28 ms·
20GB leak of Intel data: whole Git repositories, dev tools, backdoor mentions
- saagarjha 6y agohttps://twitter.com/deletescape/status/1291422841834016770 https://twitter.com/deletescape/status/1291422841834016770 Hmm…
- wonderlg 6y agoI’m completely ignorant about this but is it possible that they’re referring to a “debugging backdoor”?
- deleted 6y ago[deleted]
- bonzini 6y agoIt's most likely a callback from OS to firmware, or at least this is what I can guess based on the single comment present in the screenshot and what I saw in the past in the APEI tables of Intel-based servers. APEI tables are a part of ACPI that tell the OS how to write an error record persistently in the machine log, inject a memory error for debugging purposes, and stuff like that that's tied to the RAS (Reliability/Availability/Serviceability) features of a server. The tables contain a list of instructions like "write a value to memory" or "write a value to an I/O port"; the way they work in practice is that, by following these instructions, the OS causes the processor to enter system management mode (that's the "backdoor" into the firmware) where the firmware services the APEI request. Since the tweet mentions SMM and RAS in the two lines it shows, my guess is that it's related to that functionality.
- ccurrens 6y ago> If you find password protected zips in the release the password is probably either "Intel123" or "intel123". This was not set by me or my source, this is how it was aquired from Intel. Can't say I'm surprised, people are lazy. Another large tech company I used to work for commonly used an only-slightly more complex password. But it was never changed, so people who had left the team still could have access to things if they knew the password. It was an entry point into the system more than the company's Red team.
- schmichael 6y agoPassword protection may have been used to bypass antivirus and other filters. While you should treat dumps like this with a lot of suspicion, treat password protected zips with a heaping dose of care as they may have been used to evade automated defenses.
- ccurrens 6y agoThat's an excellent point I wouldn't have considered. I have no intention of looking at the dump anyway, but thanks for the warning.
- 1-6 6y agoI think the proper term is Honeypotting.
- deleted 6y ago[deleted]
- pjc50 6y agoYes - but not for hostile purposes, but because your own company's antivirus won't let you mail an executable to a colleague.
- marcosdumay 6y agoUsually this. Or in my workplace, an image. Antivirus are some crazy shit that may trigger on any random action and will teach people to follow the most unsafe procedures without questioning, so they can get anything done.
- myself248 6y agoI've heard it put this way: If you force users to trade convenience for security, they will find a way to obtain convenience at the expense of security.
- 6y ago
- danw1979 6y agoThe advice to try a password of “Intel123” on any protected files says it all. This organisation genuinely deserves whatever is coming for them.
- Chyzwar 6y agoThis type of passwords are use in almost all big corporations. People are being asked to encrypt things but without password managers or keys management tools.
- jychang 6y agoYeah, I know of plenty of other companies with similar multi-time-use passwords. The data in that zip file probably isn't that confidential.
- yjftsjthsd-h 6y ago> People are being asked to encrypt things but without password managers or keys management tools. That doesn't really make me think better of the company; if the company fails to support secure workflows, it's still on them when people fail to use secure workflows.
- zenexer 6y agoIt’s mentioned in the Twitter thread that at least some of the files have a password of “I accept” instead. That leads me to believe that the primary purpose might just be to indicate agreement to an NDA.
- jnwatson 6y agoThe primary use case for such passwords is not confidentiality. It is to bypass overzealous email virus checkers.
- deleted 6y ago[deleted]
- dathinab 6y agoIn my experience password protected files are often password protected for obscure reasons which have nothing to do with the intent of keeping them secret, like: - prevent anti virus from messing with it - keep to some obscure regulations wrt. Contacts or law, where is enough if you can argue the data was encrypted.
- orisho 6y agoAt a previous workplace we had a few places in the code which used the word backdoor. It was not an actual backdoor though, but merely a debugging server that could be enabled and allowed you to inspect internal state during runtime. At some point I removed the word backdoor, fearing it would get to a customer or during an audit someone would misunderstand. :|
- bhouston 6y agoYeah, I think that this is likely the case here from the screenshot.
