3 ms·

Intel is a known partner of the NSA. If Intel was intentionally creating backdoors at the behest of the NSA, how would they look different from this vulnerabili

Intel is a known partner of the NSA. If Intel was intentionally creating backdoors at the behest of the NSA, how would they look different from this vulnerability and the many other discovered vulnerabilities before it?

thelittleone 3y ago
But so is Google. It would be some very crafty theatrics if it's all coordinated.
- ZoomerCretin 3y ago
  Only the people inserting the backdoor or using it would need to be bound by a National Security Letter's gag order. I doubt anyone at Google (including those subject to NSL gag orders) was made aware of this specific vulnerability. # Google’s commitment to collaboration and hardware security ## As Reptar, Zenbleed, and Downfall suggest, computing hardware and processors remain susceptible to these types of vulnerabilities. This trend will only continue as hardware becomes increasingly complex. This is why Google continues to invest heavily in CPU and vulnerability research. Work like this, done in close collaboration with our industry partners, allows us to keep users safe and is critical to finding and mitigating vulnerabilities before they can be exploited. There's a tension between the NSA wanting backdoors and service providers (CPU designers + Cloud hosting) wanting secure platforms. It's possible that by employing CPU and security researchers, Google can tip the scales a bit further in their favor.
rep_lodsb 3y ago
My guess is that it would be something that could be exploited via JavaScript. And no JIT would emit an instruction like the one that causes this bug.
gosub100 3y ago
the backdoor would just be an encrypted stream of "random" data flowing right out the RNG. there's some maxim of crypto that encrypted data is indistinguishable from random bytes.
tedunangst 3y ago
How would you distinguish this backdoor from one inserted by an unknown partner of the NSA?

thelittleone 3y ago

But so is Google. It would be some very crafty theatrics if it's all coordinated.

ZoomerCretin 3y ago
Only the people inserting the backdoor or using it would need to be bound by a National Security Letter's gag order. I doubt anyone at Google (including those subject to NSL gag orders) was made aware of this specific vulnerability. # Google’s commitment to collaboration and hardware security ## As Reptar, Zenbleed, and Downfall suggest, computing hardware and processors remain susceptible to these types of vulnerabilities. This trend will only continue as hardware becomes increasingly complex. This is why Google continues to invest heavily in CPU and vulnerability research. Work like this, done in close collaboration with our industry partners, allows us to keep users safe and is critical to finding and mitigating vulnerabilities before they can be exploited. There's a tension between the NSA wanting backdoors and service providers (CPU designers + Cloud hosting) wanting secure platforms. It's possible that by employing CPU and security researchers, Google can tip the scales a bit further in their favor.

rep_lodsb 3y ago

My guess is that it would be something that could be exploited via JavaScript. And no JIT would emit an instruction like the one that causes this bug.

gosub100 3y ago

the backdoor would just be an encrypted stream of "random" data flowing right out the RNG. there's some maxim of crypto that encrypted data is indistinguishable from random bytes.

tedunangst 3y ago

How would you distinguish this backdoor from one inserted by an unknown partner of the NSA?