[HN Gopher] Why It's So Difficult - and Costly - To Secure Chips
___________________________________________________________________
Why It's So Difficult - and Costly - To Secure Chips
Author : PaulHoule
Score : 67 points
Date : 2021-12-02 16:07 UTC (6 hours ago)
(HTM) web link (semiengineering.com)
(TXT) w3m dump (semiengineering.com)
| yodon wrote:
| Anyone here on HN know who is doing good work in this area?
| private4e584d wrote:
| Please excuse the new account, I don't work for them, but
| https://www.nxmlabs.com . Maybe the hit will cause one of them
| to chime in.
|
| Their pitch deck was about flashing keys into a root of trust
| at the fab, then using those as a way to do different types of
| decentralized or federated firmware integrity attestation. They
| had some quiet traction with some chip manufacturers and in
| defense and aerospace and at the time, they were the only ones
| I thought were really bringing something new to the space.
| XMPPwocky wrote:
| I'm trying to read this charitably but can't. As far as I can
| tell, they're describing the concept of "fuse some keys into
| chips" (and/or "use a PUF"?) and "do secure boot". Where's
| the novelty? All I see is PR and bad, bad vibes.
|
| Is there a decent technical document available that actually
| describes their improvements over the SOTA? Without that, the
| impression I get is that somebody is trying to dazzle non-
| technical investors with bullshit.
| zimmerfrei wrote:
| https://opentitan.org/
| XMPPwocky wrote:
| Offensive or defensive? For offensive (at least in the non-
| classified space), major players include e.g. Riscure.
|
| A fun historical quirk about chip-level security is that most
| of the experienced people and firms have at least some ties to
| cable/satellite TV piracy (on either side of that).
| kayson wrote:
| Pretty much every major company in the space will have a team
| or even several dedicated to digital IC security. Qualcomm,
| Intel, Apple, Mediatek, Xilinx, and probably Google and Amazon
| now as well. I attended a really interesting pre-COVID lecture
| series given by some engineers in one of Qualcomm's teams that
| started with crypto/security basics and eventually got in to
| more advanced techniques like side channel attacks. I had a lot
| of questions related to our own products that they couldn't
| answer in the name of secrecy.
| klodolph wrote:
| Google and Amazon definitely have dedicated IC security
| staff.
| baybal2 wrote:
| Why? They don't seem to be that professional, or
| experienced
| klodolph wrote:
| Could you elaborate? Who doesn't seem to be professional?
| Why would that mean that there's no IC security team?
| aurizon wrote:
| How Small Is Small? From PC Mag
| https://www.pcmag.com/encyclopedia/term/process-technology To
| understand how tiny these transistor elements are, using state-
| of-the-art 5 nm feature sizes as an example, 16 thousand of them
| laid side-by-side are equal to the cross section of one human
| hair. See half-node and active area.
|
| Semiconductor Feature Sizes (approximate for all vendors)
| Nanometers Micrometers Millimeters Year (nm)
| (um) (mm) 1957 120,000 120.0 0.12
| 1963 30,000 30.0 0.03 1971 10,000 10.0
| 0.01 1974 6,000 6.0 1976 3,000 3.0
| 1982 1,500 1.5 ** 1985 1,300 1.3 **
| 1989 1,000 1.0 ** 1993 600 0.6 **
| 1996 350 0.35 ** 1998 250 0.25 **
| 1999 180 0.18 ** 2001 130 0.13 **
| 2003 90 0.09 ** 2005 65 0.065
| 2008 45 0.045 2010 32 0.032
| 2012 22 0.022 2014 14 0.014
| 2017 10 0.010 2018 7 0.007
| 2020 5 0.005 2022 3 0.003
| 2024 2 0.002 ***
|
| What this means is:- very complex circuits can be laid out and
| placed inside a bypass capacitor on the 3.3 or 5 volt rail that
| pass their data through the encapsulant via IR and also receive
| instructions. They can be hidden on multilayer boards hidden by
| the + and G rails from x-rays. They can also access data busses
| by similar hidden means. With data bus access they can get/send
| clocked data on command. Ever hear of the 'Russian Pebbles'. Dead
| drops that use a foot coil to send/receive data, and yes, they
| have wireless charging - a charger agent places his foot nearby
| the buried pebbles...
