Why It’s So Difficult – and Costly – To Secure Chips
semiengineering.com
semiengineering.com
I've always assumed that we just had a way to 'check' each chip used in critical industries, such as defense, if they came from another country. It kind of feels the same way it did the first time I learned how to pick pin and tumbler locks, and realized locks are purely an illusion of security.
> fast charger wall outlets, USB cables, etc.
This seems far more likely than supply chain attacks on enterprise hardware.
Second is network disconnection of the systems. Most exploits rely on remote access. If there is no network path from a C&C server to the infected host due to it not being exposed to the Internet and not having any kind of commodity radio capability, there isn't much an attacker can do short of something like Stuxnet, that is, just frying machinery instead of trying to exfil data or take over control. Something like that needs to be pretty tightly targeted, though. The factory line in China likely doesn't have any reliable way to identify exactly which chips are going to end up in US critical systems and only sabotage those.
Third is extremely thorough sandbox testing. Observe something for a long time in a controlled environment and see what it does. That is also something that is not feasible to do for every part, but it is feasible and is done for randomly selected equipment samples.
Obviously, different levels of scrutiny, testing, and security will be applied to, say, the public homepage of the Department of Labor versus the servers running blue force tracking for operational military units. In some ways, it is actually a lot easier to secure critical defense and IC systems than something like banking or email. Not having to expose an information system to external networks or allow arbitrary users signup access is already a huge first step that simplifies the problem space a ton.
There’s no absolute guarantee that a seat belt will save you, or that no one will poison your water supply, or that your AWS service will always be up.
Perhaps we are no longer 90% in this space due to changing political climates but we were there before.
Big vessels full of poisonous (but useful!) chemicals. Aircraft control systems. All carefully designed to be far more nines than 99% reliable - provided that the components behave according to their datasheets and how they behaved during validation.
People like you are spreading propaganda. This is most likely propagated by organizations trying to bring manufacturing back to US. It is actually harmful because it distracts from security that matter. Every week you have US companies hacked by Russian hackers, but somehow IC security of USB cable should be important.
It's in no way clear from your post alone that the book you're talking about is fiction.
There is a very thin line between unbiased facts and opinions and propaganda. For most people, electronics is like magic, circulating ideas about dangers to security where probability is low from both technical and economic point of view is not useful. Both old style printer yellow dots and recent CSAM are US ideas pushed to whole world in open and much higher level than individual IC components.
Now, is China doing something America has not done? Absolutely not. Is it crazy for a country to want to become more powerful? Absolutely not. Is it wrong for a country to do so? I would argue not, since their first responsibility should be to their people, and usually -- not always -- a more powerful country on the world stage is better for the people of that country.
I believe in a globalized world, I am not a nationalist, and think if the world could truly come together, it would obviously be better for all of mankind. However, I am also an American, and although I don't love everything about my country by any means, I am going to pick and favor my country over a foreign one when that country is clearly an adversary. Does that mean I want harm to come to China? No. Does that mean I wish ill-will of the Chinese people? No.
And for what it's worth, I don't think anyone is unbiased and believe it is unrealistic to expect people to be. I think biases are as fundamental (in good and bad ways) to being human as walking on two legs is. Biases are critical to how our brain/memory works -- we have something like 180+ known cognitive biases (https://en.wikipedia.org/wiki/List_of_cognitive_biases). I think the best thing we can do is recognize and acknowledge when we have bias, and factor that knowledge in to how we are thinking about a topic. For example, because of what I do for a living, if I see a positive story about the benefits of marijuana or crypto, I will initially be inclined to believe it may be true; the good ol' confirmation bias at work. But, I also usually try to stop myself, and think more critically of the information being presented, since I know that I am going to be inclined to have that bias towards the two topics. I feel as humans, that is the best we can do. Anyone who pretends to not be biased in any way whatsoever is lying. My father was a psychiatrist for 43 years, and I talked to him about this many times over the course of my life, and he agreed that he's never seen someone who did not have bias.
> To get a cable like this, you used to need a million dollar budget .. It is packed with a web server, 802.11 radio .. The O.MG Cable is built for covert field-use, with features that enhance remote execution, stealth, forensics evasion, all while being able to quickly change your tooling on the fly. And, of course, it works just like a normal USB cable when not deploying payloads. Keystroke Injection payloads are transmitted out of the USB A connector. The Keylogger Edition ... adds a Keylogger capable of storing up to 650,000 keystrokes.
