麻豆传媒

EVEN if you鈥檙e not a hacker or a coder, chances are you will have heard names like Stuxnet, NotPetya or WannaCry. After all, these malicious programs have made big waves in the past few years. First it was Iran鈥檚 nuclear centrifuges that were the target, then Ukraine鈥檚 banks, then last year, hospitals in the UK. These cyberattacks keep coming.

The standard response is to release software patches, the updates that pop up on our computers and smartphones. They are designed to seal up the holes that hackers exploit to smuggle their malicious code through. The trouble is, there are more than 100,000 holes out there 鈥� and that鈥檚 just the ones we know about. Plenty more are surely waiting to be found. 鈥淭o successfully defend, you must find all weaknesses and plug them,鈥� says Linton Salmon, who runs a computer security programme at the US Department of Defense. 鈥淭o successfully attack, you only need to find one.鈥�

It鈥檚 a losing battle, and one we can no longer afford to fight. As we build the internet of things, putting simple processors into garage doors, fridges, light bulbs and windscreen wipers, that truth is only going to become plainer. If we are going to put computers in everything, it is time we souped up their defences.

That is what Salmon and a few others have been quietly working on. We can protect ourselves from cyberattacks, they say, not with ever more patches, but with changes to computers鈥� underlying electronics. It means overhauling the way we build microprocessors, but the world鈥檚 biggest chip-makers are already getting in on the action. With a layer of protection at the heart of every chip, the hope is that we will stem the tide of cyberattacks.

Most of us use at least two computers a day, whether they be laptops, tablets, smartphones or smartwatches, and we are used to software like web browsers and spreadsheets doing our bidding. When you strike a key or click an icon, that instruction must ultimately be carried out by the computer鈥檚 hardware, specifically the processor, which is usually a single microchip. The building blocks of the processor are transistors 鈥� minuscule electronic switches 鈥� organised into functional components like memory and logic units.

But software can鈥檛 communicate directly with transistors. Software is based on words and symbols, whereas transistors understand only two commands: switch on or switch off. To help the software and hardware communicate, there are go-betweens, such as programs called compilers that translate software instructions into machine code, a binary language of 1s and 0s, or ons and offs.

Big, dumb retriever

How that translation works is determined by the chip鈥檚 architecture. This is the set of rules, embodied in the physical design of the processor, that governs how the software gets access to the hardware. It determines how much memory a program has access to, for example. 鈥淭hink of it like a contract that tells the software people what to expect from the hardware,鈥� says Richard Grisenthwaite of Arm, the firm that makes processors for most smartphones.

The rules vary slightly with the processor, but all architectures are similar, particularly in one respect. 鈥淎 chip is fundamentally gullible,鈥� says Salmon. 鈥淕ive it any instruction you like, and it says: 鈥極kay, let me do that as fast as I can! Does it make any sense? I don鈥檛 care, you asked me to do it. You鈥檙e the boss!鈥� It鈥檚 like a big, dumb golden retriever.鈥�

There鈥檚 a good reason for this. In the 1970s, chips had only about 5000 transistors. To make processors as fast as possible, none could be wasted. Architectures were designed so that whenever software made a demand the chip would comply, no questions asked.

Some 50 years later, the chips in your laptop and smartphone have about 5 billion transistors. But the golden retriever architecture has remained, largely because changing it significantly would make it incompatible with existing software.

The unpleasant consequence is that when a hacker finds a sneaky way into a processor, it is only too happy to oblige any requests. That means it is possible to harvest sensitive data like usernames and passwords or get the processor to do nefarious deeds.

The idea of making chips less gullible is not new. More than a decade ago, computer scientist at Princeton University published designs for processors that would wipe parts of their memory automatically after a period of time. Back then, the big chip manufacturers weren鈥檛 interested, but that鈥檚 starting to change for a few reasons. For one thing, 5 billion is a lot of transistors. Processors are now so fast that we can afford the drop in speed when we devote a few to security checks. For another, we are increasingly spooked by hacks, and security is becoming a selling point.

It鈥檚 not just Lee who has long seen the need for better security. In 2010, Howie Shrobe, a computer scientist at the Massachusetts Institute of Technology (MIT), went to the US government鈥檚 Defense Advanced Research Projects Agency, where he launched a programme known as . It posed a simple question: given everything we know about security today, how would we design computing infrastructure 鈥� hardware, software, servers, networks, the lot 鈥� if we started from scratch?

The biggest problem the project identified was how interconnected computers are, giving hackers easy access to a lot of information. But that horse has long since bolted, so CRASH homed in on one way forward: redesigning the hardware.

Salmon picked up where CRASH left off. He trawled the world鈥檚 most authoritative , kept by the Mitre Corporation, a non-profit organisation based in Massachusetts, and identified the most common hardware ones. There turned out to be seven main classes of hardware vulnerability, which together account for almost half of known hacks (see 鈥�Deep hacks鈥�).

In 2017, Salmon launched a programme called System Security Integrated Through Hardware and Firmware (SSITH). It is giving nine competing research teams a share of $60 million to develop processors impregnable to all those seven classes of attack by March 2020. No one has tried anything this ambitious before.

