Welcome Guest [Log In] [Register]
Welcome to Crypto. We hope you enjoy your visit.


You're currently viewing our forum as a guest. This means you are limited to certain areas of the board and there are some features you can't use. If you join our community, you'll be able to access member-only sections, and use many member-only features such as customizing your profile, sending personal messages, and voting in polls. Registration is simple, fast, and completely free.


Join our community!


If you're already a member please log in to your account to access all of our features:

Username:   Password:
Add Reply
Undetectable hardware trojans
Topic Started: Sep 23 2013, 12:23 PM (356 Views)
mok-kong shen
NSA worthy
[ *  *  *  *  *  * ]
http://www.computerworld.com/s/article/9242472/Security_researchers_create_undetectable_hardware_trojans?taxonomyId=162&pageNumber=1
Offline Profile Quote Post Goto Top
 
coder
NSA worthy
[ *  *  *  *  *  * ]
A nasty development.

As I understand it, the doctored hardware would have to be connected to the Internet in order to control the Trojan by a malicious UDP package. The solution would seem to be not to connect sensitive gear to the Internet. Bang goes on-line retailing, banking...
quot homines tot sententić
Offline Profile Quote Post Goto Top
 
mok-kong shen
NSA worthy
[ *  *  *  *  *  * ]
The following paragraphs are taken from the paper of the researchers:

"By using two case studies, a side-channel resistant SBox implementation and an implementation of a secure digital random number post-processing design derived from Intel's new RNG used in the Ivy Bridge processors, we prove that the proposed dopant-based Trojans can be used efficiently in practice to compromise the security of the underlying target design."

"The main idea of the proposed Trojan is as follows: A gate of the original design is modified by applying a different dopant polarity to speci c parts of the gate's active area. These modifications change the behavior of the target gate in a predictable way and are very similar to the technique used for code-obfuscation in some commercial designs."

This means in my understanding that "Trojan" in the present context refers simply to the subtle malicious modifications (that result in different behaviours from the standard design) in the hardware that (constantly) have effects (independent of whether the hardware is connected to the Internet or not).

The situation is apparently very grave. For hardware is really at the basic level of any computation with digital circuits and hence the security of communications involving computers will be inherently questionable if the correct functioning of the hardware cannot be assured. (In comparison, software security issues could be more easily dealt with in practice through sufficiently careful examination and verification/testing of the codes (open source) IMHO.)

Edited by mok-kong shen, Sep 24 2013, 09:00 PM.
Offline Profile Quote Post Goto Top
 
coder
NSA worthy
[ *  *  *  *  *  * ]
I also have read the Research paper and in my posting was referring to the mention of an enemy being able to control a piece of hardware by sending instructions through the Internet: "... granting complete control of the system to an external attacker. The attacker can make arbitrary changes to the program code and can get unlimited access to the memory by simply sending a specific malicious UDP package to the processor".

This seems to me to present a most unpleasant outcome if such doped chips found their way into Commercial hardware.

I note there has been a near-hysterical panic reaction to the article in various quarters, based mainly on the 'undetectability' of the doped chips, which seems to me to be overdone.

The authors of the paper conclude on this note "Future work should include developing new methods to detect these sub-transistor level hardware Trojans." Which indicates a confidence that detection methods will be found. But of course they are referring to the state of the art on the open Research community. This exerts but a fraction of the total research into military matters where the bulk is funded behind closed doors by the huge budget of the Pentagon. And one should bear in mind that 'doctored' chips have been a concern for many years as is shown by the references included in the paper.

Putting together these two factors it seems to me likely that the Pentagon not only knows about this problem but also has means of detection. That such progress should be kept secret is only reasonable, given the sensitivity of the subject and the proclivity of China and Russia to steal whatever technology they can and of East-sympathisers living safely in the West to betray technology ( here is an example )

Whether the threat in the Commercial world is anything but theoretical I cannot know, but I consider it unlikely. On the one hand it seems a bit unlikely that the chip makers (the so-called 'foundry') have decided to operate an attack on the world's commercial system because this would require not just the doped chips but also an organization to implement the scam. However I suppose it could be part of a foreign power's design to disrupt and destabilize the Western world as part of a major attack. I remain skeptical about such disaster scenarios that would require a modern-day Hitler or Stalin to put them into effect. And people who put about such ideas have probably been reading too much Science Fiction or are unfortunately in a paranoid state. But I suppose there is always the possibility of some rogue element mounting a limited attack and so it is just as well that the authors of the paper have made their research and that they stimulate continuity in this most advanced area of technology.
quot homines tot sententić
Offline Profile Quote Post Goto Top
 
mok-kong shen
NSA worthy
[ *  *  *  *  *  * ]
Note that, if e.g. the behaviour/quality of a PRNG could be influenced, then I would think that the security of all matters involving digital signatures will under circumstances be highly questionable and that would have very far-reaching negative effects to a wide spectrum of applications of information processing, whether online/offline, civil/military etc. etc. Certainly there would always be, so to say, antidotes to poisons, but IMHO a (another) Pandora's box has now been opened and that's surely bad news.

BTW, what should/could we (common people) do in face of the modern communication "in-security"? I tend to "speculate" that perhaps the old-fashioned encryption processing without computers could eventually contribute a tiny little bit on the positive side. That is, one has a pre- and/or post-processing of results of computer encryption with methodologies independent of modern hardware. For most confidential informations need not be kept secret for eternity. In the majority of practical cases I suppose a delay of a certain time period, maybe even as short as days or hours, of the success of analysis of the opponent is all that is "absolutely" required. Superencipherment, properly done, adds certainly more or less to the strength of an encryption processing in general. In that sense I think a renaissance of pre-computer encryption methodologies may not be a highly unrealistic scenario after all. (Some good existing methods may be refined and new ones developed in the realm of paper-pencil, mechanical and (elementary) electro-mechanical systems, where everybody could easily ensure that there are no malicious built-in backdoors. Personally I think it's not bad if e.g. the Jefferson-Bazeries Cylinders having a large set of exchangeable disks are optimally made with modern manufacturing technologies for the convenience of the users.)
Edited by mok-kong shen, Sep 26 2013, 07:52 AM.
Offline Profile Quote Post Goto Top
 
1 user reading this topic (1 Guest and 0 Anonymous)
ZetaBoards - Free Forum Hosting
Create your own social network with a free forum.
Learn More · Sign-up for Free
« Previous Topic · News · Next Topic »
Add Reply