2

Has there been any research on what buses in a computer can be analyzed while they are live, without rebooting the system to insert a proxy device? For example, I imagine I2C would be very easy to sniff because the wires are exposed, and because the data transfer rate is very low, but as far as I know, I2C transmits no sensitive information. On the other end of the extreme, I imagine PCIe and RAM would be almost impossible to sniff, even though the pins are all exposed, simply because of the high data rate (thankfully, I hope, because they both contain highly confidential information). The question is similar to this one here, but not specific to EM emissions.

My question is, what buses that carry sensitive data on a live system can be sniffed without interrupting the operation of the running system, if any? Sensitive information meaning anything that can be used to uncover the internal state of the system, such as cached inodes, encryption keys, ASLR layouts, process list, open sockets, etc. Pretty much anything in memory.

1

Well, when talking about the internals of a computer, Any access point you can access physically without pulling hardware out, so basically anything you can attach a probe-lead to without causing a short. So what can what is not accessible.

  • CPU, this is often only available for sniffing from when using specialized equipment in between the CPU and the main-Bord.
  • Memory, while individual memory are more or less accessible, often this is hard to actually do due to the small size of the legs and require a microscope to properly connect without short
  • PCI, Often only the external and diagnostics ports are available, rest has the same issues as Memory and CPU.

All other data carrying cables and diagnostic ports are available. its just a matter of connecting the leads and stripping the cables without causing shorts and without disrupting the running system. And all of these attacks require physical access to the machine and leave evidence on the machine after you're done. Higher data rates require better recording equipment so, just because of the high rate does not mean you're safe. But the price of such equipment is such that when these become an issue you should also worry about man putting guns on your face to get the information you have. (e.a. big government threats)

  • Requiring a microscope to connect without a short is very interesting. Do you have any citations/further information for that or is that conjecture? As these devices can be re-used, I imagine price is not as much of an issue as it could be used otherwise. A government adversary could have many of them lying around for only a small portion of their budget, which would still be enough to have many spares at all times. – forest Apr 5 '16 at 7:59
  • I can't find a direct link for you. but it is based on my experience with debugging a micro-device used in building security. In that case a microscope was used to solder micro leads directly to a FPGA chip. The guy who did this also told me he has used the technique to connect a probe lead while finding out what leads to solder to. (reason why this was done is I am afraid classified). the device also requires socialistic training so just having them is not enough. – LvB Apr 5 '16 at 8:34
  • That's fascinating. What would you say are the most effective ways to mitigate attacks involving reading sensitive data off of a bus, assuming unrestricted physical access is unavoidable? Because I assume most low data rate buses which are easier to read contain little sensitive data, I'm focusing on PCI, QPI, RAM, etc. – forest Apr 5 '16 at 8:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.