GCHQ goons so clueless they think DC/DC converters are a security risk - Page 1
Forum section: electronics / general

author: mikeselectricstuff
author_rank: Super Contributor
timestamp: May 23, 2014, 10:18:41 am
content: Quotehttps://www.privacyinternational.org/blog/what-does-gchq-know-about-our-devices-that-we-dontThe scary thing is that people supposedly in charge of national security are so stupid.

author: tom66
author_rank: Super Contributor
timestamp: May 23, 2014, 10:44:52 am
content: Inductors can store a permanent magnetic field. Perhaps they could remember the previous CPU stage in the magnetic field and be used to extract data. (cue CSI music... "YEAHHHHHHHH")

author: G0HZU
author_rank: Super Contributor
timestamp: May 23, 2014, 11:48:15 am
content: The link doesn't work for me but I found parts of the article online.I don't know what DCDC converter is referred to in the full text but some DCDC converter chips are programmable. eg via I2C. I assume there will be at least a few bytes of user OTP memory onboard in addition to the basic programmable settings.

author: dannyf
author_rank: Super Contributor
timestamp: May 23, 2014, 12:16:11 pm
content: QuoteRisk means *****potential****** harm, not harm of certainty.So from that perspective, it is PRUDENT to look for the POSSIBILITY that mundane devices like a converter as a security threat.

author: FrankBuss
author_rank: Unknown
timestamp: May 23, 2014, 03:47:23 pm
content: Maybe it was a joke, to create some more conspiracy theories. But judging from many spy movies, British agents don't joke, only Felix from CIABut I could imagine that someone could implant some flash memory in a DC-DC converter IC and save information on it, if it has I2C, like modern mainboards may use for setting the voltage. Of course, very unlikely for the LT3580 which the article describes was destroyed. It could have some electronics for power analysis, but this requires much more computing power than what is possible within a small DC-DC converter IC to get some useful data.

author: mamalala
author_rank: Unknown
timestamp: May 23, 2014, 03:52:49 pm
content: Keep in mind that spy agencies can implant devices, and have harmless looking components with implants built-in at their disposal. Did you see how they make ethernet jacks with builtin implants? USB cables with implants?I can easily imagine some stuff, assuming that the computers in question had implants, that could be going on. A DC/DC converter for a backlight could be modified. Use the enable/disable pin so that when a higher frequency signal is applied it modulates the backlight. That would make a neat device to transmit information, the backlight itself would act as the antenna. Screens have large surfaces...Controller chips in keyboards and mice/mousepads can be used to intercept whatever is typed, mouse movements and clicks, etc. Keep in mind that the bus they are connected to is bidirectional. If there is some flash storage available, that could be used as mid-/long-term buffer.It's easy to see that, given the possibility, they would try and destroy such implants before they can be found by others.The sad thing is that even we know very little from the Snowden leaks, it already is enough to make such things very plausible.Greetings,Chris

author: retrolefty
author_rank: Super Contributor
timestamp: May 23, 2014, 04:57:18 pm
content: Back in the 60s the military/government had a program called "Tempest" that was to protect classified information handled by electronic/electro-mechanical equipment (mostly teletype/crypto stuff) from detection of unprotected plain text information via remote monitoring of the generated EMI emissions of the equipment.Lots of money and manpower went into shielding, lowering signal levels, etc to make such 'attacks' more difficult, and new equipment had to be designed and build with these new requirements.

author: Rory
author_rank: Frequent Contributor
timestamp: May 23, 2014, 06:32:48 pm
content: I was thinking the same thing as the OP, why destroy a switching converter? Then it occurred to me that emitted/conducted radiation from the oscillator on this chip could be received, any signals on the rails could modulate the switching frequency.Wasn't there an article out recently talking about this method?

