121–130 of 145 posts
Reminds me of GKH story about not even kernel devs truly understanding CPUs. Here is the timestamp https://youtu.be/t9MjGziRw-c?t=585
It's absolutely incredible that I can't buy a processor and be able to run a command on the bare metal. We don't even know how many levels of indirection between x86 machine code and actual hardware there are.
Earlier quoted context omitted.
For the 6502 there were manuals that detailed how many clock ticks every instruction takes and what happens during the ticks, which is pretty much the same.
I don't know what era you are pining for. The original 6502 had many undocumented instructions. Most of them not very interesting, but certainly undocumented. http://nesdev.com/undocumented_opcodes.txt Here is a detailed examination of undocumented Z80 behavior. http://www.z80.info/zip/z80-documented.pdf The 8080 had undocumented instructions too. So now we are all the way back to pdp series. The pdp-8 had plenty of…
Same was true with pretty much all non microcomputers through the 80s.
Earlier quoted context omitted.
>What is unknown (pure speculation) is whether, for example, Intel CPUs come backdoored straight from the factory floor? There is also a third possibility, that some intelligence agency invested a ton of cash into finding abusable exploits in these systems giving them the same access a backdoor would provide. Also from the Snowden leaks, we know that they have programs with budgets in the millions into finding simila…
If I'm the CIA I have dozens of highly placed agents or at least informants at Intel. Not necessarily placing backdoors, but finding and not fixing exploits and sending them back to the CIA for later use. It would be extremely cheap, hell if I'm China, Russia, the UK, or Israel I'm doing the same thing.
Russia and China would get Windows source access for instance.
Earlier quoted context omitted.
Why is it acceptable for companies to keep such information away from a consumer?
Here's how Ford tests its car seats: https://www.theverge.com/tldr/2019/1/11/18178402/ford-robot-... Should we, as consumers, demand that Ford productize this robot and make it publicly available before we'll buy a Ford car?
Look up "Intel VISA" if you want to go down one of the many rabbitholes of undocumented x86... it makes me sad that there are whole subsystems in the hardware whose documentation is not publicly available; not from the security perspective, but from the "I bet someone could do some really interesting things with this functionality" perspective, like what LOADALL enabled (unreal mode, real-mode paging, etc.) decades a…
I've been down so many "rabbit holes" aka "levels of abstraction" aka "abstraction hierarchies" aka "turtles on top of turtles" aka "things stacked on top of other things" (compare with Monty Python's "society for putting things on top of other things") in my life as a Programmer (and in my secret life as an Philosopher! Shhh, don't tell anyone! . And yes, I know... "Keep the day job"...) that one more ("I'll go down this last rabbit hole, and then I'll be finished, really!") really won't make that much more difference!
Before I get started on that one though, two more quick references about "abstraction hierarchies" aka "rabbit holes".
On the one hand, we have Joel Spolsky's magnificent essay, "The Law of Leaky Abstractions (https://www.joelonsoftware.com/2002/11/11/the-law-of-leaky-a...) and on the other, we have the Biblical story of "The Tower Of Babel".
Now, I am not the member of any religion, I don't endorse any religious text over any other, but any intellectual worth his salt -- should read both of these writings, and compare them.
Once you've done that, then compare what's being said to abstraction hierarchies of all sorts.
We see abstraction hierarchies in code, we see them in language (especially when a language changes over many years, as it changes, fractures and sediments). We see them in Law (Law in the U.S. as it is practiced today can be compared to an abstraction hierarchy -- not at all unlike The Tower Of Babel as a metaphor for this phenomenon, or Joel's essay as a more complete modern-day explanation of it...)
We see them in a number of places and systems.
We even see them in x86-land...
