Hacker News Reader

Comment by Yetanfou | Hacker News Reader

I'm still waiting for someone - say Raytheon, General Dynamics, Northrop Grumman or Boeing - to find that those SMD capacitors or inductors they used for their hardware ended up being more than just simple passive components. The amount of space available in the package is more than enough to hide some circuitry which can be used for other purposes ranging from bridging air gaps to denial of service. These parts are used in positions where ample power is available for such purposes. The device could be triggered by outside signals, by specifically crafted power profiles, by simple timers or other means. They could be designed to detect the location where they're used in the circuitry and act accordingly.

View on HN

Obviously not at SMD scale, but I have seen fun videos with seemingly simple circuits with LEDs and switches connected in series and they behaved completely differently (eg. each switch connected in series controlled other LED). It turned out that switches and LEDs have been modified with clever frequency generators and filter circuits.

edit: https://www.youtube.com/watch?v=RkTvDjhImwo

He didn't cheat? That's impossible if they're really switches

Define cheating - https://www.youtube.com/watch?v=mzDTZuFJYX4

SMD capacitors are microphonic. They change capacitance slightly when flexed. They also act as speakers, which could be used to exfiltrate data across a (small) air gap.

I tried making my own guitar amplifier in the early 90s. It had a really mysterious feedback problem. Trying to find the cause, I accidentally brushed across one of the decoupling caps with my scope probe, and it went "doink." It was a big goober of a ceramic disc cap. Lesson learned.

Not just SMD; pretty much any tuned circuit will ring when tapped (esp. if multi-layer caps are involved, whether SMD or not).

Raytheon has already been through this [1]:

> Many [counterfeits] have been seized, but any that remain in use pose the risk of causing “components to melt, burst, rupture, catch fire or explode, resulting in property damage, personal injury and death,”

[1]: https://www.publicintegrity.org/2011/11/07/7323/counterfeit-...

Edited to add:

You might think this is different, but controlling the supply chain limits these kinds of attacks.

One way to do it is to control the chain of custody so there's a paper trail on who had access to the parts and when. The other way the pentagon is doing it is putting "dielets" into the chips so they can be verified later.

https://www.scientificamerican.com/article/the-pentagon-rsqu...

In the end it all comes down to controlling the supply chain.

> In the end it all comes down to controlling the supply chain.

And yet people got all up in arms about that guy who got convictted for counterfeiting freely downloadable Windows restoration disks by outsourcing the job to some random shop in China and making them look like official disks.

If anything, he got off easy. The world does not need more factory-backdoored OS installations.

It is for this reason that DoD is very careful about the source of all the components in things that it purchases. It ensures that as much as feasibly possible, the individual components are built in the US.

There are a lot of "ideal diode" devices being used now -- they save power by eliminating the voltage drop associated with passive diodes. Would be simple to hide extra circuitry in these already-active devices (they harvest a bit of inline power) -- and they're typically used in high-power control circuits, so the perfect DoS candidate.

Such shenanigans would be noticed as soon as someone did a routine X-ray inspection at the board house.

"routine" ? Is that a common thing ?

Things that are not routine in commercial manufacture become more common in Defence manufacture. The volumes are lower and per-unit cost-pressure is less, while reliability requirements are higher.

What you're proposing isn't really possible. Sure you could hide a microcontroller in a capacitor or diode packagebbut those components are rudimentary with very simple functions. A diode is like a check valve in pluming, it allows electricity to flow in a single direction. Capacitors are slightly more complicated but still a two pin component.

Imagine you're a pipefitting installed in something, based on the water flowing through you would you be able to distinguish if you were in a house, fire engine, office complex, or high-rise? Would you be able to ascertain what function you served in the system?

The parent comment referenced two use-cases for such nefarious components. Both of which seem quite possible:

1. Bridging an air gap. This would basically be a radio repeater that lets you reach other compromised components. It just needs power, and could certainly fit within one of these component packages.

2. Denial of service. The component may be a simple diode, but if it stops working, you could potentially disable a weapon, or maybe even cause it to self-destruct.

