Can a virus infection spread from a PC to a PCB and back to a PC?

Question

We have some equipment that is linked to PC's. These PC's acquire data from the equipment that they send to a server through an internal network. Furthermore these PC's are used to mediate instructions from network coupled PC's to the equipment. Therefore, they are named acquisition servers. The equipment has no standalone storage drive and only consists of PCBs (printed circuit boards).

There are flash chips present which stores the firmware. And yes, the equipment can write files on the PC containing data like serial number and so on. I actually do not know if it extends further. The equipment only has connection to the network through the acquisition server.

Every once in a while the equipment needs repair. In the past, the external technicians performing the repair just cut the connection to the acquisition servers and put the network cable from the equipment in their own PC's to be able to control the equipment locally.

Now, my local IT security says that we are not allowed to have external technicians coupling their own PC's directly to the equipment. They fear that a virus will infect the PCB's of the equipment and that the infection will be able to spread back to the acquisition server once it is coupled back again. All of the acquisition servers have state-of-the-art antivirus and firewall.

What do you think the risk is that an infection will go from PC to a print board and then back to a PC if any?

Answer 1

It's impractical for a PCB to be a vector for malware storage or attacks, but that's because PCBs don't do anything except route electrical signals between components. The components themselves... there's the rub. You say there's "no standalone storage drive" in the equipment, but presumably there's some storage (likely flash storage mounted on the board, or even integrated into one of the components - such as an SOC - mounted on the board) that does things like store firmware and/or configuration data? After all, presumably the technicians are changing something when they connect to the equipment, and those changes persist because it works again when you get it back. Unless the changes are purely physical (replacing, moving, or modifying hardware), there's got to be some editable data stored in the equipment.

Now, whether the risk of a maliciously modified (or unknowingly infected) board attacking your PCs is significant... that's a different question. Some of it depends on the extent to which your software trusts the equipment (can it execute code on the PC? Can it write arbitrary files to the PC storage? Has the software that interacts with this equipment been hardened at all? Is it in any way sandboxed?). Some of it depends on the way the equipment is attached to the network (does it also have Internet connectivity, even indirectly? Is the network it's attached to used for anything else, such as communicating between PCs on your LAN?). Some of it depends on what security is built into the equipment itself (does it require that its firmware be signed? Does it even contain a general-purpose processor, or something such as an FPGA that could be configured into one?). Some of it depends on how trustworthy the technicians are (are they employees of the equipment vendor? What security practices do they follow with their work computers? Would you notice if one of them was replaced with an impersonator wearing a copy of their uniform/badge?).

At the end of the day, if you don't trust the equipment vendor, it's probably not possible to service it at all in a trustworthy way (you'd have to analyze the security implication every step they tell you to take, reverse engineer every firmware blob they have you upload, physically uncap and inspect every chip they have you install with an electron microscope, etc.) although "trust" isn't a binary state and perhaps you trust them enough that you can figure they probably aren't sending you deliberately malicious code, in which case it more comes down to "how good is their security?". If you don't trust the technicians, you might be able to replace them with your own people (or with the vendor's people), but remote troubleshooting is hard and the technicians probably have software and definitely have training that your people lack.

I'd worry far, far more about things like network segmentation (keeping the potentially-vulnerable-or-malicious equipment separate from the Internet and from any other machines), physical security (making sure nobody untrusted gets access to your PCs, network switches, or similar), and employee security (making sure that your people can recognize phishing and other social engineering, using multi-factor authentication for all sensitive accounts, and running background checks + watching for disaffected employees) than about the quality of antivirus on your work PCs... though if they're connected to the Internet, or load third-party code through any other means, endpoint protection is helpful too.

Answer 2

That depends on the specifics of your PCBs, but in the absence of more information, I would follow your IT security team: they know more about them than us on this Q&A website.

It is in theory possible for a targeted attack from a skilled and resourceful attacker to compromise equipment, like your PCB, to infect connected computers. Against such targeted attacks, anti-virus and firewall are mostly useless. The best thing you can do is to enforce a strict air-gap between devices. That's what your IT security team is trying to enforce.

However, this can prevent your external technicians to perform their repairs efficiently. We cannot tell you whether this protection is overkill or justified. To get this answer, your company have to perform threat modelling and a risk assessment of your company and environment (not limited to the IT architecture). Your IT security team might have performed one, justifying their new requirements.

Answer 3

It really depends a lot on what is on those boards, and probably more importantly what type of interface is used.

If they are connected via USB, then nearly anything is possible. One could potentially modify the device to act like storage, or like a keyboard, or both (this depends on the capabilities of the device). When you plug it into your server, the device would then mount a drive (as its acting like storage) and start executing things on that drive (by simulating keyboard input).

There are even hacked USB cables out there which will do this...

If you are using Ethernet then the usual network security issues apply.

If you are using "simpler" interfaces like a serial port (UART), SPI, I2C or similar stuff, then the risk is much lower, but really depends on what on the host PC is talking to that interface, possibly who is the master, and the handling of the usual issues like buffer overflows, out of bounds values, etc.

You are much less likely to have issues with, say, a temperature sensor reporting via SPI or I2C, than with an SBC containing a full SoC and interfaced via USB for instance.

To understand the risks, you need to know a lot more about what those boards do and how they are interfaced.

Note that you state the boards don't have any storage, but that's highly unlikely. If people connect to those boards to update or configure them, then there is necessarily some storage. It may be flash on the board, or even flash inside a chip (SoC).

There are chips smaller than a fingernail which include multiple CPU cores, RAM, megabytes of flash memory, and USB interfaces...

Answer 4

No technology is free of an attack vector. However, I do not consider the exploitability of effects occurring on printed circuit boards to be obviously exploitable without further ado, unless you dimension the corresponding electronics accordingly.

On the level of a pure printed circuit board, there are tracks on it and a carrier material.

By their very nature, conductive tracks always have an inductance. There is also always a capacitance between the conductors. Both are not exactly large, but they are present.

Due to the said inductivity as well as capacitance which is inherent to a printed circuit board, mechanical (e.g. acoustic) as well as electromagnetic oscillations could be sent as well as received.

But as I said, without corresponding specially dimensioned electronics on the printed circuit board or in connection with it, this seems to me to be impossible.