Remix.run Logo
stackghost 6 hours ago

> The attack requires physical access, destructive preparation, and approximately $250,000 of laboratory equipment.

Not super practical, but neat attack

mrlambchop 6 hours ago | parent | next [-]

250k is not a bad investment for a company doing "reverse engineering as a service" - say 1k a pop to extract the firmware. Naturally, a good business idea for somewhere in the world with less regulations...

stickfigure 5 hours ago | parent | prev | next [-]

That is peanuts for a nation-state actor.

stackghost 5 hours ago | parent [-]

Sure, but if you’re defending against a nation state actor hopefully you aren’t expecting a raspberry pi to keep you secure.

palmotea 5 hours ago | parent | next [-]

> Sure, but if you’re defending against a nation state actor hopefully you aren’t expecting a raspberry pi to keep you secure.

Is there anything about these techniques that are raspberry pi specific? It seems like they're using lasers to identify and flip particular bits in registers.

bob1029 4 hours ago | parent | next [-]

There are HSMs that are effectively immune to this attack by way of their construction and packaging. You need an optical path to the secure device. The only way to get at this is to tamper with the tamperproof part of the system.

Some very high end HSMs must be actively powered at all times which makes disturbances in their local environments detectable at all times as well. Getting lucky and drilling through a part of the enclosure that isn't directly protected won't help you if a barometric pressure sensor is tripped as a consequence of breaking the hermetic seal.

yndoendo 2 hours ago | parent | next [-]

It sounds like a more cleaner method to obtain the keys versus using solvents and a lot of trial and error hardware. As described by Chris Gerlinsky with "How Do I Crack Satellite and Cable Pay TV?" [0] [1]

[0] https://simkl.com/tv/33956/chaos-communication-congress/seas...

[1] https://media.ccc.de/v/33c3-8127-how_do_i_crack_satellite_an...

palmotea 4 hours ago | parent | prev | next [-]

> Getting lucky and drilling through a part of the enclosure that isn't directly protected won't help you if a barometric pressure sensor is tripped as a consequence of breaking the hermetic seal.

That's interesting. I suppose if that technology is in use, the attack would have to occur in a pressure-controlled chamber, so breaking the seal wouldn't cause a change in pressure.

MayeulC 4 hours ago | parent | next [-]

A more likely measure, which I recall seeing years ago, is to measure the impedance of the enclosure of the thing you want to protect. If someone tampers with it, you would be alerted. It works at many scales, from a protective metal mesh over your IC to a PC case.

rcxdude 4 hours ago | parent | prev [-]

And you'd need to have a way to know what the pressure inside is beforehand.

overfeed 3 hours ago | parent [-]

You can find the pressure through destructive trial-and-error if money is no object - which it isn't for governments when the target hardware is juicy.

pixl97 22 minutes ago | parent [-]

Really sounds very very easy for any lab that can measure molecular levels of gas.

Even a very sensitive pressure checker in a temp controlled sealed box would do it.

stickfigure 3 hours ago | parent | prev | next [-]

Are any of these tamper-proof chips in my phone or laptop?

throwaway81523 2 hours ago | parent [-]

I expect typical smart cards like the one in your credit card are harder to crack than the raspberry pi was. Those cards are (or were) also used in TV set-top boxes and back in the day, there was a decades-long arms race between the chip makers and cable TV pirates. The TV pirates were also willing to make large expenditures to crack the chips so they could clone them and sell the clones. There's more about this in Ross Anderson's book "Security Engineering".

ironqcold an hour ago | parent [-]

I’m actually curious now. Thanks, you’ve given me something to do this evening.

EvanAnderson 3 hours ago | parent | prev [-]

> You need an optical path to the secure device.

Any path can be made into an optical path with a bright enough light. >smile<

2 hours ago | parent | prev [-]
[deleted]
ssl-3 5 hours ago | parent | prev [-]

The RP2350 is an inexpensive microcontroller IC with reasonable performance and some very useful (and somewhat unusual) features in its PIO blocks.

