[deleted]
Trustworthy Computing in 2021
11–20 of 32 posts
Re: Trustworthy Computing in 2021
#12The machines that get 5/5, do they have open hardware? I heard somewhere that there's this thing called microcode that resides in the processor and could contain backdoors. Is that taken into account here?
It's not.
Microcode (insofar as how the term is used for x86/AMD) controls the operation of the CPU itself and the implementation of certain CPU instructions that aren't hardwired. It's too low-level to do things on its own like send a copy of RAM through a network adapter, etc.
Nonetheless, if you could manage to reverse engineer the microcode (which is likely different per CPU manufacturer and microarchitecture), and decrypt it (I do know AMD's microcode was not encrypted for a time, but is now), you could probably alter the behavior of some CPU instructions. Maybe you could manipulate some CPU instructions into allowing code to be executed where it wouldn't previously be executed, e.g. ignoring privilege checks, etc. and maybe you could do it without introducing side effects and causing existing code to misbehave or crash.
However it's a thousand times easier to modify the actual code the CPU is executing from RAM somehow - through OS vulnerabilities, etc. Any CPU code is either going to be running in kernel mode with full privileges or eventually interacting with code that does through some sort of interface. Operating system code is either available (open source) or widely distributed (Windows). Modern software development is further and further abstracted away from real hardware with ever increasing layers which are also either open source or widely distributed.
The possibility for finding human error somewhere in this scheme is vastly more likely to produce useful vulnerabilities - not the CPU microcode which is completely unknown, undocumented, encrypted, changes which each CPU, and updates thereof provided by the manufacturer.
Re: Trustworthy Computing in 2021
#13It's great to see that more people are still working on this and that people have an interest. If you are interested in this kind of thing, then you'll also want to check out LibreBoot[1] and Bootstrappable Builds[2]. The latter is working with stage0 [3] and mes [4] to bootstrap Guix (among other projects.) All of that is further down the chain, but we'll need it if we want to build trustworthy systems. 1. https://l…
Wish modern hardware had better support for this. I don't think I'll ever trust their proprietary firmwares. The problem is becoming so widespread. All kinds of peripherals have firmware now. Who knows what they're doing. Did that storage device really delete the data or is it just pretending? Only way to be sure is to physically destroy the device.
> Only way to be sure is to physically destroy the device.
Or ... never write unencrypted data to the device.
Re: Trustworthy Computing in 2021
#14It's great to see that more people are still working on this and that people have an interest. If you are interested in this kind of thing, then you'll also want to check out LibreBoot[1] and Bootstrappable Builds[2]. The latter is working with stage0 [3] and mes [4] to bootstrap Guix (among other projects.) All of that is further down the chain, but we'll need it if we want to build trustworthy systems. 1. https://l…
Wish modern hardware had better support for this. I don't think I'll ever trust their proprietary firmwares. The problem is becoming so widespread. All kinds of peripherals have firmware now. Who knows what they're doing. Did that storage device really delete the data or is it just pretending? Only way to be sure is to physically destroy the device.
I thought something along these lines when it comes to peripherals, too, but don't these (mice and keyboards chiefly) communicate with PCs through a subset of the USB standard which only handles HID and nothing else?
Would any snooping be possible through an input device if it only did HID?
Re: Trustworthy Computing in 2021
#15The machines that get 5/5, do they have open hardware? I heard somewhere that there's this thing called microcode that resides in the processor and could contain backdoors. Is that taken into account here?
None of it is open hardware but some of it has been reverse engineered. I know some x86 CPU's have had their microcode reverse engineered, starting with the 8086 but also AMD's K8 and K10. There are lots of die photos of the 486DX chips and a patent says the microcode was pretty small (only 250 "lines", 12kbits.) About the POWER CPUs I have no idea. They're RISC so do they even have microcode?
Re: Trustworthy Computing in 2021
#16How would the HiFive Unmatched stack up here? Seems like it would do rather well:
https://starfivetech.com/uploads/hifive-unmatched-sw-referen...
https://sifive.cdn.prismic.io/sifive/28560457-c5a4-4f88-866c...
Re: Trustworthy Computing in 2021
#17Earlier quoted context omitted.
Wish modern hardware had better support for this. I don't think I'll ever trust their proprietary firmwares. The problem is becoming so widespread. All kinds of peripherals have firmware now. Who knows what they're doing. Did that storage device really delete the data or is it just pretending? Only way to be sure is to physically destroy the device.
I thought something along these lines when it comes to peripherals, too, but don't these (mice and keyboards chiefly) communicate with PCs through a subset of the USB standard which only handles HID and nothing else? Would any snooping be possible through an input device if it only did HID?
> PCs through a subset of the USB standard which only handles HID and nothing else?
Yes. Is the device truly limited to doing just that, though? No way to know. I don't know enough electronics to tear it down and analyze its parts, much less dump firmware and reverse engineer it.
>Would any snooping be possible through an input device if it only did HID?
For all I know, it could be silently storing every keystroke in some small memory module hidden somewhere.
Re: Trustworthy Computing in 2021
#18Earlier quoted context omitted.
Wish modern hardware had better support for this. I don't think I'll ever trust their proprietary firmwares. The problem is becoming so widespread. All kinds of peripherals have firmware now. Who knows what they're doing. Did that storage device really delete the data or is it just pretending? Only way to be sure is to physically destroy the device.
> Only way to be sure is to physically destroy the device. Or ... never write unencrypted data to the device.
Yeah, that was my solution as well. It's much easier to destroy a small secret key than terabytes of data.
Re: Trustworthy Computing in 2021
#19Earlier quoted context omitted.
I thought something along these lines when it comes to peripherals, too, but don't these (mice and keyboards chiefly) communicate with PCs through a subset of the USB standard which only handles HID and nothing else? Would any snooping be possible through an input device if it only did HID?
> PCs through a subset of the USB standard which only handles HID and nothing else? Yes. Is the device truly limited to doing just that, though? No way to know. I don't know enough electronics to tear it down and analyze its parts, much less dump firmware and reverse engineer it. >Would any snooping be possible through an input device if it only did HID? For all I know, it could be silently storing every keystroke in…
We had that problem with PS/2 keyboards too, you can buy hardware keyloggers for those.
Re: Trustworthy Computing in 2021
#20conspicuously, infuriatingly absent: