Software Is Tangible

Many people seem to think that software is non-physical---that unlike the computer keyboard and screen they can touch and feel, the software that makes their computer do useful work has no physical existence.  This ghost-in-the-machine view of software doesn’t square up with reality. Computing is a physical act and software is the physical object that drives computers.

Software is stored in the memory of a computer as collections of electrons: a certain number of electrons stored at a location represents a 1 bit while a small number (or no) electrons represents a 0 bit. (Other storage media represent bits in other ways---magnetic domains, pits in DVDs, etc.---but the principle remains the same.) In a modern memory, only a few hundred of these little tiny electrons are enough to store a 1 bit. 

But tiny is not the same as non-existent.  A little high school physics tells us that, in fact, electrons do exist in the physical world. Wikipedia gives the mass of an electron as 9.1 X 10^-39 kg.  That’s pretty darn small. But they do really exist. And we can sense the behavior of electrons in many ways.  For example, we can steal cryptographic keys from smart cards and computers watching the flow of electrical energy into the machine.  This technique, known as a power attack, figures out the 1s and 0s of your security key simply by watching how much power the computer consumes at different steps of the security process.  The physical nature of those little tiny bits has real and important implications.

And some of the effects of the physical nature of software are accessible by a simple touch. Running software consumes electric power that is transformed into heat by the computer, much as our bodies heat up as we exercise. When your feel your laptop grow hot as you watch a movie, you feel the physical effects of software. Can a ghost in the machine do that?

Power Attack White Paper

Rambus has posted here an interesting white paper on differential power attacks.

Apple Ships Phone with Dual-Sourced Processors

A number of sources, including Anandtech here, report that Apple's new iPhones are shipping with one of two different chips.  The chips aren't even the same size. As my student pointed out, Macrumors reports here that initial tests suggest that the two chips consume significantly different levels of power.

The Air Gap Myth

The BBC discusses here an interesting report from Chatham House on the vulnerability of worldwide nuclear energy plants to cyber attack.  The report says that although many facilities claim that they do not have direct Internet connections---an air gap---that some of them do in fact have Internet connections.  For example, a connection may have been installed for maintenance, then not uninstalled and forgotten.

But let's be clear---the notion of an air gap is a fantasy in the modern world. Even if no direct connection exists, indirect connections through storage devices is sufficient to allow hackers to attack a cyber-physical system. Sneakernet---moving data manually from machine to machine---has a long and storied tradition in computing.  (Rumor had it that while Sun promoted its Network File System on the outside, it relied on Sneakernet for internal data transfers.)  The Stuxnet attacks were initiated through data carried by maintenance workers on flash drives. Those flash drives were infected on outside machines, then carried inside the facility to help the workers with their tasks.  The UCSD team showed in its demonstrations of car hacking that the maintenance computers used by mechanics were vectors for attacking cars.

Cyber-physical systems cannot ensure a circle of trust merely by claiming that they are not connected to the Internet.   It is hard to imagine a safety-critical system that is not vulnerable to sneakernet attacks. We need to design safety-critical systems that monitor themselves during operation to watch for attacks.  Trust but verify...

Intel HDCP master key cracked

tomshardware.com reports here that the Intel HDCP master key has been cracked.  HDCP is a multimedia encryption standard.