Schneier on Security

Clive Robinson • June 2, 2018 5:22 AM

@ Hmm,

How do you think that would work anyway, I’m curious?

Certain electrical components rely on “mechanical properties”. The simplest to see this with is inductors and capacitors, that you especially find in powersupply units.

The point to remember that such components are not just electrical and mechanical but also transducers… The simplest examples to think of are capacitive and inductive microphones, but as importantly they also work the other way as speakers.

Most people have not heard “transformer humm” in years because modern Switch Mode Powersupply Units operate in the sound range above human hearing. Most SMPUs suprise suprise work in the low ultrasonic centimetric through to the sub millimetric microwave range of acoustic wavelengths.

Now the way an SMPU basically works is it rectifies it’s input voltage to get 80-250Vdc from mains supply. Whilst this is a fairly ropey waveform, it gets switched on and off onto a “lossless energy storage component network” such as a very low ESR capacitor and/or inductor low pass or similar network. The result is often a network with a highish input impedence and low output impeadence. Whilst SMPUs can be “four quadrant” devices this is generally only true at one part of the circuit.

In theory you could hit the inductor in one part of the SMPU circuit such that “magnetoconstriction” can modulate the DC voltage with a high frequency signal at the sensor sampling rate. Get the phase right and you could move the DC output voltage by say a volt. Not of much concern for a DC motor that will have a 20-50% tolerance at 12Vdc, but some modern logic and analogue circuits work at 3V or less and has a tolerance of only a few percent… Which means there is potential to zap the control board or even read/write signals.

I’ve not tried it, so I can not say for certain, but I suspect that a few people will be giving it a try just for the laughs…

Clive Robinson • June 2, 2018 4:53 PM

@ Doug,

Last I checked absorption of sound in a medium goes up as the square of frequency.

That is one effect, however things like the density of the transmission medium and any constraint such as a high density medium in a graded or profiled format to act as a channel has an effect.

The most obvious of which people get to meet in real life is knowing a train is approaching due to the twitching of the rails some considerable distance away long long befor any direct sound from the train through low density air happens.

Which brings us onto the notion of “slow wave structures” that is if you coil a higher density material in another lower density channel you can get the radiation from the coil to match propagation speeds with that of the lower density medium along with phase etc, which alows beam forming and energy containment.

Of course the other trick as with explosives is to use a higher density medium that has a propagation speed above the “speed of sound” of the surounding channel medium. Effectively trapping considerable energy into a molecule or two thick barrier similar to a blast wave.

It’s a long time since I played with such structures, and we had a tame mathmetician doing the clever stuff which was akin to hydrocodes, that at the time were still considered “classified”.

Clive Robinson • June 3, 2018 4:00 AM

@ Doug,

I’m going to guess that in the context of security, if we let bad guys design in meta-materials (or anything else) to our protected structures we’re done anyway?

To quote a bit of Shakespeare,

The evil that men do lives after them…

As for “designed in” as you are aware you can make almost any support structure a transmission line and a chosen cross member a radiator at some frequency whilst another identical looking cross member radiate at a different frequency or not at all. Quite a few people have seen a simillar problem when doing “home plumbing” when water flow makes a pipe resonate sometimes painfully loud when a tap is turned on or a “ball cock” in a tank or cistern activates.

Years ago just inside of living memory aircraft fell out of the sky due to such effects, and a couple of decades later legs came off of oil rigs that then turned over again due to such effects. We now know more about resonance effects in structures but unless an object is viewed as “life threatening” such analysis is rarely done.

I know of a company that supplies 19″ rack equipment, they had no idea that a wind tunnel added to improve air flow out of one type of high power equipment had inaudible resonance effects. Which is why the fans failed frequently in only that type of equipment and not other equipment that used exactly the same components but without the air tunnel. You can imagine how long it took to track that problem down.

We have computer models these days that would enable such effects to be deliberately “designed in”. We also know tampering with equipment “in the supply chain” happens with the likes of certain US and other Western IC entities[1] as “standard practice (interdiction).

Thus the question arises of have they put the two together?

Well we know that the UK MI5 discovered that resonance and similar acoustic effects could be used as a side channel to leak key information from mechanical cipher machines back in the 1950’s and that this was passed to GCHQ as well as the CIA and NSA under “the special relationship”. Because much to Margaret Thatcher’s ire it became public knowledge from a book that was published by an Ex MI5 Scientific Advisor.

We also now know that a supposadly independent manufacturer of crypto equipment in Switzerland was taking design advice from the NSA about “designing in” special defects into mechanical cipher equipment to make not just covert channels that leak key info but also to weaken them in other ways.

Thus I would be very supprised if quite a few IC entities had not put the two together and taken such action.

In fact there is evidence that suggests they might well have done so. If you think back to the Iranian Centrifuge issue, they had a secret test facility that found out what resonance effects to exploit to destroy the equipment. You don’t usually build a “one off” test facillity, once you have a capability, you not only keep it you develop it further. In fact we know they did with the demonstration to the utility industries of what a cyber attack could do to a generator set or similar piece of industrial equipment. It’s even been claimed that the CIA did something similar with a Russian gas pipline[2]. Whilst others have suggested that the CIA also had a hand in the Chernobyl disaster[3] (though the old saw about stupidity and malice suggests otherwise)…

Back in the Obama terms in office the subject of “Kill Switches” to the Internet came up. As I and others pointed out at the time, a kill switch is pointless with APT attacks already having taken place. Because the malware would already be there, and it would only require the most minor of changes to a payload activation code to get it to trigger if a “keep alive” signal or similar stopped.

So I put the probability that certain western IC agencies interdict equipment and add deliberate self destructive flaws or trigerable payloads in it or similar as highly probable. Which realy only leaves questions about which laws of physics they use and how they implement them for their “methods”.

I know the above might make me sound paranoid, but look at it the other way, it is something I would certainly do if I was in their position. Simply because it’s hard to fight a war if all your weapons and equipment suddenly start to fail, when you need them the most.

Likewise if all the kitchen appliances in your citizens homes stop working or become irratic in operation, ill health and demoralizing effects will follow. As I’ve mentioned before Issac Asimov put that idea in his early foundation series books thus the idea will have been read by many way way back.

As a long term friend has pointed out to me we both have a chearfully pessimistic view, in that when we walk into a new room or see a new system we look at ways it can fail and how to exploit them… Something that goes back to our childhoods and “mischief making” at school etc. You could call it the serious / business side of practical joking, our host @Bruce calls it “thinking hinky”…

[1] https://www.theguardian.com/books/2014/may/12/glenn-greenwald-nsa-tampers-us-internet-routers-snowden

[2] https://www.telegraph.co.uk/news/worldnews/northamerica/usa/1455559/CIA-plot-led-to-huge-blast-in-Siberian-gas-pipeline.html

[3] https://m.huffpost.com/us/entry/us_59a6c24ae4b0d81379a81c77

Clive Robinson • June 3, 2018 9:05 AM

@ JG4,

With regards sugars. It’s been known for some time there is a tie up with them and rheumatoid arthritis. The link was found via young women stricken with it having it leave them compleatly during pregnancy. It was discovered in the late 1980’s if my aging noddle serves me well.