16 ms·
Intel x86 considered harmful – survey of attacks against x86 over last 10 years
- qntty 11y agoWhy the second post? https://news.ycombinator.com/item?id=10458311 https://news.ycombinator.com/item?id=10458311
- dhuramas 11y agohttps://news.ycombinator.com/item?id=10223645 https://news.ycombinator.com/item?id=10223645 "We've adjusted the dupe detector to reject fewer URLs...[snip/].. Allowing reposts is a way of giving high-quality stories multiple chances at making the front page. Please do this tastefully and don't overdo it." Considering that this second post got much more traction than the first, I don't see anything wrong.
- amyjess 11y agoBoth links were submitted within a minute of each other and were both on the front page at the same time.
- detaro 11y agoI don't think posting two links 1 minute apart was the idea behind this rule change.
- qntty 11y agoBoth were submitted by the same person
- dang 11y agoIn this case the same submitter posted two versions of the story: http://blog.invisiblethings.org/papers/2015/x86_harmful.pdf http://blog.invisiblethings.org/papers/2015/x86_harmful.pdf http://blog.invisiblethings.org/2015/10/27/x86_harmful.html http://blog.invisiblethings.org/2015/10/27/x86_harmful.html Not a great approach; one ought just to pick the better of the two, which in this case is the html, because it gives more background, loads faster, and links to the pdf. General remark: I doubt that we'll make the dupe detector sophisticated enough to catch a case like this, but I do think we'll add software support for users to identify dupes when they see them. That's what happens informally already (as you all did in this thread, and by flagging the other post) so the shortest path to better deduplication for HN seems to be: write software to make community contribution easy. Also I kind of like the idea of giving a karma point to the first user who correctly links a given pair of posts.
- n0us 11y agoI really could do without "considered harmful" titles. x86 has been one of the most influential technologies of all time and a clickbait title doesn't do it justice imo.
- Bahamut 11y agoShould also be noted that the link mentions that the paper contains no new attacks - the title is misleading in this context with the new paper qualifier.
- tptacek 11y agoNeither of these are valid criticisms. Yours first: it is a new paper. It was just released. It has an "October 2015" dateline. It isn't a variant of any previous paper she's released. It's also a very good paper. Second: this isn't a blog post. It's not a news site. It's a research paper. She gave it a title that follows a trope in computer science paper titles. It's silly to call it "clickbait". As someone who's had the misfortune of going toe-to-toe with Rutkowska over details of the X86 architecture, let me gently suggest that whether she knows what she's talking about and what she's trying to say [isn't] really a fight you want to pick.
- notdonspaulding 11y ago> whether she knows what she's talking about and what > she's trying to say is really a fight you want to pick Did you mean to say: "ISN'T really a fight you want to pick"?
- dfc 11y agoI am genuinely curious: Can you not figure this out by the context alone (hint:misfortune)? Or are you going "big-game hunting on HN" and nitpicking tptacek's comment?
- Bahamut 11y agoThat wasn't what I was criticizing - I was criticizing the title on HN. It previously said (new paper). While that is true, in this context, it is actually a summary of existing information. I was not criticizing the quality of information in the paper or article. I was criticizing the summary previously displayed on HN before it was changed, which suggests that someone agrees with me.
- jbob2000 11y agoSo I read the blog post and skimmed the PDF and I'm left with some questions. IF these security issues have been present for 10 years, but there hasn't been any widespread malicious action on them, are they really issues? To create an analogy, my car doesn't have bullet proof glass, someone could easily shoot it up and i'd be dead. But nobody really goes around shooting up cars, so is it an issue?
- pgeorgi 11y agoThe problem is that if you're trying to build a secure computing environment (like Joanna is with Qubes OS), you run into limitations all the time. Those platform issues may not be a problem for Jane Doe on Windows 10, but when users decide that they need more security than that (and Qubes points in the right direction, although there's still some miles to go) they may have a reason (or just paranoia). In either case, they won't be very happy with the sad state that is x86 "security" because there are way too many places where an undue trust into Intel is implied. Eg. the SGX feature, which can run userland code in a way that even the kernel (or SMM) can't read it: The keys are likely mediated by the Management Engine (ME) - which also comes with network access and a huge operating system (for the purposes of an embedded system: the smallest version is 2MB) that you, the user, can't get rid of. So who's SGX protecting you from if you fear involvement by nation state actors? x86 isn't for you in that case (Intel's version in particular, but pretty much all alternatives are just as bad) - and that's what this paper points out.
