Intel VISA Exploit Gives Access to Computer’s Entire Data, Researchers Show

https://gadgets.ndtv.com/laptops/news/intel-visa-sa-00086-exploit-researchers-computer-data-access-2014854

by DennisP • 7 years ago

431 164 7 years ago

gadgets.ndtv.com

ccnafr• 7 years ago

This article appears to be blog spam after an interview ZDNet had with the researchers, which seems to include a lot more info on this.

Appears Intel is trying too underpin this as unexploitable (shocker!!!), citing a patch from last year. Researchers say that there are multiple ways to turn this debug mode on besides those.

DennisP• 7 years ago

Oops, didn't notice that. The article I posted has two links other than the zdnet link, but they're also contained in the zdnet article. Totally support the admins repointing to this if they want:

https://www.zdnet.com/article/researchers-discover-and-abuse...

spectramax• 7 years ago

It looks like a shady website.

Also the title needs to be changed to remove VISA. It could mean Visa(traveling), VISA(credit cards).

Zdnet titles it well “Researchers discover and abuse new undocumented feature in Intel chipsets”

detaro• 7 years ago

https://www.blackhat.com/asia-19/briefings/schedule/#intel-v... has link to presentation slides

Other articles: https://www.zdnet.com/article/researchers-discover-and-abuse...

https://www.theregister.co.uk/2019/03/29/intel_visa_hack/

tyingq4• 7 years ago

Three videos here also: https://github.com/ptresearch/IntelVISA-BH2019

rurban• 7 years ago

And the proper paper esp.

wuschel6• 7 years ago

Out of interest: What would one consider as the most secure, commercially available computer architecture?

Are there any open, vetted computer system out there?

How do projects such as the Raspberry Pi fare in terms of security?

sabujp• 7 years ago

There are many, but you'll sacrifice either price or performance to get it. The problem is that for hardware qualification/testing/development, remote management, etc many vendors have started opening up these backdoors.

shakna3• 7 years ago

Out of interest: What would one consider as the most secure, commercially available computer architecture?

Define your limits.

For the everyday, you won't get far. Intel, AMD and others have all been shown to have problems like this, or at least things they specify for government agencies.

However, tiny computer architectures like MIPS, AVR and the like probably don't, simply because they tend to be too small. They don't have the memory for advanced backdoor techniques... But are trivial to access their memory if you have physical access.

Straight-up RISC-V is too new to truly trust security, but looks fairly great... Until you realise that almost everyone is going to add their own proprietary extensions to it, and those extensions may well include things like VISA.

---

The Raspberry Pi uses a Broadcom ARM chip. (Which model you get does have different models of the particular SoC, and the two main chips are vastly different).

I don't have enough details about the particular chip to tell, but ARM does have it's own remote management system. It may or may not be part of what Broadcom offers, and may or may not have undisclosed abilities to offer to clandestine agencies.

MisterTea• 7 years ago

Straight-up RISC-V is too new to truly trust security, but looks fairly great...

Bad analogy because Risc-V is an instruction set, not a physical microarchitecture. Back doors and side channel attacks could still be possible when implementing risc-v as a uarch.

The same applies for any ISA be it MIPS, x86-64, Power, Arm, Spark, PA Risc, Alpha, etc. They're just different programming languages implemented in hardware. And like software, hardware can have bugs too, though patching is much harder or impossible.

kosma• 7 years ago

Most small microcontrollers are vulnerable to program memory extraction and replacement - even the supposedly secure ones.

wuschel6• 7 years ago

Thanks for your elaboration.

What do you think are the reasons that a "safe-by-default" CPU design has not yet seen the light of day?

I could go back to really old systems, but it does not make really sense to use the 'security through obfuscation' strategy, no?

tyingq4• 7 years ago

"How do projects such as the Raspberry Pi fare in terms of security?"

The CPU on that isn't the first thing that boots. There's a binary blob that boots the GPU first, and gets it to boot the CPU.

There is some progress on being able to boot without the mystery code, but it's not complete: https://hackaday.com/2017/01/14/blob-less-raspberry-pi-linux...

Broadcom offers very little documentation. I don't think an RPi would be a good security choice.

