Hacker News Reader

Comment by LeonM | Hacker News Reader

EE here, looking at the size of the chip, the weight and power difference is going to be too small to measure. Latency will probably not be affected when the chip is dormant

View on HN

One of the bloomberg articles claimed that in some cases it was "thin enough that they’d been embedded between the layers of fiberglass" -- like as if it were a passive in a blind/buried via?

This seems like a very sophisticated attack.

Not a sophisticated attack, but a standard industry practice for high value, high density boards. I first saw a buried passive 5 years ago.

Sorry, I didn't mean to suggest that the attack was with a passive. Clearly, this package is shown to have logic. But it was meant to look as if it were a passive. In some cases surface mount, but in truly devious ones it's much better hidden.

Well my own idea was along the lines - if they can burry passives, burying a small IC should also be possible

SD cards have the raw IC die buried in the PCB. If you crack open a cheap SanDisk card, you will see that it is a marvel of engineering. Instinctively one thinks of advanced manufacturing as being reserved for high end goods, but in reality it is used widely in cheap mass produced things to bring the cost down.

Passives don't have enough pins to do much of anything, unless it's an array of passives in a single package that happens to be on power, gnd and data lines at once.

But, I'm not sure but it seems like a bit of a red herring. Reading the article the chip in question doesn't sound passive at all: "The Supermicro board here appears to have a QSPI chip, but also a space for an SPI chip as a manufacturing-time option. The alleged implant is mounted in part of the space where the SPI chip would go."

edit: so maybe it was an array of passives that were meant to go across every pin of this protocol in a single package.

Did you see the comment above that QSPI boots up as SPI and then switches over to QSPI?

It can't be QSPI, he's forgetting the clock and (potentially) chip-select lines.

Are you basing this off the photo in the Bloomberg article that shows a small (0402?) SMT package with three terminals?

I wonder if that's an actual photo of the chip in question.

FTA: https://assets.bwbx.io/images/users/iqjWHBFdfxIU/iWRg56pmx50...

> [...] a picture of the alleged implant. This shows a 6-pin silicon chip inside a roughly 1mm x 2mm ceramic package – as often used for capacitors and other so-called ‘passive’ components, which are typically overlooked.

It might be possible to mount an attack from a board location occupied by a legitimate passive component (or a single SOT-23 transistor, something like that). In that case the attacker would only need to replace a reel of legit passives in the PnP machine. Visually they'd be identical.

SOT-23 only has three pins, seems like it would be challenging only having one data pin.

The alleged component in question had six pins, if it were passive it must have been a bank or array of passives since individual passives generally only have two pins each.

Based on the captions in the original story, I think it's just a photo of a random signal conditioning coupler, which the chip in question was said to strongly resemble.

But I'm not sure.

If it replaced a DNP part, it could have been found at a flying probe test. Half the expected impedance on a few of those pins?

Also AOI might have picked up a difference.

Flying probe testing is unlikely to be used for this type of product.

Sounds like a randomized sample of boards needs tested against a reference then.

AOI would miss the chip if it were buried between layers or look exactly like a part it was replaced for.

I wonder how the auditing team detected it. X-rays?

They might have noted an anomaly in the SMC given the acknowledged SMC firmware exploits (maybe a beta test run?) and investigated the SPI lines to the SMC as a response.

Reply on news.ycombinator.com