Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Undocumented x86 instructions in Intel CPUs that can modify microcode

twitter.com

Post reply on HN
Print view View original

71–80 of 145 posts

Re: Undocumented x86 instructions in Intel CPUs that can modify microcode

#71

Post by tinus_hn »

jesboat wrote: post #64
scaramanga wrote: post #10

Earlier quoted context omitted.

It is public knowledge that US intelligence agencies actually just hijack computers and equipment on their way to the customer and install hardware backdoors there (Snowden et al., 2014). It is also known that they have had backdoors in commercial systems as they came off the shelf, but I think usually those were CIA owned and controlled companies like the crypto AG phones. What is unknown (pure speculation) is wheth…

> On the one hand, that would be a powerful capability to have, but on the other hand, the risk of exposure and subsequent damage to the US economy, prestige, etc. would be non-zero If I were a three-letter agency, I'd bribe/blackmail somebody into inserting intentionally vulnerable code. After all, sufficiently advanced malice is indistinguishable from incompetence. We've often seen that the code inside firmware, se…

Subtly change the RNG implementation so there’s a predictability only you know.

Re: Undocumented x86 instructions in Intel CPUs that can modify microcode

#72

Post by tinus_hn »

intricatedetail wrote: post #13
yjftsjthsd-h wrote: post #12

Earlier quoted context omitted.

I don't know. It's Windows vs Linux all over; I think Open is better, but Intel has never (AFAIK) pretended to do that. If a customer knows "Intel/Microsoft controls this", I personally feel like that's an acceptable tradeoff. And for people who find that unacceptable, there's Debian on POWER9. But if you're picking Intel, it's not like these opcodes change anything; we already have ME sitting there controlling the m…

Did they release specs so that customer could build their own ME to manage the CPU? That would be interesting.

They don’t even release instructions on how to turn it off.

Re: Undocumented x86 instructions in Intel CPUs that can modify microcode

#73

Post by tinus_hn »

duskwuff wrote: post #68
monocasa wrote: post #65

Earlier quoted context omitted.

Back in the day they were though. Full schematics, microcode listings, and a flow chart to understand the microcode.

Can you give an example of a processor whose microcode was publicly documented? (Barely-public documents like patent filings don't count.)

For the 6502 there were manuals that detailed how many clock ticks every instruction takes and what happens during the ticks, which is pretty much the same.

Re: Undocumented x86 instructions in Intel CPUs that can modify microcode

#74

Post by tinus_hn »

usr1106 wrote: post #70
monocasa wrote: post #66

Earlier quoted context omitted.

The previous publicly known mechanism required signed updates. This mechanism allows anyone to twiddle the bits.

> This mechanism allows anyone to twiddle the bits. This remained unclear to me. Other comments say the CPU needs to be in red unlocked state, whatever that is. The screenshot shows UEFI. So one could guess the CPU is in such state before the operating system gets loaded. But the operating system typically loads a microcode update, after that the CPU should no longer be in unlocked state. So for "everyone can fiddle…

If you’re not doing this as a hack but to get more control over your own processor, you can just turn off secure boot, it’s a bios setting.

Re: Undocumented x86 instructions in Intel CPUs that can modify microcode

#75

Post by trasz »

jesboat wrote: post #64
scaramanga wrote: post #10

Earlier quoted context omitted.

It is public knowledge that US intelligence agencies actually just hijack computers and equipment on their way to the customer and install hardware backdoors there (Snowden et al., 2014). It is also known that they have had backdoors in commercial systems as they came off the shelf, but I think usually those were CIA owned and controlled companies like the crypto AG phones. What is unknown (pure speculation) is wheth…

> On the one hand, that would be a powerful capability to have, but on the other hand, the risk of exposure and subsequent damage to the US economy, prestige, etc. would be non-zero If I were a three-letter agency, I'd bribe/blackmail somebody into inserting intentionally vulnerable code. After all, sufficiently advanced malice is indistinguishable from incompetence. We've often seen that the code inside firmware, se…

You don’t need to bribe anyone; Intel is a US company, so A TLA can just discretely explain to them how export restrictions work.

Re: Undocumented x86 instructions in Intel CPUs that can modify microcode

#76

Post by trasz »

tinus_hn wrote: post #71
jesboat wrote: post #64

Earlier quoted context omitted.

> On the one hand, that would be a powerful capability to have, but on the other hand, the risk of exposure and subsequent damage to the US economy, prestige, etc. would be non-zero If I were a three-letter agency, I'd bribe/blackmail somebody into inserting intentionally vulnerable code. After all, sufficiently advanced malice is indistinguishable from incompetence. We've often seen that the code inside firmware, se…

Subtly change the RNG implementation so there’s a predictability only you know.

That’s one of the reasons why operating systems provide a proper CPRNG instead of trusting RDRAND.

Re: Undocumented x86 instructions in Intel CPUs that can modify microcode

#77

Post by [deleted] »

duskwuff wrote: post #68
monocasa wrote: post #65

Earlier quoted context omitted.

Back in the day they were though. Full schematics, microcode listings, and a flow chart to understand the microcode.

Can you give an example of a processor whose microcode was publicly documented? (Barely-public documents like patent filings don't count.)

[deleted]

Re: Undocumented x86 instructions in Intel CPUs that can modify microcode

#78

Post by usr1106 »

tinus_hn wrote: post #74
usr1106 wrote: post #70

Earlier quoted context omitted.

> This mechanism allows anyone to twiddle the bits. This remained unclear to me. Other comments say the CPU needs to be in red unlocked state, whatever that is. The screenshot shows UEFI. So one could guess the CPU is in such state before the operating system gets loaded. But the operating system typically loads a microcode update, after that the CPU should no longer be in unlocked state. So for "everyone can fiddle…

If you’re not doing this as a hack but to get more control over your own processor, you can just turn off secure boot, it’s a bios setting.

Sure. But preferably install your own keys and sign bootloader and operating system yourself if you run untrusted code on the machine.

Re: Undocumented x86 instructions in Intel CPUs that can modify microcode

#79

Post by justinclift »

tedunangst wrote: post #6
xwolfi wrote: post #4

Earlier quoted context omitted.

So you mean, if I am a state actor able to kidnap the child of an Intel high level employee... say I m Joe Biden, I can ask Intel to... remote unlock my CPU and read arbitrary memory block ? Or you mean Intel had to physically handle your CPU with a debug cable or whatever ? Cause I really dont feel it s okay that the only safety we have from a newly discovered exploit is that there needs to be another newly discover…

Don't use CPUs from companies that have employees that can be kidnapped.

Doesn't seem like that would leave many possibilities... ;)

Re: Undocumented x86 instructions in Intel CPUs that can modify microcode

#80

Post by konjin »

Havoc wrote: post #50

Reminds me of GKH story about not even kernel devs truly understanding CPUs. Here is the timestamp https://youtu.be/t9MjGziRw-c?t=585

It's absolutely incredible that I can't buy a processor and be able to run a command on the bare metal. We don't even know how many levels of indirection between x86 machine code and actual hardware there are.
Post reply on HN