Why There’s a CPU in Your Doorbell
Michael Tang
9/12/22
or, the Anomaly of Cheap Complexity
Source: Thomas Dullien’s CyCon Talinn 2019 Keynote
https://www.youtube.com/watch?v=q98foLaAfX8
http://rule11.tech/papers/2018-complexitysecuritysec-dullien.pdf
Why Is there a CPU in Your Doorbell?
Why Is there a CPU in Your Doorbell?
It’s cheaper.
Complex devices are cheaper
1. Moore’s law + economies of scale
Complex devices are cheaper
2. Universal computation
-David Deutsch, 1985
Complex systems are cheaper
3. Software distribution has basically no marginal cost
“How does one design an electric motor? Would you attach a bathtub to it, simply because one was available? Would a bouquet of flowers help? A heap of rocks? No, you would use just those elements necessary to its purpose and make it no larger than needed -- and you would incorporate safety factors. Function controls design.” -The Moon Is A Harsh Mistress (Robert A. Heinlein)
Software makes adding bathtubs, bouquets of flowers, and rocks, almost free.
Universal computation, Moore’s Law, and software make adding bathtubs, bouquets of flowers, and rocks, almost free.
Universal computation, Moore’s Law, and software make adding bathtubs, bouquets of flowers, and rocks, almost free.
Complex devices are less secure
(single-bit-side-note)
High-energy protons and neutrons such as those produced by large particle accelerators, are similar to those cosmic rays that penetrate the atmosphere, and interact similarly with DRAM chips. Such accelerators are often used to test the resistance of electronic components to cosmic radiation, especially components to be used on aircraft and spacecraft. Few attackers — indeed, few nation-states — have access to such accelerators. However, an Americium-Beryllium source (such as is used in oil exploration) produces neutrons that could very likely induce memory errors [13]. Access to such sources is regulated; an attacker could gain access by purchasing a small oil-drilling company, or by becoming employed at such a company.
[...]
Since we lacked the time or inclination to learn the oildrilling trade, we decided to use heat. We induced memory errors in a desktop PC by opening the box and shining light on the memory chips. We used a clip-on lamp with a flexible gooseneck, equipped with a 50-watt spotlight bulb.
(single-bit-side-note)
(single-bit-side-note)
(single-bit-side-note)
Lots of open questions