5 ms·
Hmm. OK, I have two questions - maybe somebody here has answers: 1) "...these proprietary blobs could easily contain code to exfiltrate encryption keys, remot
by jMyles 11y ago
Hmm. OK, I have two questions - maybe somebody here has answers:
1) "...these proprietary blobs could easily contain code to
exfiltrate encryption keys, remotely activate microphones and cameras..."
This seems basically impossible to actually achieve in reality though, because there will still associated network traffic that can be sniffed, and will have been by now, right? I mean, it is plausible that somehow we all just failed to notice that our computers are sending video traffic to the NSA without our noticing it?
I can imagine this happening on phones, where the baseband chip is much harder to actually sniff. But through my LAN? I doubt that.
2) Let's imagine that this post is entirely true. Why do Intel and AMD do this? If it's not part of a grand conspiracy, then why? Clearly there are far easier and cheaper ways to achieve what they view as security that don't require such a crippling approach. What's the upside to them?
- salem 11y agoIt's called covert channels. It could be done by flipping some unused/ignored bits in ip4/tcp headers in a stream of traffic that goes past a collection point.
- jMyles 11y agoBut this is still easily visible with wireshark, right? Don't you think we'd have discovered this by now?
- erikpukinskis 11y agoThere are ways of doing it invisibly. Change timestamps in very subtle ways, Embed data in lossy media formats, etc. If the code says "phone home if anywhere on the screen you see one of the following email addresses" then it won't show up in a normal security audit, unless you email one of those people during the audit. All the NSA has to do is make the phoning home rare enough that it's probabilisticly unlikely to be observed.
- teraflop 11y agoHow would Wireshark reveal this kind of attack? If the management chip has direct hardware access, it can hide data in innocuous-looking packets that the host machine never sees. You would have to monitor both the packets that the OS thinks it's sending, and the packets actually received by the switch, and constantly compare them for mismatches. Given the performance cost, I find it hard to believe that anyone except the most paranoid organizations would actually do this. And of course, if you block the obvious exfiltration methods, all you do is force the attacker to do something more creative. Like modulating inter-packet timings, or even sending data to a nearby radio receiver by using the system bus as an antenna.
- nucleardog 11y ago> How would Wireshark reveal this kind of attack? If the management chip has direct hardware access, it can hide data in innocuous-looking packets that the host machine never sees. Lots of organizations use various forms of intrusion detection. A network intrusion detection system (NIDS) would be an off-device system which monitors network traffic for suspicious or obviously malicious packets. It's certainly no guarantee, but somewhere along the line someone probably would have noticed something if these systems were exfiltrating data via the network using something like IPv4 headers. Specifically, a quick look makes it look like Snort (an open source NIDS) may actually be distributed with rules to alert on IPv4 reserved bits being set.
- na85 11y agoYou keep saying that "someone should have noticed something" but as the old adage goes, absence of evidence is not evidence of absence What you seem to keep missing is that we know from the Snowden leaks that the capability already exists, and NSA has successfully used implants to do data exfil in the past.
- Qwertious 11y ago"absence of evidence is not evidence of absence" This isn't true. Absence of evidence is weak evidence of absence, and suggests that it's not the case. Not disagreeing with anything else in your comment, but that quote completely defies Bayes 101.
- chithanh 11y agoExfiltration of logged keystrokes and other data is possible through introducing network packet jitter by the ME. This is virtually undetectable. https://events.ccc.de/congress/2013/Fahrplan/events/5380.html https://events.ccc.de/congress/2013/Fahrplan/events/5380.htm...
- deleted 11y ago[deleted]
- acveilleux 11y agoThe fact that the NSA has implants (from the various Snowden files) that do exactly this and exfiltrate over a network should tell us that this is not so far fetched. The bulk of the data volume is only used when the capability is being exploited. It would not be so hard to send out marker of exploitability over innocuous traffic (say tweaking an HTTP header) meant to be picked up by sniffing / MotS.
- bahjoite 11y agoTo your 1): there would indeed be network traffic, but how many people have a machine they can truly trust capturing and analysing enough of the traffic going in and out of their LAN? Unfortunately there are few, if any, machines we can truly trust.
- digler999 11y agoI agree that if these things were by default constantly exfiltrating, say, webcam data, someone would have noticed. But their use is likely much more insidious. Any keyboard event generates some kind of interrupt on x86, right ? Suppose this "ME" happens to record the last 64k keystrokes into a rolling buffer. Furthermore, suppose there is a very, very particular sequence of instructions that can be sent to retrieve this rolling buffer ? Boom. No more encryption (at least none that requires typing a key in from the kb). Oh, you use binary keys ? Cool, intel has special x86 instructions for doing AES. I'm sure they wouldn't do anything like copy the, oh...KEYS, into the hypothetical rolling buffer, would they ? No, that would be "dishonest", and we all know everyone who makes computer hardware and software would never think of doing something so egregiously deceitful, don't we ?
- nebulous1 11y agoHe's not saying that all machines are actively doing any of that, or even that Intel/AMD/anybody have already developed code to do so. He's just pointing out that this chip exists, it has to capability to do what he's described, and there's nothing that we can currently do to stop it if we're using an affected machine, as we don't have any control over the code being run. As to why the companies would do this ... it wouldn't necessarily be them if they lost control of the signing keys. And you can't ignore the fact that the FBI just tried to get Apple to do something pretty damn similar.
- jMyles 11y ago> And you can't ignore the fact that the FBI just tried to get Apple to do something pretty damn similar. I was very against the FBI's reasoning in the Apple case (and in fact, I'm against their existence generally). But I don't think that bypassing an unlock retry limit is "pretty damn similar" morally, legally, or technologically to a solution that can arbitrarily execute code remotely, on demand, and with root privileges on nearly any PC and game console in the world.
- nebulous1 11y agoHave to quite strongly disagree with you there. The FBI wanted Apple to create and sign software that they could forcibly push onto the phone in order to get it to do what they wanted it to do. In the recent case it was about bruteforcing a passcode, but the concept is identical regardless of the payload. It's exactly the same scenario Intel or AMD could be faced with. The entire Apple situation hinged on the fact that it was possible for Apple to comply, without that there would be no situation.
- pdkl95 11y ago> without our noticing it? Nobody noticed the bad heartbeat packets being sent to openssl for a long time.
- viraptor 11y agoRe. 1 - depends what the data and the receiver looks like and what is your end goal. If you want to "phone home" over normal network, then sure, it's going to be obvious. But if you want to preserve all the generated private keys and just send them over RF on bootup using the chip itself as an antenna? That's in the easy territory.
- soraminazuki 11y agoYeah, all the stuff we know from the Snowden leaks are "part of a grand conspiracy theory", I guess...at least according to you.
- jMyles 11y agoWell is it? Or isn't it? Why do you say, "according to [me]?"