5 ms·

Title should be renamed to: Hardware Backdoors in Obscure x86 CPUs made in 2003.

by CyanLite2 8y ago

dvfjsdhgfv 8y ago
Still, the consequences are huge. Also, how can we be sure something similar isn't implemented in modern CPUs?
- iodiniemetra 8y ago
  This is absolutely implemented in modern CPUs, as debug or management features. Usually switched off - being able to turn it on from ring 3 would be a massive bug.
ChuckMcM 8y ago
... and embedded in ATMs with a 20 year life span. Your comment sounds a bit dismissive of the vulnerability with an implication that it would never be a problem. If that was not what you were implying I apologize. It is critical that even "old" chips vulnerabilities be understood so that one can understand the risks. It pains me terribly every time I power up the Agilent signal analyzer in the lab and it boots Windows XP on its Pentium III chip.
- nrdgrl 8y ago
  I wonder if any of these chips ended up in electronic voting machines?
  - ChuckMcM 8y ago
    I would not be surprised, it was one of the earlier low TDP but x86 compatible chips.
  - jacobush 8y ago
    That is one place you don't need hacking CPUs to hack the result. Plain files vetted by no one etc etc.
- Dylan16807 8y ago
  > ... and embedded in ATMs with a 20 year life span. Privilege escalation is not a problem on ATMs. > It pains me terribly every time I power up the Agilent signal analyzer in the lab and it boots Windows XP on its Pentium III chip. Why? Just treat it as you do most hardware, under full control of whatever you attach it to. Zero security present, zero security needed.
  - jacquesm 8y ago
    > Privilege escalation is not a problem on ATMs. https://vuldb.com/?id.79002 https://vuldb.com/?id.79002
    - ChuckMcM 8y ago
      I expect that most people miss that ATM manufacturers continue to put security holes in ATMs (https://www.wired.com/2014/11/nashville/ https://www.wired.com/2014/11/nashville/) one of the 'fixes' was to make bank access unprivileged. But wait, if I have an escalation vulnerability ...
    - Dylan16807 8y ago
      Sigh. Okay let me rephrase. The thing normally called "privilege escalation", where software that is executing on a machine escapes a sandbox or gets into kernel mode, is not a problem on ATMs. That page is talking about pressing keys to exploit software flaws in already-privileged software, which is an extremely separate topic.
      - jacquesm 8y ago
        Privilege escalations come in many shapes and sizes, it is not limited to software escaping a sandbox or to get into kernel mode, it is also explicitly used to refer to users of a system managing to leverage their normal access into a more powerful one.
        Dylan16807 8y ago
        But in context I was clearly talking about the former, because the topic is software exploiting CPU backdoors.
- tinus_hn 8y ago
  I don’t think these ATMs run a lot of untrusted code, and this is of course easily patched by clearing the bit during the boot sequence. It would be much more of a problem if these were consumer machines running untrusted code.
glangdale 8y ago
I don't think minimizing the significance of the exploit should happen in the headline, but saying "x86 CPUs" instead of "Via CPUs" in the headline is very clickbaity.
- dzdt 8y ago
  "Via x86 CPUs" would be perfect. It conveys detailed information to those with detailed knowledge while still being understandable to those less familiar with tertiary cpu manufacturers.

Title should be renamed to: Hardware Backdoors in Obscure x86 CPUs made in 2003.

dvfjsdhgfv 8y ago

Still, the consequences are huge. Also, how can we be sure something similar isn't implemented in modern CPUs?

iodiniemetra 8y ago
This is absolutely implemented in modern CPUs, as debug or management features. Usually switched off - being able to turn it on from ring 3 would be a massive bug.

ChuckMcM 8y ago

... and embedded in ATMs with a 20 year life span. Your comment sounds a bit dismissive of the vulnerability with an implication that it would never be a problem. If that was not what you were implying I apologize. It is critical that even "old" chips vulnerabilities be understood so that one can understand the risks. It pains me terribly every time I power up the Agilent signal analyzer in the lab and it boots Windows XP on its Pentium III chip.

nrdgrl 8y ago
I wonder if any of these chips ended up in electronic voting machines?
- ChuckMcM 8y ago
  I would not be surprised, it was one of the earlier low TDP but x86 compatible chips.
- jacobush 8y ago
  That is one place you don't need hacking CPUs to hack the result. Plain files vetted by no one etc etc.
Dylan16807 8y ago
> ... and embedded in ATMs with a 20 year life span. Privilege escalation is not a problem on ATMs. > It pains me terribly every time I power up the Agilent signal analyzer in the lab and it boots Windows XP on its Pentium III chip. Why? Just treat it as you do most hardware, under full control of whatever you attach it to. Zero security present, zero security needed.
- jacquesm 8y ago
  > Privilege escalation is not a problem on ATMs. https://vuldb.com/?id.79002 https://vuldb.com/?id.79002
  - ChuckMcM 8y ago
    I expect that most people miss that ATM manufacturers continue to put security holes in ATMs (https://www.wired.com/2014/11/nashville/ https://www.wired.com/2014/11/nashville/) one of the 'fixes' was to make bank access unprivileged. But wait, if I have an escalation vulnerability ...
  - Dylan16807 8y ago
    Sigh. Okay let me rephrase. The thing normally called "privilege escalation", where software that is executing on a machine escapes a sandbox or gets into kernel mode, is not a problem on ATMs. That page is talking about pressing keys to exploit software flaws in already-privileged software, which is an extremely separate topic.
    - jacquesm 8y ago
      Privilege escalations come in many shapes and sizes, it is not limited to software escaping a sandbox or to get into kernel mode, it is also explicitly used to refer to users of a system managing to leverage their normal access into a more powerful one.
      - Dylan16807 8y ago
        But in context I was clearly talking about the former, because the topic is software exploiting CPU backdoors.
tinus_hn 8y ago
I don’t think these ATMs run a lot of untrusted code, and this is of course easily patched by clearing the bit during the boot sequence. It would be much more of a problem if these were consumer machines running untrusted code.

glangdale 8y ago

I don't think minimizing the significance of the exploit should happen in the headline, but saying "x86 CPUs" instead of "Via CPUs" in the headline is very clickbaity.

dzdt 8y ago
"Via x86 CPUs" would be perfect. It conveys detailed information to those with detailed knowledge while still being understandable to those less familiar with tertiary cpu manufacturers.