New tech can see a CPU's transistors in action — terahertz radiation can potentially steal data as a chip is running
Terahertz waves enable the detection of transistor activity in a chip
Researchers at Adelaide University have made a discovery that could change the way we test semiconductors for good. As reported by IEEE Spectrum, these researchers have discovered a method of detecting a chip's transistor activity using terahertz radiation.
The process involves using a laboratory tool known as a vector network analyzer or VNA, which generates a microwave signal "with a known frequency and phase." A VNA frequency extender converts the microwave signal into a terahertz wave, which then gets beamed onto a microchip using a focusing lens.
Testing requires the chip to be turned on and to be doing work. As the transistors inside switch on and off, the terahertz signal reflects these changes and returns to a receiver in the VNA extender. Afterward, the signal is "down-converted" to microwave and compared to the original signal by detecting tiny differences in amplitude and phase using a homodyne quadrature receiver.
Article continues belowOne of the researchers, Withawat Withayachumnankul, revealed his team had to hack the receiver to make it work in the terahertz domain. The device was only designed to compare microwave frequencies. The use of a homodyne detector was critical, as it is allegedly the only device that can detect the small differences between the two frequencies. Terahertz signals are physically larger than the transistors being probed by the signal, making any adjustments in the returning signal difficult to detect without a homodyne detector. Additionally, noise from the oscillator in the VNA can reportedly easily obscure any changes in signal difference as well.
The most intriguing part of this new technology is its ability to peer into a processor's internals while it is working. This is something that is reportedly not possible with any other tooling and opens up new possibilities for technicians to diagnose and test processors.
However, there are issues that need to be ironed out before this technology goes mainstream. Measuring CPUs with terahertz radiation can reportedly be problematic with complex chips that have multitudes of layers of components stacked on top of one another, such as CPUs equipped with 3D stacked chiplets, potentially. Specifically, the radiation can't detect which layer of a chip it is reading from if the "over-layers are opaque". To get around this, techniques are being discussed to increase the VNA's sensitivity to accurately test densely packed chips.
Another issue with this technology is the potential for attackers to probe into a CPU as it is running to steal data. Likely, this will only happen once the technology matures, but it is something that the security industry will likely need to start countermeasuring eventually. What makes this attack so dangerous is that outgoing encryption standards can't counter it, since CPUs have to decrypt data before processing it.
Get Tom's Hardware's best news and in-depth reviews, straight to your inbox.
Follow Tom's Hardware on Google News, or add us as a preferred source, to get our latest news, analysis, & reviews in your feeds.

Aaron Klotz is a contributing writer for Tom’s Hardware, covering news related to computer hardware such as CPUs, and graphics cards.
-
ravewulf It's only dangerous if it's both practical to use and easier than other existing methodsReply -
Sam Hobbs Reply
Is there any other method available now to read a chip's transistor activity without a physical connection?ravewulf said:other existing methods -
Stomx I dunno what and how they will see anything besides almost white noise if transistors on N2 node having physical sizes 50x50 nanometers and are made using even 30x shorter wavelengths ( EUVL/Soft X-rays ) than any visible light let alone terahertzsReply
In short, transistor is 50 nm, green light is 500 nm, terahertzs are longer than 30,000 nm and though it is somewhat possible to resolve sub-wavelengths features but not by 600x smaller than the wavelength -
Notton Seems impractical as anyone knows microwaves are absorbed by metal, and microchips are typically covered by a metal heatsink.Reply -
Stomx Reply
That is easy to remove. Of course cooling problem will arise.Notton said:Seems impractical as anyone knows microwaves are absorbed by metal, and microchips are typically covered by a metal heatsink.
Cooling probably can be done by the cold air stream -
Notton Reply
That would require physical access.Stomx said:That is easy to remove
If a hacker has that much access to a computer, getting data pulled from the chip is the least of your worries. -
Stomx Reply
Of course. But that all is not about hackers. That is about diagnostics, troubleshooting and reverse-engineeringNotton said:That would require physical access.
If a hacker has that much access to a computer, getting data pulled from the chip is the least of your worries. -
umeng2002_2 I wonder if this was tested on a real processor or just a test device. You could simply ground the heat spreader or the power delivery routings inside the processor could shield the signal.Reply