Hacker News Reader

Comment by dehrmann | Hacker News Reader

> the verification of non-existence of "backdoor" functionality is also not trivial; requiring a considerable amount of technical investigative work

With the recent news about removing Huawei from UK cell networks, it got me wondering...is there a feasible way to verify there aren't backdoors in infrastructure hardware like this other than manufacturers open sourcing (this doesn't mean open licensing) software, firmware, microcode, chip designs, board designs, and compilers so researchers can see what you did and verify production matches the source?

How would you defend your IP with it being so out-in-the-open? Competitors seeing your code probably wouldn't be so much of a problem, and it wouldn't be so much of a problem for large players in first world countries, but China has a reputation for knockoffs, and they wouldn't hesitate producing counterfeit hardware for domestic use.

View on HN

> ...is there a feasible way to verify there aren't backdoors in infrastructure hardware like this other than manufacturers open sourcing (this doesn't mean open licensing) software, firmware, microcode, chip designs, board designs, and compilers so researchers can see what you did and verify production matches the source?

Even open sourcing all that wouldn't necessarily be enough to verify the non-existence of a backdoor. IIRC, clever back doors are deliberately designed to look like unintentional 0-day security flaws.

You don't need to make it open source, you just need to make it available to researchers. Microsoft shares some source code with the US government, among others.

https://www.microsoft.com/en-us/sharedsource/

Some code....with the US government..that really says everything you need to know ;)

They license source code to a bunch of parties. Another example would be PC OEMs.

You still can have hardware backdoor in one of the ICs. You need to check them all.

So, step one: produce your hardware on your own.

How do you verify that the fab didn't insert any backdoors and made your part strictly to-spec? Fabrication-time attacks are an interesting vein of content to research. There are some good papers and talks out there if you do some quick searching.

If you eliminated vulnerabilities due to evil doping, you can use a free electron laser to holographically capture the 3 dimensional structure inside, and then you can compare the enlarged+scanned/digitally-captured patterns with those that you expect from simulating the holographic imaging.

In certain settings this should work non-destructively, but that might require something like lapped (grinding the backside after fabrication to thin out the substrate) non-stacked >=22 nm chips.

Perhaps (though doubtful) you could verify if there are no backdoors in the chip design, microcode or firmware source.

But that's not sufficient since you can't reasonably verify if a particular piece of hardware has the design, microcode or firmware that it is supposed to have. For all you know there's a tricky modification there that's not in the documents you got. There is published research on nearly undetectable alterations of chips during manufacturing, altering its functionality; chips can lie about the firmware they have, etc.

I was going to ask the same question. Besides reading every line of machine code?

The only way I can think of is monitoring its traffic and looking into anything fishy from there. But even that isn't conclusive.

Maybe the backdoor listener is behind a complex port knocking sequence? There's really no way to tell.

Reply on news.ycombinator.com