5 ms·

And what if intel is compromised? Mass rootkit installation!

by mempko 10y ago

hellbanner 10y ago
My thoughts exactly! What a great way to get rootkits on people who want to protect themselves. The code is here: https://github.com/chipsec/chipsec https://github.com/chipsec/chipsec
tptacek 10y ago
You can reverse engineer the EFI modules, build a whitelist based on known safe code, and then detect subversion at Intel, so this is not a good strategy for serious adversaries.
- etiam 10y ago
  In theory, sure. Is it sufficiently simple that people will do it in practice? (I don't know, I expect you would know) Wouldn't the malicious alterations introduced in a scenario like that most likely be exploitable defects that could be explained away as mistakes? If they accumulate too much around certain people that's suspicious of course, but it seems like it would often be difficult to downright prove that someone intentionally broke the security of a rather complex system.
  - tptacek 10y ago
    The point is that it doesn't matter what the typical person will do. All that matters is that somebody, somewhere reverse engineers the EFI binaries, and that it's easy enough for normal people to run a program to check their current EFI against a whitelist of known good EFI binaries. This is a banal point, except: if the threat is that Intel (or some other huge vendor) backdoors their EFI binaries, it will get out that they did so. It's not "the perfect crime"; it's practically the opposite of that: one guaranteed to be detected, and that will exact maximal damage on the perpetrators when it gets out.
grandalf 10y ago
Of all the attacks a nation state could do, surely finding a few talented people to get PhDs in the appropriate fields and go to work at Intel and collect a paycheck along with a nice stipend from the nation state is likely among the easiest.
- kbenson 10y ago
  I'm not sure it's all that easy, since a) you can't know exactly how good someone is going to turn out to be (you can probably get close through), and b) you can't tell what Intel will be hiring for later, and c) to increase your odds you probably want more than a few people in this program to achieve at least a few people being hired in positions that are useful. That said, the main hurdles seem to be managing people and funds, which government agencies seem pretty good at figuring out. So maybe not all that easy, but maybe not particularly hard either. The biggest problem might be keeping it secret, given the number of people that might need to be involved that are clandestinely working for a TLA but not as their main job and not steeped in the culture of secrecy.
- mcbits 10y ago
  Probably easier to find an existing employee with financial problems and offer a duffel bag of cash to plug in a USB stick for 30 seconds.
  - digler999 10y ago
    This is like the opposite or corollary of the "$5 rubber hose" cryptography cracking device.
    - mrkgnao 10y ago
      Did you mean the xkcd "crypto nerd" wrench, or is this a reference to something else? E: ah, TIL. https://en.m.wikipedia.org/wiki/Rubber-hose_cryptanalysis https://en.m.wikipedia.org/wiki/Rubber-hose_cryptanalysis
  - baq 10y ago
    Better still, infect his USB stick without him knowing.
api 10y ago
You should go post about this on Reddit /r/nosleep

And what if intel is compromised? Mass rootkit installation!

by mempko 10y ago

And what if intel is compromised? Mass rootkit installation!

My thoughts exactly! What a great way to get rootkits on people who want to protect themselves. The code is here: https://github.com/chipsec/chipsec https://github.com/chipsec/chipsec

tptacek 10y ago

You can reverse engineer the EFI modules, build a whitelist based on known safe code, and then detect subversion at Intel, so this is not a good strategy for serious adversaries.

etiam 10y ago
In theory, sure. Is it sufficiently simple that people will do it in practice? (I don't know, I expect you would know) Wouldn't the malicious alterations introduced in a scenario like that most likely be exploitable defects that could be explained away as mistakes? If they accumulate too much around certain people that's suspicious of course, but it seems like it would often be difficult to downright prove that someone intentionally broke the security of a rather complex system.
- tptacek 10y ago
  The point is that it doesn't matter what the typical person will do. All that matters is that somebody, somewhere reverse engineers the EFI binaries, and that it's easy enough for normal people to run a program to check their current EFI against a whitelist of known good EFI binaries. This is a banal point, except: if the threat is that Intel (or some other huge vendor) backdoors their EFI binaries, it will get out that they did so. It's not "the perfect crime"; it's practically the opposite of that: one guaranteed to be detected, and that will exact maximal damage on the perpetrators when it gets out.

grandalf 10y ago

Of all the attacks a nation state could do, surely finding a few talented people to get PhDs in the appropriate fields and go to work at Intel and collect a paycheck along with a nice stipend from the nation state is likely among the easiest.

kbenson 10y ago
I'm not sure it's all that easy, since a) you can't know exactly how good someone is going to turn out to be (you can probably get close through), and b) you can't tell what Intel will be hiring for later, and c) to increase your odds you probably want more than a few people in this program to achieve at least a few people being hired in positions that are useful. That said, the main hurdles seem to be managing people and funds, which government agencies seem pretty good at figuring out. So maybe not all that easy, but maybe not particularly hard either. The biggest problem might be keeping it secret, given the number of people that might need to be involved that are clandestinely working for a TLA but not as their main job and not steeped in the culture of secrecy.
mcbits 10y ago
Probably easier to find an existing employee with financial problems and offer a duffel bag of cash to plug in a USB stick for 30 seconds.
- digler999 10y ago
  This is like the opposite or corollary of the "$5 rubber hose" cryptography cracking device.
  - mrkgnao 10y ago
    Did you mean the xkcd "crypto nerd" wrench, or is this a reference to something else? E: ah, TIL. https://en.m.wikipedia.org/wiki/Rubber-hose_cryptanalysis https://en.m.wikipedia.org/wiki/Rubber-hose_cryptanalysis
- baq 10y ago
  Better still, infect his USB stick without him knowing.

api 10y ago

You should go post about this on Reddit /r/nosleep