4 ms·
A classic paper by Ken Thompson. Today I think the most important paragraph is this: "I picked on the C compiler. I could have picked on any program-handling
by anonymousiam 4y ago
A classic paper by Ken Thompson. Today I think the most important paragraph is this: "I picked on the C compiler. I could have picked on any program-handling program such as an assembler, a loader, or even hardware microcode. As the level of program gets lower, these bugs will be harder and harder to detect. A well-installed microcode bug will be almost impossible to detect."
Keep the above in mind when thinking about the proprietary microcode and ME hardware/firmware components that are built-in to nearly all modern processors. A typical "supply chain" attack.
- User23 4y agoI bet a FOIA request for information on any microcode backdoors would result in an impressive number of redactions.
- dwheeler 4y agoI don't know if much would be reported. If you mean a FOIA request to the US Federal government, there are many exemptions, including: Exemption 1: Information that is classified to protect national security. ... Exemption 3: Information that is prohibited from disclosure by another federal law. Exemption 4: Trade secrets or commercial or financial information that is confidential or privileged. Source: https://www.foia.gov/faq.html https://www.foia.gov/faq.html Feel free to try.
- anonymousiam 4y agoIt's more likely that such a request would not get a meaningful response because it would never be routed to anyone with knowledge of such activities. (SAP/SAR/UNACKNOWLEDGED/WAIVED)
- mhh__ 4y agoFOIA request with whom? Intel had a ton of firmware leaked a while back and no one found anything particularly juicy.
- cmeacham98 4y agoMany third party researchers have already found backdoors in other parts of Intel's CPUs, such as the Management Engine. I very much suspect a well funded and motivated actor like the NSA could find mistakes in the microcode without needing to ask for a backdoor directly.