61–70 of 145 posts
Earlier quoted context omitted.
I wonder what interesting things are in Apple's completely undocumented chips? There is that famous saying about known unknowns and unknown unknowns...
No more or less so than intel or amd. Or is the problem that the entire implementation is not public? Because even risc5 doesn't require that.
Intel isn't alone; search "9c5a203a" for some equally interesting stuff on the AMD side.
Earlier quoted context omitted.
It is public knowledge that US intelligence agencies actually just hijack computers and equipment on their way to the customer and install hardware backdoors there (Snowden et al., 2014). It is also known that they have had backdoors in commercial systems as they came off the shelf, but I think usually those were CIA owned and controlled companies like the crypto AG phones. What is unknown (pure speculation) is wheth…
>What is unknown (pure speculation) is whether, for example, Intel CPUs come backdoored straight from the factory floor? There is also a third possibility, that some intelligence agency invested a ton of cash into finding abusable exploits in these systems giving them the same access a backdoor would provide. Also from the Snowden leaks, we know that they have programs with budgets in the millions into finding simila…
Earlier quoted context omitted.
So you mean, if I am a state actor able to kidnap the child of an Intel high level employee... say I m Joe Biden, I can ask Intel to... remote unlock my CPU and read arbitrary memory block ? Or you mean Intel had to physically handle your CPU with a debug cable or whatever ? Cause I really dont feel it s okay that the only safety we have from a newly discovered exploit is that there needs to be another newly discover…
It is public knowledge that US intelligence agencies actually just hijack computers and equipment on their way to the customer and install hardware backdoors there (Snowden et al., 2014). It is also known that they have had backdoors in commercial systems as they came off the shelf, but I think usually those were CIA owned and controlled companies like the crypto AG phones. What is unknown (pure speculation) is wheth…
If I were a three-letter agency, I'd bribe/blackmail somebody into inserting intentionally vulnerable code. After all, sufficiently advanced malice is indistinguishable from incompetence.
We've often seen that the code inside firmware, secure environments like trustzone, etc tend to lack many of the mitigations for the classic vulnerabilities. Just rewrite one of the ASN.1 parsers in the ME (I'm sure there's at least one), "forget" a bounds check in some particularly obscure bit, and you'd have a textbook stack smash.
Earlier quoted context omitted.
Yes! God, I miss tge days when things actually shipped with manuals on how everything works. I have a fiew old pieces of hardware I keep manuals around for just to remind me of what the writing style is supposed to look like.
manual != fully documented...
As someone who isn't versed in computer hardware engineering, can nothing be done here? Why is it there is a new backdoor every few months? Is it an architecture issue, and we simply demand too much for too cheap? How do we lock this down?
This post is a nothing-burger. That an instruction exists that permits microcode updates is not new knowledge. Obviously there is one, if you can update microcode. All that's new here is reverse-engineering has filled in one of the holes in the Intel SDM.
Earlier quoted context omitted.
No more or less so than intel or amd. Or is the problem that the entire implementation is not public? Because even risc5 doesn't require that.
That isn't true. AMD aren't great at it, but Intel publish thousands and thousands of pages of manuals. They don't have the secret sauce in them as per se but Apple literally will not publish jack shit about anything inside M1.
Earlier quoted context omitted.
manual != fully documented...
Back in the day they were though. Full schematics, microcode listings, and a flow chart to understand the microcode.
(Barely-public documents like patent filings don't count.)
Earlier quoted context omitted.
Yes! God, I miss tge days when things actually shipped with manuals on how everything works. I have a fiew old pieces of hardware I keep manuals around for just to remind me of what the writing style is supposed to look like.
Intel has a 5066 page manual available for download here: https://software.intel.com/content/www/us/en/develop/downloa...
Earlier quoted context omitted.
This post is a nothing-burger. That an instruction exists that permits microcode updates is not new knowledge. Obviously there is one, if you can update microcode. All that's new here is reverse-engineering has filled in one of the holes in the Intel SDM.
The previous publicly known mechanism required signed updates. This mechanism allows anyone to twiddle the bits.
This remained unclear to me. Other comments say the CPU needs to be in red unlocked state, whatever that is.
The screenshot shows UEFI. So one could guess the CPU is in such state before the operating system gets loaded. But the operating system typically loads a microcode update, after that the CPU should no longer be in unlocked state.
So for "everyone can fiddle with the bits", that would require to run a modified bootloader first. Which should not be possible thanks to secure boot.
So yes, maybe it's a small step to another highly complex exploit. But it's not that everybody running a securely booted operating system (which should be everybody) can start fiddling with bits.
Edit: There is a difference between your own bits and someone else's bits. Yes, on your own machine you can run a modified bootloader and that's a good thing. Putting a modified bootloader to another machine should not be possible (until someone breaks secure boot, but I don't think that has publicly happened)