Hardware backdoors in some x86 CPUs
github.com251 points by epestr 10 hours ago
251 points by epestr 10 hours ago
I had not heard of VIA since the 1990's.
this is pretty old by now but still very relevant. people dont look at this enough but with rising chip complexities for TPU units etc. and a shift towards poorly documented hardware like NVIDIA gives this problem new fuel.
Domas (and maybe his team or colleagues?) has put out shit tons of very interesting materials over the past years on advanced malware, implants and things like Cantor Dust which are amazing things to dive into.
using his own cpu fuzzer, msr fuzzing techniques etc. he has found, reversed and implemented attacks through hardware bugs and backdoors.
It cant be confirmed if a backdoor is malicious or for debugging but essentially the capabilities gained through them are what is important.
These techniques he shows throughout his videos are not super tricky to replicate and I can recommend people who have interest to dive into it, reproduce things and try to help in this domain to raise awareness and findings.
Another good avenu is: Defcon 21 - Decapping Chips The Strike Easy Hard Way
People speak about supply chain issues in NPM and Pip etc. but these are much more severe and hard to detect.
Almost no one looks at it. Most vendors totally ignore it because you cannot sell products against it. (if ud detect it u need to trash the hw so its not handy... for sales...)
I didn't know what Cantor Dust was, and had to click through a few different search results to get past all the abstract descriptions and begin to form a basic idea.
In a nutshell, I understand them as a sort of "blockie" for binary data formats. Things like WAV audio files, bitmaps, ASCII text, machine code, etc. each generate their own distinct visual signature (but different examples within any of these categories tend to generate similar signatures). So once you learn the "blockies" for different types of data, they really pop out when content is viewed this way ("hey there's an image buried in that sequence of 1's and 0's!").
The explanation on this page isn't bad, and the bitmap example near the bottom is particularly illustrative (once you've seen the reference image for bitmaps earlier in the page):
https://inside.battelle.org/blog-details/battelle-publishes-...
My armchair-expertise here is only about 20 minutes old, but I hope this helps someone else looking for a starting point to learn about them!
Fascinating, thanks for sharing. A candor dust guessing game would be pretty fun to play
An absolutely great link!
Not so much for the hacking (White Hat, Black hat, other-color-hat) aspects (although they're certainly there too), but for the
visualization of higher-dimensional mathematics aspect...
In other words, have a look at the following URL's, then come back here:
https://gods.art/articles/equation_shadows.html
https://kettenreihen.wordpress.com/
See, there's Math (which typically generates graphs, graphics, other visuals), and then there's Higher-dimensional Math (you could almost call it 'Meta-math') -- which generates graphs about graphs, graphics about graphics, visuals about previous visuals...
That is, take a math equation that generates a graph. OK, so a simple example is that we could take the derivative... That generates a second graph which gives us information about the first graph... a "graph about a graph", so to speak, a "signal about a signal", information about the original information...
Point is, Cantor Dust looks like another great mathematical tool in any Mathematician's and/or Computer Scientist's and/or Engineer's visualization/understanding toolbox!
Oh sure, bad faith actors could use it for hacking (bad faith actors could use aspects of Isaac Newton's Calculus for hacking in various contexts, heck, any mathematical tool could be exploited in specific contexts!) -- but those people I'm sure, would not have an appreciation of the sheer mathematical beauty of such things! (Why use it to hack, when you can admire the mathematical beauty?)
Also, I should point out that humanity as a whole is far from discovering every single possible method, every single equation, every single way to visualize higher dimensional mathematics...
In other words, Cantor Dust is one such method... there will no doubt be many more in the future (I'd love to see fractal visualizations of higher dimensions!), and of course, we still have yet to understand all of the "old" previously discovered math in terms of all of the possible ways it can be used to visualize higher dimensions...
Anyway, great link!
A poorly documented or undocumented (debugging) backdoor in a chip marketed for ATMs and medical hardware, enabled by default, at the very least qualifies as reckless endangerment.
Not really. A properly designed network should take account for such things as unknown/irreparable flaws. An irreparable backdoor in a device can be mitigated with a gatekeeper, something akin to a firewall that will not allow a threat actor to have access to a faulty device.
The real recklessness would be allowing an ATM unfettered access to the internet on the assumption that the manufacturer has already protected the device from every known and unknown threat.
This backdoor only appears on decades-old VIA C3 embedded x86 processors
TBF the specific backdoor isn’t the point of the article. It’s a cautionary tale. The point is that practically all systems above the MCU level, and even some of those, have lower level systems that are often undocumented or not intended for use by the hardware designers, much less the end users. Those systems often have extremely low level access to system resources.
For example, I am building a device that records motion data, video, audio, and lidar imaging. Inside the 6 dollar IMU and the 12 dollar lidar sensor are powerful processors that load binary blobs provided by the manufacturer. The lidar could potentially gain access to any of the system data stored on the SPI bus, which includes the bulk storage and secondary RAM for the system. It could exfiltrate that data using its laser to anyone within a few hundred meters in the laser fov. It could also receive remote c&c over its optical sensor. The only thing that prevents that from being the case is that I trust the blob does not include the code to do those things, but it would be trivial to replace the blob with one that does.
