Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Backdoor found in a China-made US military chip

cl.cam.ac.uk

Post reply on HN
Print view View original

101–110 of 159 posts

Re: Backdoor found in a China-made US military chip

#101

Post by knowaveragejoe »

lukeschlather wrote: post #89
aiscott wrote: post #86

Earlier quoted context omitted.

I simply do not believe one could find a "back door" looking at a chip in a SEM. It sounds to me like you are describing destructive physical analysis whose purpose is to make sure requisite manufacturing practices are being followed.

The way I read that is that they make the designs and look for circuitry that does not match the designs, which is presumed to be backdoors. I would think that defects and intentional backdoors would both be findable on an SEM. Do you think otherwise? I don't have a ton of experience with bare silicon, so I'd be interested to know if that's unreasonable.

Even then - the manufacturer could supply design documents that surreptitiously include backdoors... there's simply so much to look at when it comes to actual circuit schematics, I can't see how anyone would spot "backdoor" circuitry amongst everything else that is presumably legitimate. I don't know much about silicon, so maybe I'm wrong.

Re: Backdoor found in a China-made US military chip

#102

Post by knowaveragejoe »

aiscott wrote: post #100
lukeschlather wrote: post #89

Earlier quoted context omitted.

The way I read that is that they make the designs and look for circuitry that does not match the designs, which is presumed to be backdoors. I would think that defects and intentional backdoors would both be findable on an SEM. Do you think otherwise? I don't have a ton of experience with bare silicon, so I'd be interested to know if that's unreasonable.

I do think it is unreasonable. With a SEM you only get to look at the surface of things, which is going to be either glass or metal or polysilicon. The only way to see a transistor in a sem is if you chemically remove all the top layers (which are the connections between transistors), or perform a cross section. In the cross section case you are going to see a few dozen transistors out of the millions in a design of…

This. You've articulated the complexity of looking at circuitry schematics for backdoors better than I ever could.

Re: Backdoor found in a China-made US military chip

#103

Post by mng2 »

coopdog wrote: post #81
laughinghan wrote: post #65

Earlier quoted context omitted.

"Currently there is no economical or timely way of ascertaining if a manufacturer's specifications have been altered during the manufacturing process (99% of chips are manufactured in China)," That claim about 99% of chips being manufactured in China is very easy to verify as being utterly false. I have to wonder about the trustworthiness of the rest. - kryptiskt, http://news.ycombinator.com/item?id=4030818 It has ac…

Does Taiwan count as part of China? A brief look at the Taiwan-China relationship shows it's a more difficult question than it initially seems

According to China (the People's Republic of China), Taiwan (the Republic Of China) is a "renegade province." Both the PRC and the ROC claim that they are the legitimate government of China. In the US, ever since Nixon instituted the "two China" policy, China is always taken to mean the PRC. Perhaps the security researchers are not aware of this distinction, but I am also not familiar with how the issue is treated in the British press.

Taiwan is a major US ally, so if this backdoor is real, then there will be trouble. It would be best for all parties involved for this to turn out to be a false alarm.

Re: Backdoor found in a China-made US military chip

#105

Post by codgercoder »

I reacted the same way to this news as to the news that an electrical distribution system was compromised over the Internet. That is, "are you kidding me?!". Just as it's stupid to connect certain critical systems to the public Internet, it's really silly to so loosely control military electronics sourcing.

Re: Backdoor found in a China-made US military chip

#107

Post by InclinedPlane »

dantiberian wrote: post #94
ChuckMcM wrote: post #70

Interesting discussion. Some denial, some tin hat, some contemplative. I think I've had all of those emotions with this sort of thing. There are diagnostics in our network switches that allow for traffic to be replicated and sent to other ports with a different destination mac (this isn't port mirroring is more like port re-directing). Clearly in the hands of a bad guy they might set up a machine on the LAN to get a…

To clarify for people reading, IOS is the name of Cisco's operating system for their router's and network switches. Apple licensed the trademark from Cisco when they switched the naming of their mobile operating system. http://blogs.cisco.com/news/cisco_and_apple_agreement_on_ios...

Confusingly, IBM's mainframes run on the "i" operating system.

Re: Backdoor found in a China-made US military chip

#108

Post by JL2010 »

dhx wrote: post #83
raphman wrote: post #22

The chip in question seems to be an Actel Microsemi ProASIC3 (PA3) [1,2], given the hints in the screenshot of the paper. [1] http://www.actel.com/products/pa3/ [2] http://www.actel.com/documents/pa3_faq.html (I guess there is no real advantage in keeping this obscured)

I see no mention of tamper-resistance/self-destruct features? Power glitch detection, mechanisms to detect decapping/stripping, wire mesh shielding, protection against ultra-violet laser stimulation of transistors, ... are all important. For those interested in further reading, Security Engineering[1] by Ross Anderson contains a section on chip security. Another paper[2] by Ross Anderson and Markus Kuhn (1996) provid…

"Unlike SRAM-based FPGAs or conventional ASIC solutions, ProASIC3/E devices offer one of the highest levels of design security in the industry. In fact, ProASIC3/E devices bring new levels of security to the FPGA market place. An FPGA industry first, secure ISP is performed using the industry-standard 128- bit AES block cipher algorithm. Reprogramming can be securely performed in-system to support future design iterations and field upgrades with peace of mind that valuable IP cannot be compromised or copied." ISP stands for in-system-programming

Re: Backdoor found in a China-made US military chip

#109

Post by derleth »

InclinedPlane wrote: post #107
dantiberian wrote: post #94

Earlier quoted context omitted.

To clarify for people reading, IOS is the name of Cisco's operating system for their router's and network switches. Apple licensed the trademark from Cisco when they switched the naming of their mobile operating system. http://blogs.cisco.com/news/cisco_and_apple_agreement_on_ios...

Confusingly, IBM's mainframes run on the "i" operating system.

i series aren't mainframes, they're midrange, the replacement for the AS/400 platform. Mainframe stuff is z series, a replacement for the System/390 line.

Re: Backdoor found in a China-made US military chip

#110

Post by kwantam »

aiscott wrote: post #86
gouranga wrote: post #23

The bit that surprises the fuck out of me is that they're buying stuff in from China. I've never seen that - ever! They would buy expensive stuff fabbed specially in the US rather than import usually. I did a lot of work for the UK Ministry of Defence and the US Department of Defence over the years on custom silicon and FPGA work and the paranoia factor is scary. We had the layouts of everything bought in - even 74-s…

I simply do not believe one could find a "back door" looking at a chip in a SEM. It sounds to me like you are describing destructive physical analysis whose purpose is to make sure requisite manufacturing practices are being followed.

There are companies that specialize in reverse engineering schematics from silicon. It's entirely possible (albeit relatively expensive and time-consuming compared to good old-fashioned industrial espionage) to recover schematics from silicon.

Have a look at this video from ChipWorks http://www.youtube.com/watch?v=Il5sTZKBLO0

See the schematics? They've created those from scratch by deconstructing the chip. (I can say with certainty that this is the case because I'm familiar with the original schematics for this part. The ChipWorks ones are much neater!)

Doing this for a larger, all-digital chip is substantially the same. In that case you can probably step up from identifying individual transistors and identify the standard cells directly, since they tend to have distinctive-looking gate structures.

Post reply on HN