Slashdot Mirror
DARPA Looks To End the Scourge of Counterfeit Computer Gear
coondoggie writes "Few things can mess up a highly technical system and threaten lives like a counterfeit electronic component, yet the use of such bogus gear is said to be widespread. A new Defense Advanced Research Projects Agency (DARPA) program will target these phony products and develop a tool to 'verify, without disrupting or harming the system, the trustworthiness of a protected electronic component.'"
Why did "remote kill switch" and "built in spying" just pop into my head?
No, I don't remember your name. But the memory mapped screen on a TRS80 from 1977 is from 15360 to 16383 if that helps.
Is this actually a proposal to provide a general solution to the halting problem for a potentially unpredictable(if parts of it are hidden by the bugged component) program running on logic that may deviate from expected behavior under unknown conditions, or is there some trick that makes it less hopeless?
"SHIELD demands a tool that costs less than a penny per unit, yet makes counterfeiting too expensive and technically difficult to do"
and at the same time
"What SHIELD is seeking is a very advanced piece of hardware that will offer an on-demand authentication method never before available to the supply chain"
These appear to be mutually exclusive.
William George
doesn't this seem like a job for the FCC or whatever the name of the government body that regulates business, trade and import/export makes it seem suspect?
this seems like a job for someone else entirely
Do I really want DARPA putting a remote bugging tool in my computer, under the pretext of detecting counterfeit computer gear ..
backdoors at home,
backdoors from afar.
i slap my ballsack in defiance.
What the fuck is a dod?
hahahahahahahaahahhaah
Pfft. You're over thinking it. What they want already exists - it's called a checksum. Therefore, the answer is to create any hardware you need to be secure as a software emulator. Now, you'll need to get around the fact that most emulators have a Big O notation of O(N!) or so, but that's a problem for an engineer. I'm an idea guy.
Well, given this story mentions the Defense Advanced Research Projects Agency, I'd guess DoD in this context is the Department of Defense.
It occurred quite a long time ago, but at the time no solution was proposed.
Regular steel bolts have hexagonal heads that are flat on top. Bolts made of high-strength steel are marked with three - if I recall correctly - radial lines.
You can see that it would be easy and cheap to mark a regular steel bolt with those three lines, then sell it for the high-strength premium.
This caused at least on death: a worker who was torquing a bolt while building the first Saturn car factory snapped the head off a bolt and fell to his death.
An Army general commented that when he took his battalions tanks out for training in the desert, their tracks were littered with bits of broken off bolts, as well as the occasional tank tread.
What they actually did about this was to test samples of bolt shipments, but such testing was very expensive and so could not provide good coverage.
However it has been years since I last heard about it. Has the counterfeit bolt problem been solved? If so how?
Please mail me URLs of software employers.
Because this man would be the perfect leader for their new project.
Get free satoshi (Bitcoin) and Dogecoins
... Pretty sure he meant "way of the dodo", as in the extinct bird.
Are they trying to detect counterfeit hardware, or are they trying to detect whether the hardware works as expected?
Those two aren't the same as far as I can tell.
Counterfeit hardware can be identical to non-counterfeit hardware simply because it can be made in the same factory by the same people, but just after "closing time".
Non-counterfeit hardware on the other hand can have all kinds of backdoors and whatever installed.
POW! "Yep, that cap's genuine"
How can one discern between counterfeit and real, when both are coming off the same assembly line in China?
This is what is called "third shift" products, where the first two shifts make XYZ product for ABC corp, and the third shift makes XYZ Counterfeit for black market.
Agent K: A *person* is smart. People are dumb, stupid, panicky animals, and you know it.
No, but when you buy from off-shore vendors and they ship back fake parts, it can hurt when a plane falls out of the sky.
---- Booth was a patriot ----
This caused at least on death: a worker who was torquing a bolt while building the first Saturn car factory snapped the head off a bolt and fell to his death.
While still a bad thing, this should never have happened. He should have been wearing redundant safety gear so that no matter what failed, he would have been safe.
---- Booth was a patriot ----
This caused at least on death: a worker who was torquing a bolt while building the first Saturn car factory snapped the head off a bolt and fell to his death.
While still a bad thing, this should never have happened. He should have been wearing redundant safety gear so that no matter what failed, he would have been safe.
While your point is still valid, it is hardly the only case where it is possible for a counterfeit high tensile bolt to cause a fatality.
It doesn't take much imagination to think of a problem.
Russian Components, American Components, all made in Taiwan!
Let us not forget the very real problem with NSA practices in our field, and suddenly why your technical computing cluster stopped working, or other equipment screwed up. Our friendly hackers at NSA and any bios changed while providing snooping, changing timing on cpu, etc.
I already had problems with my land line which a firmly believe was because the NSA and small local phone company kept having technical issues leaving with out phone service for extended periods with what I will assume was interface problems with the regular phone equipment and the NSA equipment locked away. The problems started each after making email contact with Congressional Reps. Sometime later on, Sen. Sanders (VT) asked the question about spying on congress, which you should already know about.