- yjftsjthsd-h 6y agoIt seems like a thin line between a debugging feature and a backdoor; "merely a debugging server that could be enabled and allowed you to inspect internal state during runtime" seems like a backdoor to me, doubly so if it's network-accessible. If Intel has, say, an undocumented way to trigger a debug mode that lets you read memory and bypass restrictions (ex. read kernel memory from user mode, or read SGX memory), is that not a backdoor? Or is the name based on intent?
- jdminhbg 6y agoI think the difference is whether it's something that's always enabled. You could presumably make it available or not at compile time, so the software shipped to a customer wouldn't have it, but maybe if they were having issues, you could ship them a version with the debug server with their permission.
- intelleak 6y agoIn what ways can an end user of intel processor expect to benefit from this? I'm guessing none, since ever consumer interface is already a standard ... Can anybody chime in?
- dleslie 6y agoOptimistically, the exposure of backdoors in the firmware may cause Intel to patch and close them. Realistically, Intel will patch the firmware and replace the backdoors with new ones.
- intelleak 6y agoBesides the backdoors I mean, I was thinking about performance or usability improvements...
- mhh__ 6y agoOther than disabling security features, Intel already publish extensive optimization manuals, so I don't think there's anything to go on here.
- eitland 6y agoMight finally get certain big PC vendors to consider using AMD which will increase competition and make sure we get better hardware in the future..?
- deleted 6y ago[deleted]
- wmf 6y agoIt would be illegal, but some of that code might help Coreboot development.
- outworlder 6y ago> but some of that code might help Coreboot development Unlikely. Most projects won't come anywhere near this sort of thing. There may be a possibility of doing clean room implementation, but writing the spec based on stolen IP is the problematic step. Then again, there is a high chance that none of this will be useful.
- svnpenn 6y agoSomeone have a mirror? Seems the actual files are here: https://t.me/exconfidential/590 https://t.me/exconfidential/590 Edit: files are here https://mega.nz/folder/CV91XLBZ#CPSDW-8EWetV7hGhgGd8GQ https://mega.nz/folder/CV91XLBZ#CPSDW-8EWetV7hGhgGd8GQ or magnet:?xt=urn:btih:38f947ceadf06e6d3ffc2b37b807d7ef80b57f21
- sdflhasjd 6y agoThe t.me page is a Telegram comment containing a mega.co.nz download link I think the tg:// link is just the site trying to open up in the Telegram app.
- johnklos 6y agoYou can't download from mega.nz unless you have their "downloader" app or an account, or if you have Firefox or Safari. It's useless. The torrent works.
- the8472 6y ago> firefox works > it's useless does not compute
- crazypython 6y agoA web app that only works in non-Chromium browsers isn't useless.
- samtheprogram 6y agoGolly, it doesn't work in Chrome? What's the technical limitation here? Or did they just choose not to support it? Asking because as someone who uses FF as their daily driver and is surprised something is supported in it that isn't in Chrome...
- bscphil 6y agoI've downloaded stuff from MEGA in the last week on a Chromium based browser, so I'm not sure what the problem is supposed to be here.
- unix_fan 6y agoThe bad news just doesn’t end for this company,does it?
- randomsearch 6y agoHmmm indeed
- eNTi 6y agoAt this point it's just more 2020...
- Alupis 6y agoOr karma finally doing it's thing?
- abvdasker 6y agoI get the sense over the last year that the wheels have fully come off the bus there
- gabcoh 6y agoIs releasing this legal? It seems like this person isn't really disguising their identity or concerned about breaking the law. In their profile they even seem to brag about leaking company's code.
- dleslie 6y agoOf course it's not legal. This is exfiltrated intellectual property being shared without license.
- gabcoh 6y agoIs the person publishing this liable or just their source? Because this seems to be a hobby for the person publishing it and yet they also aren't concealing their identity. They list their former employer on their website.
- 21eleven 6y agoIs the person publishing it or are they linking people to a place where it is published?
- jpxw 6y agoIt seems that they are the ones publishing it, from the wording of the tweets.
