Hacker News Reader

Comment by detaro | Hacker News Reader

Could be due to losses in "translation", but this paragraph seems odd:

> Three security experts who have analyzed foreign hardware implants for the U.S. Department of Defense confirmed that the way Sepio's software detected the implant is sound. One of the few ways to identify suspicious hardware is by looking at the lowest levels of network traffic. Those include not only normal network transmissions, but also analog signals -- such as power consumption -- that can indicate the presence of a covert piece of hardware.

Ideas what they mean? I'd be surprised if mainboards etc exposed power consumption of random periphery parts. Maybe sleep/link states of the actual NIC that get influenced?

View on HN

If you look at the activity in the frequency domain, you might find a clock that's present in adulterated hardware that's missing in the nominal hardware.

> exposed power consumption of random periphery parts

Sampling these analog signals is done outside of the computer itself. Even if it were exposed via i2c, you couldn't trust anything that it would tell you.

To me the article reads like it's a purely software solution, thus my confusion, but that might be misinterpretation.

I think it's probably also a software solution that the company whose CEO was the sole source for this article is trying to promote, judging from this marketing brochure for them: https://twitter.com/securelyfitz/status/1049725014075830272 The claims in that certainly look every part as improbable.

Sampling the EM profile of a large number of boards PHY signals could lead you to a deviation that indicate an anomaly Whetever that anomaly has to be forwarded to maintenance or to security can be discussed however: is the EM profile "wrong" because of tampering or because some capacitor is about to blow up?

If both are going over the same physical interface, there could be tiny voltage drops to power the chip itself. The vague-as-ever article gives no indication as to how the chip would be powered, but such a small implant could conceivably leech off the legitimate ethernet interface.

My consumer board exposes that information. There is a tab called system information with hardly readable text which lists all voltages etc by component

I've never actually checked in the bios of any server, as that information was never relevant to me, but they probably have that as well

Voltage won't tell you anything. You need to measure current. If a 50ma part is consuming 75ma you would want to investigate why.

Reply on news.ycombinator.com