A Beaglebone Black has a better documented CPU and boot process, and can run stock, non custom Linux. Not specifically "secure", per se, but is at least easier to research. Can't vouch for it, but here's an attempt to make the BBB a secure environment: https://cryptotronix.com/products/cryptocape/

wuschel6• 7 years ago

Thanks for the link!

posnet• 7 years ago

https://www.raptorcs.com/

They have a powerpc based desktop system where every component has its firmware open and available.

justinjlynn• 7 years ago

The processors have complete internal and internal configuration register documentation available, as well.

Koshkin• 7 years ago

NOTE: The proprietary NVIDIA® driver stack does not support OpenGL. There is no way to add OpenGL support to the proprietary driver stack. This system is designed for GPU compute, and while a minimal 2D framebuffer is supported 3D applications will fall back to non-accelerated LLVMPipe rendering. This may result in modern desktop environments, such as KDE and Gnome, failing to operate at an acceptable speed.

(No comment.)

edwintorok• 7 years ago

Also see https://www.raptorcs.com/BB/ for their latest, more affordable board called Blackbird.

walterbell• 7 years ago

Lenovo X230 with Heads, me_cleaner, Qubes.

Used OpenCompute enterprise server from eBay, with LinuxBoot as BIOS.

Future: OpenCompute platform based on OpenPower CPU, Open System Firmware and an open-hardware implementation of Microsoft Cerberus / Google OpenTitan.

wuschel6• 7 years ago

Interesting. Are there no known backdoors in the Lenovo X200/.../X230 Intel systems? I remember some bad news about Active Management Technologies.

How far along are these Open Architecture Systems?

confounded2• 7 years ago

Another server option is something based on ~2012 Opterton chips which have been freed, such as:

https://store.vikings.net/libre-friendly-hardware/the-server...

bo10245• 7 years ago

There are two avenues:

1. Take an Intel or AMD system and try to secure-ify it. This is what vendors like system76[1] and Purism[2] do, especially aided by the coreboot project[3]. I'm not an expert on the details, but an important goal in this space has been disabling Intel ME[4], which I note in the original parent article seems to be part of this exploit (at least when used remotely). AMD has a corresponding parasite cpu-in-cpu, not sure about progress on disabling.

2. Use another CPU. Someone else mentioned the raptor project, that's all I know of (but again I'm not an expert). But by far the most common consumer CPU that competes with Intel and AMD, who make x86 processors, is the ARM platform used by phones, Raspberry Pis, and many embedded devices.

Note the CPU is only one kind of closed firmware that can have backdoors or insecurities....

[1] https://system76.com/

[2] https://puri.sm/

[3] https://www.coreboot.org/

[4] https://en.wikipedia.org/wiki/Intel_Management_Engine

wuschel6• 7 years ago

Hi, thanks for the links

Indeed, the control and understanding of the CPU (and auxiliary chips) is key.

A naive question: what are the resources needed to get your own CPU architecture going, not necessarily state of the art, but older technology?

The fabrication technology is there, after all. And many a patent should be expired by now. Also, there must be some academic projects out there which build such complex systems.

djsumdog• 7 years ago

With Intel/AMD x86_64 chips, you have a platform to go with it: the PC architecture. The BIOS/UEFI in this architecture is incredibly standard over the course of their offerings.

The PlayStation 4 has an x86 chip, but is not a PC. It cannot boot a mainline kernel because a lot of basic assumptions about how a PC works don't exist on the PS4 platform. The Fail0ver people have done some great talks at all the issues porting Linux to the PS4.

The trouble with ARM is that it's not an architecture. Linux got so popular among developers and nerds in the 90s because you could just install it on any PC that was out there. When people got hardware working, they could upstream their changes. Phone manufactures patch the hell out of their kernels in terrible ways that can never be up-streamed, and include tons of binary blobs and shims. PostmarketOS is making some progress here, but it's slow.

ARM phones don't have a standard BIOS. (with the exception of the Windows Mobile line, which has ARM+UEFI, yet Microsoft still won't release a bootloader unlock even though their phone is pretty much dead at this point). Some ARM devices use the devicetree standard for hardware identification/allocation, but it's still a mess.

I wrote about this before:

https://penguindreams.org/blog/android-fragmentation/

Gladdyu• 7 years ago

The most certainty you are going to get is by taking an open source processor core, and run it on an FPGA with an open toolchain. You won't be able to check the actual FPGA chip, though the risk seems minimal on that front compared to ASICs with the ISA baked in.

