How open source hardware increases security

Want to boost cybersecurity at your organization? Switch to open source hardware.
295 readers like this.
Internet-enable your microcontroller projects for under $6 with ESP8266

 

Billie Grace Ward on Flickr. CC BY 2.0

Hardware hacks are particularly scary because they trump any software security safeguards—for example, they can render all accounts on a server password-less.

Fortunately, we can benefit from what the software industry has learned from decades of fighting prolific software hackers: Using open source techniques can, perhaps counterintuitively, make a system more secure. Open source hardware and distributed manufacturing can provide protection from future attacks.

Trust—but verify

Imagine you are a 007 agent holding classified documents. Would you feel more secure locking them in a safe whose manufacturer keeps the workings of the locks secret, or in a safe whose design is published openly so that everyone (including thieves) can judge its quality—thus enabling you to rely exclusively on technical complexity for protection?

The former approach might be perfectly secure—you simply don’t know. But why would you trust any manufacturer that could be compromised now or in the future? In contrast, the open system is almost certain to be secure, especially if enough time has passed for it to be tested by multiple companies, governments, and individuals.

To a large degree, the software world has seen the benefits of moving to free and open source software. That's why open source is run on all supercomputers, 90% of the cloud, 82% of the smartphone market, and 62% of the embedded systems market. Open source appears poised to dominate the future, with over 70% of the IoT.

In fact, security is one of the core benefits of open source. While open source is not inherently more secure, it allows you to verify security yourself (or pay someone more qualified to do so). With closed source programs, you must trust, without verification, that a program works properly. To quote President Reagan: "Trust—but verify." The bottom line is that open source allows users to make more informed choices about the security of a system—choices that are based on their own independent judgment.

Open source hardware

This concept also holds true for electronic devices. Most electronics customers have no idea what is in their products, and even technically sophisticated companies like Amazon may not know exactly what is in the hardware that runs their servers because they use proprietary products that are made by other companies.

In an incident reported by Bloomberg, Chinese spies recently used a tiny microchip, not much bigger than a grain of rice, to infiltrate hardware made by SuperMicro (the Microsoft of the hardware world). These chips enabled outside infiltrators to access the core server functions of some of America’s leading companies and government operations, including DOD data centers, CIA drone operations, and the onboard networks of Navy warships. Operatives from the People’s Liberation Army or similar groups could have reverse-engineered or made identical or disguised modules (in this case, the chips looked like signal-conditioning couplers, a common motherboard component, rather than the spy devices they were).

Having the source available helps customers much more than hackers, as most customers do not have the resources to reverse-engineer the electronics they buy. Without the device's source, or design, it's difficult to determine whether or not hardware has been hacked.

Enter open source hardware: hardware design that is publicly available so that anyone can study, modify, test, distribute, make, or sell it, or hardware based on it. The hardware’s source is available to everyone.

Distributed manufacturing for cybersecurity

Open source hardware and distributed manufacturing could have prevented the Chinese hack that rightfully terrified the security world. Organizations that require tight security, such as military groups, could then check the product's code and bring production in-house if necessary.

This open source future may not be far off. Recently I co-authored, with Shane Oberloier, an article that discusses a low-cost open source benchtop device that enables anyone to make a wide range of open source electronic products. The number of open source electronics designs is proliferating on websites like Hackaday, Open Electronics, and the Open Circuit Institute, as are communities based on specific products like Arduino and around companies like Adafruit Industries and SparkFun Electronics.

Every level of manufacturing that users can do themselves increases the security of the device. Not long ago, you had to be an expert to make even a simple breadboard design. Now, with open source mills for boards and electronics repositories, small companies and even individuals can make reasonably sophisticated electronic devices. While most builders are still using black-box chips on their devices, this is also changing as open source chips gain traction.

Creating electronics that are open source all the way down to the chip is certainly possible—and the more besieged we are by hardware hacks, perhaps it is even inevitable. Companies, governments, and other organizations that care about cybersecurity should strongly consider moving toward open source—perhaps first by establishing purchasing policies for software and hardware that makes the code accessible so they can test for security weaknesses.

Although every customer and every manufacturer of an open source hardware product will have different standards of quality and security, this does not necessarily mean weaker security. Customers should choose whatever version of an open source product best meets their needs, just as users can choose their flavor of Linux. For example, do you run Fedora for free, or do you, like 90% of Fortune Global 500 companies, pay Red Hat for its version and support?

Red Hat makes billions of dollars a year for the service it provides, on top of a product that can ostensibly be downloaded for free. Open source hardware can follow the same business model; it is just a less mature field, lagging open source software by about 15 years.

The core source code for hardware devices would be controlled by their manufacturer, following the "benevolent dictator for life" model. Code of any kind (infected or not) is screened before it becomes part of the root. This is true for hardware, too. For example, Aleph Objects manufacturers the popular open source LulzBot brand of 3D printer, a commercial 3D printer that's essentially designed to be hacked. Users have made dozens of modifications (mods) to the printer, and while they are available, Aleph uses only the ones that meet its QC standards in each subsequent version of the printer. Sure, downloading a mod could mess up your own machine, but infecting the source code of the next LulzBot that way would be nearly impossible. Customers are also able to more easily check the security of the machines themselves.

While challenges certainly remain for the security of open source products, the open hardware model can help enhance cybersecurity—from the Pentagon to your living room.

Tags
Joshua Pearce
Joshua M. Pearce is the John M. Thompson Chair in Information Technology and Innovation at the Thompson Centre for Engineering Leadership & Innovation.

5 Comments

I agree, and a lot, I hope I would be able to buy some day at least a FOSH phone. with Risc V and ??? as OGP and Miaow seems to be far from being an ARM GPUs alternative, But maybe some army want to put some money into security and make FOSH CPUs and GPUs or APUs able to compete with actual duopoli.

I look forward to the day when the "CPU's" on my laptop or desktop's motherboard are completely open!...No hidden "Management Engines" which can pipe data back to whomever. That would be the best of all worlds.....open source software....running on open source hardware. I think that is the aim of companies like Purism...and others.....but I guess they are getting a lot of push-back from the corporations that don't want this to become a reality? And Yes. I realize it could also be a security risk as well...(after all you wouldn't be able to tell who's hiding what information on their systems...from blueprints for bombs..to military secrets..) this was the conundrum that was faced by the FBI when Apple refused to give access to their devices....so I can understand that from the other side. It just would be nice though to have total and unrestricted privacy to the data on my computer. Not so much that I have stuff to "hide"....(unless that one time in Las Vegas with some showgirls counts!...LoL!) but I just get the creepy-crawlies thinking that someone could possible be looking at phones from the last family reunion...or reading the personal letters I've typed up to friend...family....lovers etc. Maybe there really IS no happy medium?

Insightful and informative post. Thank you very much for sharing. :)

Great article! Following the Kerckhoffs's principle, "A cryptosystem should be secure even if everything about the system, except the key, is public knowledge."

Everything about Security is essential to discuss these days since even though we are getting more secure tools every year, the hackers also become smarter and get their hands on better hacking software for each year. Now when crypto has acquired a more significant role in the society, people who are less informed becomes easy targets, which is a dream come true for all the hackers.
Anyways, thanks for taking the time to write this article! :)

Really great!

Creative Commons LicenseThis work is licensed under a Creative Commons Attribution-Share Alike 4.0 International License.