- pdkl95 11y agoIntel describe[1] SGX as a feature designed to "enable software vendors to deliver trusted[2] applications", where applications would "maintain confidentiality even when an attacker has physical control of the platform and can conduct direct attacks on memory". This already suggests the owner of the CPU isn't who they are protecting, but it gets worse (even before we consider the risk from AMT). Starting an SGX enclave seems to require[3] a "launch key" that is only known by Intel, allowing Intel to control what software is allowed to be protected by SGX. [1] https://software.intel.com/en-us/blogs/2013/09/26/protecting-application-secrets-with-intel-sgx https://software.intel.com/en-us/blogs/2013/09/26/protecting... [2] Before the term "DRM" was coined, the same crap used to be called "trusted computing" (back when Microsoft was pushing Palladium/NGSCB) [3] https://jbeekman.nl/blog/2015/10/intel-has-full-control-over-sgx/ https://jbeekman.nl/blog/2015/10/intel-has-full-control-over...
- deleted 11y ago[deleted]
- JoeAltmaier 11y agoConfused? The entire world uses x86 for almost everything. A couple of consumer products don't, namely some phones.
- metalliqaz 11y agoNot confused, just hipster.
- Xophmeister 11y ago"I use a really obscure instruction set, designed by a bunch of ex-Peruvian monks, working from a bedsit in Shoreditch. You've probably never heard of it."
- JoeAltmaier 11y agoI really had to do that once. Reverse-engineer a wifi driver in an embedded board, some niche RISC instruction set invented by god knows who. Invented a disassemble-annotate-repeat tool called GOLEM based entirely on bitmap-pattern scripts, that would produce a listing. You could edit the listing to include symbolic names for code points and data, then re-run the tool and it would use those names (instead of hex addresses) in the new listing (built a symbol table iteratively). Ultimately I had complete source for the firmware again.
- pyvpx 11y agois GOLEM available publicly and under an open source license?
- JoeAltmaier 11y agoI wish. It was a project I did as a contractor. That company has changed source control systems twice since then, and been bought. I guess I should have kept a copy.
- hmage 11y agoYes yes, everyone should move to MCST Elbrus :D
- nickpsecurity 11y agoNo, use Gaisler's stuff: http://www.gaisler.com/index.php/products/ipcores/soclibrary http://www.gaisler.com/index.php/products/ipcores/soclibrary Also SPARC but with plenty GPL. Has a quad-core, too, with all of them designed to be easily modified and re-synthesized. :)
- e12e 11y agoThere are a few of these (open architectures) - but does anyone know how much (ballpark) it'd cost to make something like the Raspberry Pi 2 (ie: a full SoC, with gig ethernet, usb, hdmi, sata) support? Say 10.000 units? I'm assuming it'd be expensive, as it doesn't appear anyone's doing it...
- alexforencich 11y agoSeveral million dollars. Everything is extremely expensive - IP licenses, ASIC layout software licenses, simulation and verification software and possibly hardware, mask costs, line setup costs, wafer production costs, packaging costs, testing costs, etc.
- e12e 11y agoIp licences for gpled cpu cores and schemas? Several million doesn't sound that bad. Means that the bar moves to 100k rather than 10k units (if the goal is to break even in the short term). And it's tricky to sell 20k units/year for five years, as the cost to upgrade (clock, ram) would probably be in the same ballbark aa initial investment.?
- alexforencich 11y agoIP licenses for things like analog clock management components/PLLs, analog Ethernet PHYs, analog serializers and deserializers for HDMI, SATA, USB 3, etc. These are all mixed-signal components. I am not aware of any open source designs for any of these for modern ASIC targets. Most open source designs target FPGAs which already have these components built onto the FPGA itself (i.e. the open source design uses the module as a 'black box'). These will probably come in GDSII form (actual layout, not a schematic, RTL, etc.) for a specific process with a specific foundry. If you want to design those yourself, then you would have to get additional licenses for analog design and simulation suites. And you might have to re-spin a couple of times (with millions of $ in mask costs) on each targeted process technology to get the kinks worked out.
