Pentagon Fears Trojans, Kill Switches In Foreign-made Cpus

May 2nd, 2008
www.arstechnica.com
By: Jon Stokes

Earth - In the 1959 novel The Manchurian Candidate, a decorated military hero returns from the Korean War to run for President of the United States, but unbeknownst to himself and the public, his stint as a POW has left him with more than just a medal of honor. During his time in captivity, he was secretly brainwashed by the communists so that, at the prompting of a special trigger, a switch would flip in his cognitive circuitry and he would be completely under the control of the Russians and Chinese.

Fast-forward to 2008, and the basic scenario outlined above has now materialized into a real threat to national security, complete with Russian and Chinese villains. Only the compromised brain in question is not the gray matter of an army sergeant, but the foreign-made silicon chips that power the aircraft, tanks, communications equipment, routers, and other key parts of our civilian and military infrastructure.

The possibility that, say, the Chinese military could slip a malicious and basically undetectable bit of circuitry into a commodity processor that was fabricated in their country has come up more than once in our coverage of national security in recent years, as has the notion that America's own NSA may have built secret back doors into some US-made software and hardware, but we've never had the opportunity to give this important issue the in-depth attention that it deserves. The IEEE Spectrum has an
important and detailed overview of this problem and looks at one potential solution that is being tested by the Department of Defense.

There is no question that the technological infrastructure in the United States is
under siege. We have seen a steady litany of attempted intrusions originating from abroad, most likely perpetrated by a mix of foreign governments and organized crime groups. An emerging concern is that the same agents behind those cyber-attacks could also have access to the chip fabrication facilities that make the components used in US military technology. Researchers say that virtually undetectable kill-switches and backdoors can be built into any of the countless integrated-circuit chips used in mission-critical military hardware systems.

Chips can be fitted with trojan horse circuitry in a number of ways. The structure of a processor could, for instance, by altered by replacing one of the mask layers that are used during the photolithographic process. Or, hackers could potentially infiltrate the computer systems where the chip designs are stored in the form of 'code' written in a special design language, then modify the original designs. Chad Rue, an engineer employed by electron microscopy supplier FEI, told Spectrum that with a focused-ion-beam etching machine and sufficient electrical engineering expertise, it is even possible to modify chips after they have been manufactured.

The Department of Defense (DoD) is responding to this growing threat by launching the DARPA Trust in IC program, a new research project that aims to find consistently reliable methodology for discovering compromised circuitry. Three of the companies that are participating in the project—Raytheon, Luna Innovations, and Xradia—will attempt to uncover malicious components that have been hidden intentionally in a set of chips by researchers from MIT's Lincoln Laboratory.

The approach taken by the company that finds the most hardware hacks and has the lowest number of false positives could be adopted by the DoD. The government hopes that the best solution will offer a scientifically verifiable technique for detecting 90 percent of all deviant circuits.

Although the participants declined to reveal how they are attempting to solve the problem, Spectrum speculates that Xradia's approach could potentially involve using soft X-ray tomography to inspect each individual layer of a chip and Luna's approach might involve systematic analysis of chip components that don't appear to contribute to the chip's overall function. The testing process began in January, and the participating companies are expected to provide preliminary reports to DARPA by the end of the month, at which point the next stage of testing will begin. If the results are good, the techniques could continue being developed until the Trust in IC program comes to a close in 2010.