2 ms·
Agree, though your response doesn’t address if an attacker had the signing key; appears that an attacker with the microcode encryption key, knowledge of how mic
by O__________O 4y ago
Agree, though your response doesn’t address if an attacker had the signing key; appears that an attacker with the microcode encryption key, knowledge of how microcode works, how it’s updated, the signing key, and how to generate a valid signed update — they would be able to deploy an exploit to the CPU; obviously this excludes the existing issues with Intel ME.
- Jolter 4y agoYes, presuming physical access as well as access to the signing key, an attacker could certainly deploy malicious microcode. It would be a very scary thing indeed. It seems a reasonable threat model if your adversary is a malicious state actor, or similarly well funded and ambitious organization. Edit: I assume this threat has existed as long as updatable microcode has.