You will pay dearly in cost, performance and pretty much every other metric that you care about though.

voldacar2• 7 years ago

Are there any open, vetted computer system out there?

Raptor Talos II comes to mind. Quite powerful, and fully auditable firmware. Uses an IBM POWER9 cpu, no x86

spaceribs• 7 years ago

Getting real tired of hearing about how our monopolistic glorious chip-maker leaks data like a sieve, almost as if there's some sort of monetary benefit to doing so...

hiccuphippo• 7 years ago

How do I find out if this debug mode is enabled?

huffmsa2• 7 years ago

Intel's recent string of "what the fuck" failures are what happens when a monopolist emerges and goes unchallenged for a long enough period to become lazy.

May the market penalize them in kind.

close043• 7 years ago

Unfortunately the market probably won't. Intel still has enough clout and resources to incentivize OEMs to sell as many Intel systems as possible.

For consumer hardware most buyers are completely oblivious to the situation but they are most likely familiar with the Intel brand. For enterprise the inertia is a lot higher and they are probably waiting to see that AMD manages to deliver for an extended period (multiple generations) before considering wider scale adoption.

nolok3• 7 years ago

Anecdotical at best but I upgrade a few dozen desktops a year for my customers during the early months of the year, and this year is the first year in a long time that there was some AMD in my purchases, in fact most of it was AMD. Not by choice, but because 1. it was available, 2. it was the best option (for a branded below 450 euros desktop with ssd, the fight was mostly ryzen 5 with 8 GB of ram vs i3 with 8 GB or ram vs i5 with 4 GB of ram). Lenovo especially had some great offering with Ryzen cpu.

bo10245• 7 years ago

The tech industry in general undervalues security (at least in my opinion). I agree part of the reason Intel does is about being a monopolist, but I see this as a bigger trend of fancy/shiny/innovative at the expense of solid/secure/stable.

huffmsa2• 7 years ago

But Intel has stalled out pretty hard on fancy/shiny/innovative. They hit a brick wall with 7nm.

threatofrain• 7 years ago

I would argue that tech people overvalue security, since they think about what could happen if you're violated, and then they discuss the expected value of making the secure decision.

carlivar• 7 years ago

Also see: Boeing

nickpsecurity2• 7 years ago

"May the market penalize them in kind. "

Intel made innovative, security-enhanced CPU's such as i432 APX, i960, and Itanium. They lost billions as the market punished them for breaking backward compatibility among a few other things. Mainly backward compatibility with insecure architecture market depended on. Market also wanted chips to maximize speed per dollar which always trades against security. Market also rarely picks secure products over insecure products whenever offered a choice.

So, our current situation is the market's responsibility, not Intel's. The market punished Intel for trying to make better products. Say what you will about two, the i960MC was pretty nice design even if BiiN wasn't. A RISC chip with object-based protection and high availability should've taken off if market really cared about reliability and security. Instead, the market rewarded what met their price/performance (x86/POWER) or price/performance/watt (ARM or MIPS) punishing all else. They also built on it non-portably in a way that led to lock-in. Now, they're reaping what they sow with everything they've done up to this point making any investment in secure chips or OS's a risk not worth taking for most suppliers.

Good news is that all the recent bad news is encouraging some companies to try secure offerings again. Might get more buyers this time. Still high risk, though.

chasil7• 7 years ago

The Core 2 series on LGA775 is the last Intel chipset where the ME can be entirely disabled.

This VISA exploit relies in some way on SA-00086, which is a flaw in the ME that cannot be removed in later versions.

The me_cleaner script has been able to purge these older chipsets since October of last year. I cleaned two different HP desktops at that time, and uploaded the modified BIOS here:

https://github.com/corna/me_cleaner/issues/233

These still suffer from Meltdown and the remediation does exact a performance penalty, but Core 2 is starting to appear as the most manageable risk of all their products.

samat• 7 years ago

Curious what your threat model is.

chasil7• 7 years ago

The Intel ME can be accessed over the connected ethernet even when the PC is shut down, as long as the power supply is attached.

SA-00086 as an exploit is available through the ME.

VISA is available for access by the (compromised) ME.

This seems threatening enough to me.

