Slashdot Mirror
Intel Says 'Partitions' in New Chips Will Correct the Design Flaw that Created Spectre and Meltdown (geekwire.com)
Intel said on Thursday it is introducing hardware protections against the Spectre CPU flaw that was discovered last year. From a report: Starting with the Cascade Lake version of its Xeon server processors later this year, Intel will incorporate "protective walls" in its hardware that prevent malicious hackers from using speculative execution techniques to steal private information from the secure part of the processor. These fixes will also ship with the PC version of the Cascade Lake chips, but the tech industry has been much more concerned about the effect of these design flaws on server processors running in data centers and cloud vendors.
The new fixes allow Intel to still benefit from the performance advantages of speculative execution -- in which a processor guesses which upcoming instructions it will need to execute in order to speed things up -- without the security risks. The hardware changes address Variants 2 and 3 of the Spectre and Meltdown issues first disclosed in early January, and software fixes should continue to address Variant 1, Intel said.
The new fixes allow Intel to still benefit from the performance advantages of speculative execution -- in which a processor guesses which upcoming instructions it will need to execute in order to speed things up -- without the security risks. The hardware changes address Variants 2 and 3 of the Spectre and Meltdown issues first disclosed in early January, and software fixes should continue to address Variant 1, Intel said.
Change log:
2018/01/01 - Added 14 Useful Links. Disable Intel ME 11 via undocumented NSA "High Assurance Platform" mode with me_cleaner, Blackhat Dec 2017 Intel ME presentation, Intel ME CVEs (CVSS Scored 7.2-10.0)
Intel CPU Backdoor Report
The goal of this report is to make the existence of Intel CPU backdoors a common knowledge and provide information on backdoor removal.
What we know about Intel CPU backdoors so far:
TL;DR version
Your Intel CPU and Chipset is running a backdoor as we speak.
The backdoor hardware is inside the CPU/Bridge and the backdoor firmware (Intel Management Engine) is in the chipset flash memory.
30C3 Intel ME live hack:
[Video] 30C3: Persistent, Stealthy, Remote-controlled Dedicated Hardware Malware
@21:43, keystrokes leaked from Intel ME above the OS, wireshark failed to detect packets.
[Quotes] Vortrag:
"the ME provides a perfect environment for undetectable sensitive data leakage on behalf of the attacker".
"We can permanently monitor the keyboard buffer on both operating system targets."
Decoding Intel backdoors:
The situation is out of control and the Libreboot/Coreboot community is looking for BIOS/Firmware experts to help with the Intel ME decoding effort.
If you are skilled in these areas, download Intel ME firmwares from this collection and have a go at them, beware Intel is using a lot of counter measures to prevent their backdoors from being decoded (explained below).
Backdoor removal:
The backdoor firmware can be removed by following this guide using the me_cleaner script.
Removal requires a Raspberry Pi (with GPIO pins) and a SOIC clip.
2017 Dec Update:
Intel ME on recent CPUs may be disabled by enabling the undocumented NSA HAP mode, use me_cleaner with -S option to set the HAP bit, see me_cleaner: HAP AltMeDisable bit.
Useful links (Added 2018 Jan 1):
Disabling Intel ME 11 via undocumented HAP mode (NSA High Assurance Platform mode)
me_cleaner: Set HAP AltMeDisable bit with -S option
Blackhat 2017: How To Hack A Turned Off Computer Or Running Unsigned Code In Intel Management Engine
EFF: Intel's Management Engine is a security hazard, and users need a way to disable it
Sakaki's EFI Install Guide/Disabling the Intel Management Engine
Intel ME bug storm: Hardware vendors race to identify and provide updates for dangerous Intel flaws.
CVE-2017-5689: An unprivileged network attacker could ga
Intel will incorporate "protective walls" in its hardware ...
Big, beautiful walls and Intel will get AMD to pay for them. :-)
It must have been something you assimilated. . . .
Where are the weaponized exploits that were going to sweep the internet and the zillion-unpatched-windows hordes? *YAWN* Again, I've gotta kick the news habit. What a hyperventilating waste of time this has been watching IT news and vendors nearly faint.
Whats good for AMD is good for Intel eh CTS labs?
Intel has already failed at exactly that before :
IntelME was supposed to be exactly that: a separated isolated ARC core in the chipset, that was used to handle administrative tasks even if the main x86 CPU was shutdown (IntelAMT - Intel own NIH syndrom "lights out management" vaguely similar to IPMI). Got further repurposed for some trusted security tasks (TPM), got further repurposed for DRM related task, used also for critical steps to bring the hardware up.
