3 ms·
Not intended as click bait. I saw it on twitter and was wondering just how serious a flaw people thought this could be. Or if the presenter might just be blowin
by thomnottom 11y ago
Not intended as click bait. I saw it on twitter and was wondering just how serious a flaw people thought this could be. Or if the presenter might just be blowing smoke.
- zobzu 11y agowell it still says "universal" but in fact, its universal if you are root/can insmod/etc. it reminds me of the unlimited data plans that are limited after 5Gb. Not sure what happened to language :)
- prof_hobart 11y agoI read it as meaning "escalating to give you universal privilege".
- fit2rule 11y agoFrom a security perspective, this: "universal if you are root/can insmod/etc." .. only needs to be true once, and from that point on the hardware no longer belongs to the owner. So, if you could for example get your secretNSA$hit installed on the Linux box that is used to test hardware at the PC assembly/manufacturing plant, before its sent off to be 'securely configured' by the sysadmin/ops as supposedly fresh equipment. Lots of ways that can happen, of course its theatrical to consider it, but little in security these days is without drama it seems. Truly, not being able to trust the microcode in my CPU is a worry, but it always has been. There are no guarantees that there aren't already CPU embeds that are configured to ship data to some quantum-bearing government spy satellite, and thus we're all fools for thinking we have any kind of security on this theatrical stage at all ..
- zobzu 11y agoeven the non-microcode part you are forced to trust but then again so goes for the rest of the hardware, not just the cpu