4 ms·
If the attacker is flashing custom ME firmware to flash, you are already well and truly fucked. They already have persistent and unlimited access to the ultima
by phire 5y ago
If the attacker is flashing custom ME firmware to flash, you are already well and truly fucked.
They already have persistent and unlimited access to the ultimate back door and modifying the microcode isn't going to get them any extra access to your data or programs.
- AnimalMuppet 5y agoAt a minimum, though, this would be harder to detect. All of the usual places to look are completely unpatched.
- phire 5y agoBut it's not persistent by itself. You are going to need both a persistent modified ME firmware to enable red mode and some x86 code do the actual microcode modification on each boot. If the attacker has that, they can already do a traditional VM rootkit to hide their modifications.
- fulafel 5y agoA publicly documented cheap and reliable way to backdoor the cpu would bring this ME vector to many more people's radars.