Information Management Online, August 19, 2009

Shane Kite



The next wave of hacking into computers and stealing data will not be requests or code coming from remote points across the Web, security experts are warning.



Instead, the most sophisticated Trojan Horses appearing on Wall Street financial systems may be threaded into the silicon of integrated circuits by design, their malicious instructions baked right into the tiny physical aspects and intricate mapping of the chip itself, according to scientists and academics working with the National Institute of Standards and Technology, the White House and the Financial Services Information Sharing and Analysis Center in Dulles, Va.



Detecting such malware after a chip is fabricated will be extremely difficult, if not impossible, these experts say, because the microchips that run servers have millions to billions of transistors in them. Adding a few hundred or even just tens of transistors can compromise an integrated circuit can serve attackers' purposes and escape notice.

Law
enforcement in Europe uncovered a scam late last year whereby criminals
had rigged credit card readers installed at Tesco and other retail
outlets there with what was essentially a tiny cell phone that was
capturing all the PINs from customers who used their cards on the
readers in stores and sending the data through Pakistan; though its
ultimate destination remains unknown. Criminals often choose nations
with porous security or limited digital forensics practices to route
their booty.

Borg makes pains however to emphasize that the threat of hardware tampering occurring in the private sector remains relatively low. "Malicious software is so much easier and cheaper to distribute," he says.

Plus, the risk is huge. "There's a serious danger that the whole world would stop buying electronics from your country if it was shown that the supply chain was compromised. The main danger here is hardware bargain hunting."