- kmeisthax 6y agoMisappropriating trade secrets for financial gain is a punishable offense, and this data would qualify as a trade secret, at least for as long as it's not general knowledge to everyone or it has yet to be reverse-engineered. Aside from that, much of the data in these files has standard copyright and patent concerns.
- pizza 6y agoOK then, out of curiosity, what are the relevant laws being broken here?
- deleted 6y ago[deleted]
- pdevr 6y agoIntel denies it was hacked: https://twitter.com/TheRegister/status/1291461942624677889 https://twitter.com/TheRegister/status/1291461942624677889
- dleslie 6y ago... They're claiming it came from an NDA'd source of IP that's shared with customers. Given that it _appears_ like there are backdoors in this Firmware code, we can conclude that if there are such backdoors then they were shared with numerous customers. That really doesn't improve the optics of the breach.
- jpxw 6y agoImagine what they aren’t sharing
- moonchild 6y agoAlternately, as others have noted, it could be overloaded nomenclature and doesn't actually indicate a backdoor. Which would be an excellent reason for them to feel comfortable sharing said 'backdoors' with their customers.
- dathinab 6y agoIt it is actually a backdoor but only gets put on prototypes/engineering samples or similar. Or maybe some well documented Intel management features need to backdoor there own security mechanisms to work. Or ... Well the point is it's a starting point for someone dissecting the data but not much more.
- technonerd 6y agohttps://del.dog/sourcestatements.txt https://del.dog/sourcestatements.txt source: They have a server hosted online by Akami CDN that wasn't properly secure. After an internet wide nmap scan I found my target port open and went through a list of 370 possible servers based on details that nmap provided with an NSE script. source: I used a python script I made to probe different aspects of the server including username defaults and unsecure file/folder access. source: The folders were just lying open if you could guess the name of one. Then when you were in the folder you could go back to root and just click into the other folders that you didn't know the name of. deletescape: holy shit that's incredibly funny source: Best of all, due to another misconfiguration, I could masqurade as any of their employees or make my own user. deletescape: LOL source: Another funny thing is that on the zip files you may find password protected. Most of them use the password Intel123 or a lowercase intel123 source: Security at it's finest.
- beervirus 6y agoFingers crossed that this will enable some smart person to completely disable the management engine.
- wmf 6y agoAFAIK the ME is required to initialize the processor so it can never be completely disabled. The best you could do is remove any code beyond necessary initialization which has mostly already been done by me_cleaner.
- noja 6y agoHow easy is it to use me_cleaner? Last time I looked it required some wiring and a Raspberry Pi.
- amiga-workbench 6y agoQuite straightforward, I used a ch341A SPI programmer. Just make sure you take multiple copies of your original ROM image and compare the hashes of them to make sure there was no screwup. It took me about 10 minutes to do my ThinkPad. All I lost was some enhanced integrated GPU power management and integrated thermal management, but I use a userland fan control program anyhow.
- WanderPanda 6y agoHow much did it cost? Everything
- nullc 6y agoOn some devices it's fairly easy: pop the chip out (or attack to it in-circuit with a clip), drop it in a programmer, run a tool.. run me cleaner.. run a tool again. On other devices you just can't read the chip or you can and me cleaner can't make any sense of it.
- netsec_burn 6y agoOr buy a laptop from a manufacturer with the ME inoperable.
- deleted 6y ago[deleted]
- iphone_elegance 6y agoSomeone in China is smiling
- deleted 6y ago[deleted]
- deleted 6y ago[deleted]
- inthewings 6y agoThat's just another internal Meltdown from a Spectre employee ! For once they don't leak our data.
- Traster 6y agoThis is more embarrassing than harmful. Having worked at companies like intel, it's not really that damaging leaking some of this IP - the worst that happens is some open source project gets slightly better or you have a few more bugs (not that Intel are lacking in that area). The second we see internal marketing, pricing & road map slides- that's when you know they're in real trouble.
