13 ms·
Hardware backdoors in some x86 CPUs
- saidnooneever 1mo agothis is pretty old by now but still very relevant. people dont look at this enough but with rising chip complexities for TPU units etc. and a shift towards poorly documented hardware like NVIDIA gives this problem new fuel. Domas (and maybe his team or colleagues?) has put out shit tons of very interesting materials over the past years on advanced malware, implants and things like Cantor Dust which are amazing things to dive into. using his own cpu fuzzer, msr fuzzing techniques etc. he has found, reversed and implemented attacks through hardware bugs and backdoors. It cant be confirmed if a backdoor is malicious or for debugging but essentially the capabilities gained through them are what is important. These techniques he shows throughout his videos are not super tricky to replicate and I can recommend people who have interest to dive into it, reproduce things and try to help in this domain to raise awareness and findings. Another good avenu is: Defcon 21 - Decapping Chips The Strike Easy Hard Way People speak about supply chain issues in NPM and Pip etc. but these are much more severe and hard to detect. Almost no one looks at it. Most vendors totally ignore it because you cannot sell products against it. (if ud detect it u need to trash the hw so its not handy... for sales...)
- rkagerer 1mo agoI didn't know what Cantor Dust was, and had to click through a few different search results to get past all the abstract descriptions and begin to form a basic idea. In a nutshell, I understand them as a sort of "blockie" for binary data formats. Things like WAV audio files, bitmaps, ASCII text, machine code, etc. each generate their own distinct visual signature (but different examples within any of these categories tend to generate similar signatures). So once you learn the "blockies" for different types of data, they really pop out when content is viewed this way ("hey there's an image buried in that sequence of 1's and 0's!"). The explanation on this page isn't bad, and the bitmap example near the bottom is particularly illustrative (once you've seen the reference image for bitmaps earlier in the page): https://inside.battelle.org/blog-details/battelle-publishes-open-source-binary-visualization-tool https://inside.battelle.org/blog-details/battelle-publishes-... My armchair-expertise here is only about 20 minutes old, but I hope this helps someone else looking for a starting point to learn about them!
- dgellow 1mo agoFascinating, thanks for sharing. A candor dust guessing game would be pretty fun to play
- addaon 1mo agoThis is excellent!
- peter_d_sherman 1mo agoAn absolutely great link! Not so much for the hacking (White Hat, Black hat, other-color-hat) aspects (although they're certainly there too), but for the visualization of higher-dimensional mathematics aspect... In other words, have a look at the following URL's, then come back here: https://gods.art/articles/equation_shadows.html https://gods.art/articles/equation_shadows.html https://kettenreihen.wordpress.com/ https://kettenreihen.wordpress.com/ See, there's Math (which typically generates graphs, graphics, other visuals), and then there's Higher-dimensional Math (you could almost call it 'Meta-math') -- which generates graphs about graphs, graphics about graphics, visuals about previous visuals... That is, take a math equation that generates a graph. OK, so a simple example is that we could take the derivative... That generates a second graph which gives us information about the first graph... a "graph about a graph", so to speak, a "signal about a signal", information about the original information... Point is, Cantor Dust looks like another great mathematical tool in any Mathematician's and/or Computer Scientist's and/or Engineer's visualization/understanding toolbox! Oh sure, bad faith actors could use it for hacking (bad faith actors could use aspects of Isaac Newton's Calculus for hacking in various contexts, heck, any mathematical tool could be exploited in specific contexts!) -- but those people I'm sure, would not have an appreciation of the sheer mathematical beauty of such things! (Why use it to hack, when you can admire the mathematical beauty?) Also, I should point out that humanity as a whole is far from discovering every single possible method, every single equation, every single way to visualize higher dimensional mathematics... In other words, Cantor Dust is one such method... there will no doubt be many more in the future (I'd love to see fractal visualizations of higher dimensions!), and of course, we still have yet to understand all of the "old" previously discovered math in terms of all of the possible ways it can be used to visualize higher dimensions... Anyway, great link!
- 1mo ago
- mike_hock 1mo agoA poorly documented or undocumented (debugging) backdoor in a chip marketed for ATMs and medical hardware, enabled by default, at the very least qualifies as reckless endangerment.
- sandworm101 1mo agoNot really. A properly designed network should take account for such things as unknown/irreparable flaws. An irreparable backdoor in a device can be mitigated with a gatekeeper, something akin to a firewall that will not allow a threat actor to have access to a faulty device. The real recklessness would be allowing an ATM unfettered access to the internet on the assumption that the manufacturer has already protected the device from every known and unknown threat.
- michaelmrose 1mo agoBoth can be negligent at once.
- esseph 1mo agoI was basically going to quote your whole statement here and then point to the more than 19 US states that have had Water Treatment plants forced to disconnect much of their Operational Technology systems.
- sandworm101 1mo agoAnd those disconnects would be that effective gatekeeper. Maybe overkill, but "air gapping" is a often a reasonable mitigation.
