Hiding Backdoors In Hardware

quartertime writes "Remember Reflections on Trusting Trust, the classic paper describing how to hide a nearly undetectable backdoor inside the C compiler? Here's an interesting piece about how to hide a nearly undetectable backdoor inside hardware. The post describes how to install a backdoor in the expansion ROM of a PCI card, which during the boot process patches the BIOS to patch grub to patch the kernel to give the controller remote root access. Because the backdoor is actually housed in the hardware, even if the victim reinstalls the operating system from a CD, they won't clear out the backdoor. I wonder whether China, with its dominant position in the computer hardware assembly business, has already used this technique for espionage. This perhaps explains why the NSA has its own chip fabrication plant."

Comments

Undetectable?

[countertrolling]

What, you can't sniff the traffic going in and out of your machine?

Re:Undetectable?

[noidentity]

Not if it's hidden among legitimate traffic.

proprietary firmware

[ArcRiley]

You don't even have to go to this great of a length; if you want to root Linux machines, release a proprietary driver in the form of a binary Linux kernel module and watch as your customers blindly install it.

This is one reason why we should insist on the source code to all firmware - or reverse engineer write new firmware ourselves.

Re:proprietary firmware

[Salamander]

This is one reason why we should insist on the source code to all firmware - or reverse engineer write new firmware ourselves.

"We" should reverse-engineer more firmware "ourselves" eh? When I see them at lunch, I'll let the subset of "we" who actually do such things know that somebody with an Ubuntu address said so. That'll be good for a few laughs.

Re:proprietary firmware

[Anonymous Coward]

Why so snarky? I don't know who either of you are, but there are many ways to contribute to open-source computing. For instance, on the development, legal or political fronts. The GP's comment is wishful thinking, but that doesn't warrant getting your hate on.

Re:Not bad but..

[ByOhTek]

So unless you are fixing their pc, it will hard to make an excuse as to why you are opening up their machine when they wanted some anti-virus installed

You haven't dealt with the average end user much have you? Probably less than 1% would be worried/suspicious. Of those that said anything, the answer "Oh, the antivirus has a special piece of hardware that it uses to prevent it from being disabled by viruses..." would suffice.

how do you hide it from QA?

[alen]

everyone knows it's easy to slip backdoors into hardware, but hiding it is the hard part. every fabless chip maker does spot checks of their products and will find these backdoors. at the very least they will find that the shipping products aren't like the ones they designed with extra circuits.

anyone with data that's worth keeping secret will have it behind firewalls and all kinds of security appliances that will start flashing alerts if there is traffic to a high risk geographic area

Re:how do you hide it from QA?

[Anonymous Coward]

Not to mention that it only has to be found in use once, and traffic is traffic. Something funny leaving the network gets a lot of attention in certain places - particularly the ones worth installing a hardware backdoor for.

Re:how do you hide it from QA?

[Samantha Wright]

You don't: you own the whole chain. There are plenty of companies that are now wholly Chinese—consider, for example, that the NASA crew on the ISS uses Lenovo T61p Thinkpad laptops for all of their personal computing needs. There's no QA going on there that Lenovo can't control or manipulate if the Chinese government covertly asks them to. The chips involved in making the system never get shipped across the ocean prior to final assembly.

Furthermore, who says you can't slip the modified chip in at the last stage? A backdoor that's only shipped to your target is less likely to be found than one you ship to every customer in the US.

Re:Not bad but..

[spottedkangaroo]

"sandboxie"

Please don't do this. You'll regret it if you make it popular.

Re:NSA Fabrication Plant...

[mrsteveman1]

By which I mean the summary is in error.

That's what they want you to think.

Re:Not bad but..

[Iron Condor]

... but I think this is why this is a non-story. ANYBODY with access to your hardware owns you. That's always been a given. If I can touch your bare silicon and metal, then I can put all kinds of things in all kinds of places for all kinds of reasons. Big fat Duh.

Maybe this is news to the public, but I'm not sure it is "news for nerds".