_bxg12• 7 years ago

The name VISA makes all of this extremely confusing, as there are two other major overloaded meanings for the word

tyingq4• 7 years ago

"Intel doesn't publicly disclose the existence of Intel VISA"

An internal-only name leaked..."Visualization of Internal Signals Architecture"

_bxg12• 7 years ago

Yeah, I figured that out eventually, but for the first while I was mentally following multiple possible narratives

sesutton• 7 years ago

VISA should at least be capitalized like in the original title.

bo10245• 7 years ago

The scariest line to me:

Intel doesn't publicly disclose the existence of Intel VISA and is extremely secretive about it

So all of my data and everything I do on my computer is flowing through this every day, and nobody knows what it is or what it does....

arcanus• 7 years ago

Does this mean AMD is inherently more secure?

chasil7• 7 years ago

AMD has an equivalent of the Intel ME that was called the "Platform Security Processor" and is now known as the "Secure Processor."

Flaws have been found in it. They are probably not as bad as Intel.

Leaving the VISA environment accessible to ME is something that I hope AMD would never entertain out of a wealth of caution for their customers.

sufiyan• 7 years ago

Test portions (debug architecture) are necessary for all chips. It is otherwise impossible to make sure what you have actually works as you intend.

lima2• 7 years ago

It's just a tiny piece of Intel's architecture. There's a ton of other components that your data also flows through that are equally undocumented.

kacamak• 7 years ago

You never heard of intel IME or amd PSP?

It's a mips microprocessor inside your cpu, completely undocumented and has access to the memory, peripherals, network interface etc.

chasil7• 7 years ago

The older Intel version was actually on the ARC architecture, which was embedded in the north bridge:

https://en.m.wikipedia.org/wiki/ARC_(processor)

Later versions of the Intel ME switched to an internally-designed 80486.

nickpsecurity2• 7 years ago

"completely undocumented and has access to the memory, peripherals, network interface etc. "

They were documented in the sense Intel publicly advertised them for years under AMT and vPro as enterprise features. That's why all the discussions on HN about whether Intel had backdoors or weakened randomness were funny. While people were "countering misinformation" here, Intel was publicly advertising backdoors in their chips to ease the management burden. I mean, I guess you could call them front doors with the publicity.

The sneaky part was how they started including them in all chips without a way to (a) buy chips without them or (b) know for sure you could turn them off. I immediately suspected NSA paying them off given most of this started in Trusted Computing Group activities which included classified sessions with NSA. They were always a stakeholder in that stuff. AMD did it, too.

Our only hope for x86 now is the Chinese company that's sharing AMD's chips. They might make a chip with no U.S. backdoors: only Chinese backdoors. If you're worried about local government but not I.P. theft, then the Chinese backdoors won't be any threat to you. Problem solved if the computers get here with no interdiction. Gotta do shell games.

bo10245• 7 years ago

I've heard a lot about those, the quote refers to "VISA"

chiefalchemist2• 7 years ago

Nobody? I'd say Intel knows. And more than likely NSA knows.

That's worse than nobody.

everybodyknows• 7 years ago

VISA's documentation is subject to a non-disclosure agreement, and not available to the general public.

- https://www.zdnet.com/article/researchers-discover-and-abuse...

Back in the 80s, such policies were dismissed as "security through obscurity". So much change, so little progress ...

amluto2• 7 years ago

This doesn’t discuss when the attack matters. I see at least three ways:

1. If you can do the attack entirely over USB, then you can completely take over a machine via USB and possibly add a very powerful firmware rootkit. The JTAG password seems relevant here.

2. If you get root code execution, you may be able to install a better rootkit. This might be able to extract supposedly hardware-secured crypto keys.

3. The “deterministic RNG” and/or inspection of RNG signals mode might be an interesting attack against SGX — SGX enclaves expect RDRAND to be secure. (If you can take over the ME, I think you can break some of SGX’s platform features, but I don’t think you break the core security guarantees.)

I think the JTAG password is the nastiest bit here.

jeroenhd• 7 years ago

For the general consumer maybe, but for media distributors the story might be a bit more worrying. Some forms of DRM keep the keys in special areas of the processor such as these and any key leaks might allow for recording or piracy of very stringently controlled content.

If the leak is bad enough, the license holder might urge distribution platforms to have certain models of Intel CPU where these exploits are most successful against blocked from playing certain content.

I doubt this will happen any time soon but there might just be indirect consequences of such inconsequential data leaks.

blfr3• 7 years ago

Is there any content which was available for streaming yesterday and isn't available on torrents today? DRM stops "casual" pirates. People exploiting CPUs are out of scope.

