Slashdot Mirror
Researchers Discover and Abuse New Undocumented Feature in Intel Chipsets (zdnet.com)
At the Black Hat Asia 2019 security conference, security researchers from Positive Technologies disclosed the existence of a previously unknown and undocumented feature in Intel chipsets. From a report: Called Intel Visualization of Internal Signals Architecture (Intel VISA), Positive Technologies researchers Maxim Goryachy and Mark Ermolov said this is a new utility included in modern Intel chipsets to help with testing and debugging on manufacturing lines. VISA is included with Platform Controller Hub (PCH) chipsets part of modern Intel CPUs and works like a full-fledged logic signal analyzer. According to the two researchers, VISA intercepts electronic signals sent from internal buses and peripherals (display, keyboard, and webcam) to the PCH -- and later the main CPU. Unauthorized access to the VISA feature would allow a threat actor to intercept data from the computer memory and create spyware that works at the lowest possible level. But despite its extremely intrusive nature, very little is known about this new technology.
"I'm just spitballing here, but I've read that a lot of computers have rootkits on them. What if we baked a root kit right into the hardware so everyone could have one without having to go through the trouble of installing one?"
"No, one rootkit is no good. Make sure we bake in a few of different types in case something goes wrong with one. Redundancy is the key to reliability."
Since these features are meant for use on the assembly line you can't just remove them.
But you can design them to be permanently disabled as one of the last steps before the chip leaves the manufacturing plant.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
Called Intel Visualization of Internal Signals Architecture (Intel VISA), Positive Technologies researchers Maxim Goryachy and Mark Ermolov said this is a new utility included in modern Intel chipsets to help with testing and debugging on manufacturing lines.
How is that "undocumented" other than Intel only provides the docs to paying developers?
"Intel Inside" has been a mandatory warning label for many years already.
Says an Intel spokesman. That is, however, not true.
Physical access is required of systems that have taken actions to require it, namely physical access required to update certain flash data. For systems that haven't done this, physical access isn't required.
This exploit requires physical access.
No, it doesn't. You took the word of an Intel spokesperson over a hackers, seriously?
You should have kept reading:
"Customers who have applied those mitigations are protected from known vectors," the company said.
However, in an online discussion after his Black Hat talk, Ermolov said the Intel-SA-00086 fixes are not enough, as Intel firmware can be downgraded to vulnerable versions where the attackers can take over Intel ME and later enable VISA.
Furthermore, Ermolov said that there are three other ways to enable Intel VISA, methods that will become public when Black Hat organizers will publish the duo's presentation slides in the coming days.
Anons need not reply. Questions end with a question mark.
That is it, I am done. Now where is my 286 ?
Sorry, no. As long as the ME continues to exist and is not exclusively under the control of the machine's owner, the risk of remote exploit exists.
Maybe Intel VISA is a newly coined phrase, but there have been access to the PCH has been around for along time. In my experience (at Intel, on dev teams) This is used firstly for debug at development time and then at manufacturing time for passing certain test. Both used to have a physical device to do this, so just doing it remotely wouldn't work. Also, all features were available at dev time for obvious reasons. By manufacturing time, it should be mostly locked down and before it goes out the door, totally locked.
What I'm afraid of is security has become lax enough to allow remote access to this. Like a lazy engineer/architect (ever had one of those?) didn't want to walk his butt into the secure lab so they just put some back door in with telling anyone. Or worse after by off from the development team.
Also, yes these are undocumented because they are never meant for outside use (Intel, OEMs, etc) Just debug and optimization. No one else would really want access, but nefarious peeps would.
This could be a big issue if there really is something here. I'm hoping Intel didn't get lazy, but who knows.
Intel put the features in, failed to document them, failed to disable them and KNOWS researchers will be looking for them.
The only abuse is Intel not taking responsibility for its incompetence.
Who else remembers the Clipper chip saga from the first light of eternal September?
Bruce Schneier's Applied Cryptography (1994) had just come out, and it was a glorious rip in the kimono of the grotesquely secretive surveillance state. (At one point, in the institution's formative adolescence, even the NSA's name was hard to find out.)
In those glorious, turbulent years of eternal onset we—the open source greybeards of minimal middle—managed to score some surprising victories over the rather clumsy NSA, clearly dazed by those first insistent rays of sunshine, now stumbling around in the public sphere like John Oliver fresh out of bed, blinded by paparazzi flashbulbs en route to his underwear drawer.
I enjoyed this comedic spectacle while it was happening to the power of ten.
Meanwhile, another part of my brain was going "they'll be baaack". If you catch Rommel with his pants down at 06:00, enjoy it while you can; by 0:900 you'll wish you hadn't. Clearly the hard-boiled eggheads of this imperious and paranoid institution weren't going to consume their crumpets of crow quavering cadaverously. Now there's so much crepuscular silicon—how shall we best phrase this?—of mixed utility that you need avail yourself of the extended edition of Hogwart's Almanac merely to decode the confounding acronyms.
Clinton's Clipper comeuppance was the most glorious greybeard insurgency I've ever witnessed, but with a teeny, tiny fly embedded in the silver lining: we basically started a land war in Asia we could not ultimately win. Not even a historic Snowden dump changed matters much at the end of the day. With the persistence of the North Vietnamese (augmented by Mexican mechanization) minions of the NSA have cunningly scrabbled subsoil, stealth supply lines all the way to Moscow's front door.
This story is a somewhat different offensive than Operation Typhoon. They don't want to conquer Moscow, they want to become Moscow, under cover of ubiquitous onion domes, now tinier than anyone had once imagined, shrouded in RF-transparent Mandelbrot onion skin: you are in a maze of twisty little passages, all alike.
All said and done—and duly intercepted—the moral of starting a land war in Asia remains mostly the same.
..no, you're mistaken. I've personally worked with Intel silicon and you have to physically connect to debug ports (that are marked on Production silicon datasheets as 'N/C' or similar) to utilize these debug features. At worst for 'closed box' debugging you need to plug Intel-specific, proprietary debug hardware into on-board USB ports. There is another requirement to enable it that I won't discuss here. You can't access this over the internet.