9 ms·
Christopher Domas: Hardware Backdoors in X86 CPUs
- based2 8y agohttps://www.reddit.com/r/programming/comments/95zgaq/rosenbridge_hardware_backdoors_in_x86_cpus_repo/ https://www.reddit.com/r/programming/comments/95zgaq/rosenbr...
- olliej 8y agoSeems via specific? Rather than “all x86”
- classichasclass 8y agoIt is highly specific, yes. But who knows what else is lurking? When chips have these undocumented co-processors in them with unlimited privilege to the system, sooner or later they're going to be exploited.
- agumonkey 8y agoYeah it opens my eyes on the real life implementation of processors, it's not just x86 assembly, a chip is free to have anything in it. /me sets up his x-ray machine
- thinkythought 8y agoThis is still a huge target. I used to be in point of sale engineering, and the majority of the quality terminals the big OEMs(NCR and their sub brands, posiflex, etc) were pushing were running these for a LONG time past when you'd think C3 was "dead". Similar vendors i bumped into were pushing stuff with them in it still when i got out of that industry. There are a LOT of machines out there which will be run essentially until they break down(and a lot are fanless, and will pretty much last until they can't be kept up to date). You have to remember, a lot of big chains(and banks!) paid for extended XP support and then extended-extended XP in the form of windows POS. This is a "every terminal in a huge fast food chain gets owned and no one finds out for years" sort of vulnerability. This is the first step to something like the target breach all over again.
- ryanlol 8y ago>This is a "every terminal in a huge fast food chain gets owned and no one finds out for years" sort of vulnerability. This is the first step to something like the target breach all over again. Utter nonsense, this bug will not lead to RCE. You might be able to implement a fancy rootkit with this, but that's all. Advanced rootkit tech is neither necessary nor particularly helpful for these sorts of breaches.
- pkaye 8y ago> VIA processors are renowned for their low power usage and excellence in embedded designs; we believe that the functionality described was created in good faith as a useful feature for the embedded market, and was unintentionally left enabled on some early generations of the processor. What is the use of this feature?
- hakfoo 8y agoI could see using a secondary core as a watchdog in an embedded environment-- if something went too wrong, perhaps the secondary CPU can either get some valuable logging data or stuff the system with code designed to restore it to a controllable state.
- CyanLite2 8y agoTitle should be renamed to: Hardware Backdoors in Obscure x86 CPUs made in 2003.
- dvfjsdhgfv 8y agoStill, the consequences are huge. Also, how can we be sure something similar isn't implemented in modern CPUs?
- iodiniemetra 8y agoThis is absolutely implemented in modern CPUs, as debug or management features. Usually switched off - being able to turn it on from ring 3 would be a massive bug.
- ChuckMcM 8y ago... and embedded in ATMs with a 20 year life span. Your comment sounds a bit dismissive of the vulnerability with an implication that it would never be a problem. If that was not what you were implying I apologize. It is critical that even "old" chips vulnerabilities be understood so that one can understand the risks. It pains me terribly every time I power up the Agilent signal analyzer in the lab and it boots Windows XP on its Pentium III chip.
- nrdgrl 8y agoI wonder if any of these chips ended up in electronic voting machines?
- DoctorOetker 8y agoSandsifter was pure genius, I can't wait to read the whitepaper for this one!
- agumonkey 8y agoThe talk is worth its weight in gold https://www.youtube.com/watch?v=KrksBdWcZgQ https://www.youtube.com/watch?v=KrksBdWcZgQ
- basementcat 8y agoThis is by the same badass who wrote a compiler that generates only MOV instructons [1] [1] https://github.com/xoreaxeaxeax/movfuscator https://github.com/xoreaxeaxeax/movfuscator
- e19293001 8y agoFrom the FAQ: Q: Why did you make this? A: I thought it would be funny.
- phs318u 8y agoThanks for that little side-bar/rabbit-hole. Fascinating, as is the paper he based it on. I'm itching to get home and try this out - specifically, I'm interested on what the performance might be like.
- stefs 8y agoperformance: something that takes seconds now takes hours. ah, here it is - branchless doom (in the validation/doom directory - https://github.com/xoreaxeaxeax/movfuscator/tree/master/validation/doom https://github.com/xoreaxeaxeax/movfuscator/tree/master/vali... ): > The mov-only DOOM renders approximately one frame every 7 hours, so playing this version requires somewhat increased patience.
- mrpippy 8y agoThese were designed by Centaur Technology (based in Austin, TX), I'd love to hear from any alums (danluu?) what the purpose of the coprocessor is. BTW there's an interesting documentary about Centaur, free to watch on Prime Video. https://www.amazon.com/Rise-Centaur-Glenn-Henry/dp/B01FSZU6FK https://www.amazon.com/Rise-Centaur-Glenn-Henry/dp/B01FSZU6F...
