36C3: Open Source Is Insufficient To Solve Trust Problems In Hardware

With open source software, we’ve grown accustomed to a certain level of trust that whatever we are running on our computers is what we expect it to actually be. Thanks to hashing and public key signatures in various parts in the development and deployment cycle, it’s hard for a third party to modify source code or executables without us being easily able to spot it, even if it travels through untrustworthy channels.

Unfortunately, when it comes to open source hardware, the number of steps and parties involved that are out of our control until we have a final product — production, logistics, distribution, even the customer — makes it substantially more difficult to achieve the same peace of mind. To make things worse, to actually validate the hardware on chip level, you’d ultimately have to destroy it.

On his talk this year at the 36C3, [bunnie] showed a detailed insight of several attack vectors we could face during manufacturing. Skipping the obvious ones like adding or substituting components, he’s focusing on highly ambitious and hard to detect modifications inside an IC’s package with wirebonded or through-silicon via (TSV) implants, down to modifying the netlist or mask of the integrated circuit itself. And these aren’t any theoretical or “what if” scenarios, but actual possible options — of course, some of them come with a certain price tag, but in the end, with the right motivation, money is only a detail.

Continue reading “36C3: Open Source Is Insufficient To Solve Trust Problems In Hardware”

Trust Hacking: How The Bitcoin System Works

how-bitcoin-network-functions

[Scott Driscoll] sent us a link to his Bitcoin explanation a couple of weeks ago. We glanced at it but moved on rather quickly. It’s been popping up here and there and we finally gave it the time it deserved.┬áThis video is interesting in that it doesn’t just focus on what the Bitcoin actually is, but how the Bitcoin system works when it comes time for money to change hands.

Quite early on in the explanation he mentions that “The Bitcoin system is amazingly designed so that no trust is needed”. That’s a powerful statement. For instance, if you sell your car, one of your friends will probably tell you not to take a check. That’s because a check means you’re trusting that the buyer actually has a balance in their account to cover the transaction. With Bitcoin the transaction carries its own proof that the currency is available by including information about the past transactions through which those Bitcoins were acquired.

If you have some idea of what public/private key pairs are you’re already equipped to understand [Scott’s] lecture. After you make it through the 22 minute video maybe you should get down to work doing some Bitcoin mining at home.