But would be curious to get your take on for example the work of Yang & Sylvester from UMich?
The basic experiment is eg. a plausible lithographic error can produce an inter-bus capacitance, which can be charged by an extremely specific sequence of unprivileged ASM instructions. When sufficiently charged it will set a single bit in a target register to perform malicious functionality.
Such supply chain corruption could be achieved via a second statistically plausible binning error for example. And would be virtually immune to detection by digital benchmarking etc.
Even at wafer level inspection it would be difficult to spot, let alone assign malicious intent without considerable allocation of resources.
IMO the point here isn’t to focus on a single attack, but rather to recognise the inherent & probably endless arms race.
IMO the point here isn’t to focus on a single attack, but rather to recognise the inherent & probably endless arms race.
True.
statistically plausible binning error
Plausible, yes. Feasible? I don’t know about that. These things often work well in laboratory environments and don’t scale to “the outside”. There are easier ways to get information out of a system, e.g. software 0days.
Yes that is true and i did have similar thoughts, for example getting a precisely stable control over eg. activation frequency while maintaining a plausible litho mask error could be tricky to make it reproducible.
On the other hand, the previously mentioned research was from a relatively small team - whereas a very well resourced team could likely produce something robust and ready for real-world. Though perhaps would likely need to be more targeted rather than a shotgun approach attack.
In any case I only started down this topic of discussion since i saw the opportunity to talk about hardware implants (which is fun to discuss), but probably doesn’t so much suit the news article in the op for the FUD-type reasons you mentioned.
Thanks for the info.
Don’t want to add to any unfounded FUD.
But would be curious to get your take on for example the work of Yang & Sylvester from UMich?
The basic experiment is eg. a plausible lithographic error can produce an inter-bus capacitance, which can be charged by an extremely specific sequence of unprivileged ASM instructions. When sufficiently charged it will set a single bit in a target register to perform malicious functionality.
Such supply chain corruption could be achieved via a second statistically plausible binning error for example. And would be virtually immune to detection by digital benchmarking etc.
Even at wafer level inspection it would be difficult to spot, let alone assign malicious intent without considerable allocation of resources.
IMO the point here isn’t to focus on a single attack, but rather to recognise the inherent & probably endless arms race.
True.
Plausible, yes. Feasible? I don’t know about that. These things often work well in laboratory environments and don’t scale to “the outside”. There are easier ways to get information out of a system, e.g. software 0days.
Yes that is true and i did have similar thoughts, for example getting a precisely stable control over eg. activation frequency while maintaining a plausible litho mask error could be tricky to make it reproducible.
On the other hand, the previously mentioned research was from a relatively small team - whereas a very well resourced team could likely produce something robust and ready for real-world. Though perhaps would likely need to be more targeted rather than a shotgun approach attack.
In any case I only started down this topic of discussion since i saw the opportunity to talk about hardware implants (which is fun to discuss), but probably doesn’t so much suit the news article in the op for the FUD-type reasons you mentioned.