- saidnooneever 1mo agoit is not overkill to airgap OT tech. having it on the internet is really braindead. most ones that are routable are hackable real easily. the only reason no one does it is because they dont need to or dont want to. more people should do this. there should be laws to prevent such systems to be connected to others. main problem is often billing systems and sometimes OT stuff will need things like weather info or external data which makes it harder or more expensive to effectively airgap. remote places are also a pain to maintain if u cant connect into them. this is why most of these places rely on not being routable over most internet, so u vpn to some place and connect in from there. Sibsequently many engineers will not properly secure OT because its not routable. then a routing mistake happen at ISP and oops all the boxes are rooted -_-. airgapping is not overkill.
- sfdlkj3jk342a 1mo agoSo is it apparent that this backdoor was intentionally added by VIA for nefarious purposes? Or is there any other reasonable explanation for its existence?
- microtonal 1mo agoI was wondering the same, this is an ancient CPU by now, having been introduced in 2001. During development and at the introduction, most people were still running Windows 95/98/ME, which had more serious security issues (like every user essentially being admin). It may just have been a handy (debugging?) feature?
- crest 1mo agoYes there is a harmless explanation. The VIA C3 is a fairly simple CPU design that cracks x86 instructions into an internal simpler instruction format. Some complex x86 behaviour is normally implemented by lengthy microcode or complex state machines. VIA wanted to make their CPU simpler than Intel and AMD. To do that they exposed this internal instruction set to the BIOS to let it handle hardware initialisation and documented how to lock this feature safely away afterward. Some BIOS authors didn't read/understand the full specification. shrug. IIRC there are also a few hints they at least considered exposing this alternative instruction set at runtime to get more performance out of the CPU core e.g. more useable registers, more three operand instructions, saturating and packed math for DSP workloads, etc.
- deleted 1mo ago[deleted]
- WhereIsTheTruth 1mo agoInteresting codenames: https://en.wikipedia.org/wiki/List_of_VIA_C3_microprocessors https://en.wikipedia.org/wiki/List_of_VIA_C3_microprocessors
- martheen 1mo agohttps://www.eetimes.com/hot-25-wen-chi-chenvia-technologies/ https://www.eetimes.com/hot-25-wen-chi-chenvia-technologies/
- joss82 1mo agoThis backdoor only appears on decades-old VIA C3 embedded x86 processors
- littlecranky67 1mo agoThey should have mentioned that in the first line of the github readme, not burried deep down in the text.
- RamRodification 1mo agoBuried? Deep down? The fourth paragraph, clearly labeled "Affected Systems", a minute or two into the read.
- deleted 1mo ago[deleted]
- rbanffy 1mo agoWe have shorter attention spans now.
- bunbun69 1mo agoMultiple things can be true at the same time. While we do have shorter attention spans, some (lots of?) developers absolutely suck at writing articles
- account42 1mo agoAnd some intentionally write clickbait headlines even though the have the skills to do better.
- rbanffy 1mo agoI fancy myself as a decent writer, but I suck at writing documentation. People describe reading my notes frustrating and incomprehensible. I find it much better to use AI to untangle my, admittedly, convoluted reasoning
- codedokode 1mo agoThis shows that large companies making closed-source CPUs cannot be trusted. No doubt they would add whatever the government asks them to add. What can be done to mitigate this? One option would be to buy a large FPGA and flash it with an open-source CPU. Another would be to emulate a CPU, working with encrypted data and commands, so that even if the backdoor in a host CPU tries to overwrite memory, it would only crash the emulated OS. One more option would be to run the code in a Virtual Machine like QEMU which translates the code and prevents issuing unknown instructions.
- simoneree 1mo ago[dead]
- deleted 1mo ago[deleted]
- anthk 1mo agoOnce you control the hosts CPU it's game over for the guest. The best you can do is to fetch old PPC G4 Apple computers or Thinkpads.
- v5v3 1mo ago>What can be done to mitigate this? Buy hardware used by government computers that are rivals to your country. So if American, buy Chinese CPUs and install Chinese Linux or HarmoneyOS Assuming there is nothing you are doing of interest to them, as that will also have back doors After Snowden, one can only imagine the worst and think everything has a backdoor. But unless you are a high level terrorist or other person of interest, no state organization is going to target you at this level P.s. you say no one can trust closed source, but a lot of open source is maintained by one or two people or a small group, just takes infiltration by one or two trusted contributors to push malicious code in and unless someone looks and finds that code amongst millions of lines of code, may never be discovered (more so as mainstream media won't publish any thing)
- deleted 1mo ago[deleted]
- rzzzt 1mo agoYou can find recorded presentations on YouTube: https://youtu.be/_eSAF_qT_FY https://youtu.be/_eSAF_qT_FY
- IshKebab 1mo agoCan we add "some ancient Via CPUs" to the title. Current title is pure click bait.
- bassiee 1mo agoFor Intel-ME and AMD PSP, you fundamentally can't see the backdoor they could produce unless you probe the seperate chip lol.
- po1nt 1mo agoOr we use AI to find bug in those systems. Along with the way to completely disable those.
- codedokode 1mo agoIf you have an AI, you could make it analyze crystal photos?
