Not having been at Blackhat and Defcon, I probably wouldn't have paid much attention to Jonathan Brossard's paper Hardware backdooring is practical if Kevin Townsend hadn't called it to my attention - his subsequent article for Infosecurity Magazine Rakshasa: Hindu demon and permanent, undetectable backdoor includes some of my thoughts on the topic, but I might as well comment a little further. I don't see why Stephen and Cameron should have all the fun.
There has been persistent conjecture regarding the possibility of hardware backdooring' for as long as I've been on the fringes of this industry, and certainly before I had any kind of reputation to risk by joining in.
Well, it isn't news that you can do something unexpected by gimmicking the BIOS at source: I have particular reason to remember the 'Welcome Datacomp' "virus". Those words appeared in documents created by Mac users without the user having typed them. That 'joke' was hard-coded into the ROM of a 3rd-party Mac-compatible keyboard - I believe the company involved was Sicon. (I don't know how many of those keyboards were affected, but there were quite a few reports in the early 90s.) Trivial though that was - though if you found yourself obliged to go back and get a keyboard that hadn't been trojanned, I've no doubt it was extremely annoying - it made the point about 'hardware backdooring' quite effectively a long time ago.
Maybe the real point there is that if you're feeling paranoid about hardware, you shouldn't necessarily source it from other countries purely on the basis of how cheaply they can produce it. ;-) At any rate, not unless it's a state you trust implicitly, and it doesn't seem to me (as an outsider) that the U.S. trusts China that much, or is that sure about its closest allies, come to that. Well, international politics isn't really my area: let's stick to hardware backdooring.
If you control the early part of the supply chain, you may never need to mess about with after-sales infection: however, the wide range of manufacturers provides some defence against that: you can't gimmick hardware if you don't have any access to/control over its components at any point during the supply process. So what about post-supply infection/compromise?
Bootkit technology, as discussed in the paper as a possible source of compromise, is by no means completely irrelevant, but you can actually go back a lot earlier to CIH (later and irrelevantly known as Chernobyl) for an example of real malware with a payload that involved writing to a flash-able BIOS, though it didn't attempt to cover all possible Flash ROM chips. It was claimed to have affected tens of millions of machines, and I guess it influenced the number of machines built subsequently with the BIOS protected by a hardware switch. It's a long step from trashing a PC BIOS (as CIH did) to using multiple device/peripheral firmware to run a botnet, but never say never. I can see potential for mischief here, but it's not as simple as the paper makes it sound. It wouldn't surprise me to hear that covert agencies are looking at this sort of approach for highly targeted operations, but I don't think it's likely to emerge as a global epidemic. After all, the malware he's describing may be 'ultra-stealthy' once installed - though I'm never convinced by words like undetectable and unremovable - but it still has to jump through the usual hoops before it gets to a clean system.
David Harley CITP FBCS CISSP
ESET Senior Research Fellow