Millions of devices are made that include basic wifi functionality. often, this comes in the form of a dedicated WiFi module. Those almost entirely consist of a powerful processor running a proprietary binary blobs, connected to some internal bus of the system that may give it access to some or all of the functions of the device, or at the very least could cause the device to malfunction. These WiFi phy modules are sub$1, pervasive, and often built in to devices that do not have any advertised connectivity features. A threat actor that has knowledge of an attack surface for that opaque blob can probably cause >50% of the connected devices built with that product to malfunction, in some cases in serious and dangerous ways, and sometimes to exfiltrate data that might be compromising or valuable.
That’s what this article is really about.
I recently got an air purifier. The touch button controls for adjusting the fan speed didn't seem to be working, so I emailed support.
They had me download their app, link the air purifier, and give them its MAC address. Then they asked me to try pressing each of the buttons a few times and email them back. I did so, and they responded that they re-calibrated the buttons using my touch samples. It worked.
I am amazed that by emailing support you were able to actually get in contact with someone technical who understood the product well enough to fix the problem.
That’s insane. I actively avoid buying things that are pointlessly internet connected nowadays. An air purifier’s buttons should be simple electromechanical switches.
They should have mentioned that in the first line of the github readme, not burried deep down in the text.
Buried? Deep down? The fourth paragraph, clearly labeled "Affected Systems", a minute or two into the read.
Opening with the title "hardware backdoors in x86 CPUs" is quite misleading, though.
We have shorter attention spans now.
Multiple things can be true at the same time. While we do have shorter attention spans, some (lots of?) developers absolutely suck at writing articles
I fancy myself as a decent writer, but I suck at writing documentation. People describe reading my notes frustrating and incomprehensible. I find it much better to use AI to untangle my, admittedly, convoluted reasoning
They knew what they were doing by not including "VIA C3 CPUs" before the fourth paragraph. Come on. It should have been in the title.
Imagine getting a letter "High Risk of Cancer" and getting all the way to the 4th paragraph to see it's just relevant to a race of blue aliens...
It's not even a "backdoor", it's documented in the datasheet...
http://datasheets.chipdb.org/VIA/Nehemiah/VIA%20C3%20Nehemia... (page 82)
...which along with the already publicly-known microarchitecture of the C3 makes this statement sound like total nonsense:
The rosenbridge backdoor is a small, non-x86 core embedded alongside the main x86 core in the CPU
I remember laughing at this with a few others knowledgeable in x86 when it first came out; a self-proclaimed "security researcher" who somehow failed to RTFM.
There's even a Wikipedia article about it now, with a link to the alternate instruction set documentation: https://en.wikipedia.org/wiki/Alternate_Instruction_Set
"It's documented in the datasheet" is such a weak excuse for a backdoor.
Documenting a backdoor doesn't make it not a backdoor, just means it's not a hidden backdoor.
The fact that a number of machines shipped with the backdoor accidentally enabled, and nobody noticed for over a decade shows just how dangerous even a documented backdoor can be. The oversight wasn't even detected by someone reading the manual, it was detected by a security researcher who wrote a generic tool to fuzz out such backdoors.
Doesn’t backdoor imply hidden? If it’s clearly documented it’s just a (front)door?
backdoor means a secondary access point that defeats the security features of the primary. In the door analogy, the home owner spends a ton on a lock and camera for the front door but doesn't even have a deadbolt on the back.
Every definition of a “backdoor” in computing implicitly or explicitly considers it hidden/covert.
In the house analogy you don’t see the backdoor when approaching the front. If it was just “an alternative everyone knows about and can be broken easier than the front door” then it probably would have been called “a window”.
Most login forms have a weaker option like a SMS 2FA or password reset fallback. Nobody calls it a backdoor. It’s just a crappy second front door, or window.
The Free Software Foundation (FSF) calls the update system used in Windows 10 a "back door" [1], I think because it installs updates automatically. This sounds like nonsense to me, because it implies that I installed a back door on my own machine by enabling automatic upgrades (on Trisquel).
It's meaningful that the Windows 10 install method has no (official) way to disable it, but I don't think making something optional could make it not a back door, if it was one before.
Even when automatic updates are disabled, I'm not going to be reading every update so the effect seems mostly the same, regardless of whether updates are automatic or not.
The FSF's definition of "back door" (at the bottom of the linked page) is "any feature of a program that enables someone who is not supposed to be in control of the computer where it is installed to send it commands" which leaves a lot of ambiguity with the words "supposed to be". I am not sure how to interpret this definition.
[1] https://www.gnu.org/proprietary/proprietary-back-doors.html#...
I'm probably mistaken, but I've always referred to password resets as backdoors. Is there another term they could be classfied as?
> Is there another term they could be classfied as?
As an advertised feature of the product.
Your personal definition doesn’t match the general understanding of the word and concept. By your definition every window on a house or car is a “backdoor”. Anything with an advertised fallback is a backdoor. And sometimes the “front door” is the back door: getting money from an ATM is less secure than with an ID at the bank teller.
Password resets aren't "backdoors" unless they contain a flaw the defeats any security protections. It's not just that the backdoor is less secure than the front, the backdoor has no security or is so easily defeated the security may as well not exist.
I'm surprised the hidden aspect of backdoor is so forward in folks minds. In my thinking nothing in cyber security is hidden, I drop the obviously present hidden part of backdoor definition when it's used in yhe cyber security context.