SlowRobotAhead2• 7 years ago

I’m driving, but don’t want to forget this later... do you think you could help me with a 30 second run down on Intel JTAG?

I assume not all chips have the same JTAG password. I assume JTAG can be accessed via software running on the processor itself and not require explicit physical access. I assume there is a hack that allows someone to obtain their processor JTAG password, how that works is what I’m most interested in I suppose.

scandinavian5• 7 years ago

I skimmed the slides.

The password is unique per cpu.

There is no hack presented in the slides to get the password, and they directly say they couldn't get the password for their system. Their evidence seems mostly based on this pdf: https://web.archive.org/web/20190213084218/http://www.keenli...

There is nothing in the slides about accessing JTAG from the processor itself, and in the pdf above you can see the JTAG equipment on page 12.

That's about it. I'm no expert at all, just relaying what's in the slides.

userbinator4• 7 years ago

JTAG requires physical access.

EGreg• 7 years ago

This is why we must all move to end-to-end encryption. We should limit “concentrations of information” just like “Concentrations of power”.

lima2• 7 years ago

Clickbait article. Ignore it and read the slides instead:

https://i.blackhat.com/asia-19/Thu-March-28/bh-asia-Goryachy...

pytyper22• 7 years ago

If this is truly for assembly line diagnostics they should add a hardware self destruct to the interlink with those circuits, after VISA serves the intended purpose fry it. Is that a reasonable and technically feasible option?

chiefalchemist2• 7 years ago

"Security researchers have discovered a previously unknown feature in the Intel chipsets, which could allow an attacker to intercept data from the computer memory. The feature called Intel Visualization of Internal Signals Architecture (Intel VISA) is said to be a utility that is bundled by the chipmaker for testing on the manufacturing lines. Although Intel doesn't publicly disclose the existence of Intel VISA and is extremely secretive about it, the researchers were able to find several ways to enable the feature on the Intel chipsets and capture the data from the CPU."

Am I the only one reading this and thinking - tho' not surprised - "there's a backdoor baked into Intel chips"?

peter_d_sherman4• 7 years ago

https://www.blackhat.com/asia-19/briefings/schedule/index.ht...

Excerpt: "The complexity of x86-based systems has become so great that not even specialists can know everything."

We need a new CPU manufacturer. One that is built from the ground up on transparency, auditability, accountability, and Einstein's "as simple as possible but no simpler" maxim.

Such an entity cannot, CANNOT be a corporation.

The reason why such an entity cannot be a corporation is because a corporation is legally bound to the legal structure in the country in which it operates, and that legal structure may create, one way or another, a door for secret agreements / secret hardware modifications between that company and the host government.

In other words, transparent, ethical engineers with NO conflicts of interest -- are no longer running the show... Corporate lawyers and Government lawyers are.

That has to change in the future...

SlowRobotAhead2• 7 years ago

Such an entity cannot, CANNOT be a corporation.

How would that work? You want a government designed secure processor... why wouldn’t you figure that the reasons they are insecure now is because of gov involvement?

If you want an open source processor... that’s cool, and corporations can/are already do that.

Now... with any solution proposed, verify to me that the silicon as designed is really the silicon made, esp when talking about 7nm.

pytyper22• 7 years ago

Can I enter your factory and inspect the dies as they come off the line before they are sealed? If yes, then you could indeed verify the silicon is as designed. Probably just as you could take a chip that does not work and diagnose the problem, this functionality would seem to be necessary to successfully build a chip/chip factory in the first place. How would you troubleshoot the manufacturing process if you couldn't audit the product for quality/accuracy?

peter_d_sherman4• 7 years ago

One possible solution: https://libresilicon.com

I don't care who produces the processor, but whoever does must be open, transparent, accountable, auditable, etc. as enumerated above.

Whichever group does this must not be guided by Lawyers who enter into secret agreements. That is, ALL legal aspects of this group must be open the public as well.

You raise an excellent point, which is "how is silicon verified as being the same silicon that was designed?".

Usually silicon is verified through tests at various levels of abstraction (electrical, signal, logical, single instruction, programs, etc.) but none of these directly verify that the silicon produced is the silicon designed.