- petecooper 11y agoThe book referred to by the article -- `Platform Embedded Security Technology Revealed` -- appears to be available for download at no cost right now[1]. Pricing error or not, I've just completed checkout without issue. For completeness, I have no affiliation or correction with Apress -- please consider this a heads-up. [1] http://www.apress.com/9781430265719 http://www.apress.com/9781430265719
- pgeorgi 11y agoIt's free for months, so probably not a mistake.
- kragen 11y agoProbably worth pointing out that the author is the project lead of Qubes, one of the very few promising projects in the vast wasteland of computer security.
- resc1440 11y agoLink for the lazy: https://www.qubes-os.org/ https://www.qubes-os.org/
- kachnuv_ocasek 11y agoVery few? Seriously?
- Pfiffer 11y agoYeah man the only good things in CS are Postgres and common lisp. Everything else is a waste of time.
- nickpsecurity 11y agoTry crash-safe.org or Cambrige's CHERI for hardware; Qflow w/ YoSys for OSS synthesis; Microsoft's VerveOS for OS correctness; Racket for LISP; Google's F1 RDBMS for databases; Ur/Web for web apps; Cornell's JIF/SIF/SWIFT/Fabric for distributed apps; Coqasm for assembler; CompCert and CakeML for compilers/tooling. That's just a tiny selection from my collection. Lots of exciting things going on for secure and correct tools that are still powerful. Postgres and Common LISP are both weak and boring in comparison despite being good tools. :P
- smt88 11y agoI don't know if I understand how most of these things could be considered secure unless they've been heavily attacked already. Are they all so much more secure by design that you consider them to be great projects? My experience is heavily with server-side web languages, so I'm particularly skeptical of those. Even the most secure-seeming web languages have buggy, insecure implementations at first.
- davesque 11y agoThe title's dumb but the paper has some good info in it.
- pmalynin 11y agoFor all of its shortcomings, I still would pick x86 over mips (which is truly horrendous, or maybe it's just once you go cisc you never take the risc) any day of week
- pcwalton 11y agoNothing in this paper has anything to do with the ISA.
- Symmetry 11y agoHmm, my favorite vulnerability is x86's lack of self-synchronization meaning that the same byte-stream could be two different streams of valid instructions depending on where you start reading. http://mainisusuallyafunction.blogspot.com/2012/11/attacking-hardened-linux-systems-with.html http://mainisusuallyafunction.blogspot.com/2012/11/attacking...
- rockdoe 11y agoThis technique is also used to render W^X useless.
- pjc50 11y ago"System management mode" is a tremendous wart and should be removed wholesale, with Intel adopting a more ARM-style trusted boot chain with explicit cooperation from the OS or hypervisor. And while you're at it, kill UEFI and install a pony for me. (Seriously, SMM serves either bizarre ILO features that high-end vendors like but are rarely used, or security agencies looking for a layer to hide in.)
- pgeorgi 11y agoSMM is used all the time: Several Intel chipset generations require certain register writes on shutdown (disable busmaster) or they won't _actually_ shut down. Operating systems aren't aware of that. (https://github.com/coreboot/coreboot/blob/master/src/southbridge/intel/i82801gx/smihandler.c#L364 https://github.com/coreboot/coreboot/blob/master/src/southbr...) UEFI Secure Boot requires "authenticated variables", which can be updated by the OS (after checking authentication, using a signature scheme). UEFI code resides somewhere in memory, so the OS (or ring0 code) could opt to bypass the verification and simply rewrite those variables. The recommended (but not required) solution is to move variable update to SMM. (https://firmware.intel.com/sites/default/files/resources/A_Tour_Beyond_BIOS_Implementing_UEFI_Authenticated_Variables_in_SMM_with_EDKII.pdf https://firmware.intel.com/sites/default/files/resources/A_T...) Several hardware features are actually implemented in SMM. I've seen SMM-based handling of certain special keys (eg. "disable Wifi" button) where ACPI grabs the event, then traps into SMM using a magic IO port.
