Slashdot Mirror
New Spectre Attack Can Reveal Firmware Secrets (zdnet.com)
Yuriy Bulygin, the former head of Intel's advanced threat team, has published research showing that the Spectre CPU flaws can be used to break into the highly privileged CPU mode on Intel x86 systems known as System Management Mode (SMM). ZDNet reports: Bulygin, who has launched security firm Eclypsium, has modified Spectre variant 1 with kernel privileges to attack a host system's firmware and expose code in SMM, a secure portion of BIOS or UEFI firmware. SMM resides in SMRAM, a protected region of physical memory that should only be accessible by BIOS firmware and not the operating system kernel, hypervisors or security software. SMM handles especially disruptive interrupts and is accessible through the SMM runtime of the firmware, knows as System Management Interrupt (SMI) handlers.
"Because SMM generally has privileged access to physical memory, including memory isolated from operating systems, our research demonstrates that Spectre-based attacks can reveal other secrets in memory (eg, hypervisor, operating system, or application)," Bulygin explains. To expose code in SMM, Bulygin modified a publicly available proof-of-concept Spectre 1 exploit running with kernel-level privileges to bypass Intel's System Management Range Register (SMRR), a set or range registers that protect SMM memory. "These enhanced Spectre attacks allow an unprivileged attacker to read the contents of memory, including memory that should be protected by the range registers, such as SMM memory," he notes.
"Because SMM generally has privileged access to physical memory, including memory isolated from operating systems, our research demonstrates that Spectre-based attacks can reveal other secrets in memory (eg, hypervisor, operating system, or application)," Bulygin explains. To expose code in SMM, Bulygin modified a publicly available proof-of-concept Spectre 1 exploit running with kernel-level privileges to bypass Intel's System Management Range Register (SMRR), a set or range registers that protect SMM memory. "These enhanced Spectre attacks allow an unprivileged attacker to read the contents of memory, including memory that should be protected by the range registers, such as SMM memory," he notes.
Too bad this guy didn't do his job when he was at Intel.
thanks for the gift that keeps giving, and won't ever be fixed for so many users,,, /s
I wish I was smart enough to fuck up at my 7 figure job, then quit and make a start up utilizing my fuck ups to get rich.
I feel like this country has been on a downward spiral since the 80s, when MBAs decided firing people when a company didn't meet it's numbers was A Good Thing. (note: they still made money, just didn't meet the numbers). Now we have MBAs fucking up, realizing they fucked up, quitting,, and making a startup capitalizing on their earlier fuckups.
How fucked up have we become that this is the norm?
The family's house was between the mountains and the sea where baskets of apples and drying herbs on the porch mingled their scents with those of the neighboring pine woods.
Seascape portrait of the woman child cavern of the soul. Under pressure-heat ratio ides of evolutions have buried their fears. Mists of dreams drip along the nascent echo and love no more.
AMD and ARM fucked up as well since they have Spectre, while Meltdown is Intel's own personal bit of hell.
You kinda forgot an important detail for your readers:
IS THIS A REMOTE EXPLOIT? Can someone use this to hack into a computer without physical access to it? If the attacker has to be in the same room with the computer, it is a very different story from "attacker needs no access to terminal, and all internet-connected machines are susceptible and as of this writing, are unpatched."
Because in the first case, "oh, that's interesting, I hope they fix that soon..." and in the second, "HOLY FUCK! UNPLUG EVERYTHING FROM THE INTERWEBZ NAOW!!!
So... which is it? Should I be mildly concerned, or should I break the glass, and punch the big red button that trips the circuit-breaker that kills all my internet-linked equipment? Or did it already mention which and I just missed it somehow?
Our reign has gone on long enough. Indeed. Summon the meteors.
It would require breaking the javascript sandbox (since performance counters in javascript now return less fine grained time values) and then hitting the CPU hard so that it can't change clock rates (doable on most modern processors, although you might want to trigger multiple passes across the same memory addresses at different periods just to make sure the values you gathered are either correct or haven't changed, a difference that you as a snooper won't be able to tell which is the cause.)
Given the browser changes, so long as our browsers are post-performance counter changes, most of us can assume we are safe from casual attack via javascript. However any sandbox breaking or privilege escalating attacks, worms, viruses, or trojans may be able to leverage these techniques for data exfiltration. Anyone running services on a third party VPS or version of Windows should assume either first parties at the behest of, or third parties can snoop on anything on their computer systems thanks to these attacks, including the potential to read areas of memory that will help fingerprint their system or help tailor malware to persistently infect their systems with a high level of reliability via fully automated means. Services like github.com where source code is stored remotely should be assumed as compromisable, which calls a large portion of the software ecosystem into question. While there have been known large public claims of backdooring of code the capability is certainly there and give the size of these codebases and revision control systems it is something to be aware of (althought the chances of being detected are also high.)
Basically this is a huge clusterfuck with an unknown threat profile that may very well turn out to run far deeper under far more software ecosystems than we will care to admit in a few years time.
To expose code in SMM, Bulygin modified a publicly available proof-of-concept Spectre 1 exploit running with kernel-level privileges to bypass Intel's System Management Range Register (SMRR) ... "These enhanced Spectre attacks allow an unprivileged attacker to read the contents of memory, including memory that should be protected by the range registers, such as SMM memory,"
An "unprivileged attacker" is "running with kernel-level privileges"?
Watch this Heartland Institute video
I'm sure the QEMU guys would be happy to emulate it, just for completeness' sake.
Intel will just invent some other undocumented,super secret, user hostile, ring of "protection" that can be used to manage SMM.
Maybe finally we get some insight into the security engine stuff to make it do what we want, instead of what Intel and big corp. in general wants.
I'm getting sick of hearing about yet more undocumented hidden software secrets in lower and lower levels of hardware. Surely a concerted effort to break everything down to the lowest machine instructions can purge this crap once and for all? Or are all modern processors basically designed to spy on us as their primary function? Hoping the spooks don't have a self-destruct sequence waiting behind all the trapdoors, might have to burn through a few sacrificial chips before regaining control.
Append the word "filter" to appropriate sentence.
This man assisted me in hacking my CHEATING HUSBAND Facebook account and he is a very good hacker for services like :what's app, call logs, test messages etc. He delivers in 2hrs or less you can email him on E N R I Q U E H A C K D E M O N 11 ( a t ) G M A I L d o t C O M or WhatsApp: + 1 ( 6 2 8 ) 2 0 3 - 7 3 4 5 .
www..enriquehackdemon11.. com