36C3: Open Source is Insufficient to Solve Trust Problems in Hardware

-

With open source software, we’ve grown accustomed to a certain level of trust that whatever we are running on our computers is what we expect it to actually be. Thanks to hashing and public key signatures in various parts in the development and deployment cycle, it’s hard for a third party to modify source code or executables without us being easily able to spot it, even if it travels through untrustworthy channels.

Unfortunately, when it comes to open source hardware, the number of steps and parties involved that are out of our control until we have a final product — production, logistics, distribution, even the customer — makes it substantially more difficult to achieve the same peace of mind. To make things worse, to actually validate the hardware on chip level, you’d ultimately have to destroy it.

On his talk this year at the 36C3, [bunnie] showed a detailed insight of several attack vectors we could face during manufacturing. Skipping the obvious ones like adding or substituting components, he’s focusing on highly ambitious and hard to detect modifications inside an IC’s package with wirebonded or through-silicon via (TSV) implants, down to modifying the netlist or mask of the integrated circuit itself. And these aren’t any theoretical or “what if” scenarios, but actual possible options — of course, some of them come with a certain price tag, but in the end, with the right motivation, money is only a detail.

Sure, none of this is particularly feasible or even much of interest at all for a blinking LED project, but considering how more and more open source hardware projects emerge to replace fully proprietary components, especially with a major focus on privacy, a lack of trust in the hardware involved along the way is surely worrying to say the least. At this point, there is no perfect solution in sight, but FPGAs might just be the next best thing, and the next part of the talk is presenting the Betrusted prototype that [bunnie] is working on together with [xobs] and [Tom Marble]. That alone makes the talk worth watching, in our view.



from CommaFeed - Real Time Trends Network https://ift.tt/39xFgZA
via IFTTT

Comments

Post a Comment

Popular posts from this blog

Takeaways from the outcry over Dior’s Johnny Depp perfume ad: Tuesday Wake-Up Call

-
Welcome to Ad Age’s Wake-Up Call, our daily roundup of advertising, marketing, media and digital news. You can sign up to get an audio version of this briefing on your Alexa device. Dior pulls a perfume ad starring Johnny Depp Yet another luxury brand just had to backtrack after a culturally insensitive move. Dior on Friday pulled an ad for its “Sauvage” perfume, as Business of Fashion reports ; the spot starred Johnny Depp playing guitar in the desert while a Native American dancer, Canku One Star, performed in traditional dress. The company portrayed the spot as “an authentic journey deep into the Native American soul.” But the brand was quickly accused of cultural appropriation. Critics seemed most troubled by the juxtaposition of Native American imagery with the word "Sauvage"—which means “wild” in French, but which also evokes the history of labeling indigenous groups as “savages.”  LVMH-owned Parfums Christian Dior had apparently tried to proceed cautiously. It coo
Read more

When the coronavirus infodemic strikes

-
Image
Social media sites are stepping up their efforts in the war against misinformation… specifically, the coronavirus/COVID-19 infodemic . There’s a seemingly endless stream of potentially dangerous misinformation flying around online related to the COVID-19 pandemic, and that could have fatal results. It’s boomtown in fake-news land riding high on the wave of people being left with their tech devices 24/7. I myself regularly see everything posted online from “hand gel is an immunizer” (nope) and “children can’t be affected” (not true) to “UK rules mean domestic abuse survivors have to stay with their abusive spouse” (absolutely not true at all and hugely dangerous to claim).  We even have engineers being spat on thanks to 5G conspiracy theories potentially resulting in transmission of coronavirus . Turns out a global pandemic is a lightning rod for pushing people to conspiracy theories galore, to the extent that some folks have to go hunting for guides to wean their family members a
Read more

Patch, Or Your Solid State Drives Roll Over And Die

-
Image
Expiration dates for computer drives? That’s what a line of HP solid-state drives are facing as the variable for their uptime counter is running out. When it does, the drive “expires” and, well, no more data storage for you! There are a series of stages in the evolution of a software developer as they master their art, and one of those stages comes in understanding that while they may have a handle on the abstracted world presented by their development environment they perhaps haven’t considered the moments in which the real computer that lives behind it intrudes. Think of the first time you saw an SQL injection attack on a website, for example, or the moment you realised that a variable type is linked to the physical constraints of the number of memory locations it has reserved for it. So people who write software surround themselves with an armoury of things they watch out for as they code, and thus endeavour to produce software less likely to break. Firmly in that arena is the size
Read more