4 ms·

This is about ancient VIA C3 CPUs processors - not your modern Intel/AMD. This isn't to say backdoors are implausible on modern processors (vulnerabilities in I

by oil25 8y ago

This is about ancient VIA C3 CPUs processors - not your modern Intel/AMD. This isn't to say backdoors are implausible on modern processors (vulnerabilities in Intel ME/AMD PSP come to mind), but I would like to see some hard evidence before we panic and freak out. For now, "God Mode on x86 Processors" isn't something I will be losing sleep over, but I will cry about it into my beer ... https://en.wikipedia.org/wiki/VIA_C3 https://en.wikipedia.org/wiki/VIA_C3

bittermang 8y ago
So you're telling me I can't make my old Pentium immune to bullets? Well that's disappointing.
- barbecue_sauce 8y ago
  When you're ready, you won't have to.
djsumdog 8y ago
Plus this isn't as undocumented as he would have you believe. .. I can't find it now, but I had a thread somewhere about how easy it was to find the PDF with the specific commands he had to reverse engineer; documented in published VIA specs.
- cafxx 8y ago
  https://it.slashdot.org/comments.pl?sid=12465074&cid=57107342 https://it.slashdot.org/comments.pl?sid=12465074&cid=5710734...
wahern 8y ago
AMD's Geode LX SoC won't ship its last order until this year, 2019. The Geode line predates the C3, and the Geode LX is just as old as the C3. I can't confirm when the C3 stopped shipping, but it was probably this decade. As for microcode vulnerabilities, don't be surprised if they start coming down the pipeline. It was only recently that researchers figured out (publicly, at least) how to hack and upload microcode on Intel chips: https://media.ccc.de/v/34c3-9058-everything_you_want_to_know_about_x86_microcode_but_might_have_been_afraid_to_ask https://media.ccc.de/v/34c3-9058-everything_you_want_to_know...
- close04 8y ago
  Even more, this isn't even a backdoor. It's in the official documentation since at least 2004. [0] > This alternate instruction set includes an extended set of integer, MMX, floating-point, and 3DNow! instructions along with additional registers and some more powerful instruction forms over the x86 instruction architecture. > This alternate instruction set is intended for testing, debug, and special application usage. Accordingly, it is not documented for general usage. If you have a justified need for access to these instructions, contact your VIA representative. It then goes on to explain in detail the mechanism for initiating execution of this alternate set of instructions. So while I am sure the researchers put plenty of work in this it seems reading the manual helped a lot more than one would expect for a "backdoor"... [0] http://datasheets.chipdb.org/VIA/Nehemiah/VIA%20C3%20Nehemiah%20Datasheet%20R113.pdf#page=82 http://datasheets.chipdb.org/VIA/Nehemiah/VIA%20C3%20Nehemia...
RachelF 8y ago
and Wikipedia has an article on this VIA "Alternate Instruction Set", too: https://en.wikipedia.org/wiki/Alternate_Instruction_Set https://en.wikipedia.org/wiki/Alternate_Instruction_Set It's still great hacking and fuzzing to find the privilege escalation instruction.
- h0l0cube 8y ago
  It seems the wiki article was created after the Blackhat Conference: > 15:22, 10 August 2018‎ Sladen (talk | contribs)‎ . . (2,003 bytes) +2,003‎ . . (initially populate based on news reports) https://en.wikipedia.org/w/index.php?title=Alternate_Instruction_Set&action=history https://en.wikipedia.org/w/index.php?title=Alternate_Instruc...
- makomk 8y ago
  One of the interesting things that article points out is that apparently Windows automatically disables this feature on boot, so it's not going to be exploitable on most Windows systems.
aokiji 8y ago
This is very reminiscent of the Code of Conduct recently integrated into Linux as a way to silence and expel the Linux developers who oppose Intel CIA-backed backdoors.
jplayer01 8y ago
It seems naive to me to believe that there aren't backdoors in AMD and Intel processors. Intelligence agencies have done far worse in our history than backdooring some electronic components. I'm not so sure why this is so unlikely, especially after the Snowden leaks showing us how far agencies like the NSA are willing to go.

by oil25 8y ago

bittermang 8y ago

So you're telling me I can't make my old Pentium immune to bullets? Well that's disappointing.

barbecue_sauce 8y ago
When you're ready, you won't have to.

djsumdog 8y ago

Plus this isn't as undocumented as he would have you believe. .. I can't find it now, but I had a thread somewhere about how easy it was to find the PDF with the specific commands he had to reverse engineer; documented in published VIA specs.

cafxx 8y ago
https://it.slashdot.org/comments.pl?sid=12465074&cid=57107342 https://it.slashdot.org/comments.pl?sid=12465074&cid=5710734...

wahern 8y ago

AMD's Geode LX SoC won't ship its last order until this year, 2019. The Geode line predates the C3, and the Geode LX is just as old as the C3. I can't confirm when the C3 stopped shipping, but it was probably this decade. As for microcode vulnerabilities, don't be surprised if they start coming down the pipeline. It was only recently that researchers figured out (publicly, at least) how to hack and upload microcode on Intel chips: https://media.ccc.de/v/34c3-9058-everything_you_want_to_know_about_x86_microcode_but_might_have_been_afraid_to_ask https://media.ccc.de/v/34c3-9058-everything_you_want_to_know...

close04 8y ago
Even more, this isn't even a backdoor. It's in the official documentation since at least 2004. [0] > This alternate instruction set includes an extended set of integer, MMX, floating-point, and 3DNow! instructions along with additional registers and some more powerful instruction forms over the x86 instruction architecture. > This alternate instruction set is intended for testing, debug, and special application usage. Accordingly, it is not documented for general usage. If you have a justified need for access to these instructions, contact your VIA representative. It then goes on to explain in detail the mechanism for initiating execution of this alternate set of instructions. So while I am sure the researchers put plenty of work in this it seems reading the manual helped a lot more than one would expect for a "backdoor"... [0] http://datasheets.chipdb.org/VIA/Nehemiah/VIA%20C3%20Nehemiah%20Datasheet%20R113.pdf#page=82 http://datasheets.chipdb.org/VIA/Nehemiah/VIA%20C3%20Nehemia...

RachelF 8y ago

and Wikipedia has an article on this VIA "Alternate Instruction Set", too: https://en.wikipedia.org/wiki/Alternate_Instruction_Set https://en.wikipedia.org/wiki/Alternate_Instruction_Set It's still great hacking and fuzzing to find the privilege escalation instruction.

h0l0cube 8y ago
It seems the wiki article was created after the Blackhat Conference: > 15:22, 10 August 2018‎ Sladen (talk | contribs)‎ . . (2,003 bytes) +2,003‎ . . (initially populate based on news reports) https://en.wikipedia.org/w/index.php?title=Alternate_Instruction_Set&action=history https://en.wikipedia.org/w/index.php?title=Alternate_Instruc...
makomk 8y ago
One of the interesting things that article points out is that apparently Windows automatically disables this feature on boot, so it's not going to be exploitable on most Windows systems.

aokiji 8y ago

This is very reminiscent of the Code of Conduct recently integrated into Linux as a way to silence and expel the Linux developers who oppose Intel CIA-backed backdoors.

jplayer01 8y ago

It seems naive to me to believe that there aren't backdoors in AMD and Intel processors. Intelligence agencies have done far worse in our history than backdooring some electronic components. I'm not so sure why this is so unlikely, especially after the Snowden leaks showing us how far agencies like the NSA are willing to go.