Researchers Discover and Abuse New Undocumented Feature in Intel Chipsets (zdnet.com) 102
At the Black Hat Asia 2019 security conference, security researchers from Positive Technologies disclosed the existence of a previously unknown and undocumented feature in Intel chipsets. From a report: Called Intel Visualization of Internal Signals Architecture (Intel VISA), Positive Technologies researchers Maxim Goryachy and Mark Ermolov said this is a new utility included in modern Intel chipsets to help with testing and debugging on manufacturing lines. VISA is included with Platform Controller Hub (PCH) chipsets part of modern Intel CPUs and works like a full-fledged logic signal analyzer. According to the two researchers, VISA intercepts electronic signals sent from internal buses and peripherals (display, keyboard, and webcam) to the PCH -- and later the main CPU. Unauthorized access to the VISA feature would allow a threat actor to intercept data from the computer memory and create spyware that works at the lowest possible level. But despite its extremely intrusive nature, very little is known about this new technology.
Overheard in the Intel marketing department (Score:5, Funny)
"I'm just spitballing here, but I've read that a lot of computers have rootkits on them. What if we baked a root kit right into the hardware so everyone could have one without having to go through the trouble of installing one?"
Overheard later in the Intel development departmen (Score:5, Funny)
"No, one rootkit is no good. Make sure we bake in a few of different types in case something goes wrong with one. Redundancy is the key to reliability."
Re: (Score:2)
Re: (Score:2)
Requires physical access (Score:1)
This exploit requires physical access.
If black-hats have physical access to your computer, you are already in deep doo-doo.
Re: (Score:2)
However, the two researchers said they found several methods of enabling VISA and abusing it to sniff data that passes through the CPU, and even through the secretive Intel Management Engine (ME), which has been housed in the PCH since the release of the Nehalem processors and 5-Series chipsets.
I think not only with physical access.
Re: (Score:3, Insightful)
Says an Intel spokesman. That is, however, not true.
Physical access is required of systems that have taken actions to require it, namely physical access required to update certain flash data. For systems that haven't done this, physical access isn't required.
Re:Requires physical access (Score:4, Interesting)
Re: (Score:2)
"Trolling is a art"
Back in the day, trolling required some artistry, some intelligence, some understanding of the subject at hand, in order to craft a troll-comment that would actually get in someone's head. These days? Any two-bit script-kiddie or room-temperature-IQ ne'er-do-well with a smartphone and too much time on their hands posts nonsensical garbage, then when they get a confused reply to the effect of 'lolwut?', they reflexively post 'ha ha u mad!' as if they accomplished something.
Sad, sad, sad.
Re:Requires physical access (Score:5, Insightful)
This exploit requires physical access.
No, it doesn't. You took the word of an Intel spokesperson over a hackers, seriously?
You should have kept reading:
"Customers who have applied those mitigations are protected from known vectors," the company said.
However, in an online discussion after his Black Hat talk, Ermolov said the Intel-SA-00086 fixes are not enough, as Intel firmware can be downgraded to vulnerable versions where the attackers can take over Intel ME and later enable VISA.
Furthermore, Ermolov said that there are three other ways to enable Intel VISA, methods that will become public when Black Hat organizers will publish the duo's presentation slides in the coming days.
Re: (Score:2)
It requires physical access to the pin that you are now shoving a 4 GHz signal out of, assuming you could figure how to set the muxes to get the signal there in the first place.
Re:Requires physical access (Score:5, Informative)
Sorry, no. As long as the ME continues to exist and is not exclusively under the control of the machine's owner, the risk of remote exploit exists.
Re: Requires physical access (Score:2)
I assume it would be illegal to sell a CPU in Soviet America that isn't factory p0wned.
I'm shocked (Score:1)
No really, I am. Who woulda thunk it.
It's getting to the point where Intel CPUs having another vulnerability is about as newsworthy as Trump tweeting something stupid: it happens far too often and no one wants to think about it.
Re:I'm shocked (Score:4, Funny)
"Intel Inside" has been a mandatory warning label for many years already.
Re: (Score:2)
Seriously, before you hurt yourself with a butter knife.
No one stalks you, you are the stalker.
