Feeds

'Tamper evident' CPU warns of malicious backdoors

Like shrink wrap for your microprocessor

5 things you didn’t know about cloud backup

Scientists have devised a chip design to ensure microprocessors haven't been surreptitiously equipped with malicious backdoors that could be used to siphon sensitive information or receive instructions from adversaries.

The on-chip engines at the heart of these "tamper evident microprocessors" are the computer equivalent of cellophane shrink wrap or aluminum seals that flag food or drug packages that have been opened by someone other than the consumer. They're designed to monitor operations flowing through a CPU for signs its microcode has been altered by malicious insiders during the design cycle.

The design, to be made public this next week at the 31st IEEE Symposium on Security & Privacy, comes as an investigation by Engineering & Technology magazine reported that at least five percent of the global electronics supply chain includes counterfeit elements that could "cause critical failure or can put an individual's data at risk," according to The Inquirer. While most of that appears to be coming from grey-market profiteers, analysts have long fretted that bogus routers and microprocessors could pose a threat to national security.

"The root of trust in all software systems rests on microprocessors because all software is executed by a microprocessor," the scientists, from Columbia University's computer science department, wrote in their paper describing the design. "If the microprocessor cannot be trusted, no security guarantees can be provided by the system."

At the heart of their proposal are two engines hardwired into a processor that continuously monitor chip communications for anomalies. One of the engines, dubbed TrustNet, sends an alert whenever a unit executes more or fewer instructions than is expected. A second, called DataWatch, watches chip data for signs the CPU has been maliciously modified.

The engines are built to detect a variety of potential threats such as emitter backdoors, which typically append instructions to a processor's normal batch of communications so that data is copied to "shadow addresses" that can later be accessed by the attackers. They're also built to flag corrupter backdoors that subtly alter microarchitectural operations.

The defenses are premised on the assumption that the backdoors would be installed by insiders working in a single sub-unit of a design team. While a well-funded nation state could afford to buy out an entire team, the more likely scenario is that adversaries would be much more limited, the researchers said. The insiders would add the hidden instructions during the RTL, or register transfer level, phase of design, which involves writing the microcode that controls a chip's functions.

The scientists demonstrated the design on a simplified OpenSPARC T2 processor from Sun Microsystems and got promising results. All emitter and control corrupter attacks were flagged in all cases, and no false positives occurred. They also said the added performance costs were negligible, with less than 3 KB of storage required per processor core.

The scientists are Adam Waksman and Simha Sethumadhavan. A PDF of their paper is here. ®

Secure remote control for conventional and virtual desktops

More from The Register

next story
Ice cream headache as black hat hacks sack Dairy Queen
I scream, you scream, we all scream 'DATA BREACH'!
Goog says patch⁵⁰ your Chrome
64-bit browser loads cat vids FIFTEEN PERCENT faster!
NIST to sysadmins: clean up your SSH mess
Too many keys, too badly managed
Scratched PC-dispatch patch patched, hatched in batch rematch
Windows security update fixed after triggering blue screens (and screams) of death
Researchers camouflage haxxor traps with fake application traffic
Honeypots sweetened to resemble actual workloads, complete with 'secure' logins
Attack flogged through shiny-clicky social media buttons
66,000 users popped by malicious Flash fudging add-on
JLaw, Kate Upton exposed in celeb nude pics hack
100 women victimised as Apple iCloud accounts reportedly popped
New Snowden leak: How NSA shared 850-billion-plus metadata records
'Federated search' spaffed info all over Five Eyes chums
Three quarters of South Korea popped in online gaming raids
Records used to plunder game items, sold off to low lifes
Oz fed police in PDF redaction SNAFU
Give us your metadata, we'll publish your data
prev story

Whitepapers

Endpoint data privacy in the cloud is easier than you think
Innovations in encryption and storage resolve issues of data privacy and key requirements for companies to look for in a solution.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Advanced data protection for your virtualized environments
Find a natural fit for optimizing protection for the often resource-constrained data protection process found in virtual environments.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.
Next gen security for virtualised datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.