That said, I'm sure that defense contractors are very careful about where they source components. They likely have spies placed within their suppliers, and perform regular audits and teardowns of components.

Food for thought?

https://www.military.com/defensetech/2012/05/30/smoking-gun-...

>That said, I'm sure that defense contractors are very careful about where they source components.

Not as careful as you might expect. "Fake" IC components were found in a military 737 [1]. Trusted ICs are a hot topic and the big players in the defense industry are working towards solutions. It's an interesting topic if you have time to read their academic papers.

[1] https://military.com/defensetech/2011/11/08/counterfeit-part...

> I'm sure that defense contractors are very careful about where they source components.

I thought that's why military hardware is so expensive. You're not just paying for a radio or whatever, you're paying for an entire hardened supply chain with everything sourced from trusted manufacturers. I guess maybe that's not the case any more...

Bridging an air gap could also be possible by simply producing a device that looks to x-ray to be a capacitor but is crafted of materials specifically selected for their ability to physically change in some dimension that the attacker is able to measure remotely.

Change physical size when charged/discharged, measure sound pressure via lasers on windows or microwaves sensing cavities in concrete walls.

The victim doesn’t even need to be specifically targeted if they use commodity components whose design is known. Just arrange for the company producing parts to select a specific recipe.

> distinguish if you were in a house, fire engine, office complex

If water is used primarily between 9-5 in large quantities: office building

If water is used during breakfast and dinner: home

Fire engines also have very distinct water usage patterns and pressures.

I bet you could easily get to >90% accuracy quickly.

This reminds of only learning about the existing of light level geolocation that uses only an accurate clock recording ambient light level to determine longitude and latitude of migratory birds - https://en.wikipedia.org/wiki/Light_level_geolocator

Decoupling capacitors are in a unique position: practically every bit-flip in a chip turns into a glitch signal on the power lines. Normally the capacitor is there to supress those signals by shorting them to ground, but it's also ideally positioned to analyse them.

The component itself doesn’t have to distinguish anything. Imagine if the component just covertly transmitted the water flow. Most would be useless, but the one installed in the CEO’s toilet could give you some useful info.

Such a device would be severely restricted in what it could exfiltrate just based on bandwidth limitations. I'm not super knowledgeable on RF, but I believe that something the size of a SMD resistor or capacitor would be too small to conceal any sort of radio with significant bandwidth (not to mention having to evade RF emissions compliance testing, but maybe some kind of exotic backscatter radio could work). Another possibility would be to modulate the power line signal, but again not enough bandwidth to transmit much that isn't already being leaked.

Perhaps information on power consumption by the CPU, which has been used to recover encryption keys in some attacks, but that's already being leaked in most cases. The most likely scenario as I see it would be parts that deliberately amplified unintentionally leaked information (like high-resolution power usage information) more than normal, but it seems to me that normal compliance testing would detect a lot of that.

I can imagine a bug or something being hidden in a large power supply capacitor, which can have volumes of several milliliters. Maybe capacitors with a hidden transmitter mislabeled as higher values to explain the extra size.

Maybe you could combine those two ideas. Have a really tiny bug in the logic electronics somewhere that transmits at extremely low power, then have a bigger thing in a power capacitor that receives those and retransmits the data at higher power. IANAEE, though, so I could be talking nonsense.

As far as the size goes, is there any tradeoff between size and price? If there’s a more expensive design that occupies less volume, an attacker could use that design, use the extra space for the bug, then sell the whole thing as if it were the cheaper version. You probably couldn’t do this for all of your capacitors, since it would cost a lot. Maybe 1% would be enough to have a good chance of getting a bug somewhere interesting.

Capacitor size is pretty much set by the technology, but where possible smaller equivalent parts are usually cheaper. You can't spam this in all of your products anyway because it makes it too likely that you'd be discovered, plus again there's the issue of making it pass spurious emissions testing. This sort of thing would probably only be used in targeted attacks.

I'll bite; the MCU in the cap (let's assume a tricky case, like a decoupling cap) could transmit by briefly shorting the PSU (one bit at a time).

Reply on news.ycombinator.com