You reply to yourself, make irrational statements continuously and are a boor and intensely spinning out of control.
Fuck it, you're a lost cause, here's a butter knife.....
Someone forgot to blow the fuse (Score:5, Insightful)
Since these features are meant for use on the assembly line you can't just remove them.
But you can design them to be permanently disabled as one of the last steps before the chip leaves the manufacturing plant.
Re:Someone forgot to blow the fuse (Score:4, Insightful)
Re: (Score:2)
Re: (Score:2)
Would be fascinating to know if the NSA did actually tell them not to disable it, when Intel wanted to. My money is on simple incompetence though.
Intel doesn't understand security and doesn't even really think about it. They just assume that because they didn't publish the docs it's a secret and no-one will be able to abuse it.
Re: (Score:1)
Re: (Score:3)
It's almost like there's a bunch of those features built in to make sure someone can get access ...
Re:Someone forgot to blow the fuse (Score:4, Insightful)
What they forgot is who owns the damned computer. Many devices have all of the same capabilities, usable for testing, diagnostics, and debugging new firmware, but most of them aren't as stupid as Intel about it. They require you to physically plug in to a JTAG interface.
Back in "the old days", you could "de-brick" a WRT54 using a simple hand made adapter to connect a PCs parallel port to the JTAG connection on the board and running a simple utility that would re-flash the WRT through JTAG.
In a world where the consumer that forks over the cash actually owns the device, all devices should expose a JTAG port, and none should be so stupid as to connect it to a Management Engine running secret signed and encrypted firmware that the rightful owner can't change.
Re: (Score:2)
You seem to be confused a bit. The Intel ME firmware is the locked down part. I was NOT talking about EFI, UEFI, BIOS, PCI boot ROMS, or even applying a vendor created and signed update.
Re: (Score:2)
Perhaps you should read that link yourself.
If you ran something on it, it was using a scripted exploit that Intel did not intend to work. So, what did you run and how did you get it on there?
Re: (Score:3)
However there are ways to re-enable it on a per-boot-cycle basis; you just have to know how. This capability is included and allowed so that 'closed box' debugging can be done by Intel if there is a problem an OEM is having that requires Intel to assist with it. Think of it as a 'backdoor' into the debugging infrastructure of the silicon. The ways and means of t
Re: (Score:1)
However there are ways to re-enable it on a per-boot-cycle basis; you just have to know how. This capability is included and allowed so that 'closed box' debugging can be done by Intel if there is a problem an OEM is having that requires Intel to assist with it.
Okay, fine, but compromise a bit on the "closed box" and require that a pin on the CPU be jumpered to something during boot to enable this, so it cannot be enabled without physical access.
Re: (Score:1)
Re: (Score:2)
Full debug access back as far as Broadwell has required a cryptographic key which is dowloaded every time you power up the device.
So it has an official name (Score:4, Insightful)
Called Intel Visualization of Internal Signals Architecture (Intel VISA), Positive Technologies researchers Maxim Goryachy and Mark Ermolov said this is a new utility included in modern Intel chipsets to help with testing and debugging on manufacturing lines.
How is that "undocumented" other than Intel only provides the docs to paying developers?
Re: (Score:2)
Re: (Score:2)
How is that "undocumented" other than Intel only provides the docs to paying developers?
Any documentation about it is only available to under NDA and only for motherboard manufacturers. As such, information about it is unable to enter the public sphere so much so that even OS developers are unaware of it's very existence. It seems to be tightly coiled with IME so the only thing more secret than Intel VISA (that we know of) is the CPU microcode.
Re: (Score:3)
Re: (Score:2)
Re: (Score:2)
That doesn't make much sense either. Anyone big enough to go into the chip business for themselves can already reverse engineer Intel's products without much effort.
Re: (Score:2)
Re: (Score:2)
done (Score:4, Funny)
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
The last time I used qemu-i386 on an ARM, it took just over 10 minutes to boot a kernel.
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Rather than try to coax a 286 to life, you should look into OpenPOWER based systems like Raptor Computing Systems POWER9 machines (https://www.raptorcs.com/). They are just about to release their microATX form factor boards that are still expensive but not too crazy. These are very open machines, performance competitive with Intel/AMD based systems and can run a number of popular Linux distros. I'm looking forward to ditching Intel once my Blackbird motherboard arrives.
