Slashdot Mirror
Researchers Discover and Abuse New Undocumented Feature in Intel Chipsets (zdnet.com)
At the Black Hat Asia 2019 security conference, security researchers from Positive Technologies disclosed the existence of a previously unknown and undocumented feature in Intel chipsets. From a report: Called Intel Visualization of Internal Signals Architecture (Intel VISA), Positive Technologies researchers Maxim Goryachy and Mark Ermolov said this is a new utility included in modern Intel chipsets to help with testing and debugging on manufacturing lines. VISA is included with Platform Controller Hub (PCH) chipsets part of modern Intel CPUs and works like a full-fledged logic signal analyzer. According to the two researchers, VISA intercepts electronic signals sent from internal buses and peripherals (display, keyboard, and webcam) to the PCH -- and later the main CPU. Unauthorized access to the VISA feature would allow a threat actor to intercept data from the computer memory and create spyware that works at the lowest possible level. But despite its extremely intrusive nature, very little is known about this new technology.
Maybe Intel VISA is a newly coined phrase, but there have been access to the PCH has been around for along time. In my experience (at Intel, on dev teams) This is used firstly for debug at development time and then at manufacturing time for passing certain test. Both used to have a physical device to do this, so just doing it remotely wouldn't work. Also, all features were available at dev time for obvious reasons. By manufacturing time, it should be mostly locked down and before it goes out the door, totally locked.
What I'm afraid of is security has become lax enough to allow remote access to this. Like a lazy engineer/architect (ever had one of those?) didn't want to walk his butt into the secure lab so they just put some back door in with telling anyone. Or worse after by off from the development team.
Also, yes these are undocumented because they are never meant for outside use (Intel, OEMs, etc) Just debug and optimization. No one else would really want access, but nefarious peeps would.
This could be a big issue if there really is something here. I'm hoping Intel didn't get lazy, but who knows.
..no, you're mistaken. I've personally worked with Intel silicon and you have to physically connect to debug ports (that are marked on Production silicon datasheets as 'N/C' or similar) to utilize these debug features. At worst for 'closed box' debugging you need to plug Intel-specific, proprietary debug hardware into on-board USB ports. There is another requirement to enable it that I won't discuss here. You can't access this over the internet.