Slashdot Mirror
Researcher Exploits 18-Year-Old Design Flaw To Compromise X86 Chips
jfruh writes: Security researcher Christopher Domas has demonstrated a method of installing a rootkit in a PC's firmware that exploits a feature built into every x86 chip manufactured since 1997. The rootkit infects the processor's System Management Mode, and could be used to wipe the UEFI or even to re-infect the OS after a clean install. Protection features like Secure Boot wouldnt help, because they too rely on the SMM to be secure.
Design flaw my ass. I bet it was there deliberately and everybody knows who originally requested it. I just love the good ol US of A.
I use Alpha 21264 you insensitive clod!
Only the State obtains its revenue by coercion. - Murray Rothbard
I think I am safe, my laptop has a core i thingy inside.
http://www.infoworld.com/article/2653209/security/hackers-find-a-new-place-to-hide-rootkits.html
We already knew this kind of thing was possible, so I guess this is just the first practical implementation? The article is short on details.
SSB1c2UgYSA2NCBiYXNlIHByb2Nlc3NvciwgeW91IGluc2Vuc2l0aXZlIGNsb2QgIQ==
I think the real story here is that 1997 was 18 years ago...
My understanding is that SMM is used, before all the TCG stuff about Secure Boot, etc., basically to control fans and shut down the system if the temperature is too high. And also to make USB keyboards appear as PS/2 hardware to DOS.
Are those functions really so expensive that they couldn't be offloaded to hardware on a chipset instead of trying to have the main CPU in your system act like it's own hardware watchdog?
How does one exploit a feature?
The article is very vague.
They remap the LAPIC to overlap the SMM memory region which makes data loads of the SMM code fetch values from the LAPIC registers instead of from memory.
Here you can find the slides and the whitepaper of the Black Hat conference talk.
System Management Mode is a feature. It's meant to render separate processors unnecessary for tasks like temperature management and system specific keyboard shortcuts. These functions need to work even if an unsupported or no operating system is running. Consequently SMM behaves almost like a separate processor. That's not a flaw, that's necessarily so.
The problem isn't SMM per se. It's that there is no way to be sure what code is executing in SMM, because there is no way to guarantee which firmware the system is running. Basic firmware should be in ROM (not flash. Read Only Memory.) And it should only do one thing: Load the actual firmware from a removable medium, like a micro SD card. With all writable storage in the system accessible to external inspection, there would at least be a chance to find and reliably remove infections.
A reason to back to Sparc
-- Thou hast strayed far from the path of the Avatar.
"To exploit the vulnerability and install the rootkit, attackers would need to already have kernel or system privileges on a computer."
You know, even without this particular SMM attack vendor, a hacker who already has system level privileges on your PC renders your PC totally insecure, besides he also can ... rewrite BIOS or various firmware components of your PC to allow his code to survive an HDD wipe.
Does UEFI Secure boot protect against this?
The article is (as expected) light on details since this is newly disclosed. I've had machines where the BIOS would require confirmation from a connected PS/2 keyboard before certain changes were written. Added a need for physical access in order to write anything to SMM. All the terms have changed but it seems the same principle here. If I can update the firmware, I can keep a machine compromised forever.
Why is all the stuff broke? Why does all the stuff have holes in it? Why isn't there any stuff that isn't broke? ARM processors from now on. All this stuff is broke.
That's what I get for scrolling through the headlines too fast--I see "One Night in the Hotel Room of the Future, Researcher Exploits 18-Year-Old"...
Nothing posted to
Three questions: 1) Is it possible to fix this with a downloadable firmware patch? 2) Will such a patch be forthcoming from Intel and/or AMD? 3) Until then, is there any way to protect my x86 machines, other than the obvious "avoid suspicious files" approach?
"Do you think that is air that you're breathing?" The Matrix has you.
my collection of 8 bit micros doesn't look so silly anymore.
In the talk he said it was Sandy Bridge and older. Ivy Bridge/Haswell/Broadwell/Sky Lake are not affected. Ivy Bridge was apparently released in 2012 - https://en.wikipedia.org/wiki/... But 1997-2012 is still a decent window of time. In the talk he also said that it's un-patchable (it's not, the SMI handler can check whether the APIC overlaps the SMM range and change it) He also said SMM controls every instruction from the boot. It doesn't. Maybe on the crappy Acer netbooks that he said he was using for tests. But on enterprise grade systems from Dell, Lenovo, or HP, they use "protected range registers" to stop SMM from being able to write to the code in the firmware. It's a good find, but he's got a lot to learn about firmware still.
If you go back through my comments, I told you that every x86 processor on the planet made since Pentium has been vulnerable.
This was the exact exploit I refused to go into full detail, except for saying the inherent problem is in the silicon itself.
And I was downmodded to hell and back.
Those that doubted me, you can eat crow, now!
Still waiting on Serviscope_minor to wake up to fucking reality and realize that Jessica Price isn't going to fuck him.
So, if I understand correctly, if you get a rootkit in your SMM you have to throw out your computer?
Intel fixed this in 2011.
Only the State obtains its revenue by coercion. - Murray Rothbard
Design flaw my ass. I bet it was there deliberately and everybody knows who originally requested it. I just love the good ol US of A.
