Hector Martin

The thing is the only reason you'd do this instead of just modifying the flash would be to more easily survive updates, or if the flash is programmed too late in the process to hijack.

How practical on a several layer deep board is it to add a chip the board wasn't designed for to tap enough traces on a bus to modify memory in real time?

Trivial, if you can just change the board design, which is what they allegedly did. This is a manufacturing side attack.

Trivial as in adding the chip or rerouting the board? It's been a long time since I was routing pcbs, but it never felt particularly trivial. Especially if you needed to create a version w/ and w/o the chip. Otherwise wouldn't they all have the spot for the chip right there?

The chip is right in between the flash and the BMC. It's literally moving a few traces to pass through the chip. Anyone experienced with a gerber editor could do it in 15 minutes. It's not a particularly dense layout.

I assume it'd be relatively easy with an unmodified board to tell if those traces pass through that area (and other things do not) to tell if it's practical to pull bring them to the chip?

Yes. I'm pretty sure I see likely traces on the top layer anyway, and this section really isn't dense. Trust me, getting the traces routed to a good spot for an implant is the easy part of this whole operation.

https://twitter.com/taviso/status/1048222789767901184 …