author: SirNick
author_rank: Frequent Contributor
timestamp: May 23, 2014, 07:04:06 pm
content: While I don't doubt that some of the tactics discussed here arepossible, and we as a species are technically advanced enough to put a scary amount of computing power into the smallest of places, the scope of that effort seems way too broad to make any sense here.I mean, c'mon... Were the notebooks acquired before the leak? If so, is Apple making these things -- or someone retrofitting shrink-wrapped goods -- on the off chance that it will land in the hands of someone that has information valuable enough to make it worth such a shotgun approach? Also, while you can fit a small computer in a tiny IC, the sheer amount of data processed by a modern laptop or desktop would make it an unenviable task to determine what is valuable information, and what is not.OK, not that I have any experience in espionage to back up my stupid opinions, but it seems to me that this kind of thing would have to be a targeted attack to be feasible. Much easier to go old-skool spy and plant a bug in the office ferns than to unleash an army of voyeuristic MacBooks in the vague hope that one will fall into the hands of a newspaper that will receive copies of confidential documents that the backlight inverter will then modulate in such a way that the NSA can pick it up with a pair of bunny ears. Ditto with the i2c controller or 2KB of flash in a trackpad.

author: mamalala
author_rank: Unknown
timestamp: May 23, 2014, 08:10:02 pm
content: Quote from: SirNick on May 23, 2014, 07:04:06 pmFrom the Snowden documents it has become clear that they do intercept packages and bug the equipment therein. It is easy for them to get hold of shipments to a targeted person, manipulate the contents, and have it continue to ship to the destination. It's not unthinkable that certain reporters/newspapers became a target, given the previous leaks.Quote from: SirNick on May 23, 2014, 07:04:06 pmAs mentiooned, it easy for them to intercept specific parcels. Have you seen the video that i linked to? They are quite sophisticated when it comes to implants. Also, the BIOS of a computer makes a really good target to plant bugs. And, if for a moment we assume that they did intercept the delivery of a machine, what makes you think that the flash still has only 2KB? Let it have a few MB and that is enough storage to sniff keyboard input during the times the machine has no network connection, only to be sent out once it is connected again.Really, take a look at what is already published from these documents. It's not hard to find. You can also download a PDF for free that contains a selection of these documents, on Glen Greenwald's site about the new book he just released:http://glenngreenwald.net/What they do goes way beyond "just" sniffing on someone, with bunny-ears. And keep in mind that so far only a tiny fraction of documents have been written about or released. But that is already enough to make it clear that such a scenario is far from fantasy, or hard to accomplish for them. Combine that with the sheer dimension of their senseless spying and intercepting, and you get the idea. Heck, they even actively manipulate equipment that is at the core of the network infrastructure.Greetings,Chris

author: Tinkerer
author_rank: Frequent Contributor
timestamp: May 23, 2014, 11:53:20 pm
content: QuoteThis is what happens when they have unlimited funding to do stuff. The day before 9/11, Dick Cheney reported to congress that $1 trillion had gone missing from the pentagon budget. Then 9/11 happened and everyone seemingly forgot. Since then, more budgeting issues have been discovered and in general book keeping is a total disaster. Just something that never gets addressed. But the point is that when you got the funding...

author: Dave Turner
author_rank: Frequent Contributor
timestamp: May 24, 2014, 12:35:23 am
content: All security people have to be paranoid - it's the nature of the job. They know someone's out to get them.Hmm do all routers and firewalls have backdoors built in?The only secure computer never connects to the internet and is only accessible by one person.

author: dannyf
author_rank: Super Contributor
timestamp: May 24, 2014, 12:56:39 am
content: QuoteMr. Snowden?

author: SirNick
author_rank: Frequent Contributor
timestamp: May 24, 2014, 01:21:45 am
content: Quote from: mamalala on May 23, 2014, 08:10:02 pmSpeaking of paranoia, I think in the interest of my ability to retain a security clearance when and if I ever require one again, I won't go pursuing leaked classified documents. But otherwise, I shall consider myself appropriately chagrined after reading your post.I confess, I am probably still a teensy bit naive when it comes to understanding how far people and governments will go.

author: T3sl4co1l
author_rank: Super Contributor
timestamp: May 24, 2014, 01:31:29 am
content: Probably, those devices contain some storage (volatile or otherwise) that could be suspected of containing information. How it would get there I don't know, but...Recall that all these devices are stateful, usually linked to the greater system via I2C or SMBus or whatever. There are probably registers that could store information; perhaps undocumented or configuration regions that would be of particular interest to spooks.Tim

author: CrosseyeJack
author_rank: Contributor
timestamp: May 24, 2014, 01:31:44 am
content: Last years GCHQ's public "Hack this and join us" comp (to be fair they got a 3rd party to run it) was easily defected by brute forcing the site. But no, if you didn't do it their way they didn't accept the submission.So I'm not surprised in the least.