- dathinab 6y agoNo the worst is it there is some dirt and people find it like: - copyright infringement - patent infringement - actual backdoors (the word backdoor does appear but there are many ways how it can already without they being a backdoor got spying including bad naming sense of engineers and code used during prototyping only
- kps 6y ago> Having worked at companies like intel I've worked at a company very much like Intel¹ and the really closely guarded secret — the one where two vetted people turn the launch key at the same time — was the microcode patching keys. ¹ I'm not saying it was Intel, but it was Intel
- dgellow 6y ago> the worst that happens is some open source project gets slightly better If anyone is reading this is working on open source projects that would benefits from what has been leaked: stay far away from such a leak. The last thing you want is your open source project to be accused of copyright or patent infringement.
- deleted 6y ago[deleted]
- Keyframe 6y agoAt this rate, I fully expect Nvidia to make a meger bid for intel.
- mhh__ 6y agoBigger market cap but something like 10 times less revenue, strange world (As intel get hammered in the media their revenue remains in a different league to AMD - which I suspect is partly because AMD can walk the walk after dropping their trousers but there is no foreplay [i.e. sales and software])
- alsdkfjkqjwer 6y agoWhy would they include stuff from proprietary releases? I understand exposing backdoors and all, but who cares about a camera firmware for a airgaped system? wonder if some of the clients for those devices is involved and the goal of this is that those clients got fed up with the NDAs and wanted all this in "public domain"?
- RSO 6y agoAnybody else wondering at the rate of bad news around Intel at this moment? Like, is someone after them or is this just bad luck?
- Nasrudith 6y agoPersonally it seems more like complacency and cultural rot has caught up to them than any bad actor - excluding their own management chasing ego gratification or short term profits. Falling behind AMD in so many metrics when they were previously often a second-best rival screams that they need to get their shit together.
- ddingus 6y agoThis. Inertia, tech debt, a less nimble culture all add up. Intel needs to kick off a skunk works that basically gets funded well enough to find a new way. If they do it now, some space could get really interesting again.
- bubblethink 6y agoMay be a good time for Intel to open-source FSP anyway. They've been dilly-dallying around it for a while now. There were some phoronix articles about it a year ago.
- xyst 6y agoI’m not touching the binaries or executables, but I’m interested in the source code. Has anybody found anything interesting? Will download from the mega link and explore in a VM later.
- james412 6y agoThis kid has been posting these for fame (it's the same guy that posted the Daimler leak). I guess it's all fun and games until he finds himself in prison
- elmo2you 6y agoThat is indeed often the case with young narcissists (I don't know if it applies to this person, don't know him/her). That said, I remember the shocking arrogance and total disregard (for anything but their own ego) of a few young privileged "hackers", who were involved in DDOS services for hire, and also for some very nasty IoT bot net (if I recall correctly). Krebs wrote about them quite a bit. I think they even got caught because of that, but not sure. They did loads of real damage, that much is certain. But instead of going to jail, they got community service. Apparently with intervention of the US government, for which they now work. Go figure.
- antihero 6y agoIDK if wanting a bit of fame and validation makes you a narcissist per-say.
- elmo2you 6y agoNot per-se, indeed. But if that urge for validation is for something that's fundamentally wrong and/or only supports an person's failure to critically assess their own actions, then it usually is narcissism.
- mirekrusin 6y agoI'm not sure you can even consider it "breaking in", it's more like tweeting that under intel.com/super-secret url you can see some internal, secret documents.
- james412 6y agoThe definition of "unauthorized access" is intentionally very broad, and ultimately depends on the kind of lawyer you can afford. Publicly taking a piss in the face of Intel and Daimler in exchange for a little lame publicity seems an incredibly dumb tradeoff
- phendrenad2 6y agoThis is more of an advertisement for all the cool stuff you can work on if you go work for Intel than anything.
- Jonnax 6y agoWho should we follow on twitter / blogs to read analysis of whether this is impactful or interesting?
- chasd00 6y agoif you're at a company that can be considered an Intel competitor i would avoid this like the plague. Wasn't there problems for people working on Linux after only viewing source code from other operating systems?
- pepemon 6y agoIntel went open source today.