That's because the x86 (as far as all of my research has suggested, and someone correct me if you think I am wrong, with links/references please!) -- is really a RISC core with a separate microcode execution engine (the level of abstraction above the RISC core), and has been since at least the Pentium Pro (P6, 1995):
https://stackoverflow.com/questions/5806589/why-does-intel-h...
http://i.blackhat.com/us-18/Thu-August-9/us-18-Domas-God-Mod... (Or Google "Christopher Domas God Mode Unlocked") (Also, see the patents listed in this PDF)
https://arxiv.org/pdf/1910.00948v1.pdf
https://troopers.de/events/troopers16/655_the_chimaera_proce... ("We take a 12-core processor, inject microcode to simulate a PowerPC (2 cores) and a MIPS processor (2 cores), restrict 2 cores to i386 and leave 4 cores to amd64.")
So with all this in mind, let's turn back and look at VISA:
https://threatpost.com/undocumented-intel-visa-tech-can-be-a...
>"The Intel technology is called Visualization of Internal Signals Architecture (VISA), and is used for manufacturing-line testing of chips.
However, Maxim Goryachy and Mark Ermolov, security researchers with Positive Technologies, said in a Thursday Black Hat Asia session that VISA can be accessed – and subsequently abused — to capture data from the CPU using a series of previously-disclosed vulnerabilities in Intel technology."
You know, that sort of reminds me of lyrics from The Who's "You Better You Bet":
"I showed up late one night with a neon light for a VISA,
But knowing I'm so eager to fight can't make letting me in any easier..."
Hmmm, now who is "me" in the above context?
?
Could it be... (With my apologies to SNL's Dana Carvey as "The Church Lady")... a TLA? (Three Letter... er, group? )
Hey, if any power-that-be is offended, then I'd like them to know that I only quote things that I find on some places on the Internet -- on other places on the Internet....
In other words, I am only the messenger... one of millions and billions, that also quote things that they find on the Internet -- on other places on the Internet...
(Side note: There should be a Monty Python sketch for that topic! )
In other words, "don't shoot the messenger...(s)" ...
Earlier quoted context omitted.
Plot twist: there’s been a few ME vulnerabilities. And who knows what other purposeful ME backdoors there may or may not be.
Sure, which is why this is useful to researchers. But the access someone needs to your system in order to exploit the ME vulnerabilities is sufficiently extreme that if someone achieves it you probably have other things to worry about.
- Police confiscate your laptop on some bogus pretext, then return it to you saying you're free to go.
- You open the laptop and find nothing that shouldn't be there. You wipe it, reinstall the OS and continue using the laptop.
- Surprise! The CPU now works for the police, so after some time it installs a rootkit or whatever.
Dunno if the microcode is big enough to do this kind of attacks, and perhaps some other firmware is easier to program.
But if someone waves this off saying that's not how police works in the US, well the world is larger than the US and it all definitely happens in other countries, only without CPU rootkits so far.
Earlier quoted context omitted.
Can you give an example of a processor whose microcode was publicly documented? (Barely-public documents like patent filings don't count.)
For the 6502 there were manuals that detailed how many clock ticks every instruction takes and what happens during the ticks, which is pretty much the same.
Here's a typical datasheet from Rockwell, for example:
http://archive.6502.org/datasheets/rockwell_r65c00_microproc...
It's also worth noting that the architecture diagram on page 5 of this document isn't entirely accurate, either. It's closer to a programmer's model than an RTL description of the CPU; some "hidden" registers used during certain operations (like indirect addressing modes) aren't shown.
Earlier quoted context omitted.
Sure, which is why this is useful to researchers. But the access someone needs to your system in order to exploit the ME vulnerabilities is sufficiently extreme that if someone achieves it you probably have other things to worry about.
I suppose one possible scenario is: - Police confiscate your laptop on some bogus pretext, then return it to you saying you're free to go. - You open the laptop and find nothing that shouldn't be there. You wipe it, reinstall the OS and continue using the laptop. - Surprise! The CPU now works for the police, so after some time it installs a rootkit or whatever. Dunno if the microcode is big enough to do this kind of…
There's not really a meaningful difference between these! If there's an exploitable ME vulnerability then the police can absolutely own your system in an undetectable way regardless of whether or not this feature exists. If we were in a different universe where the ME enabled whether or not the CPU was in debug mode but wasn't responsible for any other security features then we'd care about this a great deal more, but as long as compromising the ME already gives you a way to permanently backdoor the system it's doesn't make any real difference.