From the article linked:
"To exploit the vulnerability and install the rootkit, attackers would need to already have kernel or system privileges on a computer. That means the flaw cant be used by itself to compromise a system, but could make an existing malware infection highly persistent and completely invisible."
This doesn't let an outsider break into the system; it is a flaw that only is useful if you have already compromised the machine.
http://www.geoffreylandis.com
All this recent news makes me want to fire-up my PowerPC-based G5 Tower again. Then I can simply worry about unpatched SSL vulnerabilities in OS X 10.5 Leopard.
But at least no one will be writing exploits that can easily run on my computer.
Thank goodness all the other zero-day flaws have been fixed in Windows, OSX, and Linux. And BDS is dying (Netcraft confirms it!)
From another satisfied AMD customer.
I would like to know, how long have NSA known about this? Assuming ofc, that they do have known.
Will you please forgive us?
Oh, the fools! If only they'd built it with two layers of bootkit protection! When will they learn?!?
"When information is power, privacy is freedom" - Jah-Wren Ryel
This doesn't let an outsider break into the system; it is a flaw that only is useful if you have already compromised the machine.
For a Windows machine, that's not a very high bar, especially in 1997 and all the way until... well, it's a little harder today, but not that much harder...
The problem is persistence. If you get root, you can get firmware and nothing short of throwing the motherboard away would fix it. That's scary.
"If a nation expects to be ignorant and free in a state of civilization, it expects what never was and never will be."
If you go back through my comments, I told you that every x86 processor on the planet made since Pentium has been vulnerable.
This was the exact exploit I refused to go into full detail, except for saying the inherent problem is in the silicon itself.
And I was downmodded to hell and back.
Those that doubted me, you can eat crow, now!
There's a lesson you can learn from this experience: provide detailed information and proof of your claims if you want to be taken seriously. Until you can do that, the only person eating crow is you.
This isn't new ground at all. Originally covered in phrack #66 (2009) (http://phrack.org/issues/66/11.html#article) and phrack #65 (2008) (http://phrack.org/issues/65/7.html#article).
Are there computers out there that are locked into Windows due to UEFI that could be freed through this hack?
SMM was a "nice" idea in more timid times. It let unscrupulous vendors emulate missing hardware features with (usually poorly written) firmware. I had quite enough head-banging when trying to implement realtime audio I/O on systems that turned out to emulate sound blaster and other industry standards.
A successful API design takes a mixture of software design and pedagogy.
Simple way to avoid the problem on Macs... don't load BootCamp, and you won't have SMM on the systems you load under bootcamp.
Mac OS X itself doesn't use SMM. Instead, it uses a PE (Platform Expert) module that loaded as part of the OS, which knows in detail about the hardware platform it's going to be running on. Without bootcamp, there's not even ACPI support, since power management is implemented in a much more discrete level of steps than the 4 which ACPI provides.
You must be new here ...
Someone doesn't know their classic TV ...or their slashdot!
Like Windows, Linux is a complex rambling Swiss cheese and privilege escalations are pretty common.
Lean security protocols need to come first, which is why Qubes OS is based on a Type 1 hypervisor (Xen). An attacker can try to use an exploit (like in OP) all they want in an untrusted domain, but they aren't going to get access to the hardware (or the other VMs, unless the user has done something to specifically expose those VMs to the attack).
Or visit our website www.LeadToolsGlobal.net
Maybe I'll visit it 100,000 times in quick succession and see what your hosting bill looks like. Since you're spamming Slashdot, you did want a Slashdotting, right?
This is pretty god damn sloppy of intel to allow re-mapping of registers/addresses/variables/anything onto what is supposed to be secured memory ! HAHA !
Good example why chip competitors/competition is needed.
Which design flaw in the 18-year-old did they exploit? The one where they're impossible to get out of bed? How does this help them compromise x86 chips?
SIG FAULT: Post index out of bounds.
Lean security protocols need to come first, which is why Qubes OS [qubes-os.org] is based on a Type 1 hypervisor (Xen). An attacker can try to use an exploit (like in OP) all they want in an untrusted domain, but they aren't going to get access to the hardware (or the other VMs, unless the user has done something to specifically expose those VMs to the attack).
This assumes there is a security layer that is free of exploitable bugs and that there is no way to influence the lower security layers in a way that can exploit bugs in those layers.
That's a very big assumption unless the security layer you are talking about AND all lower security layers are all so simple that the code can be proven bug-free by inspection.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
I've been saying for years that computers should have a hardware reset button or (for chips) a pin that restores them to a known factory state. If the button is pressed or the pin is set during initial power-on from a cold boot, the factory reset occurs. Any "infected" code will never get a chance to take control before the reset is finished.
Obviously now I'm going to have to extend that recommendation to any system or subsystem - including the CPU - which can be reprogrammed or save state in a way that survives power loss.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
You forgot to put "Design Flaw" in quotes.
I blame /. for my knowledge of "cosmonaut"..
If the drive comes pre-installed with Windows you should consider it previously compromised.
18 years ago was 1997?
Fuck, I feel old now.