And was the target of attacks and exploits last summer. Attacks that thus work EVEN when the main x86 CPU is turned off (remembre, before the overarching list of roles, it began as an IPMI-like solution). To the point that vendors like DELL started offering new BIOS/UEFI firmware, in which the Intel ME code was stripped to the bare strict minimum for just the "bring hardware up" part.
But I'm sure *this time around* the walled secure CPU core that Intel promise will be flawless and never exploited~~
"Sufficiently advanced satire is indistinguishable from reality." - [Tips: 1DrYakQDKCQ6y52z6QbnkxHXAocMZJE61o ]
Doesn't it take years to design and fabricate chips? And yet, the fix for this latest round of problems is already to be found in the next generation of processors to be released later this year. Almost as if they knew the flaws were coming...
Please, please please Intel, provide a mechanism to COMPLETELY disable the IME BackDoor in your CPUs ( https://en.wikipedia.org/wiki/Intel_Management_Engine/ )
You're assuming Intel has any say in it.
AMD has its bugs, but one new feature that they have implemented is RAM encryption. This way, one VM has no way of obtaining content from another VM's RAM space, should a leak be possible. Why not be proactive in dealing with virtualization and keeping stuff separate, perhaps adding some pipeline randomization to foil side channel attacks?
Intel knows what they are doing. Might as well be ahead of the curve and add some useful security features.
what's wrong with "check for permissions in the pipeline before doing a speculative memory access"
Partitions inside Intel CPUs? How often will we have to re-format the damn things?
#DeleteFacebook
The problem is they already did fire their IT department. Slashdot is run by corporate whores and a single Perl script now.
NSA exploits won't work and Intel won't get a 5% benchmark advantage
"We have redesigned parts of the processor to introduce new levels of protection through partitioning that will protect against both Variants 2 and 3."
Hopefully the new level is just making what is already there work.
The ring system is already in the ISA. That allows the s/w to tell the h/w what is ok and not.
The problem is that the specex h/w does not fully do what it is told.
(It runs memory cycles outside of what is ok, and then permits code to use the results, and then doesn't fully negate the side effects of this code.)
Instead of adding yet another feature to the ISA, hopefully they are just tweaking what already almost works.
(Probably by preventing code from using the result?)
This seems least likely to add another bug.
Not between Intel before and after the patches but Intel after against Ryzen and ThreadRipper now/after.
Sure I know Intel perform worse with an SSD now and possibly even worse with virtualization but can I please get to see how Ryzen perform with it too?
Sounds like they hired the fired Equifax I.T. stool samples.
Maybe they'll dedicate more floorspace, therefore room, for all levels of CPU cache; and with floorspace maybe there's now 5 clocks for a L1d hit instead of 4. Consumers: boned. Maybe not as boned as with the software fix, but boned nonetheless.
So intel is hiding more unknown suspect shit in their chips?
great. thanks. but i didn't need MORE reasons not to buy intel.
While you went about paying a company to diss AMD, I checked CTS' report, found out one of my intel systems uses one of the mentioned vulnerable chipsets, the ASM1142, for its USB 3.1 controller.
I bet that the PoC exploit would work on the intel platform right out of the box, if the CTS code isn't full of shit.
Gimme a copy so I can test it out.
Still waiting on Serviscope_minor to wake up to fucking reality and realize that Jessica Price isn't going to fuck him.
Intel Israel created the current 'core' design by crossing the Pentium 3 with the Athlon 64 (legal cos Intel and AMD have cross patent agreements- AMD based Bulldozer on Netburst, would you believe). But the jews stripped out all low level privilege data tests to ensure Mossad and the NSA could always run user code at any elevated privilege level on any Intel CPU. A useful side effect was Intel chips would then run faster per clock and clock faster cos of the simpler memory logic.
AMD's Bulldozer was so slow because of the cross module memory tests to ensure no thread could access data from another thread- the logc completely missing in all post-Netburst Intel chips. Ryzen got vastly faster cos AMD employed a designer who knew proper optimal ways of doing the correct privilege tests in hardware.
When Intel talks of internal DOMAINS or PARTITIONS within the CPU, it is refering to software OS methods that Intel has used since the days of Netburst. These are dealt with with the memory management/paging hardware are are the EXACT reason Intel CPUs are vulnerable to privilege escalation exploits.
