19 ms·
>the whole backdoor-conspiracy bandwagon This isn't a correct characterization of the suspicion that Intel microcode has backdoors in it. The suspicion isn't j
by javajosh 4y ago
>the whole backdoor-conspiracy bandwagon
This isn't a correct characterization of the suspicion that Intel microcode has backdoors in it. The suspicion isn't just based on distrust of authority, like flat Earth, etc, but also on the org having means, method, and opportunity to remotely modify the operation of a CPU. And it operates within the domain of the USG, who have demonstrated a keen interest in weaponizing 0-day exploits.
What better way to acquire a novel 0-day than to simply write one known only to you and distribute it from the source? This is a good plan, but it comes with a substantial risk to Intel, or any company who wishes to maintain a trust relationship with its customers.
That said, I don't think anyone doing this is stupid, and for safety they would not install microcode malware on everyone, just some. This means we will find nothing in general CPUs, and anecdotal reports finding "something" can easily be dismissed as malicious or noise.
The truly paranoid need not worry, even if the microcode is seen to be harmless, there is always the possibility that hardware you buy is interdicted, modified, and sent onward, such that your paranoia can remain intact.