Live data from Hacker News

Hardware backdoors in some x86 CPUs

github.com

51–60 of 103 posts

Re: Hardware backdoors in some x86 CPUs

#51
post #28
post #26

Earlier quoted context omitted.

"It's documented in the datasheet" is such a weak excuse for a backdoor. Documenting a backdoor doesn't make it not a backdoor, just means it's not a hidden backdoor. The fact that a number of machines shipped with the backdoor accidentally enabled, and nobody noticed for over a decade shows just how dangerous even a documented backdoor can be. The oversight wasn't even detected by someone reading the manual, it was…

Doesn’t backdoor imply hidden? If it’s clearly documented it’s just a (front)door?

Not really... backdoor just means something that can bypass the main security.

It's just that publicly known backdoors are of very limited usefulness, because people go out of their way to remove, disable, or avoid them. Or worse, use them for their own gains. There have been more than a few cases of governments trying to implement and enforce publicly known backdoors (with keys only the government knows), such as the Clipper cryptography chip in the 90s.

But... just because something is documented, doesn't mean it's publicly known. We have an example here of something obscure enough to be a useful backdoor (assuming someone knew about it).

And while the underlying feature might have been documented, the fact that many BIOSes enabled the feature was not documented anywhere. That does count as hidden.

Re: Hardware backdoors in some x86 CPUs

#52

this is pretty old by now but still very relevant. people dont look at this enough but with rising chip complexities for TPU units etc. and a shift towards poorly documented hardware like NVIDIA gives this problem new fuel. Domas (and maybe his team or colleagues?) has put out shit tons of very interesting materials over the past years on advanced malware, implants and things like Cantor Dust which are amazing things…

I didn't know what Cantor Dust was, and had to click through a few different search results to get past all the abstract descriptions and begin to form a basic idea.

In a nutshell, I understand them as a sort of "blockie" for binary data formats. Things like WAV audio files, bitmaps, ASCII text, machine code, etc. each generate their own distinct visual signature (but different examples within any of these categories tend to generate similar signatures). So once you learn the "blockies" for different types of data, they really pop out when content is viewed this way ("hey there's an image buried in that sequence of 1's and 0's!").

The explanation on this page isn't bad, and the bitmap example near the bottom is particularly illustrative (once you've seen the reference image for bitmaps earlier in the page):

https://inside.battelle.org/blog-details/battelle-publishes-...

My armchair-expertise here is only about 20 minutes old, but I hope this helps someone else looking for a starting point to learn about them!

Re: Hardware backdoors in some x86 CPUs

#53
post #33

Earlier quoted context omitted.

> Is there another term they could be classfied as? As an advertised feature of the product. Your personal definition doesn’t match the general understanding of the word and concept. By your definition every window on a house or car is a “backdoor”. Anything with an advertised fallback is a backdoor. And sometimes the “front door” is the back door: getting money from an ATM is less secure than with an ID at the bank…

Password resets aren't "backdoors" unless they contain a flaw the defeats any security protections. It's not just that the backdoor is less secure than the front, the backdoor has no security or is so easily defeated the security may as well not exist. I'm surprised the hidden aspect of backdoor is so forward in folks minds. In my thinking nothing in cyber security is hidden, I drop the obviously present hidden part…

No offense but I don’t think you have a clear enough definition in your head and you’re making it up as we go along and you get challenged.

>> I'm probably mistaken, but I've always referred to password resets as backdoors

> Password resets aren't "backdoors" unless they contain a flaw the defeats any security protections.

You really have to make up your mind. It was “always” but then it wasn’t, and even as you put it you’d have been wrong almost every time to call a reset “a backdoor”.

> I'm surprised the hidden aspect of backdoor is so forward in folks minds.

Only because you misunderstand the meaning of the term, as made very clear above. Go through the wiki page for a “backdoor”.

> In my thinking nothing in cyber security is hidden

I wonder what all those security researchers do all day, with everything being so out in the open and known by everyone.

> I drop the obviously present hidden part of backdoor definition when it's used in yhe cyber security context.

You can drop it but then you’re just using the wrong definition and wrong understanding.

Re: Hardware backdoors in some x86 CPUs

#54
post #50

This shows that large companies making closed-source CPUs cannot be trusted. No doubt they would add whatever the government asks them to add. What can be done to mitigate this? One option would be to buy a large FPGA and flash it with an open-source CPU. Another would be to emulate a CPU, working with encrypted data and commands, so that even if the backdoor in a host CPU tries to overwrite memory, it would only cra…

>What can be done to mitigate this? Buy hardware used by government computers that are rivals to your country. So if American, buy Chinese CPUs and install Chinese Linux or HarmoneyOS Assuming there is nothing you are doing of interest to them, as that will also have back doors After Snowden, one can only imagine the worst and think everything has a backdoor. But unless you are a high level terrorist or other person…

[deleted]

Re: Hardware backdoors in some x86 CPUs

#55
post #50

This shows that large companies making closed-source CPUs cannot be trusted. No doubt they would add whatever the government asks them to add. What can be done to mitigate this? One option would be to buy a large FPGA and flash it with an open-source CPU. Another would be to emulate a CPU, working with encrypted data and commands, so that even if the backdoor in a host CPU tries to overwrite memory, it would only cra…

>What can be done to mitigate this? Buy hardware used by government computers that are rivals to your country. So if American, buy Chinese CPUs and install Chinese Linux or HarmoneyOS Assuming there is nothing you are doing of interest to them, as that will also have back doors After Snowden, one can only imagine the worst and think everything has a backdoor. But unless you are a high level terrorist or other person…

If many people do this then I'm sure China will find some uses for that data at some point.

Re: Hardware backdoors in some x86 CPUs

#57
post #55
post #50

Earlier quoted context omitted.

>What can be done to mitigate this? Buy hardware used by government computers that are rivals to your country. So if American, buy Chinese CPUs and install Chinese Linux or HarmoneyOS Assuming there is nothing you are doing of interest to them, as that will also have back doors After Snowden, one can only imagine the worst and think everything has a backdoor. But unless you are a high level terrorist or other person…

If many people do this then I'm sure China will find some uses for that data at some point.

Sure but the cops aren't going to pull you over based on what you think about Chinese policy. Government do mess with people across international borders, but the capacity to do that is inherently limited.

Re: Hardware backdoors in some x86 CPUs

#58
post #57
post #55

Earlier quoted context omitted.

If many people do this then I'm sure China will find some uses for that data at some point.

Sure but the cops aren't going to pull you over based on what you think about Chinese policy. Government do mess with people across international borders, but the capacity to do that is inherently limited.

Blackmail is still a possibility ...

Plus your data can be sold on the market. To US based entities. While the Chinese still hold on to the data for future uses ...

Post reply on HN