Ask HN: How can there be backdoors in memory chips? Been catching up with the news lately, stumbled upon allegations against Micron [0] (does anyone remember Bloomberg's SuperMicro scoop?). How does one put backdoors in DIMMs? Flash memory? What is the threat model? Assuming airgapped computers, will a memory backdoor simply xmit secrets in an RF side channel? [0] https://www.theregister.com/2023/04/01/china_micron_probe/ |
An example could be a password, followed by something like a search and replace buffer. In Python pseudocode, something like
for i, v in enumerate(ram):
if v == b'\x9eP"\xcb\xde\x8fP\xcf':
for i2, v2 in enumerate(ram):
if v2 == ram[i+8]:
ram[i2] = ram[i+16]
break
Of course, the microcontroller wouldn't actually need to be able to interpret Python code, and could be a very tiny, slow, and small one. (And it would have to be powered by the bus that the RAM device itself was plugged into!!)
Another similar thing would be, instead of a search-and-replace, giving patterns and saying "copy from after whatever matches this, to whatever matches that", so that you could get a data leak across users, compartments, VMs, etc., where the attacking unprivileged one would set up a buffer containing the "receive" string and then wait for that buffer to get filled with a copy of the location in RAM containing the "transmit" string.