4 ms·

The instructions they found are only usable when in a special unlocked debug mode that they managed to access through exploiting the Intel CSME at a very early

The instructions they found are only usable when in a special unlocked debug mode that they managed to access through exploiting the Intel CSME at a very early boot stage. Part of the reason this is about ATOM is that they haven't unlocked it yet on other, more recent desktop processors. So no immediate reason to worry but all the more reason to ask Intel to get all it's fucking "management engine" crap out of processors. There is no reason for this mode to be in production processors at all, or not behind a hard blown fuse.

ClumsyPilot 5y ago
Every time i read this 'intel managment engine issue' i am like 'oh, it's that time of the year again'
hackerfromthefu 5y ago
Chipmakers are doubling down on coprocessors with Pluton, first to market in Amd Ryzen 6x series chips. It's a rootkit on your machine plain and simple.
- danuker 5y ago
  Depending on your security needs, you can go back to transistors à la Ben Eater. Or an Arduino, or a permanently-offline device with its Wi-Fi card unplugged and its Ethernet cable desoldered or poured-in with hot glue/plastic. Also desolder/unplug the speakers/microphone while you're at it; there may be some air gap leaks that way. Ideally, only use it on a separate power supply also (say, an older vehicle without networking capabilities, or a solar panel). Check out the Glacier protocol for inspiration: https://glacierprotocol.org/docs/overview/ https://glacierprotocol.org/docs/overview/
markus_zhang 5y ago
Just curious. Recently I have picked up the hobby of reverse engineering and I read that some electronics components such as a ROM can be protected by blowing the fuse after writing to it. Is there a physical, affordable way (under 5K USD let's say) to reconnect the fuse somehow?
- zaarn 5y ago
  The cheapest way to reprogram a blown efuse is to buy a new efuse. In some cases, the efuse is a separated chip but it can be integrated into the CPU or Microcontroller, in which case your only option is to find one of those without the efuse blown. The fuse generally is basically the size of a normal transistor on the IC, good luck getting that repaired otherwise :)
  - avian 5y ago
    > The cheapest way to reprogram a blown efuse is to buy a new efuse. I think this somewhat undersells what a monumental task un-blowing an e-fuse on a chip would be (e.g. resetting something like the USB boot enable bit on the RaspberryPi's SoC). If it's even feasible with today's technology, it would take a top-class semiconductor research facility and significant effort to pull it off. It's $millions compared to taking a new ~$1 chip off the shelf.
  - userbinator 5y ago
    The fuse generally is basically the size of a normal transistor on the IC, good luck getting that repaired otherwise https://en.wikipedia.org/wiki/Focused_ion_beam https://en.wikipedia.org/wiki/Focused_ion_beam I'm not sure what resolution they've achieved now, but it's definitely possible to either cut or repair connections using such a machine. It's a very expensive process, but definitely within the capabilities of even the far-East "MCU break" companies.
- fhars 5y ago
  No, that is usually not possible. Sometines you can reset write-once-bits by shining UV light in the right part of the processor die, or you can try to circunvent the fuse checks by fault injection during, https://media.ccc.de/search/?q=fault+injection https://media.ccc.de/search/?q=fault+injection
- stefan_ 5y ago
  Reconnecting the fuse isn't a thing, as the other comment notes it's just a bunch of atoms somewhere in the chip. But in case of ROM protection for microcontrollers the fuse doesn't directly, in silicon, prevent reading the ROM - after all the controller still needs to be able to read its code! So in practice the fuse only disables e.g. JTAG access, and often that isn't even done in silicon but through a manufacturer boot ROM that checks the fuse state, then either disables or enables JTAG. So often the easiest way to still read the ROM is to find some vulnerability in the code the chip is running and use that to run some code that can leak the ROM contents. Beyond that it's possible with voltage glitching and similar fault injection methods to get the chip to skip the fuse check or put it in some other indeterminate state that allows access - there are some well documented methods for popular microcontrollers: https://www.aisec.fraunhofer.de/en/FirmwareProtection.html https://www.aisec.fraunhofer.de/en/FirmwareProtection.html

ClumsyPilot 5y ago

Every time i read this 'intel managment engine issue' i am like 'oh, it's that time of the year again'

hackerfromthefu 5y ago

Chipmakers are doubling down on coprocessors with Pluton, first to market in Amd Ryzen 6x series chips. It's a rootkit on your machine plain and simple.

danuker 5y ago
Depending on your security needs, you can go back to transistors à la Ben Eater. Or an Arduino, or a permanently-offline device with its Wi-Fi card unplugged and its Ethernet cable desoldered or poured-in with hot glue/plastic. Also desolder/unplug the speakers/microphone while you're at it; there may be some air gap leaks that way. Ideally, only use it on a separate power supply also (say, an older vehicle without networking capabilities, or a solar panel). Check out the Glacier protocol for inspiration: https://glacierprotocol.org/docs/overview/ https://glacierprotocol.org/docs/overview/

markus_zhang 5y ago

Just curious. Recently I have picked up the hobby of reverse engineering and I read that some electronics components such as a ROM can be protected by blowing the fuse after writing to it. Is there a physical, affordable way (under 5K USD let's say) to reconnect the fuse somehow?

zaarn 5y ago
The cheapest way to reprogram a blown efuse is to buy a new efuse. In some cases, the efuse is a separated chip but it can be integrated into the CPU or Microcontroller, in which case your only option is to find one of those without the efuse blown. The fuse generally is basically the size of a normal transistor on the IC, good luck getting that repaired otherwise :)
- avian 5y ago
  > The cheapest way to reprogram a blown efuse is to buy a new efuse. I think this somewhat undersells what a monumental task un-blowing an e-fuse on a chip would be (e.g. resetting something like the USB boot enable bit on the RaspberryPi's SoC). If it's even feasible with today's technology, it would take a top-class semiconductor research facility and significant effort to pull it off. It's $millions compared to taking a new ~$1 chip off the shelf.
- userbinator 5y ago
  The fuse generally is basically the size of a normal transistor on the IC, good luck getting that repaired otherwise https://en.wikipedia.org/wiki/Focused_ion_beam https://en.wikipedia.org/wiki/Focused_ion_beam I'm not sure what resolution they've achieved now, but it's definitely possible to either cut or repair connections using such a machine. It's a very expensive process, but definitely within the capabilities of even the far-East "MCU break" companies.
fhars 5y ago
No, that is usually not possible. Sometines you can reset write-once-bits by shining UV light in the right part of the processor die, or you can try to circunvent the fuse checks by fault injection during, https://media.ccc.de/search/?q=fault+injection https://media.ccc.de/search/?q=fault+injection
stefan_ 5y ago
Reconnecting the fuse isn't a thing, as the other comment notes it's just a bunch of atoms somewhere in the chip. But in case of ROM protection for microcontrollers the fuse doesn't directly, in silicon, prevent reading the ROM - after all the controller still needs to be able to read its code! So in practice the fuse only disables e.g. JTAG access, and often that isn't even done in silicon but through a manufacturer boot ROM that checks the fuse state, then either disables or enables JTAG. So often the easiest way to still read the ROM is to find some vulnerability in the code the chip is running and use that to run some code that can leak the ROM contents. Beyond that it's possible with voltage glitching and similar fault injection methods to get the chip to skip the fuse check or put it in some other indeterminate state that allows access - there are some well documented methods for popular microcontrollers: https://www.aisec.fraunhofer.de/en/FirmwareProtection.html https://www.aisec.fraunhofer.de/en/FirmwareProtection.html