Why wouldn't a person build that into the heart of something important?

sephamorr 5 hours ago | parent | next [-]

"Important" and "tamper proof against a determined adversary" are very different goals.

jacquesm 2 hours ago | parent [-]

Tamper proof against a determined adversary starts at 'call us' not at '$10'.

alnwlsn 3 hours ago | parent | prev | next [-]

Depending on what sort of important you're talking, those ICs don't have the usual "something important" environmental specs, like an extended temperature range, or certification for automotive use or safety critical applications, for one thing.

stackghost 4 hours ago | parent | prev [-]

>Why wouldn't a person build that into the heart of something important?

Because it's inexpensive and not designed to be tamper-resistant. If preventing this type of thing is your goal there are chips out there designed to break irrepairably if tampered with.

rcxdude 4 hours ago | parent [-]

Rp2350s are advertised as having quite a few anti-tamper functions. They had a bounty when it launched to find similar vulnerabilities and they worked to patch the ones that were found. This is a lot more credible than a lot of advertised anti-tamper features.

_trampeltier 6 hours ago | parent | prev | next [-]

Some people have such and other toys just at work and can use it in spare time.

paulnpace 6 hours ago | parent | prev | next [-]

> $250,000 of laboratory equipment

*currently

stavros 5 hours ago | parent [-]

$300,000 next year.

TeMPOraL 5 hours ago | parent | next [-]

In 5 years, either $400,000 or $50 and a hammer, depending on whether the core piece of the process aligns with the needs of some fast-growing consumer tech product like e.g. drones.

dist-epoch 4 hours ago | parent [-]

I think GP was making a joke about RAM prices. Makes me wonder what is the effect of the RAMpocalypse on drone prices.

TeMPOraL 3 hours ago | parent [-]

Maybe.

I was referencing my own realization earlier today, when I was wondering if I can DYI a ground-penetrating radar to scan the allotment garden for hidden "surprises". A ground-penetrating radar is something I learned about as a kid watching a popular science videotape, back then a stupidly expensive high-tech piece of professional equipment.

But it hit me that there are two main forces keeping such technologies stupidly expensive and inaccessible to general public over time: costs of knowledge that went into their design (protected by patents and trade secrets), and specialized parts made in unique way or from unique materials, that don't happen to have alternate applications.

Nowadays, knowledge is not an issue - 20+ years is enough for all the relevant patents to expire, and information to have seeped through to the Internet, available in a combination of Wikipedia articles, textbooks, scientific papers, and blogs, plus we have good LLMs more than happy to synthesize that and transform into a DIY tutorial for dummies.

Which leaves the parts. Whether or not you can DIY such a tech really hinges on whether you can find the critical components somewhere. If they're still unique, you're paying $$$ for procurement (and it makes more sense to try and score broken/used equipment off eBay or something). But there's a chance there's a close equivalent that's part of mass consumer or prosumer device, at which point you just buy it and strip it for parts.

(Which way it is with ground-penetrating radars? Don't know, didn't bother to prompt an LLM with that question yet.)

MadnessASAP 35 minutes ago | parent | next [-]

Radar is cheap now, thanks to semiconductors getting smaller and faster the analog front-end which used to be a long expensive chain of components is now much smaller, the ADC is now faster, more accurate, and cheaper, the processor is now fast enough to keep up with a higher bandwidth signal. You could probably drive a very rough radar system directly off a Pico's GPIO and ADC, maybe toss in a decently fast op-amp for a receive amplifier.

Where you will run into issues is processing radar signals into usable data. If you're happy with the results that radar was giving 30 years ago then it's fine and dandy, but the magic of modern radar is in the software, not the hardware.

dist-epoch 2 hours ago | parent | prev [-]

[dead]

k12sosse 5 hours ago | parent | prev [-]

We're already up to 400,000 just today.

TZubiri 5 hours ago | parent | prev [-]

It reads as impressive defense. Meaning that it's presumably not possible to get root with physical access on a live 50$ device without 250k capital

Rohansi 5 hours ago | parent [-]

This is for a $1 microcontroller. I'm assuming you're talking about the Raspberry Pi computers based on the $50 cost and root.