So, you are correct, that's a very real problem that needs a very real solution in the future...

otakucode2• 7 years ago

What exactly is 'Orange Mystery'? From the context of the article they make it sound like it is another known vulnerability, but I went looking and can't find anything related with that name.

scandinavian5• 7 years ago

Orange Mystery (their made up name) is an intended way to get JTAG access to TXE if the CPU is in manufacturing mode. Something that only happens if an OEM forgets to turn it off before shipping. This was the case with Intel Macbooks, before it was fixed. Haven't heard of other manufactures making the same mistake.

Avery3R• 7 years ago

IIRC CS(TXE/ME) are implemented in the pch, not the cpu. It's also pretty common for consumer gaming motherboard manufacturers to leave it on. I know at least MSI and Gigabyte do

peter_d_sherman4• 7 years ago

"VISA... it's everywhere you don't want to be..." <g>

MrXOR3• 7 years ago

Undocumented? a bug? No, a backdoor. big brother (NSA, FSB, ...) inside[1]?? There isn't any datasheet/docs about "Intel Visualization of Internal Signals Architecture" on Google! even documented technologies/features like Intel ME and AMT or speculative execution (Spectre/Meltdown) are (were) backdoors, not bugs! We need open (free) source hardwares (PCH, CPU, GPU, ...) with a complete documentation.

[1] https://github.com/CHEF-KOCH/NSABlocklist/issues/31

[2] https://software.intel.com/sites/default/files/managed/d3/3c...

userbinator4• 7 years ago

Intel underplayed the exploit and told ZDNet that the VISA issue requires physical access to the machines and the Intel-SA-00086 vulnerabilities have already been mitigated.

Am I the only one here who thinks "threat model" and isn't all too worried? Physical access = full control, I've long held that belief and am not happy that this freedom is continually being eroded in the name of ever-increasing ridiculous "security" (a lot of it against the user, for things like DRM, as mentioned in one of the other comments here.)

Debugging/"test mode" features are basically present in all modern CPUs. I would not bet that Intel is the only one.

Edit: such features have been present in CPUs dating back to the late 70s, so perhaps "modern" isn't needed: see http://forum.6502.org/viewtopic.php?f=8&t=3366 and http://e4aws.silverdr.com/hacks/6500_1/

MrXOR3• 7 years ago

The main thing is "Why undocumented?", not threat model and physical or remote exploit.

dooglius• 7 years ago

Based on the name, the tool likely makes it easy for others to figure out low-level details of processor implementations that Intel would prefer be trade secrets.

0815test5• 7 years ago

Why undocumented? Because Intel is not RISC-V or even Arm. Do you expect other chip makers to document every internal detail of their chips? And yes, as chips grow in internal complexity, bugs like this one become inevitable - so perhaps we should be insisting on fully-documented designs.

CodeWriter23• 7 years ago

The main thing is "Why undocumented?", not threat model and physical or remote exploit.

No, the main thing is if VISA is for qualifying chips on the production line, why don’t they burn a fuse permanently disabling it on chips that pass QA?

userbinator4• 7 years ago

Testing/debugging features are intended for internal use only and can expose proprietary information about their implementation, so only Intel and possibly some motherboard manufacturers are allowed the knowledge.

Speaking of documentation, while not fully open, Intel/AMD are already ahead of many others when it comes to documenting things. Look at the SoCs used in smartphones and tablets, or the infamous Raspberry Pi. AFAIK, Intel is not in the business of making secure cryptoprocessors like the ones used in payment cards and SIMs, but once again even with those you are very unlikely to find public documentation --- everything is NDA'd.

That said, don't get me wrong, I'm not advocating for leaving things undocumented; just explaining how it usually turns out that way.

deathanatos• 7 years ago

The next sentence in the article,

The researchers however disagreed with Intel's comments and reportedly said in an online discussion that the patched Intel firmware can be downgraded using Intel ME, making the chipset vulnerable and opening the door for accessing Intel VISA.

I agree that "physical access" is a threat that I'm not too concerned about¹. But the researchers don't seem to agree that that's the extent of the issue.

¹If physical access means "disassemble the case and do X". If physical access is "two seconds with an exposed USB port", then that's a different matter.

mirimir• 7 years ago

Rackable servers typically have a locking front cover to prevent that. You can buy CoverLocks for desktops.[0] This Kensington USB lock also looks interesting.[1] The keys are unique, by the way.

