Slashdot Mirror
NSF Awards $10 Million To Protect America's Processors
aarondubrow writes "The National Science Foundation and the Semiconductor Research Corporation announced nine research awards to 10 universities totaling nearly $4 million under a joint program focused on secure, trustworthy, assured and resilient semiconductors and systems. The awards support the development of new strategies, methods and tools at the circuit, architecture and system levels, to decrease the likelihood of unintended behavior or access; increase resistance and resilience to tampering; and improve the ability to provide authentication throughout the supply chain and in the field. "The processes and tools used to design and manufacture semiconductors ensure that the resulting product does what it is supposed to do. However, a key question that must also be addressed is whether the product does anything else, such as behaving in ways that are unintended or malicious," said Keith Marzullo, division director of NSF's Computer and Network Systems Division.
http://redmondmag.com/articles...
Make of these what you will.
If you keep throwing chairs, one day you'll break windows....
Conversely it can be done in the US by 1H-B visa holders from India.
Or it could be done by IBM in Zurich or India. If IBM gets a piece of the action, it could be done anywhere. Remember, they no longer report employment by country, so no matter where they say the work was done, big chunks of it cold be done anywhere on the planet.
Remember that Zuckerberg and Microsoft are threatening to move to Canada because the US only produces second rate computer talent, so clearly there is no one in the US capable of doing the job right. (Look up the recent Slashdot post about this, I'm too lazy.)
I know that the money is actually going to universities, not corporations. I'm just pulling your leg. Even so, given the ties between academic institutions and big corporations, who knows where the data from this will end up, or who will have input into the process. Inquiring minds want to know...
Why is Snark Required?
Is in outsourcing.... nothing bad can happen if you have everything made in China....
Do not look at laser with remaining good eye.
We probably have to assume all chips have Chinese or NSA backdoors. Choose your poison.
See his blog post on the War on General Computing. (warning: video lasts more than five minutes, but it is worth seeing.)
Just another "build me a device that can do anything, except for (<insert feature here>)" action.
Nae king! Nae laird! Nae yurrupiean pressedent! We willna be fooled again!
easy facebook profits review https://www.youtube.com/watch?...
$ Torproject Blog Announcement:
https://blog.torproject.org/bl...
$ TAILS News Announcement:
https://tails.boum.org/news/ve...
$ TAILS Download Site:
https://tails.boum.org/downloa...
#
"TAILS, The Amnesic Incognito Live System, version 1.1.2, is out.
This release fixes numerous security issues[1] and all users must upgrade[2] as soon as possible.
We prepared this release mainly to fix a serious flaw[3] in the Network Security Services (NSS) library used by Firefox and other products allows attackers to create forged RSA certificates.
Before this release, users on a compromised network could be directed to sites using a fraudulent certificate and mistake them for legitimate sites. This could deceive them into revealing personal information such as usernames and passwords. It may also deceive users into downloading malware if they believe itâ(TM)s coming from a trusted site.
( Changes )
-- Notable user-visible changes include:
- Security fixes
- Upgrade the web browser to 24.8.0esr-0+tails3~bpo70+1
- Install Linux 3.16-1
- Numerous other software upgrades that fix security issues: GnuPG, APT, DBus, Bash, and packages built from the bind9 and libav source packages
See the online Changelog[4] for technical details."
[1] https://tails.boum.org/securit...
[2] https://tails.boum.org/doc/fir...
[3] https://blog.mozilla.org/secur...
[4] https://git-tails.immerda.ch/t...
#
-((( Direct download )))-
( Latest release: Tails 1.1.2 ISO image )
http://dl.amnesia.boum.org/tai...
( Cryptographic Signature - Tails 1.1.2 signature )
https://tails.boum.org/torrent...
( SHA256 checksum for ISO )
f8a15f7c63662815a7087d36e1f614c9382675dd2424c2cd336aca6b72203ea2
#
-((( BitTorrent download )))-
( Latest release: Tails 1.1.2 torrent )
https://tails.boum.org/torrent...
"The cryptographic signature of the ISO image is also included in the Torrent. Additionally, you can verify the signature of the Torrent file itself before downloading it."
( Cryptographic Signature: )
https://tails.boum.org/torrent...
"However, a key question that must also be addressed is whether the product does anything else, such as behaving in ways that are unintended or malicious,"
Like "off label" usage of prescriptions, using a frozen leg of lamb as a murder weapon, or spending money to fund all things evil and destructive? My point is that a product can and will do anything else, such as behaving in ways that people decide and control, be it malicious or mundane. Nobel invented dynamite, should he get his own prize for breakthroughs in bank vaults? This really sounds like a load of toad.
Face it, friends. We're pwnz0rs.