- exikyut 8y ago> I'd love to hear from any alums (danluu?) what the purpose of the coprocessor is. Absolutely agree there, I can imagine it being ridiculously interesting. But the truth might also be equal parts boring and scary instead. I mean... > The backdoor allows ring 3 (userland) code to circumvent processor protections to freely read and write ring 0 (kernel) data. While the backdoor is typically disabled (requiring ring 0 execution to enable it), we have found that it is enabled by default on some systems. > The core executes these commands (which we call the 'deeply embedded instruction set'), bypassing all memory protections and privilege checks. > The rosenbridge backdoor is entirely distinct from other publicly known coprocessors on x86 CPUs, such as the Management Engine or Platform Security Processor; it is more deeply embedded than any known coprocessor, having access to not only all of the CPU's memory, but its register file and execution pipeline as well. This is enough anti-plausible-deniability that I can just sweepingly point everybody in the direction of the big fat (flashing!) elephant in the room and the "..." sitting next to it. I mean, VIA didn't have as much success as Intel or AMD, but they are a known name. Anything that implements x86 is going to have market penetration to some extent, and VIA achieved success in the industrial and embedded sectors. If danluu was able to comment here and debunk what I'm saying, I would be both very surprised and even more delighted.
- luu 8y agoIf I knew anything non-public (and in this case I don't -- this is from before my time there), I wouldn't be able to talk about it :-) This has now been pointed out in another thread, but this feature is documented in the datasheet here: http://datasheets.chipdb.org/VIA/Nehemiah/VIA%20C3%20Nehemiah%20Datasheet%20R113.pdf http://datasheets.chipdb.org/VIA/Nehemiah/VIA%20C3%20Nehemia.... See Appendix A, A-9 & A-10, as well as the section on CPUID bits.
- 0x0 8y agoThis is a HUGE wake-up call. It really is incredible to see that a third party apparently has discovered a genuine backdoor in a production CPU with completely independent research. If that's within reach for a standalone researcher, what secrets lie in well-funded organizations at the nation level? Perhaps this will bring further mindshare to the RISC-V approach in the future?
- earenndil 8y agoThat would be nice, but I'm more hopeful in the immediate for openpower to gain widespread usage on the desktop. Google seems to be banking on it for servers, at the very least.
- analognoise 8y agoIsn't openpower not actually very open? At least with RISCV we can compete vendors while maintaining a compatible instruction set, I'm not sure how many people are going to produce openpower chips.
- classichasclass 8y agoIn the long term, I think you have a point here. It would be nice to have IBM not being the only producer of, say, the POWER15. In that sense RISC-V is substantially more open than OpenPOWER. But parent was talking about in the immediate timeframe, and right now (and I predict for the next few years at minimum), if you want free(r) and ballpark performance class with x86, then you're going to have to play with POWER. I don't think ARM is there yet with respect to grunt and some ARM designs have some of the same concerns about creepy dark corners of the processor die. It's why there's a Talos II under my desk.
- analognoise 8y agoI wanted one of those, just couldn't justify the price. I've been toying with the idea of running Reactos or Haiku on an FPGA as a cheaper "you own it as much as possible" variant.
- wmf 8y agoVIA/Centaur C3 processors are internally RISC and the front end converts x86 instructions into RISC instructions that the processor executes. People used to ask "can I generate native RISC code?" and Centaur always said no, but you know they must have debugging functionality to do that. And now someone has discovered that sometimes you can enter debug mode from ring 3 and they're calling it a backdoor.
- basementcat 8y agoWaits for Chris Domas to write an LLVM backend for the internal RISC target so we can get 1337 performance out of our C3's.
- q3k 8y agoHow is it not a backdoor? Just because it's unintended or due to a very complex reason doesn't mean it's not one.
- wmf 8y agoNot every security vulnerability is a backdoor. (The Intel ME isn't a backdoor either.)
- bdamm 8y agoYou're being either overly generous to Intel or you're underestimating how well funded some of the espionage organization really are. And consider that for decades espionage organizations have been taking advantage of bugs in commercial products. This is so well documented at this point that it's not even worth arguing. Personally I believe this has been going on since the '70's.
- wmf 8y agoWell-funded espionage organizations can exploit almost everything, so almost everything is a backdoor? Is that a useful definition?
- admax88q 8y agoThey so clearly titled this "X86 CPUs" instead of "VIA C3 CPUs" or "VIA C3 x86 CPUs" on purpose. Clickbait title in my opinion, they wanted the casual observer to confuse this with Intel/AMD at first glance.
- derpherpsson 8y agoThis is absolutely insane! With all the recent bugs and features that looks like backdoors I have completely lost faith in x86. We need simple open ISAs (like RISC-V) and a handfull of trusted organizations that inspect the manufacture processes to protect ourselves from this. A bit like how countries and organizations send people to inspect other countries democratic voting processes, or like how IAEA inspect nuclear stockpiles etc. I call for: + Open source. + No creeping featurism. + Multiple inspection organizations that watch the process from source code to final chip product.
- raxxorrax 8y agoWe should go back to real mode. Imagine all the sudden possibilities. No pesky memory barriers, no protection faults and superb integration of applications of all kind. Application could even share the same memory and the better one wins. "If nothing is secure, everything is secure" - Lincoln But seriously: I don't think this "feature" is a real backdoor. It is nonetheless an interesting topic. I am more concerned about bugs and backdoors in modules like TPM/ME or other even less documented surprises. Wouldn't be the first time that happened and we can only hope, that better people find these type of vulnerability first.
- enyone 8y agoDocumented instruction set switch which is just implemented poorly. But the real news here seems to be that the ALTINST is set to 1 by default in some C3 generations.