- pdkl95 11y ago> and simply rewrite those variables Good luck trying that once that memory is encrypted with SGX.
- pgeorgi 11y agoSGX is too complex for such purposes, and it also doesn't provide access levels to hardware. The alternative to hooking into UEFI code would be to just write to flash by yourself. SMM has additional permissions there.
- 11y ago
- deleted 11y ago[deleted]
- 0xdeadbeefbabe 11y agoDon't they know considered harmful essays are considered harmful? http://meyerweb.com/eric/comment/chech.html http://meyerweb.com/eric/comment/chech.html
- seccess 11y agoAn interesting point I read awhile ago (wish I could find the article) is that variable-length instruction sets (like x86) are preferred by authors of malicious software over fixed length sets because the binaries are harder to analyze. That is because in variable length ISAs, you must use a recursive decent parser to find all code paths in the program, because jump targets are specified in bytes or words instead of discrete instructions. This allows someone to jump into what might be the data portion of an instruction when parsed one way, and now the behavior totally changes because the bytes are being interpreted another way.
- kaesve 11y agoAre you talking about "The Geometry of Innocent Flesh on the Bone: Return-into-libc without Function Calls (on the x86)"(https://cseweb.ucsd.edu/~hovav/dist/geometry.pdf https://cseweb.ucsd.edu/~hovav/dist/geometry.pdf)? Great paper with a great title.
- seccess 11y agoI wasn't, I'm pretty sure it was a blog post not an academic paper. Regardless, this paper looks awesome thanks for the link :D
- ris 11y agoYes, but this property is probably more regularly used for ROP attacks.
- ajdlinux 11y agoThis has bitten me in CTFs before - anyone aware of any disassembler tools that help with this problem?
- Animats 11y agoThere just have to be backdoors built into the Intel Management Engine. Intel won't disclose what code it executes, so we have to assume there's a backdoor. The question is, whose backdoor. It would be useful to install some honeypot machines which would appear to be interesting to governments (an ISIS bulletin board, for example) and record every packet going in and out.
- nickpsecurity 11y agoThis is why I laugh about people here that laugh about backdoors in their TRNG, etc. Intel's been backdoored for AMT, etc for a while. Those circuits, due to NRE costs, have to be in most of their chips whether they advertise them or not. They have deep read access into everything in the system with who knows what write access. We also know some of their chipsets have radios in them which might be in the others, permanently or temporarily disabled. Just a huge black box of interconnected black boxes at least one set of which is definitely a backdoor. And worst thing is I heard it can work when the machine is entirely or somewhat powered down. (!) I don't know for sure because I won't buy one lol. The old stuff less likely to have those features works fine for me with my builds. Gaisler's stuff and RISC-V are best hope as they're both open hardware plus getting fast. Gaisler's are already quad-core with as much I.P. as people could ever use. Anyone wanting trustworthy hardware knows where to start on building it. CheriBSD on CHERI capability processor is also open-source and can run on a high-end FPGA. So, there's that for use or copying in a Gaisler modification.
- throwaway7767 11y ago> Gaisler's stuff and RISC-V are best hope as they're both open hardware plus getting fast. Gaisler's are already quad-core with as much I.P. as people could ever use. Anyone wanting trustworthy hardware knows where to start on building it. CheriBSD on CHERI capability processor is also open-source and can run on a high-end FPGA. So, there's that for use or copying in a Gaisler modification. How can you trust the FPGA? Or the very closed-source bitstream generator necessary to compile the VHDL/Verilog code? Assuming you want to manufacture secure processors from these designs, how can you trust the chip fab? I'm genuinely interested, as I'm not aware of any research into protection from these issues.
- justin_vanw 11y ago" "Considered Harmful" Article Titles Considered Derivative and Uncreative"
- nickpsecurity 11y agoBest enumeration of x86 security problems I've seen so far. Solid argument to avoid Intel in security-critical products where possible. :)
- nn3 11y agoTo paraphrase Stroustrup: There are two kinds of systems: the ones that have security holes and the ones that people don't use.
- caf 11y agoThe footnote link [13] in section "The audio card" is an unrelated footnote, the correct one appears to be missing.