5 ms·

An embedded device running inside my server I cannot audit, with direct memory access to everything running? Feels like the Holy Grail of backdoors.

wolandpe 5y ago
Can you audit your CPU? Can you audit your mainboard, which was probably assembled in China and has some microcontrollers with firmware installed in China? Mikrotik is made in Europe in a democratic state.
- oliwarner 5y ago
  I cannot. But this is another software stack, another CPU and another mainboard with DMA access. It's a big bucket of additional weak links in my chain of security security. The whattabouttery in these replies isn't s good approach. It only takes one component to get hacked. More than doubling your surface area isn't something to do lightly.
cduzz 5y ago
A modern (server) system probably has 3-8 of these already, some of them explicitly with independent network connectivity. Trust your vendors, lock down your network, be large enough to build your stack yourself; chose any 2...
blibble 5y ago
turn on your IOMMU
- oliwarner 5y ago
  Do you suppose it would still work? Is the PCIe4x2 connector not how it achieves the internal part of its 25GBps throughout?
  - blibble 5y ago
    it's no different to any other pcie device
icedchai 5y ago
Many servers already have embedded devices in them that you can't audit. How is this anything new? (I'm thinking of remote management, like HP iLO, Intel AMT, etc.)
- runnerup 5y ago
  And secret microcode / hidden instructions in every major x86 CPU, presumably for the NSA. [0]: https://www.youtube.com/watch?v=KrksBdWcZgQ https://www.youtube.com/watch?v=KrksBdWcZgQ
  - runnerup 5y ago
    If the downvotes are due to poor quality discussion, that's fair enough. If they're due to skepticism, here's his talk from the next year: [0]: https://www.youtube.com/watch?v=jmTwlEh8L7g https://www.youtube.com/watch?v=jmTwlEh8L7g "DEF CON 26 - Christopher Domas - GOD MODE UNLOCKED Hardware Backdoors in redacted x86"
    - icedchai 5y ago
      I'm not skeptical they exist, I'm skeptical that they're "for the NSA."

wolandpe 5y ago

Can you audit your CPU? Can you audit your mainboard, which was probably assembled in China and has some microcontrollers with firmware installed in China? Mikrotik is made in Europe in a democratic state.

oliwarner 5y ago
I cannot. But this is another software stack, another CPU and another mainboard with DMA access. It's a big bucket of additional weak links in my chain of security security. The whattabouttery in these replies isn't s good approach. It only takes one component to get hacked. More than doubling your surface area isn't something to do lightly.

cduzz 5y ago

A modern (server) system probably has 3-8 of these already, some of them explicitly with independent network connectivity. Trust your vendors, lock down your network, be large enough to build your stack yourself; chose any 2...

blibble 5y ago

turn on your IOMMU

oliwarner 5y ago
Do you suppose it would still work? Is the PCIe4x2 connector not how it achieves the internal part of its 25GBps throughout?
- blibble 5y ago
  it's no different to any other pcie device

icedchai 5y ago

Many servers already have embedded devices in them that you can't audit. How is this anything new? (I'm thinking of remote management, like HP iLO, Intel AMT, etc.)

runnerup 5y ago
And secret microcode / hidden instructions in every major x86 CPU, presumably for the NSA. [0]: https://www.youtube.com/watch?v=KrksBdWcZgQ https://www.youtube.com/watch?v=KrksBdWcZgQ
- runnerup 5y ago
  If the downvotes are due to poor quality discussion, that's fair enough. If they're due to skepticism, here's his talk from the next year: [0]: https://www.youtube.com/watch?v=jmTwlEh8L7g https://www.youtube.com/watch?v=jmTwlEh8L7g "DEF CON 26 - Christopher Domas - GOD MODE UNLOCKED Hardware Backdoors in redacted x86"
  - icedchai 5y ago
    I'm not skeptical they exist, I'm skeptical that they're "for the NSA."