The Memory Sinkhole - Unleashing An X86 Design Flaw Allowing Universal Privilege Escalation

What Hacker News said

Recommends sabas123 · 2022-07 · on “Intel Microcode Decryptor”

This is a thing and was used in this fantastic piece: [this video] However the way they obtained these dumps is by going deep into debugger mode of the cpu which makes me doubt anything spooky would be going on.

Cites kogepathic · 2017-11 · on “MINIX – The most popular OS in the world, thanks to Intel”

> adding the possibility to turn it off should suffice. How could Intel/AMD reasonably communicate this to customers and have it taken at face value? "Here's a flag to disable this black box we ship in every CPU. The product design and source code are proprietary, so please take our word for it that this flag disables everything." There was a blackhat talk on embedding malware in SMM and triggering it with a magic number written to a register to escalate the process privileges. [0] So there will always be suspicion of special triggers to re-enable the black box that you turned "off" I think there is a very slim chance that Intel and AMD can regain credibility when it concerns the IME/PSP. Es

Cites jerf · 2018-01 · on “Reading privileged memory with a side-channel”

I can imagine some ways to armor the branch predictor, similar in principle to how languages like Perl have to include a random seed in their hash code (in some circumstances) to avoid being able to pre-compute values that will all hash to the same thing [1]. There should be some ways to relatively cheaply periodically inject such a randomization into the prediction system enough to prevent that aspect of the attack. This will cost something but probably not be noticeable to even the most performance-sensitive consumers. But no solution leaps to mind for the problem of preventing speculative code from leaking things via cache, short of entirely preventing speculating code from being able to

Cites throwaway47292 · 2021-12 · on “Professional maintainers: a wake-up call”

I can make an argument that money will make it even worse, as people will full-time make even more useless features that just increase the attack surface. This particular class of problems (same as the sqlite fts tokenizer exploit and most of openssl exploits, even lots of the sendmail exploits) are just obscure unused features. It happens even in CPUs themselves. (e.g. [this video] ) Removing code is twice harder than adding code, why do you think paid maintainers would improve anything? Just look at the code written in FAANG or any enterprise, and those maintainers are very well paid, imagine this code being public, we will have 1 new exploit per day per company... and that is assuming non mali

Critical ryacko · 2017-11 · on “Qubes OS: A reasonably secure operating system”

Then from recent Defcon and Black Hat talks, they are an absymal failure. ( [this video] Memory Sinkhole - Unleashing An X86 Design Flaw Allowing Universal Privilege Escalation ) (I don't understand it beyond what everyone says it can achieve) Intel should be considered to be totally unreliable and incompetent. I mean, no one buys office store safes and expects their things to be secure in them. But a processor is a little more expensive than a cheap safe and holds more valuable things. Edit: and besides, Fortezza is an SSL protocol option.

Critical rasz · 2021-06 · on “Two Hidden Instructions Discovered in Intel CPUs Enable Microcode Modification”

Chris Domas works at Battelle Memorial Institute. Battelle is a "non profit R&D house" that just so happens to hire "retiring" CIA operatives, and work on tons of CIA/NSA contracts. Completely coincidentally Chris Domas managed to discover the only Intel CPU backdoor ever discovered and publicized the very same year Intel already patched it [this video]