The gold standard of hardware defence is formal verification, a way of using fiendishly complicated maths to prove that the hardware does only what it should do. It requires rigorous checks to be made, which takes time. So far, it has only been used in custom-made chips for applications where human life is at stake, for example in flight control systems.

That鈥檚 changing.鈥滻 looked into formal methods a few years ago and was pretty disappointed,鈥� says Ben Laurie, head of security at the Google-owned artificial intelligence firm DeepMind. 鈥淏ut then I looked into it again more recently and was surprised by the amount of progress.鈥� Salmon is similarly confident. He says improvements to algorithms should make formal verification of hardware practicable by 2020.

at MIT is working on a processor design that uses formal verification as part of SSITH. 鈥淲e鈥檙e building a compiler that automatically implements that idea,鈥� he says. At the moment, however, his method only works for parts of chips, and it is uncertain how quickly it can be scaled up.

A good backstop option might not be too distant, however, thanks to another line of research for SSITH: instead of radically redesigning processors, you can give them a partner to help them out.

This idea is being taken forward by , an engineering non-profit company headquartered in Cambridge, Massachusetts. Inside the main processor, every kind of data is given a tag that specifies what security policies it must adhere to. Those policies are held on an adjacent coprocessor, which vets every action the main processor takes. If anything breaks the rules, the flinty-eyed coprocessor stops it. If it tries to find another way to execute, the coprocessor shuts down the program. Draper calls this an inherently secure processor.

This set-up allows chip manufacturers the best of both worlds. Should someone identify a new hardware vulnerability, the policies in the co-processor can be updated without messing around with the main chip. 鈥淎 new policy can be deployed almost immediately,鈥� says Draper scientist Curtis Walker. It is as fast as a software update, and as strong as changing the hardware.

Still, even if this prevents people from stealing passwords, continual attacks could force programs to shut down. That鈥檚 far from ideal 鈥� especially if the program is controlling something crucial, like an electricity grid or a nuclear power plant.

, who studies secure computer architectures at the University of Cambridge, is working on a third way with colleagues at Cambridge and at SRI International, a research institute in California.

His architecture, called CHERI, traps malicious software, partitioning it off so it can do little damage. Think of what happens when everyday software like Microsoft Word freezes on your computer. You can force it to quit with a few clicks, and this won鈥檛 affect other applications. CHERI works in a similar way, at the hardware level.

鈥淗ackers can get into chips 鈥� but then they鈥檙e trapped with nowhere to go鈥�

Let鈥檚 say a hacker emails you a corrupted image that, if clicked on, will trick your email software into sending malicious code to the processor. A processor using the CHERI architecture will construct a perimeter wall that isolates the compromised part of the processor. This wall is reconfigurable, so it can trap the enemy code in one mailbox, one email or even just the corrupted image

itself. Attackers can get in, but then find themselves with nowhere to go.

听

Some infrastructure already uses incredibly secure chips: nuclear plants for example. The people who run them 鈥渁re even more paranoid than I am鈥�, says Salmon. But those chips are expensive and slow, optimised for one job. You couldn鈥檛 use them in a smartphone or a laptop.

Switching the processors in those everyday computers for something more secure would mean a huge upheaval. 鈥淚t鈥檚 really not that simple to replace the systems that are out there,鈥� says Katie Moussouris, an information security researcher who started Microsoft鈥檚 bug bounty programme, which pays hackers to report software vulnerabilities. So will it ever happen?

Armageddon chips

There are reasons to be optimistic. Sarah Leeper, an engineer at Draper, works with a spin-off company called Dover Microsystems that is already marketing a commercial version of the inherently secure processor. Leeper says the firm is in touch with electricity grid operators who want to use it.

The major microchip manufacturers have also begun to take less radical steps towards making hardware that helps constrain the software that runs on it. 鈥淲e are already working on our own hardware security projects,鈥� says Ronak Singhal, an engineer and senior fellow at Intel.

Even the cheapest chips, those in devices that might be connected to the internet of things, could be switched. Arm鈥檚 primary interest beyond phones is in such devices, and Grisenthwaite says the firm has long been watching Watson鈥檚 CHERI architecture. 鈥淲e are really interested in what he鈥檚 doing.鈥�

But hardware security is unlikely to end cyberattacks completely. 鈥淭he ground is littered with the bodies of all the people who have 鈥榮olved鈥� cybersecurity,鈥� says Salmon. That鈥檚 partly because there will always be old systems in our computing infrastructure, not to mention attacks that rely on human gullibility: phishing, for example, or someone putting a sticky note bearing their password on their monitor.

Sooner or later, something very important will be attacked, perhaps a power grid, bank or hospital, with major consequences. That鈥檚 why it is good to think about a hardware overhaul, says Lee. 鈥淲e need a chip that we can use the day after the catastrophe,鈥� she says. 鈥淚f the change doesn鈥檛 happen before that day, it will happen after 鈥� and it will happen fast.鈥�

This article appeared in print under the headline 鈥淐an鈥檛 hack it鈥