| anaphor wrote:
| You can even place a backdoor on a circuit without any
| noticeable physical changes (other than chemical differences
| which are extremely hard to detect). You basically change which
| chemicals are used to "dope" the transistors, which changes
| their polarity.
|
| See: https://news.ycombinator.com/item?id=26860715
| DaftDank wrote:
| After reading "Ghost Fleet" by P.W. Singer and August Cole, the
| idea in there about China putting backdoors in chips sent to the
| US for years -- laying the 'groundwork' for an eventual cyber and
| physical invasion -- has really stuck with me. He makes the point
| in the book (which has tons of citations to describe the
| attacks/weapon systems) that even critical defense-related chips,
| for things like our most advanced fighter jets, are often still
| assembled/manufactured in China. But I imagine an equally useful
| strategy could just be putting backdoors in all the various
| things ordinary people order off Amazon each day: fast charger
| wall outlets, USB cables, etc.
|
| I've always assumed that we just had a way to 'check' each chip
| used in critical industries, such as defense, if they came from
| another country. It kind of feels the same way it did the first
| time I learned how to pick pin and tumbler locks, and realized
| locks are purely an illusion of security.
| nonameiguess wrote:
| There are a few ways this is dealt with in government. First is
| a requirement to provide engineering diagrams sufficient to
| rebuild a chip from scratch if necessary. When purchasing a few
| hundred thousand servers at a time from Dell or leasing space
| in Amazon's data centers, nobody is physically auditing that
| every chip actually matches the diagram, but they will randomly
| audit at least a few. If someone is shipping a bunch of
| motherboards that have undocumented backdoors on them, it will
| get noticed.
|
| Second is network disconnection of the systems. Most exploits
| rely on remote access. If there is no network path from a C&C
| server to the infected host due to it not being exposed to the
| Internet and not having any kind of commodity radio capability,
| there isn't much an attacker can do short of something like
| Stuxnet, that is, just frying machinery instead of trying to
| exfil data or take over control. Something like that needs to
| be pretty tightly targeted, though. The factory line in China
| likely doesn't have any reliable way to identify exactly which
| chips are going to end up in US critical systems and only
| sabotage those.
|
| Third is extremely thorough sandbox testing. Observe something
| for a long time in a controlled environment and see what it
| does. That is also something that is not feasible to do for
| every part, but it is feasible and is done for randomly
| selected equipment samples.
|
| Obviously, different levels of scrutiny, testing, and security
| will be applied to, say, the public homepage of the Department
| of Labor versus the servers running blue force tracking for
| operational military units. In some ways, it is actually a lot
| easier to secure critical defense and IC systems than something
| like banking or email. Not having to expose an information
| system to external networks or allow arbitrary users signup
| access is already a huge first step that simplifies the problem
| space a ton.
| lnsru wrote:
| You need to know what are you looking for in a potentially
| hostile device. I really like the story about The Thing:
| https://en.m.wikipedia.org/wiki/The_Thing_(listening_device)
| You'll never know what opponent has discovered and using for
| his advantage.
| wolverine876 wrote:
| Interesting, but what is the source?
| tomnipotent wrote:
| The book must have been the source of Bloomberg's horrible
| reporting with the "Big Hack".
|
| > fast charger wall outlets, USB cables, etc.
|
| This seems far more likely than supply chain attacks on
| enterprise hardware.
| gumby wrote:
| I wonder how easy these attacks are to control. The reason the
| great powers signed the Geneva protocols against poison gas use
| is that the gas was as likely or more to cause problems for the
| user as it was for the enemy. The same applies to biological
| agents.
|
| Once you push parts into the supply chain you can't really tell
| where they will end up.
| Chyzwar wrote:
| US is already paranoid about sourcing components. Even European
| companies are asked to use US components when trying to sell to
| US. China is selling to the world. One confirmed case of
| backdoors and financial loses will be far greater than benefit
| of spying on average US citizen.
