▲ 101 points
back
30 comments
Looks like (according to Intel) it's only the lower end Pentium / Celeron / Atom stuff; it wouldn't be useful for the kinds of chips people are most interested in circumventing ME for, though perhaps there are things that are useful to learn…
Also mildly interesting, Dmitry Sklyarov was credited… appears to be the same one from Elcomsoft that got arrested at one point because Adobe complained (and DMCA).
Also seems to require physical access:
"may allow an unauthenticated user to potentially enable escalation of privilege via physical access"
I'm sure there's cases where that's still an issue, but for me, if they have their hands on it it's probably game over via some other route.
The CVE is reserved at this time so it's hard to be sure.
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-0146
They're not impenetrable per se, but iPhone is pretty secure, even with physical access.
>They're not impenetrable per se, but iPhone is pretty secure, even with physical access.
Citation seriously needed for this bold statement.
Apple is not known for timely patches for their vulnerabilities, so no, you don't even need physical access to compromise iPhones, RCE vulns not acknowledged by Apple will do just fine. Just ask shady Israeli/Saudi security companies.
Also, nothing is ever impenetrable. In cybersecurity, if your opponent has physical access to your device then it's considered game over and you have to wipe or even throw it away. That's why burner devices are heavily used.
Plus, what do iPhones have to do with the Intel chips here anyway?
Wow! Every week it seems on HN there are articles about the porous nature of iPhone impenetrability. Everything from zero click attacks in iMessages that have been unpatched since iOS 4 to Wi-Fi bugs that could be exploited for remote code execution without any user interaction at all. The problem that these exist is not even the issue. It's the glaring number and breadth of the exploits that make it likely these are just the tip of the iceberg. Apple has been sleeping at at wheel with regards to security and I can't imagine short of a "Snow Leopard" style crusade to fix security (back then it was performance), that this is going to change anytime soon.
> They're not impenetrable per se, but iPhone is pretty secure, even with physical access.
Ironically, given lots of early Iphone jailbreaks were due to Apple finding out that CPUs have JTAG ports too late.
The Atom SoCs in question were widely used in network switches and appliances.
There is also a whole series of Atom processor made for 5G telecom appliances, the kind of thing where security definitely matters.
The Atom C3000 series is also widely used in NAS because it supports ECC memory and can be passively cooled while still being performant enough to not be a bottleneck.
Atom is not a low-end product. Atom is to Intel’s embedded product line what Xeon is to their server and workstation line. It’s the top brand.
> Atom is not a low-end product. Atom is to Intel’s embedded product
right, not so much low-end as dead-end :)
The E-cores in Intel 12th gen CPUs are basically Atom cores, so very much not dead.
Well, yes, but they are not atom CPUs, so they won't likely be vulnerable to this issue as it is not part of the core.
In any case, it is not like I was making some deep point, other than a cheap shot at Intel mobile/embedded effort :).
"may allow escalation of privilege" - from being a mere consumer to an actual owner? All advantages as far as I can see, but of course to the authoritarian corporatocracy it's a vulnerability...
I really miss the days when Intel basically released all the documentation you needed to build a computer around their CPUs. The Pentium was when they started being secretive.
You're not an "actual owner" if non-ring-0 code you run on your processor can gain ring 0.
I agree that there is value in having control over your devices. But control, by its nature, must be limited. If everyone controls your device, nobody does, certainly not you.
But it's proprietary security through obscurity which is why this keeps happening.
This seems to be about physical access, not ring-3.
Uh oh, looks like someone left the DF* (DF-star, a.k.a. design for X) features accessible and not fused-off. The links on the intel page don't show any details, nor does googling the CVE.
One of the researchers (@_markel___) put out a tweet with more information
> After a year of the coordinated disclosure process, we (+ @h0t_max and @_Dmit ) can finally share: we found a reliable, not damaging way to extract the security fuses (Chipset + EPID root keys) from the Intel platforms.
coordinated disclosure
I wonder if these people really think they are heroes for effectively helping Intel further its user-hostile actions.
These kind of disclosures are the accepted practice in this security space. People and organizations more-or-less help each other out, help users, and play by the rules.
There are some who disagree the process is good, works well, or actually achieves its goals. However most (not all) go along with it and don't moralize about corporate strategy or try to hold their vulnerability discoveries over a company as some kind of activism.
I think it's pretty safe to say they don't think they are heroes for working with the vendor, they are probably quite rightly proud of their discovery and work though.
You comment seems unnecessarily hostile toward them.
People and organizations more-or-less help each other out, help users, and play by the rules.
In other words, they're mostly bootlickers.
You comment seems unnecessarily hostile toward them.
Intel is unnecessarily hostile towards us! Those who help the enemy, should also be considered enemies.
> In other words, they're mostly bootlickers.
No that is not what bootlicker means.
> Intel is unnecessarily hostile towards us!
An organization like Intel has extremely complicated strategies and estimations of what they deem "necessary". Whether you personally like it or not, a company has some leeway to do their own thing with the products they sell.
> Those who help the enemy, should also be considered enemies.
And you have purchased no products that contain any parts or other companies that license Intel's IP because that benefits Intel in the form of revenue in any way. What computers, phones, etc do you use, then, that come from companies which don't act in any user hostile ways?
Is there any team that has done more public work on ME transparency than Positive Technologies? Unlike others that withhold all information for embargoed announcements, they continually publish updates on their research.
> Intel recommends that users of affected Intel® Processors update to the latest version provided by the system manufacturer that addresses these issues.
The latest version of what? microcode? BIOS?
Sounds like the processor/SoC itself?
The Atom C3000 family is really cursed, it seems.
Worse than the C2xxx family? Intel has a trust deficit.
https://www.theregister.com/2017/02/07/intel_atom_failures_g...
"C" stands for "cursed".
Just noticed mostly all laptops got a bios update today, including Dell and HP.
https://support.hp.com/us-en/document/ish_5031100-5031212-16...
Whats going on? These arent to Atom CPUs alone it seems.
Does this help circumvent/disable IME?