0) http://www.computersecurity.com/coverlock/

1) https://www.amazon.com/Kensington-Cable-Guard-Rectangular-K6...

cm2187• 7 years ago

With encrypted drives and TPM you can still raise the bar pretty high before physical access means you have control. You may have control of the hardware, but not of what’s running inside.

bsder• 7 years ago

Am I the only one here who thinks "threat model" and isn't all too worried? Physical access = full control, I've long held that belief and am not happy that this freedom is continually being eroded in the name of ever-increasing ridiculous "security" (a lot of it against the user, for things like DRM, as mentioned in one of the other comments here.)

People care because that means that when you run something in the "Cloud(tm)" you have to trust the cloud provider.

The goal of things like "SGX" was so that you could run things on machines under someone else's control and still trust the results.

rficcaglia2• 7 years ago

SGX doesn’t guarantee results, just isolation. You would still need a protocol for confirming that the code was error free, didn’t leak data, not to mention side channel attacks and timing analysis.

Oblivious RAM, FHE, ZKSNARKs are to be considered when you don’t trust the hardware, the users, the cloud, administrators, etc.

Some combo of TEEs, formal verification, binary verification, FHE, etc. might keep your data secure for a little while...maybe.

rednixion• 7 years ago

I was shopping a few months back at a store with a particularly disinterested cashier who was doing something on their phone and was also charging it using the USB port that was on the register. It struck me as something that you probably shouldn't be able to plug your personal device into but that it is likely a common practice when nothing actually prevents it.

Made me wonder if an attack scenario would be feasible where compromised phones could be used for targeted attacks utilizing one of the USB vulnerabilities; essentially just laying dormant until the user plugs into something interesting to charge.

Assuming that: Physical access vectors are often deemed a low priority/less likely to be patched and that testing if an employee cares more about the BYoD security policy or their dying phone will have not favor infosec. It seemed like an interesting way to get access to point of sale systems that I had not heard anyone talk about before.

Some other privilege escalation vulnerability would have to be exploited go beyond the usual app malware capabilities but I don't know enough about USB or mobile OS's to know if it would be possible even with root(maybe that's why no one talks about it).

dchichkov• 7 years ago

I was re-reading the 2017 AMT story, it is so strange. How is this even possible?

https://www.tenable.com/blog/rediscovering-the-intel-amt-vul...

mkup• 7 years ago

I hope this Intel VISA Exploit will shed some light upon inner workings of Intel Management Engine, its memory states, software modules, their undocumented features etc.

sabas123• 7 years ago

The slides mention that they are able to unlocked JTAG for IME cores, so I suspect we should be finally be able to do research into it.

Personally I'm curious what doors this will open for understanding microcode.

JudasGoat• 7 years ago

I mean you could look at it as a 20 channel logic analyzer for free...

snvzz• 7 years ago

Don't trust the hardware RNG, they said. And people pointed fingers and called them paranoid while laughing.

voldacar2• 7 years ago

Given the scale of some of the recent x86 exploits that went totally unnoticed by massive chipmakers like Intel (thinking mainly Spectre/Meltdown but this is pretty bad too), is it even possible to build a secure x86 processor?

Can anyone really say, given the insane pit of complexity that x86 has become?

int_19h2• 7 years ago

This one is more like a deliberate backdoor that was left not fully secured. It doesn't seem to have anything to do with x86-the-instruction-set.

And stuff like Spectre and Meltdown is all about how they chose to implement it - specifically, optimizations. It is very possible to have an x86 CPU that doesn't try to be "smart" at all, and just implements the x86 spec in the most straightforward way possible... so long as you're willing to pay the perf penalty. It looks like we don't.

nunobrito2• 7 years ago

For some odd reason Twitter does not permit that I share the link to the security disclosure page.

I can post youtube videos, cat pictures but the link to this page gets refused. Here is a video of what happens: https://media.giphy.com/media/kiB8T8qeTHCVdUM2oZ/giphy.gif

Are we in China yet?

neop1x2• 7 years ago

Just delete Twitter account and create a Mastodon account :)

nunobrito2• 7 years ago

True.

On the other side: stepping out of twitter will isolate those who call attention to these things and just helps them to further block the population from knowing what is happening..

Intel VISA Exploit Gives Access to Computer’s Entire Data, Researchers Show

Related Stories