5

Has there been any research on what buses in a computer can be analyzed while they are live, without rebooting the system to insert a proxy device? For example, I imagine I2C would be very easy to sniff because the wires are exposed, and because the data transfer rate is very low, but as far as I know, I2C transmits no sensitive information. On the other end of the extreme, I imagine PCIe and RAM would be almost impossible to sniff, even though the pins are all exposed, simply because of the high data rate (thankfully, I hope, because they both contain highly confidential information). The question is similar to this one here, but not specific to EM emissions.

My question is: What buses that carry sensitive data on a live system can be sniffed without interrupting the operation of the running system, if any? Sensitive information meaning anything that can be used to uncover the internal state of the system, such as cached inodes, encryption keys, ASLR layouts, process list, open sockets, etc., so pretty much anything in memory.

Improve this question
2
  • 1
    I assume you were already aware of the Fireware bus master attack (Thunderbolt has similar bus mastering access): papers.put.as/papers/macosx/2006/ab_firewire_rux2k6-final.pdf
    – Ben Voigt
    Mar 17, 2022 at 16:03
  • @BenVoigt I'm aware of that. My question is about passing sniffing of electrical or electromagnetic signals, not direct memory access from a malicious device. So bus mastering attacks (and anything with similar capabilities like JTAG) are out of scope.
    – forest
    Mar 18, 2022 at 19:30

1 Answer 1

Reset to default
2

Well, when talking about the internals of a computer, Any access point you can access physically without pulling hardware out, so basically anything you can attach a probe-lead to without causing a short. So what can what is not accessible.

  • CPU, this is often only available for sniffing from when using specialized equipment in between the CPU and the main-Bord.
  • Memory, while individual memory are more or less accessible, often this is hard to actually do due to the small size of the legs and require a microscope to properly connect without short
  • PCI, Often only the external and diagnostics ports are available, rest has the same issues as Memory and CPU.

All other data carrying cables and diagnostic ports are available. its just a matter of connecting the leads and stripping the cables without causing shorts and without disrupting the running system. And all of these attacks require physical access to the machine and leave evidence on the machine after you're done. Higher data rates require better recording equipment so, just because of the high rate does not mean you're safe. But the price of such equipment is such that when these become an issue you should also worry about man putting guns on your face to get the information you have. (e.a. big government threats)

Improve this answer
9
  • 1
    Requiring a microscope to connect without a short is very interesting. Do you have any citations/further information for that or is that conjecture? As these devices can be re-used, I imagine price is not as much of an issue as it could be used otherwise. A government adversary could have many of them lying around for only a small portion of their budget, which would still be enough to have many spares at all times.
    – forest
    Apr 5, 2016 at 7:59
  • 2
    I can't find a direct link for you. but it is based on my experience with debugging a micro-device used in building security. In that case a microscope was used to solder micro leads directly to a FPGA chip. The guy who did this also told me he has used the technique to connect a probe lead while finding out what leads to solder to. (reason why this was done is I am afraid classified). the device also requires socialistic training so just having them is not enough.
    – LvB
    Apr 5, 2016 at 8:34
  • That's fascinating. What would you say are the most effective ways to mitigate attacks involving reading sensitive data off of a bus, assuming unrestricted physical access is unavoidable? Because I assume most low data rate buses which are easier to read contain little sensitive data, I'm focusing on PCI, QPI, RAM, etc.
    – forest
    Apr 5, 2016 at 8:58
  • 1
    @flarn2006 There are "middle man" devices for debugging DRAM, but they're pretty expensive. A hobbyist-level FPGA wouldn't be fast enough. In fact, I kind of doubt any FPGA would be fast enough, at least not for modern DDR3/DDR4 DRAM. It's entirely custom hardware. I forget what they're called at the moment, but they're essentially an ultra-high speed logic analyzer with very short traces that is placed between the motherboard and memory.
    – forest
    Mar 11, 2022 at 22:01
  • 1
    @forest The frequency of discrete TPM chips is very low, so it's relatively easy to sniff this bus. One example: pulsesecurity.co.nz/articles/TPM-sniffing
    – A. Hersean
    Mar 16, 2022 at 13:40

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .