds like a lot of exaggeration. Nothing specific was said. I hate those sorts of articles, reminds me of a website called pcpitstop that are always alerting you to new dangers of the pc like your printer getting a virus and causing a fire...... some people should never have been released into the wild. It's a pity one cannot prosecute people that come out with utter dribble but I don't think there would be enough lawyers to defend them all....

author: bruce273
author_rank: Contributor
timestamp: June 23, 2012, 07:49:11 pm
content: had a good laugh about this journalist thing the other day. A channel 4 news presenter said if you had $100m to spare and you are not pleased with your internet conenction speed that the new supercomputer would be a good investment. Really wish they would employ folk with more than a couple of brain cells...

author: T4P
author_rank: Super Contributor
timestamp: June 23, 2012, 08:35:08 pm
content: Quote from: bruce273 on June 23, 2012, 07:49:11 pmSNR Ratio to Brain cells is ... high if you look at it1 : 1 ...Maybe the employer also has a height to brain cell ratio of 167:1

author: G7PSK
author_rank: Super Contributor
timestamp: June 23, 2012, 09:19:55 pm
content: Putting all theses back doors into chips has to have been done by the little green men or is that gray's.