Re: (Score:2)
Let's talk... (Score:2)
...NSA here, please ignore that little feature, nothing to see here!
https://media.giphy.com/media/... [giphy.com]
https://tenor.com/view/fizzer1... [tenor.com]
These are not new features, they've been there (Score:5, Interesting)
Maybe Intel VISA is a newly coined phrase, but there have been access to the PCH has been around for along time. In my experience (at Intel, on dev teams) This is used firstly for debug at development time and then at manufacturing time for passing certain test. Both used to have a physical device to do this, so just doing it remotely wouldn't work. Also, all features were available at dev time for obvious reasons. By manufacturing time, it should be mostly locked down and before it goes out the door, totally locked.
What I'm afraid of is security has become lax enough to allow remote access to this. Like a lazy engineer/architect (ever had one of those?) didn't want to walk his butt into the secure lab so they just put some back door in with telling anyone. Or worse after by off from the development team.
Also, yes these are undocumented because they are never meant for outside use (Intel, OEMs, etc) Just debug and optimization. No one else would really want access, but nefarious peeps would.
This could be a big issue if there really is something here. I'm hoping Intel didn't get lazy, but who knows.
Re: (Score:2)
There are certain levels of debug access that are left open for the system integrators (e.g. Dell) to do debug on their own systems. It is then their responsibility to disable this on production systems.
Okay, that's it (Score:2)
Enough with all the dumbass stuff from Intel, Microsoft and Apple.
My next laptop will be a freakin' Raspberry Pi 3 running a non-systemD Linux distro of some sort.
Re: (Score:2)
Re: (Score:2)
Only 'abuse' is by Intel (Score:3)
Intel put the features in, failed to document them, failed to disable them and KNOWS researchers will be looking for them.
The only abuse is Intel not taking responsibility for its incompetence.
Re: (Score:1)
Make AMD pay for it!
remember the Clipper chip? (Score:3)
Who else remembers the Clipper chip saga from the first light of eternal September?
Bruce Schneier's Applied Cryptography (1994) had just come out, and it was a glorious rip in the kimono of the grotesquely secretive surveillance state. (At one point, in the institution's formative adolescence, even the NSA's name was hard to find out.)
In those glorious, turbulent years of eternal onset we—the open source greybeards of minimal middle—managed to score some surprising victories over the rather clumsy NSA, clearly dazed by those first insistent rays of sunshine, now stumbling around in the public sphere like John Oliver fresh out of bed, blinded by paparazzi flashbulbs en route to his underwear drawer.
I enjoyed this comedic spectacle while it was happening to the power of ten.
Meanwhile, another part of my brain was going "they'll be baaack". If you catch Rommel with his pants down at 06:00, enjoy it while you can; by 0:900 you'll wish you hadn't. Clearly the hard-boiled eggheads of this imperious and paranoid institution weren't going to consume their crumpets of crow quavering cadaverously. Now there's so much crepuscular silicon—how shall we best phrase this?—of mixed utility that you need avail yourself of the extended edition of Hogwart's Almanac merely to decode the confounding acronyms.
Clinton's Clipper comeuppance was the most glorious greybeard insurgency I've ever witnessed, but with a teeny, tiny fly embedded in the silver lining: we basically started a land war in Asia we could not ultimately win. Not even a historic Snowden dump changed matters much at the end of the day. With the persistence of the North Vietnamese (augmented by Mexican mechanization) minions of the NSA have cunningly scrabbled subsoil, stealth supply lines all the way to Moscow's front door.
This story is a somewhat different offensive than Operation Typhoon. They don't want to conquer Moscow, they want to become Moscow, under cover of ubiquitous onion domes, now tinier than anyone had once imagined, shrouded in RF-transparent Mandelbrot onion skin: you are in a maze of twisty little passages, all alike.
All said and done—and duly intercepted—the moral of starting a land war in Asia remains mostly the same.
Hmmm (Score:1)
Re: Hmmm (Score:2)
Intel snoops for Uncle Sam. Huawei snoops for Emperor Xi. Everybody knows it.