Now we have less than 10%-15% of it because it was cheaper to outsource it to Taiwan, Korea or Japan. We created the problem ourselves by shunning manufacturing and wanting to be a "knowledge-service economy" which only sounds good in the abstract but you still need to have the hardware in trustable form and even worse: most innovation (easily 80% or more) in anything but especially in computers, only comes from innovation of the manufacturing process, and only AFTER that does any other innovation (e.g. software) FOLLOW - software is the tail, not the dog!
Once you push parts into the supply chain you can’t really tell where they will end up.
That's why I wonder if it wouldn't be a good, "broad spectrum" attack. I imagine aides to key Senators, Congressmen, White House staffers, C-suite people at defense contractors etc. buy all sorts of devices off Amazon, which they plug in without a second thought like the vast majority of us do. Obviously, 98% of the people plugging in the devices aren't valuable from a military/intelligence perspective, but even if only 1 in 10,000 targets was worthwhile, I imagine there would be a few that were goldmines of information.
On the other hand, I imagine if it was that sophisticated of an attack, the more devices you have randomly "in the wild" increases the chances it is discovered potentially, which could then nuke your whole operation. I remember in the Snowden docs, the NSA's TAO was sometimes intercepting orders for laptops etc people placed online, carefully placing backdoors in it, then sealing it all perfectly back up and putting it back on track for delivery. It arrives and you think it's safe since it's factory sealed and you got it brand new from a reputable retailer. That's a more targeted example of the same concept
I've often thought that if they were going to do it, we would have heard about it by now.
In The Long Hack they not only reiterate the same claim regarding SuperMicro motherboards, they reference a 2010 criminal case involving counterfeit Cisco hardware in which a witness (Marine Staff Sergeant on active duty at the time, thus speaking for the military) discussed supposedly chipped IBM-branded Lenovo-built laptops sent to the military circa 2008. (The counterfeit Cisco hardware case itself seems a less interesting example as it simply might have involved trojan'd firmware, which is sadly quite common.)
https://link.springer.com/content/pdf/10.1007/978-3-642-4034...
Holy crap wtf.. how is this even possible
I wrote a bunch of blog posts on this theoretic hardware a while ago http://bitgrid.blogspot.com
Semiconductor Feature Sizes (approximate for all vendors)
Nanometers Micrometers Millimeters
Year (nm) (µm) (mm)
1957 120,000 120.0 0.12
1963 30,000 30.0 0.03
1971 10,000 10.0 0.01
1974 6,000 6.0
1976 3,000 3.0
1982 1,500 1.5 **
1985 1,300 1.3 **
1989 1,000 1.0 **
1993 600 0.6 **
1996 350 0.35 **
1998 250 0.25 **
1999 180 0.18 **
2001 130 0.13 **
2003 90 0.09 **
2005 65 0.065
2008 45 0.045
2010 32 0.032
2012 22 0.022
2014 14 0.014
2017 10 0.010
2018 7 0.007
2020 5 0.005
2022 3 0.003
2024 2 0.002 ***
Their pitch deck was about flashing keys into a root of trust at the fab, then using those as a way to do different types of decentralized or federated firmware integrity attestation. They had some quiet traction with some chip manufacturers and in defense and aerospace and at the time, they were the only ones I thought were really bringing something new to the space.
Is there a decent technical document available that actually describes their improvements over the SOTA? Without that, the impression I get is that somebody is trying to dazzle non-technical investors with bullshit.
A fun historical quirk about chip-level security is that most of the experienced people and firms have at least some ties to cable/satellite TV piracy (on either side of that).
The TL;DR of it is that I think the hardware industry is in the exact same spot as the software industry was 20 years ago; a wild west of security. And I think the only way out of this is with decades of good tools, infrastructure, and methodology development.
That's not to say software security isn't a mess right now-- it also is. But at least we *know* relatively how much it's a mess. With hardware, it's an unknown unknown, the worst kind of unknown.
Sounds like systems architecture is about to get physical.
Call the architects!