6 ms·
If there is a backdoor, it could be widely exposed. And such a hypothetical backdoor may not be patchable AT ALL. As in, there may a possibility for almost eve
by Akronymus 4y ago
If there is a backdoor, it could be widely exposed. And such a hypothetical backdoor may not be patchable AT ALL.
As in, there may a possibility for almost every computer being vulnerable to a RCE that bypasses even the OS.
- spockz 4y agoDepending on where the vulnerability exists it can be patched by patching the microcode right?
- mjg59 4y ago> And such a hypothetical backdoor may not be patchable AT ALL. Intel microcode can be loaded at runtime. If there's a backdoor in the microcode then it can, by definition, be patched.
- pitaj 4y agoPretty sure the microcode could be changed to deny a patch, since it has the most privileged level of control on the system.
- mjg59 4y agoMicrocode isn't persistent - on reboot you'll be running whatever version was in the CPU at manufacturing time. That means there's a path to booting to a known-good environment and updating the firmware, which will then load patched microcode before any attacker-controlled code can run.
- gorgoiler 4y agoAs I understand it, you would need to have an existing RCE to exploit the microcode patching process. h0t_max’s research means that future attacks — once your local machine has been infiltrated by some other means — can do a lot more damage than simply encrypting your filesystem or sending spam. They can rewrite the way your CPU works. When your OS gets attacked by malware it is attacking the layer above the bare metal on which your OS runs. The base hardware remains untouched. You can at least clean things up by installing a new OS on the bare metal. If malware attacks the bare metal itself, then you are stuck out of luck.
- ndiddy 4y agoAs mentioned in the github page that this post links to, it's impossible to make a custom microcode update because the updates are RSA signed.
- anewpersonality 4y agoDidn’t they dump the private keys?
- sroussey 4y agoPublic key
- deleted 4y ago[deleted]
- anewpersonality 4y agoWhat can do they with the public key vs private key?
- pitaj 4y agoPublic keys can only be used to verify a signature, not to sign anything.
- anewpersonality 4y agoWas the public key found used to decrypt the microcode?
- NavinF 4y agoWhy would private keys be on the chip?
- reocha 4y agoExcept if someone finds a flaw in the microcode loader.
- stonepresto 4y agoIf there exists a backdoor, its unlikely to be remotely accessible. But privesc for any OS running a vulnerable CPU, absolutely. This would probably look like some hidden instruction to load and execute an arbitrary ELF at the XuCode level, not a magic packet.
- Akronymus 4y agoCant the intel ME already bypass the OS and connect to the network?
- stonepresto 4y agoI'm unfamiliar with it, but that would still be initiated from the host itself, not an attacker on another machine.
- bogomipz 4y ago>"But privesc for any OS running a vulnerable CPU, ..." What is privsec here?
- na85 4y agoNot privsec, privesc -> PRIVilege ESCalation.
- sschueller 4y agoIsn't the point of the microcode to make it possible to patch a HW bug?
- Akronymus 4y agoIt takes microcode to patch microcode though. AFAIK. If the malware shuts that patching off...
- rrix2 4y agoYour OS loads a microcode update in to the CPU very early in the boot process, it's not a static firmware. Unless the microcode malware is sophisticated enough to block e.g. windows update, debian mirrors, then updating the system and rebooting to load a patched microcode would be sufficient to flush this out.