- BoingBoomTschak 1mo agoEven before that, wasn't SMM the OG x86 backdoor?
- userbinator 1mo ago"Not this shit again"... Almost exactly 8 years ago: https://news.ycombinator.com/item?id=17727140 https://news.ycombinator.com/item?id=17727140
- sph 1mo agoShould add (2018) to the title
- epestr 1mo agoMy bad, but I don't see an edit option anymore.
- inigyou 1mo agoWhile the README calls it a separate core, it's more likely to be a direct encoding of uops.
- deleted 1mo ago[deleted]
- StrLght 1mo ago(2018)
- blueflow 1mo agoAs noted by userbinator: https://news.ycombinator.com/item?id=49220030 https://news.ycombinator.com/item?id=49220030 Not a backdoor, but a documented CPU feature. The whitepaper about rosenbridge cannot be published because it would constitute scientific fraud.
- alfanick 1mo ago> Not a backdoor, but a documented CPU feature. I would be even more explicit and call it “Not a backdoor, but a documented feature of ancient de facto unused Via C3 CPU.”
- phendrenad2 1mo agoCalling it a "backdoor" is subjective, because it looks enough like an unintentional exploitable bug that one could make that argument. Is an accidental backdoor still a backdoor? That's pure semantics.
- benfortaz 1mo ago[dead]
- zx8080 1mo agoTitle should be: ..in VIA C3 processors.
- rbanffy 1mo agoIt’s lovely to think some x86 CPUs have a nice ISA buried under the layers of cruft that form a recent x86 ISA. I still remember the time when mnemonics were 2 or 3 characters. Good days.
- taviso 1mo agoThey still do! AMD Zen cores use RISC86, I documented it a little bit here: https://github.com/google/security-research/blob/master/pocs/cpus/entrysign/zentool/docs/reference.md https://github.com/google/security-research/blob/master/pocs...
- jkwang 1mo ago[flagged]
- ironbound 1mo agoClick bait title, please change it to VIA C3 CPUs
- netsharc 1mo agoI recommend flagging this sort of crap to death... Stupid autistic policy of "Don't editorialize the title"...
- epestr 1mo agoMy bad, HN doesn't allow editing after an hour of posting
- ForOldHack 1mo agoThe backdoor(sic) is to delete and repost as you wipe the egg off your face. The CPU is not the most used vector, the firmware is.
- greenyhuman 1mo ago[dead]
- DobarDabar 1mo ago[dead]
- jcalvinowens 1mo agoA much better title would be "A hardware backdoor in a historical VIA x86 CPU".
- wbsun 1mo agoI am always wondering how those backdoors are discovered without internal leaks, fuzzing or enumerating all instructions bytes seem like too random.
- dmitrygr 1mo agoGoogle “sandsifter”
- loeg 1mo ago(2018) And "x86" sort of gives the wrong impression -- this isn't an AMD or Intel chip; it's a 2001-era VIA chip.
- GeekyBear 1mo agoIntel chips also have a hardware backdoor in the form of a separate core that the neither the user nor the installed operating system control. Intel Management Engine: https://www.wikipedia.org/wiki/Intel_Management_Engine https://www.wikipedia.org/wiki/Intel_Management_Engine As do AMD chips: AMD Platform Security Processor: https://www.wikipedia.org/wiki/AMD_Platform_Security_Processor https://www.wikipedia.org/wiki/AMD_Platform_Security_Process...
- loeg 1mo agoIrrelevant. The IME/PSP are not described in this article and function differently.
- PeterStuer 1mo agoI had not heard of VIA since the 1990's.
- prmoustache 1mo agoI owned an HP 2133 mini-note netbook for a little while around 2008-2010. It was sporting a VIA C7-M with a VIA Chrome 9 gpu. Honestly the cpu was slow, probably slower than the equivalent Atom of that era but the Linux version of that laptop (sold with Linux Enterprise) made up for it with 2GB as standard which was glorious for a netbook at the time. The keyboard and trackpad was also way ahead of the competition (ie other netbooks). The GPU was the biggest issue as VIA only built a proprietary driver for the kernel that was used at the time by Suse Enterprise. Thanksfully someone quickly wrote an openchrome driver that allowed me to install my distro of choice at the time with a newer kernel. I think it would still be a decent portable machine to write stuff and or use as a portable terminal emulator to connect to remote machines but completely unusable to do anything else. I remember resizing photos to create thumbnails for a web gallery was taking ages and that was with much fewer megapixel than today.
- ltbarcly3 1mo agoMisleading, clickbait title. Technically accurate, but it would be accurate if it were 3 total cpu's rather than thousands or millions so that is a low bar. Via C3 CPUs are the only ones affected. A security problem sure, but a relatively obscure one that doesn't effect anyone's laptop, server in the cloud, etc. A reasonable title is "Backdoor found in Via C3 cpus".
- phendrenad2 1mo agoApparently a chain of bugs leads to this. This is an internal debugging feature for VIA, but some motherboards accidentally left it enabled.
- nc55g3g 1mo ago[dead]