20GB leak of Intel data: whole Git repositories, dev tools, backdoor mentions

Post by close04 » Thu, Aug 06, 2020, 10:41 PM UTC

fit2rule wrote: post #109

yjftsjthsd-h wrote: post #52

Earlier quoted context omitted.

It seems like a thin line between a debugging feature and a backdoor; "merely a debugging server that could be enabled and allowed you to inspect internal state during runtime" seems like a backdoor to me, doubly so if it's network-accessible. If Intel has, say, an undocumented way to trigger a debug mode that lets you read memory and bypass restrictions (ex. read kernel memory from user mode, or read SGX memory), is…

Was it a backdoor, or a hidden door, or .. a utility panel? The difference, in my opinion, is in the documentation and frequency of use. Is it overt? Does the customer really know its there, and what its for? Perfectly fine to have an access panel that gives you access to the buss .. if the pilot knows you're doing it. But if its some random entrance in the back of an alley, only 2 or 3 users in the universe know wha…

Post by dathinab » Thu, Aug 06, 2020, 10:41 PM UTC

dosshell wrote: post #65

dleslie wrote: post #17

Earlier quoted context omitted.

Of course it's not legal. This is exfiltrated intellectual property being shared without license.

Which country laws does apply? Is it really illegal to share this in the whole world? Im not so sure about that.

Post by heavenlyblue » Thu, Aug 06, 2020, 10:43 PM UTC

skissane wrote: post #135

orisho wrote: post #11

At a previous workplace we had a few places in the code which used the word backdoor. It was not an actual backdoor though, but merely a debugging server that could be enabled and allowed you to inspect internal state during runtime. At some point I removed the word backdoor, fearing it would get to a customer or during an audit someone would misunderstand. :|

Once I got a complaint from a security auditor that some code was using MD5. It wasn’t being used for any security purpose, just to check whether an autogenerated file had been manually edited. We decided it was easier to do what they wanted than argue with them, so we replaced it with CRC32C. That would have been faster than MD5, but nobody cares about saving a few milliseconds off reading a configuration file at st…

Post by dathinab » Thu, Aug 06, 2020, 10:43 PM UTC

msbarnett wrote: post #72

dosshell wrote: post #65

Earlier quoted context omitted.

Which country laws does apply? Is it really illegal to share this in the whole world? Im not so sure about that.

>Which country laws does apply? At the very least, Intel owns the copyright on this material, so sharing it is a copyright violation in any country that is a signatory to the Berne Convention or the TRIPS Agreement, which is effectively almost the entire planet. Then you have to add Trade Secret laws on top of that, which will have slightly narrower jurisdiction but still impact a lot of countries. There are very few…

Post by deviarte » Thu, Aug 06, 2020, 10:44 PM UTC

aflag wrote: post #118

dleslie wrote: post #67

Earlier quoted context omitted.

Intel is an American company; so wherever there is an extradition treaty with the USA and where there are also similar laws.

No country Will extradite their own citizens, though. If intel wants the person punished, they have to sue them in the country they live in.