- dmix 6y agoBinaries unique to SpaceX, maybe related to a server or contract with SpaceX?
- akayoshi1 6y agoThe next Edward Snowden.
- mhh__ 6y agoUnless they've actually found a real smoking gun, probably not even close. Besides, even if there isn't a backdoor in intel CPUs they've definitely tried.
- deleted 6y ago[deleted]
- greyface- 6y agoAny IP lawyers in the house willing to speculate on how this is going to go down? Intel surely isn't going to let this stand, and the (Swiss) leaker is being completely open about their identity. What's the legal action going to look like?
- ggm 6y agoI'd love an IPR lawyer to explain legal paths to clean room spec of the bits of this which could be useful like ME or coreboot depending parts. I see comments which says "stay clear, they will" but I would like to know how, if at all, this could be done and be legal on the receiving side of the functional spec from a clean room.
- spicyramen 6y agoCisco123
- privacyonsec 6y agoIntel leaked sources contain "backdoor" keyword https://twitter.com/deletescape/status/1291419918685147149?s=09 https://twitter.com/deletescape/status/1291419918685147149?s...
- wingerlang 6y agoI’ve only seen people writing “backdoor!” without actually saying what kind of, for who, to what and so on. Seem pretty disingenuous to me. Could easily be something trivial.
- jarym 6y agoWith stuff like this being exfiltraded (let’s admit if hackers got this they prob could have a whole ton of fab secrets) it won’t be long until America’s IP is all in the hands of China/Russia/Europe. We will have confirmation when China launch a ‘Xi Lake’ x86 compatible cpu...
- Anarch157a 6y agoThey already have it, thanks to AMD, before Trump blocked further cooperation.
- als0 6y agoThe FSP source code is supposedly leaked as part of this, which is used to initialise the memory controller. Are we closer to (modern) blob-free Intel platforms?
- kr99x 6y agoCloseR, yes. Close? No. For one, memory init code differs from product gen to product gen and pulls in platform/board specific libraries and inputs to set up some parameters. The bigger problem though is just how big and messy the memory init code is. It would take a substantial number of people a substantial amount of time to unwind and understand what's going on, let alone do a sane and/or clean-room implementation of it all.
- kr99x 6y agoThe three "biggest deals" here are all... a lot less important than they look. Clarifying info on all three: "Did Intel get hacked?" I can't confirm the exact mechanism by which these files got out, but I do know that these files are things which get shared externally already with Intel's customers under NDA. If security in general is lax, that's one thing and future hacks of more sensitive stuff could be expected. If security in general is fine, but for some NDA customer sharing channel is lax, don't expect to see anything juicier. "Intel123 is an awful password." Yes it is, but... it's not for security. Intel123 is the password used to bypass executable/script filtering systems that overzealous IT put in place to "protect" employees. Employee A wants to share a zip with employee B. There are many channels they can use to do this, because the contents of the zip are not encrypted or restricted. None of these channels require encryption, but either A or B doesn't like/understand them, so they agree on email. Whoops, the filter says that executable could be harmful and out it goes. Zip-via-email doesn't work. Unless... well, if they put a password on it, the filter doesn't catch it. Good. Problem solved. This is so common that the convention Intel123 arose and solidified for exactly this purpose. "I see the word 'backdoor' in there!" Sure. Bad name choice. That's not the kind of backdoor you're thinking. There are a lot of things in the firmware that take this exact same form and don't use the word backdoor. It's a signal the low level firmware is keeping an eye out for, and if received, it will trigger some other piece of firmware to do some task in SMM. If that other piece of code takes input parameters and fails to verify them, then you may have a vulnerability on your hands - in fact, this was a very common kind of vulnerability before. Intel has fixed a lot of these over the years. Odds are they're mostly gone by now. If input parameters are verified (or none taken), the worst you could do is maybe a DoS by spamming that signal to keep the CPU clogged/stuck in SMM.
- deleted 6y ago[deleted]
- WhyNotHugo 6y agoI'm very curious about this. What's the legality on just reading on this for mere curiosity (e.g.: I don't work for AMD nor write drivers, etc.).