4 ms·

The real problem is not the CPUs but the mobo chipsets. The actual root.

by papichulo2023 3y ago

TacticalCoder 3y ago
> The real problem is not the CPUs but the mobo chipsets. The actual root. But that actual root (complete with a networking stack etc.) backdoor (sorry: that amazing feature allowing updates we-swear-its-not-a-backdoor) is running the Minix OS on an... Intel chip? So if they ban Intel chips for government use, technically they also ban all these backdoored (sorry, "upgradable") mobos too no!?
- deleted 3y ago
  [deleted]
eric-hu 3y ago
Pardon my ignorance, but does “actual root” imply some kind of connection between a Linux root user and the motherboard chipset?
- jpgvm 3y ago
  Probably not. They are probably referring to root of trust. Though they could also just be referring to "root" as a colloquialism to compromise the system but we are going to go with root of trust for sake of discussion. The motherboard (and associated UEFI/BIOS bits) is responsible for bootstrapping the Secure Boot process, it holds the keys that are used to verify the boot loader etc, which then chain-loads into a signed initramfs and kernel which then would normally decrypt and authenticate the filesystem. This chain of trust only works forwards. If you pwn any link in that chain then everything forward of it is now untrusted. Thus compromising the actual root, i.e the UEFI/BIOS firmware is the ultimate hack. Especially if it can be done persistently and without detection. Now for a normal desktop this doesn't really matter but on something like an EV (basically computer on wheels in Tesla's case atleast) then it really matters. High value military computers wouldn't be much different in this respect.
- yencabulator 3y ago
  "root" has come to mean "unrestricted access", e.g. "to root" = "to gain unrestricted access". In this case, it most likely refers to a network connected hardware subsystem that can pause the main CPU and access its state freely.
userbinator 3y ago
There were a few non-US companies making chipsets for PCs back in the late 90s/early 2000s --- VIA, SiS, ALi, UMC, Winbond, etc. I'm sure China has the resources to make its own.
may_mccheese 3y ago
if you're a fan of DEFCON it has been found that there are weirdo instructions on an unnamed x86 CPU that activate some sort of secondary RISC core with completely different instructions. it's not unreasanable to hypotheticate that such secret cores may exist on modern processors, and may be hidden by more than some weirdo instruction i.e. run these 18 instructions in a row with these register values and these memory values at these addresses and this timing, and then and only then will the suber secret risc core activate https://media.defcon.org/DEF%20CON%2026/DEF%20CON%2026%20presentations/Christopher%20Domas/DEFCON-26-Christopher-Domas-GOD-MODE-UNLOCKED-hardware-backdoors-in-x86-CPUs.pdf https://media.defcon.org/DEF%20CON%2026/DEF%20CON%2026%20pre...

The real problem is not the CPUs but the mobo chipsets. The actual root.

> The real problem is not the CPUs but the mobo chipsets. The actual root. But that actual root (complete with a networking stack etc.) backdoor (sorry: that amazing feature allowing updates we-swear-its-not-a-backdoor) is running the Minix OS on an... Intel chip? So if they ban Intel chips for government use, technically they also ban all these backdoored (sorry, "upgradable") mobos too no!?

deleted 3y ago
[deleted]

eric-hu 3y ago

Pardon my ignorance, but does “actual root” imply some kind of connection between a Linux root user and the motherboard chipset?

jpgvm 3y ago
Probably not. They are probably referring to root of trust. Though they could also just be referring to "root" as a colloquialism to compromise the system but we are going to go with root of trust for sake of discussion. The motherboard (and associated UEFI/BIOS bits) is responsible for bootstrapping the Secure Boot process, it holds the keys that are used to verify the boot loader etc, which then chain-loads into a signed initramfs and kernel which then would normally decrypt and authenticate the filesystem. This chain of trust only works forwards. If you pwn any link in that chain then everything forward of it is now untrusted. Thus compromising the actual root, i.e the UEFI/BIOS firmware is the ultimate hack. Especially if it can be done persistently and without detection. Now for a normal desktop this doesn't really matter but on something like an EV (basically computer on wheels in Tesla's case atleast) then it really matters. High value military computers wouldn't be much different in this respect.
yencabulator 3y ago
"root" has come to mean "unrestricted access", e.g. "to root" = "to gain unrestricted access". In this case, it most likely refers to a network connected hardware subsystem that can pause the main CPU and access its state freely.

userbinator 3y ago

There were a few non-US companies making chipsets for PCs back in the late 90s/early 2000s --- VIA, SiS, ALi, UMC, Winbond, etc. I'm sure China has the resources to make its own.

may_mccheese 3y ago

if you're a fan of DEFCON it has been found that there are weirdo instructions on an unnamed x86 CPU that activate some sort of secondary RISC core with completely different instructions. it's not unreasanable to hypotheticate that such secret cores may exist on modern processors, and may be hidden by more than some weirdo instruction i.e. run these 18 instructions in a row with these register values and these memory values at these addresses and this timing, and then and only then will the suber secret risc core activate https://media.defcon.org/DEF%20CON%2026/DEF%20CON%2026%20presentations/Christopher%20Domas/DEFCON-26-Christopher-Domas-GOD-MODE-UNLOCKED-hardware-backdoors-in-x86-CPUs.pdf https://media.defcon.org/DEF%20CON%2026/DEF%20CON%2026%20pre...