A short calculation:
$4m in funding
- 50% of overhead (overhead varies between 40% and 67%)
= $2m of effective funding
This is available for at least 10 professors (though it's for sure more than 1 professor per institution), thus, it's $200,000 per university team. From this you have to remove summer salaries for each year for the professor(s), so it' maybe $140k-$160k. Running for 3 years, this means funding for 10 students at most across all projects.
Read a little further down in the article and you'll see that NSF allocated $73 for cybersecurity alone. Now that's a number that already gets more things moving. But $4m in the current system with overheads, summer salaries, and project meetings is nothing.
Why do we need the State Science Institute telling us that we need better control over the processor supply chain? Companies for whom this is important will implement it, and the rest won't. It's a self-correcting problem. And 10 million? If you're going to go out and nationalize the production of processors that's chump change, do it right, at least.
I want to delete my account but Slashdot doesn't allow it.
I remember watching some show on a river in Africa that never makes it to the coast. Every spring it starts as a rushing torrent, but as the thaw ends and the water spreads out it evaporates and sinks into the land, leaving a huge inland river delta.
On can construct a similar imaginary money river for this story. $10 million? It will never see hardware, that money will disappear into the bureaucracy like water into the African plains.
To put this in perspective, $10 million is what, one hour of iPhone sales? That's how important the NSF considers this?
Does four million get even one item on this list?
(from the article)
Combating integrated circuit counterfeiting using secure chip odometers--Carnegie Mellon University
Intellectual Property (IP) Trust-A comprehensive framework for IP integrity validation--Case Western Reserve University and University of Florida
Design of low-cost, memory-based security primitives and techniques for high-volume products--University of Connecticut
Trojan detection and diagnosis in mixed-signal systems using on-the-fly learned, pre-computed and side channel tests--Georgia Institute of Technology
Metric and CAD for differential power analysis (DPA) resistance--Iowa State University
Design of secure and anti-counterfeit integrated circuits--University of Minnesota
Hardware authentication through high-capacity, physical unclonable functions (PUF)-based secret key generation and lattice coding--University of Texas at Austin
Fault-attack awareness using microprocessor enhancements--Virginia Tec
Invariant carrying machine for hardware assurance--Northwestern University
So of course this whole project will need to attract international support from all those other governments grateful that the US role protects the integrity of critical hardware worldwide.
After all, those same governments will probably send their very brightest and most dedicated graduate students and post-docs to the institutions conducting the research.
Maybe they're already supporting it and working on it.
... what with the state of education in the US, not only do we not have people with computer talent, we no longer have computer people capable of hacking.
The good news is that all Americans have been removed from the no-fly list.
The bad news is that we're screwed.
It little behooves the best of us to comment on the rest of us.
One of the first things they are going to research is how to properly add numbers.
Dr. Evil would be proud.
Do you guys realize how minor this money is? Do you know how much research costs? Basically, this is an amount that would run one decent sized lab at a research university for maybe a year. If these are the grants we're crowing about... well, I guess it's a start.
$10M a year for five years might be reasonable to get some traction on the problem. All this will do is fund a few papers which will probably disappear. That grad students and post docs will survive another year, I guess, so that might be good.
That is all.
NSx working against NSx
The emergence and growth of blogs in the late 1990s coincided with the advent of web publishing tools that facilitated the posting of content by non-technical users. (Previously, a knowledge of such technologies as HTML and FTP had been required to publish content on the Web.)
owietlenie biurowe
Monitoring floty
Navision - BLOG
Navision
rachunek zysków i strat
NAVISION financial
How do I know that some microcode hasn't been added to the CPU/GPU I've got plugged into my motherboard? Is there some sort of independant auditing process in place? Not that this would do any good. Customers of components like FPGAs have demanded methods to secure their device code from illicit inspection and copying. And any audit process would be indistinguishable from such inspection. So that isn' going to happen.
If you buy a router, how can you be sure that a back door hasn't been installed, either by the manufacturer or at some point in the unit's transit? And I suspect tht any attempt to secure such a device from tampering by those evil Chinese would trip over NSA requirements to provide exactly the same kind of access.
Have gnu, will travel.
America also pushes the gov. to buy this and help restart the industry.
I prefer the "u" in honour as it seems to be missing these days.
Do the research here then send the details so they can be subverted... Oops I meant manufactured in China. That'll do a lot of good.
You really must have zero concept of how universities do research.
Do you know anything about research funding? These grants are to support graduate research work for a certain amount of time. Most of these things don't *HAVE* hardware as their outcome. Most likely, they are doing theoretical research into algorithms for detecting bugs and protecting hardware that can then be integrated into future hardware. Do you think that universities just spit out 14nm Xeons made by graduate students?
Jesus, this Slashdot discussion is just idiotic. What the hell happened to this place?
there will never be a processor available to the general public that doesn't have a backdoor. now if your a government or corporation with a big and i mean really big wallet... .