{"id":63646,"date":"2018-11-01T19:00:57","date_gmt":"2018-11-01T23:00:57","guid":{"rendered":"https:\/\/newsroom.carleton.ca\/?post_type=cu_story&p=63646"},"modified":"2025-08-19T09:37:34","modified_gmt":"2025-08-19T13:37:34","slug":"hardware-security-vulnerabilities","status":"publish","type":"cu_story","link":"https:\/\/carleton.ca\/news\/story\/hardware-security-vulnerabilities\/","title":{"rendered":"Don\u2019t trust your hardware: Why security vulnerabilities affect us all"},"content":{"rendered":"\n
\n
\n\n \n \n \n \n
\n\n
<\/div>\n \n
\n
\n\n

\n Don\u2019t trust your hardware: Why security vulnerabilities affect us all\n <\/h1>\n \n <\/header>\n <\/div>\n\n \n <\/path>\n <\/path>\n <\/svg>\n <\/div>\n\n \n\n <\/div>\n<\/section>\n\n

This article was originally published by The Conversation in 2018.<\/em><\/h4>\n\n\n\n

A few weeks ago, Bloomberg reported that China was spying on American tech firms<\/a>, including Apple and Amazon, by installing secret microchips on server boards during the production process. These hardware trojans<\/em> are, like the Greek horse used to sneak in soldiers, designed to appear harmless while in actuality they perform secret malicious operations.<\/p>\n\n\n\n

The named tech firms have denied this report<\/a>; at the moment, we have no way of knowing who is right. If true, this is potentially the greatest malicious hardware security breach we\u2019ve seen. If not true, well\u2026 there are still enough hardware security vulnerabilities to go around.<\/p>\n\n\n\n

Earlier this year, the Spectre\/Meltdown bug was disclosed<\/a>. This security vulnerability affects virtually every processor, from those powering consumer computers to company servers, and it allows malicious code to access potentially confidential information. This was a fault in the hardware design: software patches<\/em> (updates intended to correct the fault) were made available soon after and, officially, with negligible performance impact (it\u2019s not really negligible<\/a>).<\/p>\n\n\n\n

But this doesn\u2019t affect you<\/em> directly, apart from a slightly slower computer\u2026 or does it?<\/p>\n\n\n\n

Microprocessors are everywhere<\/h2>\n\n\n\n

The average person interacts with scores of microprocessors every day. This does not include the servers and internet routers that process your email and social media: think closer to home. You likely have a smartphone and a personal computer or tablet.<\/p>\n\n\n\n

Perhaps an Amazon Echo or another smart speaker? An electronic doorbell or intercom<\/a>? Your car alone, if less than ten years old, has dozens of processors responsible for everything from controlling the radio to acting on the brakes. A Spectre\/Meltdown-like bug on your car\u2019s breaks<\/a> is a frightening thought.<\/p>\n\n\n\n

These bugs occur because hardware design is hard<\/em>. As part of my research<\/a>, I\u2019ve had to design and implement processors. Making them work is challenging enough, but ensuring they are secure? Exponentially harder.<\/p>\n\n\n\n

Some might remember that in 1994, Intel had to recall a line of buggy processors<\/a>, costing them millions of dollars. This was a case where the best chip designers in the world produced a flawed chip. Not a security vulnerability, just an incorrect result on some operations.<\/p>\n\n\n\n

This is much easier to detect and correct than a security vulnerability, which is often incredibly nuanced \u2014 those interested in reading more about the Spectre\/Meltdown exploit will see it\u2019s a very, very sophisticated attack<\/a>. Last year, a cybersecurity researcher found several undocumented instructions on an Intel i7 processor. Instructions are the atomic operations a processor can perform: for example, adding two numbers, or moving data from one place to another. Every program you run likely executes thousands or millions of instructions. The discovered ones are not disclosed on the official manual, and for some, their exact behaviour remains unclear.<\/p>\n\n\n\n