3 ms·

I'm surprised the CPU microcode angle isn't mentioned.

• teraflop 12y ago
  Has there ever been a non-theoretical use of microcode in malware? I would expect it to be difficult for a lot of reasons (the maximum microcode size is probably quite limited; the format is extremely proprietary; and there's only so much overhead you can add at the instruction level before you start causing a noticeable slowdown). Also, microcode updates aren't retained when the system is powered, so you still need to have a persistent backdoor installed at the OS level. Given that, it's not clear what additional benefit a microcode backdoor would provide.
  • kw71 12y ago
    If you are going to modify a BIOS, then the BIOS can apply the microcode update. No need to tamper with OS then.
  • rl3 12y ago
    > Has there ever been a non-theoretical use of microcode in malware? Not to my knowledge. Indeed, the difficulty involved as well as proprietary nature of the format seems to indicate such an attack vector would be restricted to only the most sophisticated actors. So, it's no wonder that there are no real-world examples, assuming that they even exist in the first place. > Also, microcode updates aren't retained when the system is powered, ... While true, I don't necessarily see this as a fatal blow to the attack vector's utility. Without delving into raw speculation, I'm sure there's plenty of clever ways to craft attacks unique to what microcode affords. That said, it seems likely that microcode attacks would be treated more as a specialized capability augmenting something like what the article outlines, rather than a method of attack unto itself.
  • rasz_pl 12y ago
    You 'only' need one instruction compromised/customized to be able to breach ring barrier/take over mmu.