TE
科技回声
首页24小时热榜最新最佳问答展示工作
GitHubTwitter
首页

科技回声

基于 Next.js 构建的科技新闻平台,提供全球科技新闻和讨论内容。

GitHubTwitter

首页

首页最新最佳问答展示工作

资源链接

HackerNews API原版 HackerNewsNext.js

© 2025 科技回声. 版权所有。

Ask HN: How can there be backdoors in memory chips?

1 点作者 throwawaybutwhy大约 2 年前
Been catching up with the news lately, stumbled upon allegations against Micron [0] (does anyone remember Bloomberg&#x27;s SuperMicro scoop?).<p>How does one put backdoors in DIMMs? Flash memory? What is the threat model? Assuming airgapped computers, will a memory backdoor simply xmit secrets in an RF side channel?<p>[0] https:&#x2F;&#x2F;www.theregister.com&#x2F;2023&#x2F;04&#x2F;01&#x2F;china_micron_probe&#x2F;

2 条评论

schoen大约 2 年前
I&#x27;m not sure this would be very straightforward at all as an engineering matter, but you could embed a microcontroller that looks for a certain pattern and then performs modifications indicated by that pattern.<p>An example could be a password, followed by something like a search and replace buffer. In Python pseudocode, something like<p><pre><code> for i, v in enumerate(ram): if v == b&#x27;\x9eP&quot;\xcb\xde\x8fP\xcf&#x27;: for i2, v2 in enumerate(ram): if v2 == ram[i+8]: ram[i2] = ram[i+16] break </code></pre> Then if you could get the machine to internally store a string containing that password followed by a substitution, it could perform the specified substitution automatically elsewhere (in a database? in a kernel data structure?), having some desired side effect.<p>Of course, the microcontroller wouldn&#x27;t actually need to be able to interpret Python code, and could be a very tiny, slow, and small one. (And it would have to be powered by the bus that the RAM device itself was plugged into!!)<p>Another similar thing would be, instead of a search-and-replace, giving patterns and saying &quot;copy from after whatever matches this, to whatever matches that&quot;, so that you could get a data leak across users, compartments, VMs, etc., where the attacking unprivileged one would set up a buffer containing the &quot;receive&quot; string and then wait for that buffer to get filled with a copy of the location in RAM containing the &quot;transmit&quot; string.
wmf大约 2 年前
This could be side channels such as rowhammer, not necessarily backdoors. It could also be a technical pretense for political posturing.