After the 3rd time started I decided a cell was the option, though I hate the quality. But at least the damn this would dial 911 if I happen to need it, and I can get voice mail and make calls.. you know, what was working fine before on the better system.
All before Snowden NSA reveal, so my complaints were brushed away at the time. although many of us here who follow technical and networking hires/info had clear signs this was occurring long before Snowden came on scene.
So, let's all not worry about those NSA ass-holes, you got nothing to hide, right? Why object otherwise.
...instead of stopping the system if it doesn't verify (kill switch) or sending the results back to headquaters (spying), otherwise it's DRM. As long as the user has full control on what this thing does such as turning it off or changing what server it sends the info to or what it registers as counterfeit and what doesn't then it could be a good thing. But if this is used to lock the user out of his own hardware or prevent him from changing or modifying it then this is going to be a huge problem.
while
It seems to me that most of you didn't bother to read the article. In a nutshell, DARPA wants a small electrically isolated chip that acts as a RFID chip and sends an encrypted response to an interrogation. Method of use
1. Specialized probe scans chip. Obtains serial number of chip.
2. Specialized probe sends serial number information to centralized server.
3. Centralized server sends back to probe query string.
4. Probe passes onto chip, the query string.
5. Chip sends back encrypted response to query string.
6. Probe passes back to centralized server, encrypted chip response.
7. Centralized server sends back to probe "good" or "bad" results.
Notice that the encryption key may be unique for each chip. The keys are known by the centralized server, but don't need to be known by anything else.
In order to create a counterfeit, the attacker needs to do one of two things.
1. Duplicate an existing chip to include the serial number and encryption key.
2. Create a new chip with a new serial number and encryption key and implant that serial number and key into the database maintained by the centralized server.
If an attacker is capable of compromising the central server, then it's game over. But the assumption is that is a "hard task". So the security is likely to be aimed at protecting the encryption key for each chip. Perhaps store the key in TLC Nand and arrange for the value to be corrupted if it's exposed to light (and of course, encapsulate the chip in an opaque material).
So when you manufacture a "non-counterfeit" component, you
1. Manufacture component.
2. Glue a chip to the component.
3. Register the chip with the centralized server.
To verify that a component isn't a counterfeit.
1. Scan for chip and do the entire song and dance to verify the chip.
The key words here are "PER UNIT".
I expect you know very well that just about all software costs less than a penny per unit to deliver into the hands of customers.
As I recall, in 2002 the Oxford Semiconductor OXFW911 Firewire/IDE storage bridge chip cost eight bucks apiece, when purchased in quantity. It was a little small than a dime.
For eight bucks, you got a 32-bit ARM7TDMI microprocessor, 64 kB of Flash for your firmware, 1800 bytes (yes, really: BYTES) of RAM, an IDE core for talking to your disk drive, a Firewire link-layer core (for talking the logical 1394A protocol), and a serial UART that was thrown in just for grins.
Now that was in 2002. What would that same chip cost now, if it were designed and manufactured today? Probably about ten cents.
However I expect the logic diagram, the physical design of the chip - that is, the mask pattern that is printed onto the silicon wafer - the verification of the design before manufacturing, a few rounds of bad silicon and design revision, cost tens of millions of dollars.
So in reality, it is quite possible that DARPA, or one of its contractors, could blow a billion dollars on the design of a chip, that when actually cast into silicon was a very small chip. The price of manufacturing just one chip is, for the most part, it's "real estate". That is, the physical area, like one square centimetre.
The wholesale price of the chip is then determined for the most part by how many you make. There are HUGE economies of scale in silicon manufacturing.
Please mail me URLs of software employers.
Actually that is precisely what the US Federal Occupational Safety and Health Administration is for.
Perhaps money changed hands.
Please mail me URLs of software employers.
Increased awareness, new federal laws holding manufacturers responsible for meeting the marking of their items, etc. I suspect it's still a problem though, just not as widespread as it once was. There is a good pdf guide from the gov on counterfeit bolts and other hardware items (I love the completely cosmetic gas cutoff valve on pg. 32)
I browse on +1 so AC's need not respond, I won't see it.
What the fuck is a dod?
That's what everyone will be saying if the draft budget is passed.
The summary and the article state that these counterfeit parts are so dangerous. Can anybody provide examples of harm done? And not just to somebody's bank account? I'm not saying I disagree, but if you tell me I should be afraid, at least point to examples of why I should be afraid.
What we really need to do is end the scourge of faggotry. If we cannot protect men's anuses from being penetrated by erect penises then nobody is safe. Let's end the scourge of faggotry now!
this should never have happened. He should have been wearing redundant safety gear so that no matter what failed, he would have been safe.
Ahh, yes, the belt-and-suspenders approach. Which, although over-engineered to avoid the embarrasment of your pants falling down to expose your undershorts (or worse!), completely fails to protect against an inadvertently-left-unzipped fly.
If you want something done right, do it yourself...
Fuck it if things get more expensive, that's the price you pay for the knowledge how it was made.