siliconexposed.blogspot.com
Silicon Exposed: January 2014
http://siliconexposed.blogspot.com/2014_01_01_archive.html
Thursday, January 23, 2014. Hardware reverse engineering class. So, it's been a while since I've posted anything and I figured I'd throw up a quick update. I've been super busy over the winter break working on my thesis, as well as something new: My advisor and I are running a brand-new, experimental course, CSCI 4974/6974 Hardware Reverse Engineering. At Rensselaer Polytechnic Institute (RPI). Lecture notes are available online on the course website for anyone who wishes to follow along. Ive been intere...
siliconexposed.blogspot.com
Silicon Exposed: FPGA cluster updates
http://siliconexposed.blogspot.com/2015/01/fpga-cluster-updates.html
Thursday, January 15, 2015. Although the "raised floor" design for my FPGA cluster looked cool, it really didn't scale. My entire desk was full, there was very limited room for new hardware, and the boards kept getting dusty. To make matters worse, long wires were needed to connect everything and it was difficult to manage them all. I ended up moving forward with the plan. I came up with a few months ago and my FPGA cluster is now living on the 19" rack in my living room. 3U x 4HP USB hub blade. I went w...
siliconexposed.blogspot.com
Silicon Exposed: October 2014
http://siliconexposed.blogspot.com/2014_10_01_archive.html
Saturday, October 4, 2014. Why Apple's iPhone encryption won't stop NSA (or any other intelligence agency). Matthew Green at Johns Hopkins wrote a very nice article. On the subject recently, but there are a few points I feel it's worth going into more detail on. The general case here is that of two people, Alice and Bob, communicating with iPhones while a third party, Eve, attempts to discover something about their communications. First off, the changes in iOS 8 are encrypting data on disk. Although this...
siliconexposed.blogspot.com
Silicon Exposed: May 2015
http://siliconexposed.blogspot.com/2015_05_01_archive.html
Saturday, May 23, 2015. Graduating, TDR prototype, lab move, and a conference talk. So, it's been a busy couple of months and I haven't had time to post anything. Here's a few quick updates:. I successfully defended my Ph.D thesis few weeks ago and will be graduating next weekend. You can download the thesis. And browse the code. TDR prototype during bring-up. This was my improvised jig for holding probes on small test points. The current state of my lab. Subscribe to: Posts (Atom). Recent news headlines...
siliconexposed.blogspot.com
Silicon Exposed: November 2013
http://siliconexposed.blogspot.com/2013_11_01_archive.html
Friday, November 29, 2013. This is the story of the hunt for a bug that I've been chasing, on and off, for the last month. After my last post on the PDU, I began doing more exhaustive testing. I left Munin polling all of the stats every 5 minutes and kept the GUI open for maybe half an hour, turning channels on and off, and everything seemed fine. After checking in a couple of times and not seeing a hang, I finally got it to crash a couple hours later. A quick inspection in gdb suggested that the CPU...
siliconexposed.blogspot.com
Silicon Exposed: Graduating, TDR prototype, lab move, and a conference talk
http://siliconexposed.blogspot.com/2015/05/graduating-tdr-prototype-lab-move-and.html
Saturday, May 23, 2015. Graduating, TDR prototype, lab move, and a conference talk. So, it's been a busy couple of months and I haven't had time to post anything. Here's a few quick updates:. I successfully defended my Ph.D thesis few weeks ago and will be graduating next weekend. You can download the thesis. And browse the code. TDR prototype during bring-up. This was my improvised jig for holding probes on small test points. The current state of my lab. Subscribe to: Post Comments (Atom). Recent news h...
siliconexposed.blogspot.com
Silicon Exposed: TDR updates
http://siliconexposed.blogspot.com/2015/01/tdr-updates.html
Tuesday, January 20, 2015. A few months ago, I wrote. About a project I had been thinking of for a while but not had time to work on: a time-domain reflectometer. TDR) for testing twisted pair Ethernet cables. One possible architecture would consist of a pre-amplifier for each channel, a 4:1 RF mux, and a single high-speed ADC sampled by an FPGA. This would work, but seemed quite expensive and I wanted to explore lower-cost options. For each point T in time. Set DAC to (Vstart Vend) / 2. In order to work...
siliconexposed.blogspot.com
Silicon Exposed: September 2014
http://siliconexposed.blogspot.com/2014_09_01_archive.html
Wednesday, September 17, 2014. Threat modeling for FPGA software backdoors. I've been interested in the security of compilers and related toolchains ever since I first read about Ken Thompson's compiler backdoor. Many years ago. In a nutshell, this famous backdoor does two things:. Whenever the backdoored C compiler compiles the "login" command, it adds a second code path that accepts a hard-coded default password in addition to the user's actual password. As far as I can tell, the majority of research i...
siliconexposed.blogspot.com
Silicon Exposed: Getting my feet wet with invasive attacks, part 1: Target recon
http://siliconexposed.blogspot.com/2014/03/getting-my-feet-wet-with-invasive.html
Monday, March 31, 2014. Getting my feet wet with invasive attacks, part 1: Target recon. This is part 1 of a 2-part series. Part 2, The Attack, is here. One of the reasons I've gone a bit dark lately is that running CSCI 6974. RPI's experimental hardware reverse engineering class, has been eating up a lot of my time. The first step was to pick a target. I was interested in the Xilinx XC2C32A. But not so modern as to be insanely hard to work with. It was also quite cheap ($1.25 a pop for the slowe...The n...
siliconexposed.blogspot.com
Silicon Exposed: January 2015
http://siliconexposed.blogspot.com/2015_01_01_archive.html
Tuesday, January 20, 2015. A few months ago, I wrote. About a project I had been thinking of for a while but not had time to work on: a time-domain reflectometer. TDR) for testing twisted pair Ethernet cables. One possible architecture would consist of a pre-amplifier for each channel, a 4:1 RF mux, and a single high-speed ADC sampled by an FPGA. This would work, but seemed quite expensive and I wanted to explore lower-cost options. For each point T in time. Set DAC to (Vstart Vend) / 2. In order to work...
