DE version is available. Content is displayed in original English for accuracy.
Advertisement
Advertisement
⚡ Community Insights
Discussion Sentiment
50% Positive
Analyzed from 805 words in the discussion.
Trending Topics
#backdoor#cpu#via#more#documented#https#old#still#etc#years
Discussion (27 Comments)Read Original on HackerNews
Domas (and maybe his team or colleagues?) has put out shit tons of very interesting materials over the past years on advanced malware, implants and things like Cantor Dust which are amazing things to dive into.
using his own cpu fuzzer, msr fuzzing techniques etc. he has found, reversed and implemented attacks through hardware bugs and backdoors.
It cant be confirmed if a backdoor is malicious or for debugging but essentially the capabilities gained through them are what is important.
These techniques he shows throughout his videos are not super tricky to replicate and I can recommend people who have interest to dive into it, reproduce things and try to help in this domain to raise awareness and findings.
Another good avenu is: Defcon 21 - Decapping Chips The Strike Easy Hard Way
People speak about supply chain issues in NPM and Pip etc. but these are much more severe and hard to detect.
Almost no one looks at it. Most vendors totally ignore it because you cannot sell products against it. (if ud detect it u need to trash the hw so its not handy... for sales...)
http://datasheets.chipdb.org/VIA/Nehemiah/VIA%20C3%20Nehemia... (page 82)
...which along with the already publicly-known microarchitecture of the C3 makes this statement sound like total nonsense:
The rosenbridge backdoor is a small, non-x86 core embedded alongside the main x86 core in the CPU
I remember laughing at this with a few others knowledgeable in x86 when it first came out; a self-proclaimed "security researcher" who somehow failed to RTFM.
There's even a Wikipedia article about it now, with a link to the alternate instruction set documentation: https://en.wikipedia.org/wiki/Alternate_Instruction_Set
https://web.archive.org/web/20140130160743/http://datasheets...
sandsifter was lots of noisy PR, but no new encoding findings
Documenting a backdoor doesn't make it not a backdoor, just means it's not a hidden backdoor.
The fact that a number of machines shipped with the backdoor accidentally enabled, and nobody noticed for over a decade shows just how dangerous even a documented backdoor can be. The oversight wasn't even detected by someone reading the manual, it was detected by a security researcher who wrote a generic tool to fuzz out such backdoors.
What can be done to mitigate this? One option would be to buy a large FPGA and flash it with an open-source CPU. Another would be to emulate a CPU, working with encrypted data and commands, so that even if the backdoor in a host CPU tries to overwrite memory, it would only crash the emulated OS. One more option would be to run the code in a Virtual Machine like QEMU which translates the code and prevents issuing unknown instructions.
IIRC there are also a few hints they at least considered exposing this alternative instruction set at runtime to get more performance out of the CPU core e.g. more useable registers, more three operand instructions, saturating and packed math for DSP workloads, etc.
Almost exactly 8 years ago: https://news.ycombinator.com/item?id=17727140