3 ms·

I don't think you read the article closely enough. You only need "red state" (aka Debug mode) if you are using the instructions with unsigned microcode updates.

I don't think you read the article closely enough. You only need "red state" (aka Debug mode) if you are using the instructions with unsigned microcode updates. But if you have a way to pop the machine into redstate you can exfiltrate the secret key and actually sign microcode changes that will be accepted as legit. All of those things are well within the capability of an APT, especially if you don't need the EXACT target system[1]. Personally I thought IME was a huge problem when Intel announced it, and I haven't changed that opinion. [1] Open question I don't know the answer too is whether all CPU SKUs share the same secret key. (which would be logical if you wanted to push a microcode change for a particular SKU).

deleted 5y ago
[deleted]
mjg59 5y ago
> But if you have a way to pop the machine into redstate you can exfiltrate the secret key and actually sign microcode changes that will be accepted as legit. No. The article mentions that the key required to decrypt microcode updates can be extracted. http://inertiawar.com/microcode/ http://inertiawar.com/microcode/ indicates that the encrypted microcode image is also signed, and being able to decrypt the image doesn't mean you can also generate an appropriate signature.
marcan_42 5y ago
Microcode updates are signed with an asymmetric key ever since the Core line, so no, you can't "extract" the key because the only key the computers have is the public key, not the private key.
- ChuckMcM 5y ago
  I misread this paragraph: As a matter of fact, several vulnerabilities in Intel ME have been discovered in the past. Among others, Ermolov, Sklyarov, and Goryachy described a method to extract the secret key that is used inside the CPU to decrypt microcode updates, which also led to the possibility of executing your own microcode on the CPU or reading Intel's microcode. Where it talked about extracting the secret key.

deleted 5y ago

[deleted]

mjg59 5y ago

> But if you have a way to pop the machine into redstate you can exfiltrate the secret key and actually sign microcode changes that will be accepted as legit. No. The article mentions that the key required to decrypt microcode updates can be extracted. http://inertiawar.com/microcode/ http://inertiawar.com/microcode/ indicates that the encrypted microcode image is also signed, and being able to decrypt the image doesn't mean you can also generate an appropriate signature.

marcan_42 5y ago

Microcode updates are signed with an asymmetric key ever since the Core line, so no, you can't "extract" the key because the only key the computers have is the public key, not the private key.

ChuckMcM 5y ago
I misread this paragraph: As a matter of fact, several vulnerabilities in Intel ME have been discovered in the past. Among others, Ermolov, Sklyarov, and Goryachy described a method to extract the secret key that is used inside the CPU to decrypt microcode updates, which also led to the possibility of executing your own microcode on the CPU or reading Intel's microcode. Where it talked about extracting the secret key.