11–19 of 19 posts
Earlier quoted context omitted.
I'd love to have this verified but I don't think #3 is applicable because SPI is push-pull and not open collector. If you think this writing is feeding FUD do you believe the demo is fake?
The demo shown in the talk was in an emulator, I have no doubt that he actually added his script into the filesystem in the emulation.
I think I found some flaws with this, now I think I am rather experienced but I haven't seen everything. 1) He didn't demonstrate it in real hardware without outside power and ground, while he says an arm core is very small, capacitors are large unless you change the laws of physics. Also I never saw a reliable clock generator the size of a 0402 (or even 1208 now that I think about it) passive. Like I said I haven't…
He didn't demonstrate it in real hardware without outside power and ground Are you sure about this? The writeup says (emphasis added): --- My FPGA proof of concept implant is a little larger than the passive resistor component we would want to hide it in, although that is not a significant limitation. Thanks to Moore's Law, an entire ARM Cortex M0+ CPU could fit in the space used by two transistors on the 6502 CPU".…
That would be pretty cool to see demoed itself. As he states we have RFID CPUs that can work with fantastically small amounts of power only from their antennas.
Earlier quoted context omitted.
The demo shown in the talk was in an emulator, I have no doubt that he actually added his script into the filesystem in the emulation.
For the demo its in an emulator but he says the real version works 1 in 8 or 1 in 80 times. Is he lying?
I think I found some flaws with this, now I think I am rather experienced but I haven't seen everything. 1) He didn't demonstrate it in real hardware without outside power and ground, while he says an arm core is very small, capacitors are large unless you change the laws of physics. Also I never saw a reliable clock generator the size of a 0402 (or even 1208 now that I think about it) passive. Like I said I haven't…
1) One could feasibly wire to nearby power/ground, although that would certainly be more obvious. The clock for this is ~17 MHz (I believe), so one can certainly achieve 'good enough' with a microcontroller's internal clock. 2) While that is an obvious countermeasure, it's one nobody is currently taking (judging by the large block of 1's in the SPI flash chip he read from the server). 3) You're thinking of a protocol…
What are the economic forces behind this, and would it be feasible to change this state of affairs?
Earlier quoted context omitted.
He didn't demonstrate it in real hardware without outside power and ground Are you sure about this? The writeup says (emphasis added): --- My FPGA proof of concept implant is a little larger than the passive resistor component we would want to hide it in, although that is not a significant limitation. Thanks to Moore's Law, an entire ARM Cortex M0+ CPU could fit in the space used by two transistors on the 6502 CPU".…
I think his demo POC had outside power and ground. He believes the actual implant was powered parasitically from the SPI's bus current. That would be pretty cool to see demoed itself. As he states we have RFID CPUs that can work with fantastically small amounts of power only from their antennas.
I would hope this is not the case. If it was, I don't see how it can be legitimately called a hardware proof-of-concept. I agree, though, that the lack of outside power and ground doesn't seem to be explicitly stated in the writeup. The video comes a little closer, with one of the questions after the talk asking whether using more pins would make things easier: (from the automatic transcript of https://youtu.be/C7H3V7tkxeA?t=1868, punctuation added and some typos corrected):
"But do you see a way to actually get more power into your setup, maybe using other power sources other than the two pins?"
"So the question is about would there be some way to do more arbitrary changes through redesigning the implant? One of the goals was to fit with only those two pins so that a single piece on the motherboard could be replaced. You know, with a dual probe soldering iron you can pop it out and stick a new one down in a matter of seconds. So yes, if you have more pins where you can get more power from you can do much more interesting things, but that would require a different set of changes to the motherboard."
I'm pretty sure the author is claiming that their FPGA implant was working off of just two pins on the motherboard. If they are relying on some technicality (such as "all the other pins are from a source other than the motherboard") this would make me write off the entire article as untrustworthy. But until there is proof to the contrary, I'm inclined to believe that they used no outside power or ground, and that they indeed built a hardware POC.
Edit: I sent email to the author asking for clarification.
Earlier quoted context omitted.
I think his demo POC had outside power and ground. He believes the actual implant was powered parasitically from the SPI's bus current. That would be pretty cool to see demoed itself. As he states we have RFID CPUs that can work with fantastically small amounts of power only from their antennas.
I think his demo POC had outside power and ground. I would hope this is not the case. If it was, I don't see how it can be legitimately called a hardware proof-of-concept. I agree, though, that the lack of outside power and ground doesn't seem to be explicitly stated in the writeup. The video comes a little closer, with one of the questions after the talk asking whether using more pins would make things easier: (from…
Did he prove that B) he can do it in the footprint of a surface mount resistor? No. His information on how small uCs can be is supposed to support that.
Did he prove that C) the implant can do it _with only one wire_ going to it with no power and ground? No. He makes references to RFID CPUs to show that it should be possible to power it parasitically.
Does not doing B or C invalidate A and make the whole A, B, C implant impossible? I don't think so.
I would really like to see a POC for C though. That would be super interesting to me. That would be the next logical step for this or another researcher.
I think I found some flaws with this, now I think I am rather experienced but I haven't seen everything. 1) He didn't demonstrate it in real hardware without outside power and ground, while he says an arm core is very small, capacitors are large unless you change the laws of physics. Also I never saw a reliable clock generator the size of a 0402 (or even 1208 now that I think about it) passive. Like I said I haven't…
You don't need a very accurate clock (quartz) for ~100 Mhz SPI. A ring oscillator is just a chain of inverters. If you want to match the bus frequency accurately you can train a PLL against the signal clock.
Not sure what the point is about the pullup, to flip the bit you need only to overpower the output buffers of the other chip.
Cramming it all in a 0402 would be a stretch but I could see it being possible with the right resources. Having only 2 pins would be pretty useless if you can't snoop the address though. And modern NOR devices on a motherboard is almost certainly using the high speed 4 pin serial interface rather than standard SPI.