4 ms·
Putting my tinfoil hat on for a moment, these are the exact types of attacks that China and the US are alleged to have executed. I would trust Intel to lock dow
by exelius 12y ago
Putting my tinfoil hat on for a moment, these are the exact types of attacks that China and the US are alleged to have executed. I would trust Intel to lock down security on microcode updates (which is exactly why you can't find the answers to any of the questions you asked), but I would also trust that state actors (i.e. spies backed by a trillion dollar economy) have the resources to break any security that any one company could dream up.
I would guess that the first layer of protection comes from limiting the scope of microcode updates. Perhaps there's a semiconductor engineer out there who knows more?
- 0x0 12y agoWell. Microcode updates are lost on reboot, and they can only be applied from privileged code. Which means you'll have to be able to slip rogue code into the BIOS or the kernel, at which point you already have full control. The "negative ring" levels of code (SMI, etc) are quite powerful already. But a trojanized microcode update file inside an otherwise regular BIOS would be a nice hiding spot, hard to detect and analyze, at least for anyone outside Intel.
- AlyssaRowan 12y agoOr you could just use SMM or IPMI.
- sillysaurus3 12y agoUse those how? Would you go into detail?
- amluto 12y agoSee, for example: http://www.eecs.ucf.edu/%7Eczou/research/SMM-Rootkits-Securecom08.pdf http://www.eecs.ucf.edu/%7Eczou/research/SMM-Rootkits-Secure... If you're an OS, then you need some kind of exploit to update SMM code. But if you're the BIOS, then you have complete control over what happens in SMM mode.