author: rexxar
author_rank: Frequent Contributor
timestamp: May 24, 2014, 01:42:19 am
content: Quote from: T3sl4co1l on May 24, 2014, 01:31:29 amYeah, but across all three you might have enough to store "GCHQ sucks lol"I guess you could nuke the actual firmware on the chip and get a few kB, but it'd be easier for a person tomemorizethat amount of information than to do that sort of hackery.

author: chicken
author_rank: Frequent Contributor
timestamp: May 24, 2014, 01:56:50 am
content: Methinks someone is projecting their own actions onto others. I.e. GCHQ's version of "We patch up Cisco gear, therefore Huawei gear must have backdoors too"What is Psychological Projection?http://en.wikipedia.org/wiki/Psychological_projection

author: TVman
author_rank: Frequent Contributor
timestamp: May 24, 2014, 03:31:19 am
content: And guess what?!?They are puttingCAMERAS And A microphonein Tv boxes.By installing Cameras and hidden microphones inside our all but mandatory digital boxes, the government and whatever corporate entities get a slice of the pie, have direct access to our living rooms.http://www.propagandamatrix.com/articles/february2009/021809_spy_camera.htmSo evil!

author: Monkeh
author_rank: Super Contributor
timestamp: May 24, 2014, 03:43:07 am
content: Convenient how that video is so blurred you can't actually see anything.. like any contact between the 'camera' and the PCB! The 'microphone' is in an interesting spot, too.Don't believe everything you see on the internet.If you open up a normal one, you know what you find in place of the 'microphone'?A TO-92! And I'll bet that it's a TL431, too, I wonder what a TL431 could be doing there? No real purpose right in the middle of the feedback for the PS- oh, right.

author: TVman
author_rank: Frequent Contributor
timestamp: May 24, 2014, 03:46:21 am
content: This is the search I did...http://www.google.com/cse?cx=002683415331144861350%3Atsq8didf9x0&q=camera+in+tv+spying&ie=utf-8&sa=Search

author: Monkeh
author_rank: Super Contributor
timestamp: May 24, 2014, 03:58:43 am
content: Quote from: TVman on May 24, 2014, 03:46:21 amHow many times are you going to edit the link to 'the search you did'?Wake up, kiddo, the internet is full of BS.

author: TVman
author_rank: Frequent Contributor
timestamp: May 24, 2014, 04:02:10 am
content: because the link was searching for camera in dvr not camera in tv box.

author: dannyf
author_rank: Super Contributor
timestamp: May 24, 2014, 01:36:30 pm
content: QuoteFor the security folks, they think in terms of what's possible, not what's probable.

author: G7PSK
author_rank: Super Contributor
timestamp: May 24, 2014, 05:32:27 pm
content: They most likely wanted to make sure that the bugs they had planted were removed, I expect that most newspapers are bugged to buggery by the various "intelligence" agency's.

author: G0HZU
author_rank: Super Contributor
timestamp: May 24, 2014, 10:54:04 pm
content: Quote from: rexxar on May 24, 2014, 01:42:19 amOr, instead of "GCHQ sucks lol" you could store and hide an encryption/decryption key for something else on the system...?

author: Rasz
author_rank: Super Contributor
timestamp: May 25, 2014, 03:21:19 am
content: DC/DC is a good candidate for side channel RF com linkDC/DC that does PWM on the screen backligh is even better, because you can use whole BL like IRDAhttp://en.wikipedia.org/wiki/Visible_light_communicationnot so funny, eh?My guess is GCHQ was just covering their tracks and removing their own implants.

author: NiHaoMike
author_rank: Super Contributor
timestamp: May 25, 2014, 03:34:38 am
content: Quote from: Rasz on May 25, 2014, 03:21:19 amSome solar (micro)inverters use PLC to send their stats to a central hub. They modulate the PWM frequency or inject a (relatively) low frequency data waveform on the output.