A modern simultaneous mutli-threading CPU has data (like your variable 'x') potentially stored in one of HUNDREDS of different types of RAM location. Caches (l-2, l-1, l-0, l-1, l2, l3), translation buffers, remapped registers, data in flow registers, etc etc etc. And each has to be coded with a privilege value that is tested correctly at each memory interaction to avoid exploits. Ryzen (from AMD) has this logic. Intel has removed ALL privilege value logic from its CPUs since Netburst.
Think of a chest with a lock. an AMD thread holds a 'key' that must be inserted into the 'lock' to extract any data the thread needs. Intel data 'chests' have 'labels' but no locks. Any Intel thread can open any chest and look inside. The idea of 'domains' or 'partitions' is that you tell a thread not to do so, but it is still free to do so if it wishes.
Intel Israel created a broken design by design. And it would take Intel at least FOUR years to come up with a correct, ryzen like design, build and deploy it.
We called it "mandatory security levels and categories" (eg, Dockmaster.mil), and then reinvented them for minis (eg, Trusted Solaris) and micros (eg, SELinux), and now Intel is doing the category part in hardware, just like Multics. Methinks they're a tiny bit behind the times...
davecb@spamcop.net
Spectre and Meltdown being mixed constantly such to always drag AMD and ARM along with their much worse Meltdown bug. Complete nonsense Spectre and Meltdown are always mention together.
Hi, I'm one of the folks with mod points that hit you for a -1.
No, it's not because you have secret insight and are being silenced by 'the Man'. You aren't an oppressed revolutionary struggling to help us understand the danger we are all in. It's because you are a spammy crank.
Further down the thread, I gave someone a +1 for mentioning the problems with Intel's ME. But they related it to the topic at hand and didn't cut and paste their favourite rant. I skipped the first time you posted this. It was clearly crap, but if you'd have stopped at once, then I'd have left it alone. It was your second post where you've promised to cross-post this to other threads that made me decide to a) find another couple of these and give them a down mod and b) tell you that you're doing more harm than good.
Content doesn't trump method. Your method deserves a -1 and if you think that you're getting a -1 because of your content, you're clinging to a delusion of persecution to make yourself feel special. Grow the fuck up.
It's because you are a spammy crank.
Only because you're a Intel fanboi.
Further down the thread, I gave someone a +1 for mentioning the problems with Intel's ME. But they related it to the topic at hand and didn't cut and paste their favourite rant. I skipped the first time you posted this. It was clearly crap, but if you'd have stopped at once, then I'd have left it alone.
Who gives a shit. This was never about you.
Content doesn't trump method. Your method deserves a -1 and if you think that you're getting a -1 because of your content, you're clinging to a delusion of persecution to make yourself feel special. Grow the fuck up.
This never had anything to do with me.
The report has gotten +5 dozens of times on Slashdot.
Referenced in numerous blog posts.
Referenced as "Work of art" on twitter by other security professionals.
You're just some idiot with mod point trying to feel special.
Now fuck off while I post it on more threads.
It was your second post where you've promised to cross-post this to other threads that made me decide to a) find another couple of these and give them a down mod and b) tell you that you're doing more harm than good.
The first post of this thread is now back to 0 from -1:
https://hardware.slashdot.org/...
Clearly your opinion does not matter.
This is about spreading the word, not you, so fuck off.
Millions of computers are infected with Intel's backdoor, millions of users are still unaware, and some random AC with mod point thinks everything is about being "Special" and him being some kind of opinion leader.
Like the simple fact that more people need to be aware of what "Intel inside" really means totally escapes him.
Little shit brain AC can't think beyond his little opinion.
Who gives a fuck what you think, the report will be posted on every Intel thread, if any of you fanbois mod it down, it'll be posted on dozens of other threads.
Understand? Now shut the fuck up.
This is what we call a 'workaround'.
If somebody beats you up every time you go to the supermarket, the fix would be to get this slugger arrested. Now you can go to the supermarket without a hassle.
The alternative would be to walk around the block and avoid that battler. This is what Intel has chosen as their 'solution'.
I'm not judging, I'm merely pointing out the difference.
Content doesn't trump method. Your method deserves a -1 and if you think that you're getting a -1 because of your content, you're clinging to a delusion of persecution to make yourself feel special. Grow the fuck up.
And first post is now (Score:2, Informative) so fuck you and your worthless fanboi opinion.
God, this site is crap now.