|
| People like you are spreading propaganda. This is most likely
| propagated by organizations trying to bring manufacturing back
| to US. It is actually harmful because it distracts from
| security that matter. Every week you have US companies hacked
| by Russian hackers, but somehow IC security of USB cable should
| be important.
| DaftDank wrote:
| I am spreading propaganda by mentioning a fictional book I
| read, which made me think of potential security
| vulnerabilities? Things like a LAN Turtle exist, and have
| probably existed long before most people were aware of them.
| thrashh wrote:
| Calling something an illusion is the wrong way of looking at
| things because everything in life is about getting at least
| 80-99% there -- to be "good enough." Everything therefore is an
| illusion by that logic.
|
| There's no absolute guarantee that a seat belt will save you,
| or that no one will poison your water supply, or that your AWS
| service will always be up.
|
| Perhaps we are no longer 90% in this space due to changing
| political climates but we were there before.
| rm445 wrote:
| There are safety-critical systems, though.
|
| Big vessels full of poisonous (but useful!) chemicals.
| Aircraft control systems. All carefully designed to be far
| more nines than 99% reliable - provided that the components
| behave according to their datasheets and how they behaved
| during validation.
| digikata wrote:
| And if it's critical enough, that isn't just left to chance
| after the initial design validation. There are continuous
| supply chain and acceptance testing checks that have to
| keep being run and managed. This is one reason the costs
| are higher.
| mikewarot wrote:
| I believe it is possible to have a computing fabric that is so
| simple there isn't anywhere to hide bugs in it, yet extremely
| performant. The downside is it wastes transistors, and isn't a
| Von-Neuman architecture at all. It's a grid of 4 in, 4 out look
| up tables (that's 64 bits of state each), each exchanging 1 bit
| with its cartesian neighbors, clocked in alternate phases like a
| chess board to prevent all race conditions. It's Turing complete,
| can route around bad cells, and you could securely partition a
| program to run in part of it, but not all.
|
| I wrote a bunch of blog posts on this theoretic hardware a while
| ago http://bitgrid.blogspot.com
| ljhsiung wrote:
| Shameless blog post, but I wrote about something similar here.
| [1]
|
| The TL;DR of it is that I think the hardware industry is in the
| exact same spot as the software industry was 20 years ago; a wild
| west of security. And I think the only way out of this is with
| decades of good tools, infrastructure, and methodology
| development.
|
| That's not to say software security isn't a mess right now-- it
| also is. But at least we *know* relatively how much it's a mess.
| With hardware, it's an unknown unknown, the worst kind of
| unknown.
|
| [1]: https://ljhsiung.com/posts/the-state-of-cpu-fuzzing/
| not2b wrote:
| The semiconductor industry was using fuzzing before it was used
| in software (starting about two decades ago), but they didn't
| call it that. They (or rather, the academics who pioneered it)
| called it coverage-directed constrained random simulation, and
| it worked in much the same way as modern fuzzers do.
| snovv_crash wrote:
| I wonder if you could fuzz a chip directly, without having
| the schematics, so that if the manufacturer inserts something
| off-the-books it still gets explored.
| not2b wrote:
| For fuzzing to be effective you need access to coverage
| information. If you have the RTL (SystemVerilog or VHDL
| source) you can verify that you're hitting all the paths
| and the branches, and use a constraint solver to find paths
| that increase coverage. If you just have the registers and
| latches you can see how much of the state you've reached.
| But if you just have a chip too much of the internal state
| is unreachable: you'll never find the magic sequence that
| triggers the badness (if it exists) by random simulation,
| the heat death of the universe will happen first.
| frazbin wrote:
| I wonder if certain applications would benefit from redundant
| setups in different cpu arches to check for discrepancies.. kinda
| like NASA stuff but different.
| m3kw9 wrote:
| Latticesemi's Supply Guard helps with this type of security:
| https://www.latticesemi.com/Solutions/Solutions/SolutionsDet...
| mr_overalls wrote:
| Required reading: "Stealthy Dopant-Level Hardware Trojans" by
| George Becker et al
|
| https://link.springer.com/content/pdf/10.1007/978-3-642-4034...
| yodon wrote:
| Who needs horror films when journal articles can be that scary!
___________________________________________________________________
(page generated 2021-12-02 23:02 UTC)