Information Management Online, August 19, 2009
Shane Kite

The next wave of hacking into computers and stealing data will not be requests or code coming from remote points across the Web, security experts are warning.

Instead, the most sophisticated Trojan Horses appearing on Wall Street financial systems may be threaded into the silicon of integrated circuits by design, their malicious instructions baked right into the tiny physical aspects and intricate mapping of the chip itself, according to scientists and academics working with the National Institute of Standards and Technology, the White House and the Financial Services Information Sharing and Analysis Center in Dulles, Va.

Detecting such malware after a chip is fabricated will be extremely difficult, if not impossible, these experts say, because the microchips that run servers have millions to billions of transistors in them. Adding a few hundred or even just tens of transistors can compromise an integrated circuit can serve attackers' purposes and escape notice.

Lawenforcement in Europe uncovered a scam late last year whereby criminalshad rigged credit card readers installed at Tesco and other retailoutlets there with what was essentially a tiny cell phone that wascapturing all the PINs from customers who used their cards on thereaders in stores and sending the data through Pakistan; though itsultimate destination remains unknown. Criminals often choose nationswith porous security or limited digital forensics practices to routetheir booty.

Borg makes pains however to emphasize that the threat of hardware tampering occurring in the private sector remains relatively low. "Malicious software is so much easier and cheaper to distribute," he says.

Plus, the risk is huge. "There's a serious danger that the whole world would stop buying electronics from your country if it was shown that the supply chain was compromised. The main danger here is hardware bargain hunting."